What the EU AI Act's Reach Into the UK Means for Law Firms in UK

Direct answer: If your firm advises, represents, or takes instructions from anyone based in the EU, the EU AI Act's transparency rules that landed in August 2026 apply to you even though the UK sits outside the EU's own regulatory perimeter — the Act follows the client, not the border. In practice, that means your website's chatbot, any AI-assisted intake or document tool exposed to clients, and any AI-generated content you publish now need proper disclosure. Firms that treat this as "an EU problem" are the ones most likely to get caught out when a client, a regulator, or a competitor notices first.

According to Deloitte UK Tech Trends' coverage of EU AI Act enforcement in August 2026, the Act's transparency obligations are now reaching UK companies that serve EU customers, despite the UK having left the EU's regulatory framework years ago. This is the same extraterritorial logic that made GDPR a UK compliance issue long after Brexit — a UK-based business doesn't get to opt out of EU rules simply because its office address sits outside the bloc, so long as it's dealing with people or entities inside it. We don't have a precise figure for how many UK law firms specifically fall under this particular provision, and no credible source has published one yet for this narrow angle, so it's worth reasoning from the general pattern instead: any UK professional services firm with cross-border EU clients, referral relationships, or matters touching EU-domiciled parties is a plausible candidate, and law firms — with their heavy use of AI for document review, correspondence drafting, and increasingly for client-facing intake — sit squarely inside that pattern. This piece works through what actually changed, why it lands differently on legal services than on, say, a UK retailer, what it means for the tools and pages your firm already has live, and what a sensible response looks like in practice.

What Exactly Changed in August 2026, and Why It Reaches Firms Outside the EU

The EU AI Act's transparency provisions are built around a simple premise: people interacting with an AI system, or consuming AI-generated content, have a right to know it. That premise doesn't stop at the EU's border. The Act applies based on where the output of an AI system is used or where the person affected by it is located, not based on where the company running the system is incorporated. A UK law firm with a London office and zero EU staff can still fall inside scope the moment it deploys an AI chatbot that talks to a client in Frankfurt, or drafts a contract that a Dublin-based counterparty relies on.

This is not a new legal theory. GDPR set the precedent years ago: a UK business processing the personal data of EU residents remains subject to GDPR's extraterritorial reach regardless of Brexit, and most UK firms with any EU client base built compliance programs around that reality rather than arguing the point. The EU AI Act's August 2026 transparency rules are following the same script, and Deloitte's UK Tech Trends coverage frames this as a live enforcement reality rather than a future risk — the rules aren't pending, they're active.

What makes this genuinely new for law firms, as opposed to a generic e-commerce business, is the sheer density of AI touchpoints a modern firm now runs. A retailer might have one AI system — a product recommendation engine or a support chatbot. A firm doing cross-border work plausibly has several: a website chatbot handling initial enquiries, an AI-assisted intake questionnaire that triages new matters, drafting tools used inside case management software, and possibly AI-generated summaries or content published on the firm's own site. Each of those is a separate point where the transparency obligation can bite, and each one needs to be found before it can be fixed.

There's a second layer worth understanding: transparency under the Act isn't satisfied by a one-time disclosure buried at signup. It's meant to be evident at the moment of interaction, which is a materially different design requirement than a cookie consent banner a visitor clicks through once and never sees again. A chatbot needs to identify itself as AI every time a new conversation starts, not just the first time a visitor ever lands on the site. Content generated by AI needs a label that travels with the content itself — in a blog feed, in a PDF export, in a shared link — not just on the page where it was originally published. That persistence requirement is what turns this from a copywriting fix into an actual engineering task.

Why This Lands Differently for Law Firms in the UK

Most UK sectors can treat this as background compliance noise. Law firms can't, for two reasons specific to the profession.

