Following conclusion of a process that commenced in Spring 2025, the UK Department for Business, Innovation, Science and Trade published guidance on 4 November 2026 which provides that parts of the EU AI Act will apply in Northern Ireland under the Windsor Framework (being the post-Brexit mechanism that governs Northern Ireland’s place within the EU common market for goods).

 

However – although this will have significant impact on some businesses – the most important takeaway is that the legislation will not apply to all businesses in Northern Ireland and, even where it does apply, the extent of requirements will be less than as it would apply in the context of EU market.

 

The version of the Act that does apply for purposes of NI is a narrower, product-focused version, built around the question: is the AI system closely integrated with a physical product placed on the NI market?

 

When the EU AI Act will not apply

 

If your business uses AI tools to manage work, analyse data or run back-office functions without close connection to a tangible product, the guidance confirms the EU AI Act does not affect you simply because you use those tools. Of particular comfort to businesses – it has been made clear that standalone or downloadable AI software (including AI accessed through a browser, app or API) is out of scope unless it is closely integrated with a physical product.

 

It is worth noting in passing that the specific and direct obligations on general-purpose AI model providers do not apply in NI at all – although in practice, the providers of these models are a small group of mainly international developers (so this point may not be of direct relevance to most). However, NI businesses may still need to check that they can obtain information from those providers when building their models into products.

 

The guidance gives some further useful examples of when the AI Act will not apply, including:

• a company using AI software to screen job applications is out of scope;
• a school using an online AI tool to assess students is out of scope;
• a generative AI chatbot downloaded or used online in NI doesn’t need to comply, and NI market surveillance authorities won’t monitor it.

 

When the EU AI Act will apply

 

The first test is whether an AI system is closely integrated with a physical product. Generally speaking, this will be the case if either:

• Condition A: the AI is embedded or pre-installed in the product when it is placed on the market; or
• Condition B: the AI is downloaded separately, but the product is specifically designed to rely on that system to deliver its intended functionality.

 

A smart speaker with a built-in voice assistant would meet Condition A (and therefore be subject to the EU AI Act). A smartwatch that needs the manufacturer’s AI health app to deliver its advertised health features meets Condition B.

 

On the other hand – a chatbot downloaded by a customer onto a laptop after buying it (rather than the laptop’s manufacturer pre-installing that same chatbot onto the product) does not obviously meet either condition and therefore is unlikely to be caught by the legislation.

 

We envisage that there will need to be engrained understanding of these rules within Product teams (as packaging and go-to-market decisions are now compliance decisions) and Marketing teams (as “Intended functionality” is assessed by reference to how the product is designed, marketed and documented; so a product’s marketing material can decide whether the Act applies).

 

What will be required

 

What – if any – obligations apply will depend on further analysis of the role of the business in the supply chain.

 

Providers

Most obligations fall on the “provider” (broadly speaking, being the business that develops an AI system, or has it developed, and places it on the market under its own name, which – for AI integrated into regulated products as a high-risk safety component – will often be the product manufacturer). A distributor, importer, deployer or other third party will be treated as the provider if it puts its name or trademark on, or substantially modifies, a high-risk AI system already on the market, or changes the intended purpose of an AI system so that it becomes high-risk.

 

Importers and Distributors

Importers and distributors have obligations only in respect of high-risk AI systems.

A manufacturer integrating a third-party AI system that is not high-risk will generally be treated as a distributor, with no direct obligations under the Act (due to the risk categorisation), although it should confirm the software provider has in turn complied with its legislative obligations.

 

Deployers

Deployers’ obligations in NI are limited to monitoring high-risk systems and reporting risks and serious incidents.

 

Requirements

Depending on that allocation, the extent of the obligations that apply requires further consideration of the risk level associated with the AI system. The heaviest obligations arise where the system is prohibited or high-risk, but providers also face transparency and AI literacy duties regardless of risk level. This will have to be reviewed on a case-by-case basis.

Once those tests have been applied, businesses may therefore have to comply with some or all of the following requirements:

• Ensure no prohibited AI practices are involved in physical products placed on the NI market (in NI, the bans apply to placing on the market only, not to use);
• Comply with the obligations applicable to their role in relation to high-risk AI systems integrated into physical products placed on the NI market (for providers, these include risk management, data governance, technical documentation, human oversight, conformity assessment and CE marking);
• Providers: disclose interaction with an AI system where not obvious;
• Providers: mark AI-generated content, where the product generates new synthetic content; and
• Providers: take proportionate measures to support AI literacy among staff and others operating the AI system on their behalf.

 

Timelines

Like the implementation of EU AI Act in the EU, the timeline for application in Northern Ireland is staggered (but with a short lead-time between announcement of the application and the first implementation date):

• 10 November 2026: prohibited practices, AI literacy and disclosure of AI interaction;
• 2 December 2026: marking of AI-generated content, plus the bans on generating non-consensual intimate imagery and child sexual abuse material;
• 2 December 2027: high-risk AI in Annex III use cases (such as biometrics, critical infrastructure and worker management), where closely integrated into products;
• 2 August 2028: high-risk AI used as safety components in regulated products such as toys, lifts, gas appliances and medical devices.

 

Moving Forward

For most NI businesses, the implementation of the EU AI Act changes little about how they will use AI day to day (either because they should already be aware of how it applies to them and their interaction with the EU market, or because it will not apply). Otherwise, for businesses that make, import or sell AI-enabled physical products, it could bring significant changes, with the first obligations starting next week.

 

For legal guidance and advice on what legislation may apply to your business and your use of AI, please contact Paul Eastwood or another member of our Contracts & Technology team.

While great care has been taken in the preparation of the content of this article, it does not purport to be a comprehensive statement of the relevant law and full professional advice should be taken before any action is taken in reliance on any item covered.