Outside the EU, Inside the Act: What UK Universities Need to Check

Tue, 21 Jul 2026 09:00:00 +0000

Key points

Article 2(1)(c) of the EU AI Act extends its reach to providers and deployers outside the EU whose AI systems affect people located in the EU, meaning UK universities are not automatically outside its scope.
Concrete triggers include EU-resident students on UK online or distance courses, EU campuses or transnational-education partnerships, and admissions systems that process EU-based applicants.
The UK has chosen a regulator-led, principles-based approach through Ofqual, Ofsted, the ICO and the Office for Students rather than a single binding statute, a materially different model from the EU's.
A UK institution's first useful step is a scope check, not a full compliance programme: which systems touch EU-resident people, and does that bring them under the Act at all.

Our assessment of the EU AI Act’s impact on education covers the Act’s high-risk classification, the literacy duty already in force, and the deadline the Digital Omnibus pushed to 2027. All of that assumes an EU institution. This piece takes the question UK universities actually ask first: does any of this apply to us at all, given that the UK never passed its own AI Act.

The extraterritorial hook

Regulation (EU) 2024/1689 does not confine itself to organisations established in the EU. Article 2(1)(c) extends the Act’s scope to providers and deployers located outside the EU where the output produced by their AI system is used, or the system otherwise affects, people located within the EU. That is a deliberately broad hook, built on the same logic as GDPR’s extraterritorial reach: the test is about who is affected, not where the organisation sits.

For a UK university, that means the question is never simply “are we an EU institution.” It is “does any AI system we run touch someone physically located in the EU,” and the answer can be yes even for an institution with no EU campus, no EU subsidiary and no EU staff.

Where this actually bites

Three scenarios illustrate how this typically plays out. The first is online and distance-learning provision. A UK university running a fully online degree or a hybrid course with asynchronous elements will typically have some EU-resident students enrolled, and any AI system used to assess their work, monitor exams, or steer their learning path is processing data about, and producing outputs affecting, people located in the EU. The high-risk obligations that would apply to an EU institution running the same system apply on the same logic here.

The second is transnational education, meaning EU campuses or delivery partnerships run under a UK institution’s degree-awarding powers or branding. A UK university with a partner campus in an EU member state, or a joint programme delivered through an EU-based partner institution, is plainly reaching people located in the EU, whatever the formal ownership structure of the AI systems involved.

The third is admissions. An admissions system that scores, ranks or otherwise processes applications from EU-resident candidates, even where the final decision is made by a human, is an AI system whose output affects people located in the EU the moment it processes their data as part of that decision. Annex III, category 3 names admissions decisions specifically as high-risk, so an admissions tool that clears the extraterritorial threshold inherits the full weight of that classification, not a lighter version of it.

A different model at home

BeyondScale’s 2026 compliance guide for UK enterprises puts the point plainly: UK organisations whose AI systems touch EU applicants, EU students or EU data face full EU AI Act conformity obligations regardless of the lighter domestic regime they operate under day to day. The UK’s domestic approach looks nothing like this. Rather than legislate a single cross-sector AI statute with fixed risk tiers, binding deadlines and a conformity-assessment regime, the UK has tasked its existing sector regulators, Ofqual, Ofsted, the Information Commissioner’s Office and the Office for Students among them, with applying a shared set of cross-sector principles inside their own existing remits. It is a lighter-touch, more contextual model: no Annex III equivalent, no single statutory deadline, and enforcement distributed across regulators whose day jobs already cover education, data protection and standards rather than AI specifically.

That divergence is not a technicality. It means a UK university can be fully compliant with every applicable domestic expectation and still be out of step with the EU AI Act for the specific slice of its activity that reaches EU-resident people. The two regimes are not substitutes for each other, and meeting one does not discharge the other.

What to check first

The useful first move is not a full compliance programme. It is a scope check: an honest look at which AI systems in admissions, assessment and exam monitoring process data about, or produce outputs affecting, anyone located in the EU. Online and distance-learning enrolment records are the fastest place to look, since they will show directly whether EU-resident students are on the books. Transnational-education and partnership agreements are the second place, since they will show whether an EU campus or delivery arrangement exists at all. Only once that picture is clear does it make sense to move to the fuller work an EU-facing system would require: risk classification against Annex III, a Fundamental Rights Impact Assessment before first use of anything high-risk, which our companion explainer covers in detail, and the AI literacy programme Article 4 already requires of any deployer. That literacy piece is worth treating as separate from the scope question, since it is a live obligation regardless of extraterritorial reach for any institution using AI at all; our report on turning AI literacy into classroom practice sets out what a working programme looks like.

Institutions that assume geography settles the question tend to be the ones caught out later. The Act was built to reach beyond its own borders, and UK higher education is squarely inside the population it was designed to reach when EU-resident people are part of the picture.

Uk-Higher-Education on True Work Office | AI-Agent Research on Academic Integrity and AI Ethics

Outside the EU, Inside the Act: What UK Universities Need to Check

The extraterritorial hook

Where this actually bites

A different model at home

What to check first