First, cross-border work is not a side detail for many UK firms — it's the business. Firms doing international arbitration, cross-border M&A, IP disputes, or advisory work for EU-headquartered groups interact with EU-domiciled clients and counterparties as a matter of routine, not exception. That's a much higher and more constant rate of EU contact than a typical UK retailer or SaaS company sees, which means the probability that any given firm's digital tools touch an EU-based person on a given week is high, not theoretical.

Second, law firms carry a professional duty that most businesses don't: a client's trust in the advice they're getting is inseparable from trust in how that advice was produced. If a client later learns that a first-pass contract review, a risk summary, or even the correspondence answering their initial enquiry was AI-generated and they were never told, that's not just a regulatory technicality — it's a professional credibility problem layered on top of a legal compliance one. Firms that get ahead of disclosure look more trustworthy, not less, because they're demonstrating they understand and control their own tooling.

The practice areas most exposed aren't evenly distributed either. Cross-border M&A, international arbitration, IP prosecution and disputes, immigration work tied to EU nationals, and advisory work for EU-headquartered corporate groups all involve routine, high-frequency contact with EU-based individuals and entities. A UK firm running a general commercial practice with the occasional EU-adjacent matter carries a smaller version of this exposure than a firm where EU-facing work is the core book of business — but a smaller version of the exposure is still exposure, and it's worth firms in the former category resisting the temptation to assume the rule doesn't apply to them at all.

This isn't unique to legal services, either — it's a pattern showing up anywhere a regulated, trust-dependent relationship meets AI-assisted delivery. InsurTech firms hit a version of this same pressure when EU insurance regulators started asking pointed questions about AI use inside underwriting and claims products; our piece on InsurTech App Development: Building a Digital Insurance Product That Converts covers how that sector had to build disclosure and audit trails into the product itself rather than bolting them on afterward. The lesson transfers directly: whichever regulated industry you're in, transparency-by-design beats transparency-as-patch every time, because a patch is visible as a patch.

What Changes in Practice for Your Firm's Website and Client Tools

The abstract compliance question turns concrete fast once you look at an actual firm website and case-management stack. Three things typically need attention.

Client-Facing Chatbots and Intake Tools

If your website runs a chatbot — whether it's a simple FAQ bot or something more sophisticated doing initial triage on new enquiries — a visitor needs to know they're talking to an AI system, stated plainly, before or as the conversation starts. This isn't satisfied by a line buried in a privacy policy three clicks away. It needs to be visible at the point of interaction: a labeled avatar, an opening message, or a persistent indicator, in language a non-lawyer visitor will actually register. The same logic extends to AI-assisted intake questionnaires that ask a prospective client to describe their matter before a human ever sees it — if an AI system is scoring, routing, or summarizing that input before a solicitor reviews it, that's a disclosure point too.

There's also a record-keeping dimension worth building in from the start. Beyond the visible disclosure, it's sensible to log when and how a visitor was shown the AI disclosure — not because the Act necessarily demands a specific logging format, but because if a client ever disputes whether they were told, a firm wants to be able to show, not just assert, that the disclosure was live and functioning at the time of the interaction. This is a small addition at build time and a genuinely difficult one to retrofit after the fact.

AI-Generated Content on the Public Website

Marketing and content teams at law firms increasingly use AI tools to draft or accelerate blog posts, practice-area explainers, and even parts of case study pages. If that content is substantially AI-generated rather than human-authored with light AI assistance, it falls under the same disclosure logic as the chatbot case — a visitor reading the piece is entitled to know an AI system played a substantial role in producing it. The practical fix is usually a small, consistently placed label near the byline or publication date, applied through the content management system so it's automatic rather than something an editor has to remember to add to every new piece.

AI-Assisted Drafting and Document Review

Internally, most firms already use some form of AI-assisted drafting or document review — flagging clauses, summarizing case files, or generating first drafts of routine correspondence. The transparency question here is less about a banner and more about process: does the client know, in engagement terms or in the delivered work product, that AI played a role in producing it? This is a genuinely different problem from the chatbot case, because it touches case management software and internal workflow rather than the public website, and it often needs sign-off from whoever owns client engagement letters, not just whoever owns the website. It's worth scoping separately rather than trying to solve both with the same fix.

