The EU regulates AI through one law, the EU AI Act, with duties set by risk tier. The UK has no single AI law; it takes a principles-based, regulator-led approach, applying existing rules from the FCA, PRA, ICO and others to AI. A firm running AI agents in both needs EU-specific duties layered on a UK control set.
What does each regime require, in plain words?
The EU. The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and phases in. It bans certain practices, imposes heavy duties on high-risk systems, requires disclosure when people interact with AI, and requires AI literacy across the board. Providers and deployers have different duties, enforced by national authorities.
The UK. There is no AI Act. Regulators apply their existing powers to AI within their own remits. For a financial firm, that means:
- FCA conduct rules, including the Consumer Duty, which requires good outcomes for retail customers;
- the Senior Managers and Certification Regime, which makes named individuals accountable;
- PRA expectations for banks, including SS1/23 model risk management principles;
- ICO enforcement of UK GDPR and the Data Protection Act 2018;
- PSR oversight of payment systems.
Our explainer on the UK principles-based approach to AI goes further into how this works for agents.
Who does each apply to?
The EU Act applies to providers and deployers in the EU and to those outside it whose AI output is used in the EU. UK rules apply to firms within each regulator's remit, whatever technology they use.
A UK firm with EU customers may be in scope of both. A group with an EU subsidiary certainly is. For a short comparison of the two systems, see how AI rules differ between the UK and the EU.
How do the two differ when the AI system is an agent?
Classification. The EU asks you to classify each system by risk tier. The UK does not; instead, each regulator asks whether your existing obligations are met. An EU-minimal-risk payment agent can carry heavy UK duties under conduct and payment rules.
Accountability. The EU assigns duties to legal roles: provider and deployer. The UK's Senior Managers regime assigns them to named people. For an agent, the UK question is which senior manager answers for it, and whether they can show they took reasonable steps.
Outcomes. The Consumer Duty asks whether customers get good outcomes, including in communications, support and value. An agent that answers accurately but makes it hard to complain or cancel can fail the Duty without breaching anything in the EU Act's transparency tier.
Model risk. For banks, the PRA's SS1/23 principles treat models broadly. An agent that produces outputs used in decisions sits within model risk management, with validation, inventory and governance expectations that look similar to some EU high-risk duties.
Data protection. UK GDPR and EU GDPR are close. Article 22 restrictions on solely automated decisions, impact assessments and records of processing look alike in both. Our piece on UK GDPR and AI agents covers the UK side.
The common thread is the risk-based approach: both regimes scale controls to risk, but the EU defines the tiers in law and the UK leaves the judgement to firms and their supervisors.
How do you run agents in both?
Build one control set that meets the stricter requirement in each area, then add jurisdiction-specific items.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| EU classification; UK model inventory | One register: agent, capability, EU tier, UK model risk status, accountable senior manager | Register with both views |
| EU human oversight; UK SM&CR reasonable steps | Named overseers with authority; hold points before adverse or irreversible actions | Approvals and override records |
| EU logs; UK record-keeping and audit expectations | Append-only action record with verdict and reason | Retained records |
| EU AI literacy; UK competence expectations | Role-based training on each agent | Training records |
| EU disclosure; UK Consumer Duty communications | Clear disclosure and easy route to a person | Disclosure and escalation evidence |
| EU deployer monitoring; UK outcomes monitoring | Monthly review of behaviour and customer outcomes | Monitoring reports |
| GDPR and UK GDPR | One DPIA method; Article 22 test applied in both | DPIAs and decision design records |
| EU-only: FRIA, notices, serious incidents | Added for EU-facing high-risk capabilities | Assessments and notifications |
Firms should also be ready for the different way each side asks. EU authorities will ask for duty-by-duty evidence; UK supervisors will ask the accountable senior manager to explain how they know the agent produces good outcomes. Our EU AI Act documentation an auditor will ask for works for the first; a clear owner with current monitoring works for the second.
What will a supervisor or auditor ask?
- EU: What tier is this agent? Are you provider or deployer? Show the evidence for each duty.
- UK: Which senior manager is responsible? How do you know customers get good outcomes? How does this agent sit in your model risk framework?
- Both: Show us what the agent did in this case and who approved it.
What does neither regime settle for a dual-market firm?
Neither resolves where data may be processed across the two; that is a transfer question under both GDPR regimes. Neither aligns timelines, and the UK approach can change through regulator guidance without new law. And neither tells you whether to split agents by jurisdiction or run shared agents under the stricter rule. That is an operating choice. For the wider map of duties, see AI agent regulation, mapped to controls. If you build agents yourself, the EU's definition of a provider decides your heavier duties there.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Will the UK adopt something like the EU AI Act?
We do not predict legislation. The UK approach is principles-based and regulator-led. Build controls that meet both regimes' substance so a change on either side requires adjustment, not rebuilding.
Does a UK firm with EU customers need EU AI Act compliance?
If its agents' output is used in the EU, it is likely in scope for those agents. Map EU-facing capabilities separately and apply the Act's duties to them.
Is the Consumer Duty stricter than the EU AI Act for service agents?
For retail customer service, often yes. The Act mostly requires disclosure for service agents; the Duty requires good outcomes, which covers support quality, fair value and ease of complaint.