Is your AI use case going to get you in trouble?

Directly, only if your AI is placed on the EU market, serves EU users, or processes data about EU persons. Indirectly, it applies to almost everyone selling into medium or large UK customers, because procurement teams increasingly require AI Act-equivalent controls regardless of geography. UK government is also signalling alignment via the AI Safety Institute and an expected UK AI Bill. Treat it as the operating baseline rather than the exception.

The AI Act governs the system; UK GDPR governs the personal data inside it. They overlap heavily when an AI uses personal data to make or inform decisions. The ICO has specific guidance on automated decision-making (Article 22), explainability (Articles 13–15 / 22), and legitimate interests for AI training. The check flags where those kick in alongside the AI Act tier.

Look at the “why this tier” reasons. If one of them is wrong (for example, the tool misread your inputs and thinks you’re making decisions when a human always reviews), re-run with clearer answers. If it’s genuinely high risk, that’s usable information: you’ll need conformity assessment, a proper risk management system, technical documentation, and human oversight. Either solve those, or reshape the use case so it falls into limited risk.

No. This is a practical first read based on the Act's classification logic plus common-sense UK SMB context. It’s enough to know whether you need a real legal review, and enough to walk into that review already knowing the right questions. If the tier comes back high or unacceptable, get qualified counsel.

At minimum: a one-page AI use register (what systems, for what purpose, with what data), a human-in-the-loop policy for anything affecting customers or staff, data processing terms with your AI vendors, and a lightweight testing approach so you notice quality regressions. That covers the bottom of the pyramid for most SMB use cases.

Because most of our law firm, healthcare, and recruitment clients ask the same question when we scope an automation: “is this going to get us in trouble?”. Answering it early shapes the design and saves weeks of rework. Building it as a free tool means we get the same question answered at the start of every prospect conversation, so we're talking about the same thing.