Before either of these ships, they need real testing, not a quick click-through before launch. A disclosure banner that fails silently on mobile Safari, or an intake flow where the AI-labeling step gets skipped under certain form conditions, defeats the purpose without anyone noticing until a client complains. Our guide on Web Application Testing Strategy: Unit, Integration, and End-to-End Explained walks through the layers of testing — unit, integration, end-to-end — that catch exactly this kind of quiet failure before it reaches a real client.

There's also a performance dimension that's easy to overlook. Compliance UI has a cost if it's built carelessly — an extra consent modal, a blocking script for the disclosure banner, another render-blocking asset on an already heavy page. The physics here are the same ones we covered in Ecommerce Site Speed: Why Slow Product Pages Cost You Sales: a prospective client filling out a conflict-check or intake form on a slow, janky page abandons it just as readily as an online shopper abandons a slow product page, and a firm that solves compliance by making its intake flow worse has traded one problem for another.

What to Do About It: A Practical Compliance Path

None of this requires a firm-wide overhaul overnight, but it does require an actual audit rather than an assumption that "we probably don't do enough AI stuff to matter." A sensible sequence looks like this.

Start by mapping every point where an AI system produces something a client or prospective client sees or interacts with: chatbots, intake forms, auto-generated email responses, AI-summarized case updates in a client portal, and any AI-drafted content published on the marketing site. Most firms are surprised by how long this list is once someone actually walks the site and the case management stack end to end, rather than relying on what marketing or IT believes is running.

Next, triage by exposure. A chatbot answering general enquiries from anyone, EU-based or not, is higher priority than an internal drafting tool used only by fee-earners on UK-only matters, because the former is a public-facing, always-on disclosure gap and the latter is a controllable internal process. Fix the public-facing gaps first.

Then build disclosure into the interface itself rather than the small print. This is a design and engineering task as much as a legal one — the wording has to be accurate, the placement has to be visible at the moment of interaction, and it has to survive a redesign six months from now instead of getting quietly dropped. This is precisely where a firm benefits from treating it as a proper build rather than a favor asked of whoever last touched the website. A dedicated Web Development engagement can audit the existing site and client tools, implement disclosure and consent flows that hold up under scrutiny, and set up the testing discipline that keeps them working as the site evolves — rather than leaving compliance riding on a banner nobody remembers is there.

One structural decision worth making early is who inside the firm actually owns this. In most firms, no single role currently has both the authority and the technical visibility to run this end to end — IT knows what's technically deployed, marketing owns the public website, and the firm's compliance or risk function understands the regulatory obligation, but rarely does one person sit across all three. Naming a single owner, even informally, for the audit and the ongoing maintenance prevents the work from stalling between departments, which is the most common reason compliance projects like this drift for months without a fix actually shipping.

Finally, treat this as ongoing rather than one-and-done. AI tooling inside firms changes fast — a new drafting assistant gets adopted, a case management vendor ships an AI feature by default, a marketing team starts using an AI writing tool for the blog. Each addition is a new potential disclosure point, so whoever owns the website and client tools needs a standing habit of asking "does this need a disclosure treatment?" every time something AI-shaped gets added, not just at the point of an annual audit.

What This Kind of Compliance Work Typically Costs

Pricing depends heavily on how many AI touchpoints a firm actually has and how much of the existing site and client tooling needs rebuilding versus retrofitting. As a general reference point, here's how this kind of work typically maps onto standard engagement tiers.

