AI Governance Across the EU, UK and UAE: What Actually Changed in 2026

Abstract editorial illustration created for this article. It is not a depiction of PJN Group, a client, an office or an operational system.

For boards and business leaders operating across Europe, the United Kingdom and the United Arab Emirates, 2026 has not produced one common model of AI regulation. It has made the differences between jurisdictions more important.

The most significant governance mistake is assuming that a classification, threshold or compliance term used in one market automatically transfers to another. It does not.

The EU has a horizontal, risk-based regulation with defined categories and dates. The UK continues to rely on principles, existing regulators and data protection law. The UAE is developing a national policy and institutional framework that combines an official AI charter, a newly consolidated authority, data governance and national standards.

The position below was checked in early October 2026. It is general educational information, not legal, regulatory, tax or investment advice, and is not a substitute for jurisdiction-specific advice on particular facts.

The short answer: 2026 changed the timetable, not the need to prepare

The most prominent European headlines concern the postponement of certain high-risk AI obligations to 2027 and 2028. That is accurate, but incomplete.

In the EU:

The delay is therefore better understood as a preparation window than as an exemption.

EU: a revised timetable within a binding horizontal regime

The EU AI Act is Regulation (EU) 2024/1689, in force since 1 August 2024. The 2026 change came through the Digital Omnibus on AI, Regulation (EU) 2026/1744.

It was adopted on 8 July 2026, published in the Official Journal on 24 July and entered into force on 27 July 2026. The stated reason for extending the high-risk timetable was practical: harmonised standards and national governance and conformity-assessment frameworks had taken longer than expected to develop, creating a heavier compliance burden.

That change does not remove the need to understand classification.

High-risk classification remains jurisdiction-specific

The EU high-risk regime operates through two routes:

  1. Annex I and Article 6(1): AI systems that are safety components of, or products covered by, EU harmonisation legislation.
  2. Annex III and Article 6(2): listed use cases including biometrics, critical infrastructure, education, employment, access to essential services such as creditworthiness assessment, law enforcement, migration and justice.

The relevant question is not simply whether a supplier describes a tool as “high-risk”. A business must assess the system against the EU framework, its intended purpose, how it is integrated and how it is used.

The EU regime also has extraterritorial reach. It can apply to organisations inside or outside the EU that place an AI system or general-purpose AI model on the EU market, or put a system into service or use it in the EU. This is particularly relevant to businesses serving EU-facing operations, including activity connected with Croatia and the wider European market.

Provider and deployer are not the same role

A provider develops an AI system or has it developed and places it on the market or puts it into service under its name or trademark. A deployer uses an AI system under its authority, other than where it is being used in a personal non-professional activity.

For boards, the deployer role is often the more immediate operational issue. Deployers must use systems in accordance with instructions, monitor operation, assign human oversight and ensure that input data is relevant and sufficiently representative where they control that data. Certain deployers must also carry out a fundamental rights impact assessment.

A company buying an external platform cannot assume that responsibility ends with the supplier contract. Third-party model and platform dependency remains a governance issue requiring named accountability.

What is already relevant in 2026?

Article 50 transparency obligations apply from 2 August 2026. Organisations using systems that generate synthetic audio, image, video or text should therefore consider how marking, detectability and related information requirements affect their workflows.

The Omnibus also changed the AI literacy provision. Providers and deployers must take measures to support the development of AI literacy among staff and others dealing with AI systems on their behalf. It does not require an organisation to guarantee a specific level of AI literacy for every individual.

The legislation also provides for:

The AI Act’s penalty ceilings remain material. They can reach up to EUR 35 million or 7% of total worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for other requirements, and up to EUR 7.5 million or 1% for supplying incorrect, incomplete or misleading information. The applicable fine for SMEs is the lower of the two amounts, with a parallel lower-of-two rule introduced for certain fines involving small mid-cap enterprises.

UK: governance through principles, regulators and data protection

The UK has not enacted a single AI Act. Its approach is principles-based and sector-led, using existing regulators and an initially non-statutory framework built around five cross-sector principles:

For UK businesses, the practical driver is often not an AI-specific statute. It is the interaction between data protection, employment, financial-services and other sector rules.

Several 2026 developments make that clearer.

On 28 January, the Department for Science, Innovation and Technology and the Department for Business and Trade wrote jointly to 19 regulators. They asked regulators to publish plans explaining how they would enable safe AI-powered innovation within their remits and to report annually on progress. The plans were expected by May 2026.

The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025 and is being implemented in stages, includes changes to automated decision-making through new Article 22C of the UK GDPR and section 50C of the Data Protection Act 2018. These provisions concern significant decisions based solely on automated processing and associated safeguards, including information, representations, human intervention and the ability to contest decisions.

