iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The UK framework is triggered mainly by the sector or service your company operates, while the EU AI Act is triggered by your role in the AI value chain, the AI system’s risk category and your EU-facing activity. A company can fall under both regimes, one regime or neither. To determine the result, map your entity type, services, locations, AI roles, products and suppliers rather than relying on whether you call yourself a technology company.
At a glance: the two laws ask different questions
The UK Cyber Security and Resilience Bill is an expansion of the UK’s existing network-and-information-systems regime. The starting question is whether you operate a covered sector or service, or whether the Bill’s planned additions bring you into scope. The European Union AI Act starts with a different test: what role do you play (provider, deployer or general-purpose AI model provider), what risk class applies to the system, and is there an EU connection through customers, users, deployment or market placement?
| Decision point | UK Cyber Security and Resilience regime | EU AI Act |
|---|---|---|
| Primary trigger | Sector, service and designation under UK cyber rules | AI value-chain role, risk category and EU-facing activity |
| Typical organisations covered | Operators of essential services, relevant digital services, data centres, managed service providers and certain designated suppliers | AI providers, deployers and providers of general-purpose AI models, depending on the system and use |
| Current legal position | The 2018 NIS Regulations remain the foundation; Bill scope and duties are being developed through consultation and secondary legislation | Regulation (EU) 2024/1689 is applying in stages, with several obligations already active |
| Main evidence | Cyber-risk controls, incident reporting and supply-chain governance | AI classification, literacy, transparency, technical documentation and human oversight where applicable |
| Penalty certainty | Detailed Bill penalties and commencement depend on final legislation and regulations | Published maximum fines reach €35 million or 7% of worldwide annual turnover for prohibited practices |
Being outside one regime does not prove that you are outside the other. For example, a software company can be outside the UK sectoral scope but still be an EU AI provider, or operate a UK managed service that is brought into scope while its AI product is not marketed in the EU.
Recommended Free Tools
When the UK Cyber Security and Resilience Bill can apply
Existing NIS coverage
The UK government says the 2018 Network and Information Systems Regulations cover energy, transport, health, drinking water, digital infrastructure and some digital services. Whether a particular business is covered depends on the service it provides and the applicable operator or digital-service definitions, not simply on its size or use of technology.
#1 Best Overall
Planned expansion
The Bill is intended to extend the framework to data centres, managed service providers (MSPs) and large load controllers. These additions matter to companies that may not have considered themselves part of critical national infrastructure but provide infrastructure or ongoing technology operations to organisations that do.
The government estimates that bringing MSPs into scope would secure a further 900–1,100 MSPs. That figure is a 2025 government estimate, not a count of enacted registrations or a final list of regulated providers.
What counts as the intended managed-service category
The government’s policy statement describes an intended managed service as one that:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- is provided externally to a customer;
- relies on network and information systems;
- performs ongoing management, administration or monitoring of IT systems, infrastructure, applications or networks; and
- involves a connection to, or access to, the customer’s systems.
A one-off installation with no continuing administration may therefore be treated differently from a service that continuously monitors, patches, operates or administers a customer environment. The final boundary will be set by legislation and regulations. The Information Commissioner’s Office (ICO) is intended to regulate MSPs.
Timing and uncertainty
The government planned implementation consultation in 2026, followed by a response, secondary legislation and an adjustment period for stakeholders. Exact commencement dates, duties, thresholds and designations can change as that process develops. The Bill also states a policy goal of allowing the government to act against emerging threats without needing new primary legislation, but that policy statement does not itself create a final compliance deadline.
What an in-scope organisation should be ready to evidence
The comparison framework for the Bill centres on demonstrable cyber-risk management, incident reporting and supply-chain governance. In practice, an affected organisation should be able to identify critical services and dependencies, assign control ownership, record material incidents and show how suppliers and outsourced technology are assessed. Do not treat these as a final catalogue of statutory controls: detailed duties remain subject to the Bill and secondary legislation.
When the EU AI Act can apply
Role in the AI value chain
The Act places obligations on providers, deployers and providers of general-purpose AI (GPAI) models. A provider is the organisation that develops an AI system or model for placing on the market or putting into service; a deployer uses an AI system under its authority. A company can occupy more than one role across different products—for example, deploying a third-party model internally while providing a separate AI application to customers.