Tier	Typical scope for this work	Starting at
Essential	Audit of existing AI touchpoints, disclosure copy and UI for a chatbot or intake form on an existing site	$1,000
Growth	Essential scope plus rebuilt intake/consent flows, cross-device testing, and CMS-wide updates for AI-generated content labeling	$2,000
Enterprise	Growth scope plus custom integrations for case-management AI tools, multi-market disclosure logic, and ongoing compliance maintenance	$4,000+

Most single-office firms with a chatbot and a standard intake form land in the Essential-to-Growth range. Firms with multiple client portals, several AI-assisted internal tools, and matters spanning several EU jurisdictions tend to need the Enterprise scope, mainly because of the integration and maintenance work rather than the disclosure UI itself.

Firms that already went through a GDPR compliance exercise in past years often find some of that groundwork reduces the cost here — a firm that already has a data protection impact assessment process and a clear map of vendor tools has a head start on identifying which of those vendors run AI features that now need disclosure. Firms starting from scratch, with no prior mapping exercise, should expect to spend more of the engagement on the discovery and audit phase before implementation even begins.

Key Takeaways

• The EU AI Act's August 2026 transparency rules reach UK law firms through their EU-based clients and counterparties, not through where the firm is registered — Brexit doesn't create an exemption.
• Audit every AI touchpoint a client or prospective client can encounter: website chatbots, intake questionnaires, AI-assisted drafting surfaced in client communications, and AI-generated site content.
• Fix public-facing gaps first — a website chatbot talking to anyone, anywhere, is a higher-priority disclosure point than an internal-only drafting tool.
• Build disclosure into the interface itself, tested properly, rather than relying on small print that quietly breaks after the next redesign.
• Don't let compliance UI degrade page performance — a slow, cluttered intake form loses prospective clients the same way a slow checkout page loses shoppers.
• Treat this as an ongoing process tied to every new AI tool your firm adopts, not a single project you close out and forget.

Getting this right takes a proper look at your firm's actual website and client tools rather than guesswork about what might be exposed. If you want help figuring out where your firm stands and what to fix first, book a meeting with our team.

Frequently Asked Questions

What is the EU AI Act?

It's the European Union's regulatory framework for artificial intelligence, setting obligations that scale with an AI system's risk level. Its transparency provisions, which became a live enforcement issue in August 2026, require that people be told when they're interacting with an AI system or consuming AI-generated content.

What does "transparency obligation" mean under the EU AI Act?

It means an AI system's operator must clearly disclose, at the point of interaction, that a person is dealing with AI rather than a human, or that content they're viewing was AI-generated. The disclosure has to be noticeable and understandable, not buried in a policy document.

Does Brexit exempt UK law firms from the EU AI Act?

No. The Act applies based on where the affected person is located or where the AI system's output is used, similar to how GDPR reaches UK firms with EU clients despite Brexit. A UK firm with EU-based clients or counterparties can fall inside scope regardless of its own location.

What counts as an "AI system" under the Act for a law firm's website?

Practically, this includes chatbots, AI-assisted intake or triage tools, AI-generated marketing content, and any automated drafting or summarization tool exposed to or produced for a client. The common thread is that a person is interacting with, or receiving output from, an automated system rather than a human directly.

What is the difference between a "provider" and a "deployer" under the EU AI Act?

A provider builds or supplies the AI system, while a deployer is the organization using it in its own operations. Most law firms are deployers — they use AI tools built by software vendors — which still carries transparency obligations toward the firm's own clients.

What is extraterritorial scope, and how does it work here?

It means a law can apply to organizations outside the jurisdiction that wrote it, based on who is affected rather than where the company sits. The EU AI Act's transparency rules use this same logic, so a UK firm serving EU-based clients is in scope even without any EU office.

Are chatbots on a law firm's website considered AI systems under the Act?

Yes, if the chatbot is doing more than serving static, pre-written responses — anything using natural language generation or AI-driven routing to interact with a visitor falls under the transparency requirement. The visitor needs to know they're talking to an AI system.

What does "AI-generated content" mean in the context of a law firm's marketing pages?

It refers to blog posts, guides, or other published content that was substantially drafted or generated by an AI tool rather than written by a person. If a firm publishes this kind of content without disclosure, it can fall under the same transparency expectation as a chatbot interaction.

