EU AI Act
Most of it does not apply to your firm.
Plenty of vendors will sell you the EU AI Act as an emergency. For a private-practice law firm it mostly is not one. Here is where it genuinely reaches you, where it does not, and the one duty that already applies and that most firms cannot currently evidence.
Scope
Three answers, in the order that matters.
Work out which of these is true of your firm before spending a budget line on the rest.
Probably not high-risk
Your research, drafting and review AI
Annex III paragraph 8 catches AI intended to be used by a judicial authority, or on its behalf, to research and interpret facts and law and apply the law to a concrete set of facts. The classification turns on use by or for a judicial authority. Ordinary private-practice research and drafting sits outside it.
In scope regardless
Article 2, if your output is used in the EU
The Act reaches providers and deployers wherever they are established, if the output is used in the Union. A UK firm advising a client with EU operations does not escape it by being outside the EU.
Applies now
Article 4, AI literacy
Deployers must take measures to ensure a sufficient level of AI literacy among staff using AI on their behalf. It has applied since 2 February 2025, it was not deferred, and it is the obligation most likely to be relevant to your firm today.
If your firm is deploying AI into a court or tribunal process rather than into its own advisory work, take specific advice. That is a genuinely different question, and not one a marketing page should answer for you.
The dates, as they now stand
One of these moved. Several vendors have not updated their pages.
12 July 2024
The Act is published in the Official Journal as Regulation (EU) 2024/1689.
2 February 2025
Prohibited practices take effect, and the Article 4 AI literacy duty begins to apply to deployers.
2 August 2025
Obligations for general-purpose AI models take effect.
2 August 2026
Article 50 transparency obligations apply, with a grace period under Article 50(2) to 2 December 2026 for systems already on the market.
2 December 2027
High-risk obligations under Annex III apply to standalone systems, moved from 2 August 2026 by the AI Omnibus, which entered into force on 27 July 2026. Where the AI is embedded in a product, the date is 2 August 2028.
What we ship for it
A supported framework, handled quietly.
The Act is a checkbox for most firms in our range, so we treat it as one. It rides on the governance you are putting in place for your own regulator anyway.
Article 4 literacy, tracked
Who was trained, on what, and when, recorded alongside the attestation that they read the firm's AI policy. Evidence rather than an assertion.
Articles 13 and 14 in the policy pack
Transparency and human-oversight policies templated in, running as code on every governed task rather than sitting in a document.
Article 12 record-keeping
Automatic, tamper-evident logging of the events that matter, exportable as a human-oversight attestation for the firms that need one.
The record underneath all three is the same one your COLP uses. Inside the evidence chain.
If you want a reason to move this year, it is not this.
For a UK firm, the SRA and your professional indemnity renewal are nearer, sharper and far more likely to produce a difficult conversation before December 2027. Start there, and the AI Act becomes a box you can already tick.
The EU AI Act, answered.
Scope, dates and what genuinely applies to a private-practice firm.
Still have questions? Talk to the founderFrom the blog
Understand the EU AI Act in depth
The risk tiers, the dates as they now stand, and which of them actually reach a law firm.
Start with the regulator that is actually watching.
The readiness check covers the EU AI Act alongside eleven other governance domains, and tells you which of them apply to your firm rather than to firms in general.