UK and EU AI governance: a working map

Research note. Reviewed 8 November 2026. Desk research from legislation, regulators and standards bodies; no original survey or legal opinion is claimed.

AI governance work can involve several kinds of requirement. The useful distinction is what each source does: law establishes obligations within its scope; a management-system standard organises a system of work; guidance and frameworks help teams choose and operate controls.

The main references

The standard descriptions come from ISO 42001 and ISO 27001. NIST identifies its AI RMF as voluntary. The UK AI Cyber Security Code is also voluntary; its language should not be presented as a separate statutory duty.

EU AI Act: the amended dates

The 2026 amendment changed parts of the original timetable. The following is a selected planning reference, not a complete list of transitional provisions.

Sources: Regulation (EU) 2026/1744, Article 1 amendments to Articles 111 and 113, Commission AI Act overview and Commission amendment announcement.

A later high-risk date does not defer every obligation. Assess the relevant role, prohibition, transparency requirement, model obligation and transition separately. For Annex I products, the interaction with the applicable product legislation also needs review.

The amended Article 4 retains a duty for providers and deployers to take measures supporting staff AI literacy, while clarifying that they need not guarantee a particular individual's literacy level. Amending regulation, Article 1(5).

UK organisations and EU scope

The assessment starts with activity and use, not just the registered address. Article 2 covers, among other cases, providers placing systems or general-purpose models on the EU market and certain non-EU providers/deployers whose system outputs are used in the EU. Review the actual arrangement and exclusions before assigning obligations. Commission Article 2 text.

UK data protection needs a current review

Where AI processes personal data, the organisation needs to consider the processing purpose, lawful basis, fairness, transparency, minimisation, security and relevant rights. A data protection impact assessment is required for processing likely to result in high risk; the screening needs to reflect the actual use. ICO DPIA guidance.

The Data (Use and Access) Act 2025 changed the UK framework, including automated decision-making provisions. Avoid reusing a generic summary of the former Article 22 as if nothing had changed. The factsheet explains the replacement with Articles 22A–D; use the current law and ICO guidance for a system-specific assessment. Government factsheet.

Physical systems add another layer

An AI management process does not establish the functional safety of a machine. Physical AI projects need to identify the applicable product, safety and sector requirements, then connect those requirements to system design and evidence.

A platform programme such as NVIDIA Halos may support a particular engineering or assessment route. Its applicability has to be considered for the actual product; it should not be treated as a general certificate covering every AI system. See our separate Physical AI: NVIDIA Halos and Hailo note.

A practical way to use this map

For one system, record the intended use, territory, roles and affected people. Identify relevant obligations and chosen frameworks. Link each material requirement or control to an owner and the evidence needed to support it.

This produces a manageable workplan. It also makes later changes easier to assess because the reasons for the original decision remain visible.