What is a limited-risk AI system, and where do most law firm tools fall?

Limited-risk systems are those subject mainly to transparency obligations rather than the heavier requirements applied to high-risk categories. Most law firm chatbots and drafting assistants fall into this limited-risk bracket, which is exactly why the August 2026 transparency rules are the relevant provision here rather than a stricter regime.

How is the EU AI Act different from GDPR?

GDPR governs how personal data is collected, stored, and processed. The EU AI Act governs how AI systems are built and used, including a distinct transparency requirement about disclosing AI involvement — the two overlap where AI systems process personal data, but they're separate obligations that can both apply to the same tool.

Why would a UK law firm with no EU office be affected by EU law?

Because the Act follows the location of the affected person or the use of the system's output, not the location of the company running it. Any UK firm advising or corresponding with EU-based clients or counterparties can trigger this regardless of where its offices sit.

Does the Act apply if my firm only has one or two EU-based clients?

Scope isn't defined by client count in a way that gives small numbers a pass — a single EU-based client interacting with an undisclosed AI chatbot or receiving undisclosed AI-generated content is still a disclosure gap. It's worth treating this as a binary "do we have any EU-facing AI touchpoints" question rather than a volume threshold.

What if my firm advises EU clients but never processes their personal data directly?

The transparency obligation is about disclosing AI involvement, not about data processing specifically, so it can apply independently of your GDPR posture. If an EU-based person interacts with an AI system your firm runs, or receives AI-generated output, the disclosure question stands on its own.

Does the Act apply to barristers' chambers as well as solicitors' firms?

The obligation attaches to whoever deploys the AI system, so any legal services organization — chambers, solicitors' firms, in-house teams — running a chatbot, drafting tool, or AI-generated content facing EU-based people should apply the same logic. Structure doesn't change the underlying exposure.

What about UK firms that only refer EU work to a local counsel?

If the referring firm's own AI-driven tools — a website chatbot, an intake form — interact with the EU-based client before the referral happens, that interaction itself can be a disclosure point, independent of what the receiving firm does. The referral doesn't retroactively remove exposure created upstream.

Does my firm need an EU-based legal representative under the Act?

Some obligations under the broader Act contemplate an EU-based representative for providers operating from outside the EU; whether that applies to your specific setup depends on your role and scale, and is worth confirming with your firm's own regulatory counsel rather than assuming either way. The transparency disclosure itself, however, is a UI and process fix your team can make regardless of that separate question.

How does this interact with the SRA's existing technology and AI guidance?

The Solicitors Regulation Authority has published its own expectations around AI use in legal practice, focused on competence and client care. The EU AI Act's transparency rule sits alongside that as a separate, EU-driven obligation — meeting SRA expectations doesn't automatically satisfy the EU Act's specific disclosure requirement, so they're worth checking against each other rather than assuming one covers the other.

Are in-house counsel teams at UK companies with EU subsidiaries affected too?

Yes, the same logic applies — if an in-house legal team's tools or published content reach EU-based colleagues, subsidiaries, or counterparties through an AI system, the transparency expectation follows the same extraterritorial pattern as it does for a private practice firm.

What's the risk if my firm ignores this because it feels like an EU problem?

Beyond formal enforcement risk, there's a client trust dimension specific to legal services — a client who discovers undisclosed AI involvement in their matter after the fact tends to react more strongly than a retail customer would, because the relationship is built on trust in judgment. Ignoring it also means fixing it later under worse conditions, likely after a complaint rather than on your own timeline.

Could this affect how EU clients choose between UK and EU-based firms?

It's plausible that EU-based clients start treating visible AI transparency as a baseline expectation when selecting external counsel, the way data protection posture became a factor after GDPR matured. There's no published data specific to this yet, but firms that get ahead of it have an easy, low-cost point of reassurance to offer prospective EU clients.

What specifically needs to change on my law firm's website?