The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 were made on 1 April and came into force on 12 May. They require the Information Commissioner to prepare a code of practice on processing personal data for AI development and automated decision-making, supported by a panel.

The ICO also published findings in March on automated decision-making in recruitment, following engagement with more than 30 employers. It opened a consultation on updated automated decision-making guidance in April, with the consultation closing on 29 May. The final position and related guidance remained subject to development at the time of writing.

In financial services, the FCA has said it does not plan new AI-specific rules. Its approach remains principles- and outcomes-based, relying on existing frameworks, including senior manager accountability under the Senior Managers and Certification Regime. The FCA also operates the AI Lab, AI Live Testing and the Supercharged Sandbox, and published the Mills Review in January 2026.

For boards, this means that a UK AI assessment should begin with the relevant sector, regulator, data use and decision-making impact, not with a search for a single UK AI classification.

UAE: institutional consolidation and national direction

The UAE is taking a different route again.

The UAE Charter for the Development and Use of Artificial Intelligence is an official national policy document supporting the UAE Strategy for Artificial Intelligence. Its priority areas include safety, algorithmic bias, data privacy, transparency, human oversight, governance and accountability, as well as compliance with applicable laws and treaties.

On 14 June 2026, the UAE approved the establishment of the Artificial Intelligence and Data Authority, or AIDA. It is a single national body for data, AI and digital government, reporting directly to the Cabinet and chaired by Omar Sultan Al Olama.

AIDA consolidates functions previously held by the Office of Artificial Intelligence, Digital Economy and Remote Work Applications, the Digital Government Sector at the Telecommunications and Digital Government Regulatory Authority, and the UAE Data Office. Its remit includes proposing national policies, legislation and strategies, and setting standards and guidelines for data and AI management.

The UAE Personal Data Protection Law remains Federal Decree-Law No. 45 of 2021, which came into effect on 2 January 2022. According to the Dubai Government Media Office announcement of 14 June 2026 establishing AIDA, the UAE Data Office’s functions now sit within AIDA.

The UAE has also published a National Cyber Security Policy for Artificial Intelligence covering governance, asset inventory, configuration and patch management, supply chain, model and data protection, operational safety and oversight, and AI-specific monitoring and incident response.

In May 2026, the UAE Cabinet approved a national framework to implement Agentic AI across 50% of federal services and operations within two years. The UAE’s Rules as Code platform, developed by the Ministry of Finance with other partners, also demonstrates the direction of travel: laws and regulations can be represented in machine-readable formats for use in digital services and AI-supported processes.

For companies operating in the UAE, the immediate governance question is not simply whether a system falls into a formal AI risk tier. It is how national policy, data protection, cyber security, sectoral requirements and emerging AIDA standards apply to the actual use case.

Original PJN diagram comparing the EU, UK and UAE AI governance positions as at 2 October 2026. Source information shown on the diagram.

Original PJN diagram comparing the EU, UK and UAE AI governance positions as at 2 October 2026. Source information shown on the diagram.

A practical board agenda for 2026

Boards overseeing cross-border operations should consider five actions:

  1. Map roles and locations. Identify where the organisation is a provider, deployer, customer, integrator or user, and where the system is actually used, not only where the supplier is registered.
  2. Classify separately. Do not import an EU classification into a UK or UAE assessment. Record the applicable jurisdiction, sector and legal basis for each conclusion.
  3. Name responsibility for dependencies. Third-party models, cloud platforms, data suppliers and system integrators should be included in governance and contracting decisions.
  4. Keep dated evidence. Retain records of what was assessed, by whom, using which information, and when the assessment should be revisited.
  5. Treat delay as preparation time. The 2027 and 2028 EU dates do not justify waiting. Standards, guidelines, delegated acts and national frameworks are still developing.

PJN Group is a family of connected companies with shared ownership and activity across the UK, UAE, Croatia/Europe and India. Where relevant, general advisory and due diligence work may be undertaken by the appropriate portfolio company; services and responsibilities should not be attributed to PJN Group as a whole unless expressly verified.

Limitations and date of review

This article was checked on 2 October 2026. Dates, rules, guidance and regulatory expectations are time-sensitive. The EU position remains subject to further delegated acts, guidelines and standards. UK plans and ICO guidance were partly still in consultation or development at the time of writing. UAE standards and guidance continue to develop following the establishment of AIDA.

No governance measure makes an organisation “compliant”, “secure” or protected from regulatory action, and no regulatory outcome is guaranteed.

Sources