Research, development and prototyping before market release are exempted according to the European Commission’s FAQ. The exemption does not automatically cover a system once it is released, supplied to customers or put into operational use.
EU connection
An EU connection can arise through EU customers or users, deployment in the EU, or placing an AI system or model on the EU market. A UK company therefore cannot decide that the Act is irrelevant solely because it is incorporated in the UK. Map where the system is offered, who uses it, where it is deployed and whether its outputs serve EU activity.
Rank #4
Risk categories determine the work required
The Act uses different obligations for different risk classes. Prohibited practices are subject to an outright ban. High-risk systems face the heaviest governance requirements, including technical documentation, risk management, human oversight and other controls applicable to the system. Transparency duties apply to certain systems that interact with people or generate content. AI-literacy requirements already apply to organisations within scope. GPAI providers have their own obligations, including model-level documentation and information duties.
Do not label a product “low risk” in a marketing document and treat that as a legal classification. Record the intended purpose, users, deployment context and any sensitive-area use cases, then document the classification decision and its owner.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →EU AI Act timeline (position verified 20 October 2026)
| Date | What applies | What it means for planning |
|---|---|---|
| 2 February 2025 | Prohibitions, definitions and AI-literacy provisions | Screen existing uses and train relevant staff; prohibited practices are already subject to the Act |
| 2 August 2025 | Governance rules and GPAI obligations | GPAI providers and organisations covered by governance provisions need an operating model, records and responsible owners |
| 2 August 2026 | General application date, including Commission and Member State enforcement responsibilities | Most remaining general obligations are now in the application phase |
| 2 December 2027 | High-risk use cases in sensitive areas such as biometrics, critical infrastructure, education, employment, migration, asylum and border control | Use the extended period to complete conformity, documentation, oversight and monitoring work |
| 2 August 2028 | High-risk AI embedded in regulated products such as medical devices, toys and lifts | Coordinate AI compliance with the product’s existing safety and conformity processes |
The 2026 Omnibus changes extended the high-risk deadlines to allow standards, guidance and competent authorities to mature. Confirm the latest European Commission guidance before relying on a transition date, especially where a product could fit more than one high-risk route.
Maximum fines
| Issue | Maximum stated by the Commission FAQ |
|---|---|
| Prohibited practices | €35 million or 7% of worldwide annual turnover, whichever is higher under the applicable calculation |
| Other obligations | €15 million or 3% of worldwide annual turnover |
| Incorrect, incomplete or misleading information | €7.5 million or 1% of worldwide annual turnover |
These are maximum ceilings in the current Commission FAQ, not an automatic fine for every breach. The FAQ describes SME-specific thresholds separately, so a smaller company should check the applicable calculation rather than assume that the headline percentages are the amount it would pay.
UK Bill versus EU AI Act: the practical differences
| Axis | UK cyber regime | EU AI Act |
|---|---|---|
| What triggers it | Operating a covered sector or service, or falling within a planned designation such as MSP or data-centre coverage | Providing or deploying AI, providing a GPAI model, and meeting the Act’s EU connection and risk tests |
| Regulated subject | Operators, digital services, data centres, MSPs, large load controllers and designated suppliers | AI systems and models plus the organisations that provide or deploy them |
| Geography | UK services and entities designated under UK rules | EU market, users, deployment or affected activity can connect a non-EU business |
| Implementation | Phased; consultation, response and secondary legislation still shape scope and dates | Staged dates from 2025 are active; high-risk dates extend into 2027 and 2028 |
| Core records | Cyber-risk assessments, incident records, resilience measures and supplier controls | Role and risk classification, technical documentation, transparency records, literacy evidence and human-oversight arrangements where required |
| Regulators | Existing competent authorities, with the ICO intended to regulate MSPs | National authorities and the European Commission’s AI Office, with enforcement responsibilities applying from 2 August 2026 |
A six-step test for your company
- Map UK services and sectors. List every service, business unit and infrastructure operation. Check the 2018 NIS categories—energy, transport, health, drinking water, digital infrastructure and relevant digital services—then mark possible Bill additions such as data centres, MSP activities and large load control.
- Identify customer-access relationships. For each outsourced service, record whether your staff or systems continuously manage, administer or monitor a customer’s IT and whether you connect to or access that customer environment. This is the fact pattern the policy statement uses for an intended managed service.