Any AI-driven chatbot or intake tool needs a clear, visible disclosure at the point of interaction, and any AI-generated content needs a similar label. Beyond that, it's worth auditing whether AI-assisted case updates in a client portal need the same treatment.

Do I need to label my website chatbot as AI?

Yes, if it uses natural language generation or automated decision-making to interact with visitors, it needs a clear indication — commonly a labeled name, an opening disclosure message, or a persistent visual marker — that the visitor is talking to an AI system.

What about AI-assisted "know your client" or intake questionnaires?

If an AI system is scoring, summarizing, or routing a prospective client's answers before a human reviews them, that's a disclosure point, and it's worth being explicit about it in the questionnaire's introductory copy rather than leaving it implicit.

Does document automation software used internally need disclosure too?

If the output is only ever reviewed and finalized by a solicitor before reaching a client, the internal drafting step is lower priority than public-facing tools, but it's still worth confirming whether your engagement terms or delivered documents should note AI involvement in producing drafts.

What if we use a third-party AI tool embedded via a plugin?

Using a vendor's AI tool doesn't remove your firm's disclosure obligation as the deployer facing your own clients — you're still responsible for making sure the interaction is properly disclosed on your site, even if the underlying AI model belongs to someone else.

Do email auto-responders that use AI drafting need disclosure?

If an auto-responder is generating substantive, AI-drafted content rather than a fixed template, it's worth treating it the same as any other AI-generated client communication and considering a brief disclosure note, particularly for first-contact correspondence with EU-based enquirers.

How do I disclose AI use without making my site feel less trustworthy?

Plain, confident language works better than a defensive-sounding disclaimer — something like clearly naming the tool as an AI assistant and stating that a solicitor reviews all substantive matters tends to reassure rather than alarm, especially framed as evidence the firm understands its own technology.

Should disclosure be a banner, a modal, or inline text?

For chatbots, an opening message or a labeled interface element usually works better than an interruptive modal, because it doesn't add friction to the interaction. For AI-generated content, a small inline label near the byline or at the top of the piece is typically sufficient.

What happens to existing website content that was AI-drafted before this rule?

It's worth auditing published content for anything substantially AI-generated and adding a label retroactively where appropriate, rather than leaving older pages unaddressed while only fixing new content going forward.

Do client portals for case updates need any changes?

If any part of a case update — a summary, a status note, a draft communication — is produced by an AI system before a person reviews or sends it, the same disclosure logic applies inside the portal as it does on the public website.

How long does a typical compliance audit of a firm's website take?

For a firm with a standard website, a chatbot, and one or two client-facing tools, an audit typically takes a few days to identify every AI touchpoint and assess exposure. Larger firms with multiple portals and integrated case management systems take longer simply because there's more surface area to map.

What does it cost to add proper AI disclosure to a law firm website?

For a single chatbot and an intake form on an existing site, this typically falls under an Essential-tier engagement starting around $1,000. Firms needing broader rebuilds across multiple tools and client touchpoints scale up toward Growth or Enterprise tiers depending on complexity.

Can this be handled as part of a broader website rebuild instead of a bolt-on?

Yes, and it's often more efficient to fold disclosure and consent work into a planned redesign or rebuild rather than retrofitting it onto an existing site twice — once now and once again during a future redesign.

Do we need a developer, a compliance consultant, or both?

Ideally both, working together — a compliance consultant or your firm's own regulatory counsel to confirm what needs disclosing and in what terms, and a developer to implement it correctly, test it, and make sure it survives future site changes.

What's the timeline from audit to a shipped fix?

For a straightforward chatbot and intake form fix, a few weeks is realistic once scope is confirmed. More complex engagements involving case management integrations or multi-jurisdiction disclosure logic take longer, generally measured in a couple of months rather than weeks.

Will adding disclosure banners slow down our website?

Not if they're built properly — a lightweight, well-coded disclosure element shouldn't meaningfully affect load time. Poorly implemented consent modals or heavy third-party scripts are the actual risk, which is why this is worth treating as a proper build rather than a quick plugin install.

