Selling into Europe
This page is for organisations that sell to European customers but are not based in Europe, including businesses in the United States, Kenya, Nigeria and South Africa. It covers the European Union first, then the UK, which has taken a different path.
The EU AI Act can apply to you even if you have no office, no staff and no company registration in Europe. It follows the market, not the company address. If you place an AI system on the EU market, or the output of your AI system is used there, parts of the Act apply to you.
Below is what applies now, what has been put back, what your customers are likely to ask you for in the meantime, and how the position differs if you sell into the UK.
The EU AI Act: what applies now, and what has been put back
Already in force
Specific banned uses of AI, and a duty to make sure staff using AI know what they are doing. In force since February 2025.
Rules for general purpose AI models. In force since August 2025.
Transparency duties. In force since 2 August 2026. People have to be told when they are dealing with an AI system, and AI generated content has to be identifiable.
Put back to a later date
High risk uses, such as recruitment, credit scoring, education and the management of workers. Moved from August 2026 to the 2nd of December 2027.
AI built into products that are already regulated, such as medical devices and machinery. Moved to August 2028.
The deadline moved. The requirement did not.
Does it apply to a business outside the EU?
The test is not where your company is registered. It is where your AI system, or what it produces, is used.
In scope. A software company in Nairobi builds a tool that screens job applicants, and a German employer uses it to shortlist candidates.
In scope. A firm in Lagos scores loan applications for a lender in the Netherlands.
Not in scope. A company in Johannesburg uses AI in its own back office, sells only to South African customers, and nothing it produces is used in Europe.
What about selling into the UK?
The UK is not in the EU and has no equivalent AI Act. It regulates AI through laws and regulators it already had, so there is no single deadline to work towards.
What does apply is UK data protection law. Since 5 February 2026, where a decision about someone is made by a machine alone, that person has to be given meaningful information about how the decision works, a right to have a human look at it, and a right to challenge it. The Information Commissioner’s Office is also writing a code of practice on AI, which is expected to become binding in 2027.
In practice, British buyers do what European ones do. They ask their suppliers directly, and some want ISO 27001 or Cyber Essentials as evidence.
What you already have to build on
If you have done work on data protection, you are not starting from nothing. Kenya’s Data Protection Act 2019, Nigeria’s Data Protection Act 2023 and South Africa’s POPIA all ask you to know what personal data you hold, why you hold it, who it is shared with and how it is protected. That work carries straight across.
What those laws do not cover is the AI itself. How the system was chosen and tested. Who oversees the decisions it influences. How accuracy and bias are checked over time. What records exist about the system rather than the data. Whether people are told they are dealing with AI at all.
That gap is what we help you close.
How we work with clients outside Europe
- All work is done remotely, over video and email. There are no travel costs.
- Our working day overlaps with yours. We are never more than two hours apart from Lagos, Johannesburg or Nairobi, and we keep afternoon and early evening slots for clients in the United States.
- We can invoice in euros, pounds or US dollars. Invoices to clients outside the EU carry no Spanish VAT.
- You can pay by card, Wise or international bank transfer.
- Kenyan clients: we allow for the 20 per cent withholding tax when quoting, so the fee you agree is the fee we receive.
- Our contracts are governed by Spanish law. Terms of business and a mutual confidentiality agreement are sent before we start.
- Professional indemnity insurance in place. Work is led by Antony Kendall, ISO 27001 Lead Auditor and Lead Implementer.
Where we are, and why it matters
SCUK Consulting is an independent consultancy run by Antony Kendall, a British practitioner based in Spain, inside the European Union. Antony leads the governance, risk and assurance work himself, and engages trusted legal and technical experts when they are needed.
Being based in Europe matters for two reasons. We work under the EU AI Act and European data protection law ourselves, in the same market your customers are in. And we know the UK side, because British businesses have had to meet EU requirements from outside the EU since the end of 2020, which is close to the position you are in now.
Most advisers cover one side or the other. We cover both.
Because we are established in Spain, European data protection law applies to us as well as to you. Anything you share with us is handled under it.
Your customers will ask before the law does
The move to December 2027 has given a lot of businesses a sense of relief. We would be careful with it. European companies are building AI checks into their own supplier processes now, because they have to be able to show where their AI comes from and how it is controlled.
In practice, that reaches you as a questionnaire, a clause in a contract, or a section in a tender. It asks who is accountable for AI in your business, which tools you use, what data goes into them, and what oversight there is of the decisions they influence. Most suppliers cannot answer it, and the work either slows down or goes to someone who can.
A legal deadline moved. What your customers expect did not.
We offer a free AI governance assessment. It is a structured questionnaire about how AI is actually used in your business, followed by a snapshot report. You get a red, amber or green score across six domains, anything that looks like a gap gets flagged, and the three things we recommend you deal with first. There is no charge and no obligation.
If you want to go further, we offer the full comprehensive report, more in-depth assessments including a culture and visibility staff survey, help writing policies and setting up oversight, support putting the changes in place, and ISO 27001 work where a customer is asking for a recognised certificate. Paid work is quoted at a fixed price before it starts. See our AI governance services.
Common questions
Does the EU AI Act apply if we have only one European customer?
Possibly. There is no minimum number. What matters is whether your AI system, or its output, is used in the EU. How much you need to do then depends on what the system is used for.
We sell to the UK, not the EU. Does any of this apply to us?
The AI Act does not, unless something you supply also reaches the EU. UK data protection law does, particularly where decisions about people are made automatically. And UK buyers ask suppliers much the same questions European ones do, so the practical work is similar.
We do not build AI. We only use tools like ChatGPT and Copilot. Are we in scope?
You can be, although the duties on an organisation using a system are lighter than those on the organisation that built it. Either way, your customers will ask about your use of these tools whether or not the law reaches you.
What happens if we do nothing until 2027?
The EU transparency duties are already in force, so doing nothing is not without risk. You will also still have to answer customer questions in the meantime, and those tend to arrive with a deadline attached.
A customer has sent us an AI questionnaire. Can you help us answer it?
Yes. Send it to us and we will tell you what it is actually asking for and what a good answer looks like. That is often the quickest place to start.
Do we need ISO 42001, ISO 27001 or Cyber Essentials?
None of them is required by law. ISO 27001 is the one buyers ask for most often, in Europe and the UK, because it covers information security and is widely recognised. Cyber Essentials is a smaller UK scheme that some British buyers ask for. ISO 42001 covers the management of AI specifically. It is newer, so fewer buyers ask for it yet. See our AI governance services for how we help with certification work.
What does it cost?
The first assessment is free. Paid work is quoted at a fixed price before it starts, so you know the cost in advance. See our AI governance services for what the paid work covers.
Ready to find out where you stand?
Last reviewed 31 August 2026. Written by Antony Kendall, SCUK Consulting.