The EU has a dedicated AI law, the EU AI Act, which classifies AI systems by risk and sets duties for providers and deployers. The UK has no single AI law; its regulators, such as the FCA, PRA and ICO, apply existing rules. For agents, the EU asks what category it is in; the UK asks what outcome it produces.
How is each system built?
The EU regulates AI as a product category. The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and phases in over several years. It bans certain practices, imposes detailed obligations on high-risk systems, sets transparency duties such as telling people they are dealing with an AI system, and requires AI literacy for staff. Providers and deployers have distinct duties. A plain summary is in what the EU AI Act is.
The UK regulates the activity, not the technology. Regulators apply their existing powers to AI within their remits. In financial services, that means the FCA's Consumer Duty for retail outcomes, the Senior Managers and Certification Regime for named accountability, the PRA's SS1/23 model risk principles for banks, and UK GDPR with the Data Protection Act 2018, overseen by the ICO.
The deeper comparison for agents is in EU AI Act vs the UK approach to AI agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where do the differences show up for an agent?
| Question | EU | UK |
|---|---|---|
| Is there an AI-specific classification? | Yes: prohibited, high-risk, transparency, minimal | No; risk is judged under existing rules |
| Who must ensure human oversight? | Deployers of high-risk systems, with competent assigned people | Firms, through governance and named senior managers |
| Must customers be told they face an AI? | Yes, under Article 50 transparency duties | Expected where needed for good outcomes and fairness |
| What about automated decisions? | GDPR Article 22 | UK GDPR's equivalent, which UK law can amend separately |
| Operational resilience | DORA for financial entities | The UK's own operational resilience rules |
| Model risk | Supervised by national and EU banking supervisors | PRA SS1/23 for banks |
What does that mean for what stays with a person?
In both regimes, decisions with significant effects on individuals belong with a person. The routes differ. In the EU, a credit scoring agent is high-risk, so the Act itself requires human oversight by people with the competence and authority to override it. In the UK, the same agent is governed through the Consumer Duty's focus on outcomes, UK GDPR's limits on solely automated decisions, and SM&CR, under which a named senior manager must be able to show they took reasonable steps.
The practical result is similar: the agent prepares and recommends; a person decides the adverse outcome. The evidence you keep differs. EU supervisors will ask for the documentation the Act lists. UK supervisors will ask how you know outcomes are good and who is accountable.
An illustrative example
Take a lender with offices in London and Dublin, running one agent that pre-assesses personal loans in both markets. For Irish customers, the agent's credit capability is a high-risk use under Annex III. The lender, as deployer, needs assigned human oversight, logs kept under its control, and a fundamental rights impact assessment under Article 27.
For UK customers, none of those specific EU documents is required. But the lender must show the FCA that the agent produces fair outcomes across customer groups, that refusals are reviewed by people, and which senior manager answers for it. The lender chooses one design for both: refusals held for a credit officer, outcomes monitored by group, and a single documentation set that satisfies the stricter EU list while also naming the UK senior manager. Running two versions of one agent would cost more than meeting both at once.
Which controls work in both?
- Classify each capability under the EU Act, and record the UK rules that apply to the same activity.
- Hold adverse decisions for a competent, named person.
- Monitor outcomes by customer group for the Consumer Duty and EU fairness duties alike.
- Keep one record of each agent action and the sources behind it.
- Name the accountable senior manager for UK purposes and the oversight owner for EU purposes; often the same person.
- Plan for resilience under DORA and the UK operational resilience rules together.
For a third comparison, see how US AI regulation differs from the EU AI Act. The full map is in AI agent regulation, mapped to controls.
Questions people ask
Does the EU AI Act apply to UK companies?
It can, where a UK company places AI systems on the EU market or where its agents' outputs are used in the EU, for example decisions about customers in Ireland or France.
Will the UK adopt its own AI act?
Do not plan around it. Build controls that satisfy existing UK rules and the EU Act where you need it, and adjust if UK law changes.
Is UK GDPR the same as the EU GDPR?
It started from the same text and remains close, but the UK can amend its version independently. Check specific points, such as automated decisions, under each regime.