- Inventory AI systems and models. Include internally deployed tools, customer-facing features, embedded components and any model supplied to other organisations. Assign a role for each item: provider, deployer, GPAI provider or another value-chain position.
- Check the EU connection. Record EU customers, users, deployment locations, market placement and where outputs are used. A UK incorporation address is not a substitute for this analysis.
- Classify risk and apply the date. Screen for prohibited practices, transparency-sensitive uses, GPAI obligations and high-risk contexts. Match each system to the applicable date, including 2 December 2027 or 2 August 2028 where a high-risk transition applies.
- Assign evidence owners and recheck the law. Give named owners responsibility for cyber controls, incidents, suppliers, AI documentation, literacy and human oversight. Recheck UK secondary legislation and current Commission guidance before treating the register as final.
Examples: which outcome fits?
| Business pattern | Likely result | Why |
|---|---|---|
| UK manufacturer with no covered cyber service and no EU AI activity | Possibly neither | Neither sector/service coverage nor an EU AI role and connection is established by the facts given |
| UK MSP continuously administering customer networks, with no AI product sold in Europe | Potentially UK only | The planned MSP category may apply; EU AI duties do not arise merely because the company uses ordinary automation |
| UK software provider selling an AI hiring product to EU employers | Potentially EU AI Act, and possibly UK rules separately | The provider has EU-facing activity and employment is a listed sensitive high-risk area; UK status still depends on sector or service |
| UK data centre that also provides an AI service to EU customers | Potentially both | Data-centre coverage is a planned UK addition, while the AI service can create an EU provider connection |
| UK retailer deploying an EU vendor’s chatbot only for its UK website | Usually an AI deployer analysis, with UK cyber status assessed independently | Determine whether the system has an EU connection and what role the retailer plays; do not assume the vendor’s status answers the retailer’s obligations |
These are decision patterns, not legal determinations. A definitive answer requires the company’s actual services, contracts, locations, AI purpose and supplier arrangements.
How to prepare without doing the work twice
Build one inventory with two regulatory views
Use a single register of services, systems, suppliers and incidents. Add UK fields for covered service, competent authority, critical dependency, incident route and supplier access. Add EU AI fields for provider or deployer role, model lineage, intended purpose, risk class, EU users, transparency need and human-oversight owner. One inventory reduces the chance that an AI component hidden inside a managed service is missed.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSeparate controls that can be shared from controls that cannot
Access management, change control, monitoring, incident escalation and supplier review can support both regimes. They do not replace AI-specific work: a cyber risk assessment does not prove that an AI system has the required technical documentation, transparency information or human oversight. Conversely, model documentation does not demonstrate resilient network operations or an incident-reporting process.
Make transition assumptions visible
For the UK Bill, label every conclusion as current NIS coverage, planned Bill scope or an unresolved question awaiting secondary legislation. For the EU Act, record the exact date and transition basis used for each high-risk system. This prevents an internal roadmap from presenting a consultation proposal or extended deadline as a permanent rule.
Common mistakes that create avoidable exposure
- Using company labels instead of service facts. Calling a business a “software company” does not answer whether it operates an MSP, data-centre or digital service.
- Assuming UK location defeats EU reach. EU customers, users, deployment or market placement can create the relevant connection for an AI system.
- Counting prototypes as released products. The Commission FAQ exempts research, development and prototyping before market release; release or operational use changes the analysis.
- Treating the MSP estimate as a final register. The 900–1,100 figure is a government estimate from 2025, not an enacted registration count.
- Planning from a headline deadline alone. High-risk AI dates differ by use case, and the UK Bill’s commencement and detailed duties remain subject to further legal steps.
- Ignoring suppliers. Both regimes can involve third parties: UK cyber resilience includes supply-chain governance, while AI systems often incorporate external models, data or infrastructure.
- Repeating the same evidence under separate names. A shared control may serve both regimes, but maintain a traceable record showing exactly which legal requirement it supports.
Bottom line for a 2026 compliance decision
Start with two independent maps. For the UK, map sectors, services, customer access and planned designations, then monitor consultation and secondary legislation. For the EU, map every AI system’s role, purpose, risk category and EU connection, and apply the staged dates already in force or approaching. Only after those maps are complete can you say whether your company faces the UK regime, the EU AI Act, both or neither.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