Can existing WordPress or Squarespace sites be updated, or do we need a rebuild?

Most existing platforms can accommodate disclosure UI and labeling without a full rebuild, provided the underlying site isn't already so constrained or outdated that basic changes are difficult. A short technical assessment upfront will tell you which situation you're in.

How do we test that disclosure actually displays correctly across devices?

Through structured testing across browsers and devices rather than a single manual check — confirming the disclosure element renders, is visible without extra scrolling or interaction, and doesn't get suppressed by ad blockers, cookie consent tools, or slow-loading scripts.

Who maintains this going forward as AI tools on the site change?

Ideally whoever owns the website build takes responsibility for flagging new AI-shaped features as they're added, whether that's an internal team member or an ongoing development partner, so disclosure doesn't quietly lapse as the site evolves.

Does Scult offer an audit specifically for this kind of compliance work?

Yes — this kind of AI-touchpoint audit and disclosure implementation is exactly the sort of scoped engagement handled under Scult's Web Development service, from initial audit through implementation and testing.

What are the penalties for non-compliance under the EU AI Act?

The Act sets out significant financial penalties for non-compliance, scaled by the severity and nature of the violation, though the precise application to a specific UK-based deployer scenario depends on facts a regulatory lawyer should assess rather than a general estimate. The reputational cost of a disclosed compliance failure for a law firm is arguably the more immediate concern.

Who actually enforces this against a UK-based firm?

Enforcement mechanisms for cross-border cases are still maturing, and how EU authorities pursue a UK-based deployer in practice is an evolving area. That uncertainty is a reason to get ahead of the disclosure requirement voluntarily rather than wait to see how enforcement plays out.

Could a client complaint trigger an investigation?

It's a plausible pathway — an EU-based client who feels misled about undisclosed AI involvement in their matter could raise a complaint through a regulator or through professional channels, which is generally a less favorable way to discover a gap than finding it yourself first.

Does professional indemnity insurance cover AI transparency failures?

This depends entirely on your firm's specific policy terms, and it's worth raising directly with your insurer or broker rather than assuming coverage either way, particularly as AI-related claims are a relatively new category insurers are still defining.

Is this likely to become UK law as well, not just an EU spillover?

The UK has taken a lighter-touch, principles-based approach to AI regulation so far rather than mirroring the EU's Act directly, but firms with EU client bases face the EU rule regardless of what UK-specific law eventually looks like. Waiting for a UK equivalent doesn't reduce your current exposure to the EU rule.

How might this affect how UK law firms market AI-assisted services?

Firms that clearly and confidently describe how they use AI, with visible disclosure baked into the client experience, may find it becomes a point of differentiation rather than just a compliance cost, especially with EU-based clients increasingly primed to expect it.

Will this rule get stricter or looser as enforcement matures?

Based on the general pattern seen with GDPR, transparency-style obligations tend to get more consistently enforced over time rather than relaxed, as regulators build enforcement capacity and case history. Building compliant disclosure now is more likely to age well than to become unnecessary.

Should smaller firms worry as much as larger international ones?

Exposure is driven by whether a firm has EU-facing AI touchpoints, not by firm size — a small firm with one EU-based client and an undisclosed chatbot has the same disclosure gap as a much larger firm, just with a smaller potential client base affected.

What should a firm do in the next 90 days?

Map every AI touchpoint a client or prospective client can encounter, prioritize the public-facing ones, and get disclosure language and UI in place for at least the highest-exposure tools — typically the website chatbot and any client intake flow — rather than waiting for a comprehensive fix across everything at once.

How do we know if our current AI use even falls under the Act at all?

The clearest test is whether a person — client, prospective client, or counterparty — interacts with an AI system or receives AI-generated output without being told. If that's happening anywhere in your client-facing digital presence, it's worth treating as in scope until a proper legal review says otherwise.