Evidence Before Assurance: UK Suppliers and the EU AI Act’s Contractual Reach

The EU AI Act is often described as European legislation for European companies. That description is legally incomplete and commercially misleading. For UK mid-market firms supplying AI-enabled products or services into the EU, the Act can arrive through a customer questionnaire, a procurement condition or a contractual warranty long before any regulator makes direct contact. The mechanism is familiar from data protection and product safety: European requirements travel with the product, the service or the customer’s own compliance obligations. This is the Brussels effect in operational form.

For UK boards in 2026, the practical question is not whether the company has an EU establishment. It is whether the company is being asked to provide evidence that its AI-enabled offering can be used in the EU without exposing its customer to unacceptable regulatory risk. Those requests are becoming more detailed, more contractual and more frequent.

Why the Act travels with the product

The Act applies to providers, deployers, importers and distributors of AI systems placed on the EU market or put into service in the EU. A UK company may not consider itself a provider in the ordinary sense, but the definition can capture a firm that develops an AI system or has one developed and markets it under its own name or trademark. A UK software supplier that embeds AI functionality into a product sold to EU customers may therefore fall within scope even without a European subsidiary.

The more common scenario for mid-market firms is indirect. A UK supplier sells an AI-enabled tool to an EU customer. That customer is a deployer and needs to meet its own obligations. It may ask the UK supplier for technical documentation, information on intended use, human oversight measures, data provenance, testing records or assurances about serious-incident reporting. If the UK supplier cannot provide credible evidence, the customer may decline the contract, seek a broad indemnity or choose a competitor with a more mature governance package.

Where UK suppliers are caught out

Four failures recur. The first is assuming that no EU establishment means no EU obligation. The Act’s territorial reach and the commercial pressure exerted by customers make that assumption unsafe. The second is treating the Act as a purely legal drafting exercise. Contracts can allocate responsibility, but they cannot manufacture missing technical documentation or substitute for genuine risk management. A supplier that signs extensive warranties without the underlying evidence is storing up future disputes.

The third failure is conflating UK and EU regimes. The UK’s approach to AI regulation remains sector-based and principles-led, with regulators such as the ICO, FCA and MHRA applying existing frameworks. That does not mean EU requirements are irrelevant. Nor does it mean UK GDPR compliance automatically satisfies the EU AI Act. The Act asks different questions about risk classification, technical documentation, human oversight and post-market monitoring. The fourth failure is a lack of ownership. AI governance is often split between legal, product, information security and commercial teams. Without a board-level owner, no one is accountable for the evidence trail.

The board’s oversight question

The board does not need to interpret every article of the Act. It does need to understand which products or services are in scope, which customers are asking for assurances and whether the company can substantiate what it signs. A useful starting point is a simple inventory: list every AI-enabled offering sold into the EU or to customers who may deploy it in the EU; identify the intended purpose and the likely risk classification; note which customers have requested contractual assurances; and record who owns the evidence for each claim.

That inventory should be reviewed at board level at least annually and whenever a material new AI feature is launched. The board should also ask whether the company’s quality management system, risk management process and incident reporting channels are capable of producing the documentation that customers and regulators may request. For many mid-market firms, the gap is not a lack of technical competence. It is a lack of documented governance. The Act rewards evidence, not assertion.

Contracting for evidence, not comfort

Customer contracts are where the Act becomes commercially real. UK suppliers are increasingly asked to warrant that their AI system complies with the Act, to indemnify the customer for regulatory breaches, to grant audit rights and to notify incidents within tight deadlines. Some of these requests are reasonable. Others transfer risk that the supplier cannot realistically control. The board should establish a clear negotiating position before the sales team accepts the first draft.

A more defensible contract separates obligations that the supplier can evidence from obligations that depend on the customer’s use. The supplier can describe intended use, known limitations, testing performed and the information it will provide. The customer should own decisions about deployment context, human oversight and local conditions. Incidents should be notified within a defined period, but the supplier should not be required to guarantee the absence of every possible failure. Change control matters too: if the customer modifies the system or uses it outside the intended purpose, responsibility should shift accordingly.

Indemnities and liability caps deserve particular attention. A broad indemnity for all regulatory fines may be uninsurable or disproportionate for a mid-market supplier. A narrower allocation, linked to proven breach of agreed obligations and subject to the contract’s liability cap, is often more realistic. The aim is not to avoid responsibility. It is to ensure that the contract reflects the evidence the supplier can actually produce.

A practical 2026 agenda

For UK mid-market suppliers, the priority is to move from reactive questionnaire answering to a repeatable governance process. That means assigning board-level accountability, building an AI inventory, mapping customer contractual requests, reviewing documentation against likely EU expectations and training commercial teams on what can and cannot be promised. Legal and compliance teams should work alongside product and engineering colleagues, because the evidence ultimately comes from the development process.

The EU AI Act will not transform every UK supplier into a regulated European entity. But it will continue to shape procurement, contracts and customer expectations in 2026. Firms that treat it as a contractual nuisance will find themselves signing assurances they cannot support. Firms that treat it as a discipline will find that the same evidence trail improves their position in the UK, in Europe and with any customer who values governance. The Brussels effect is not only a compliance story. It is a commercial one.