Capitalising on AI in Europe and the UK

• Adoption has roughly doubled, depth has not. Eurostat puts AI use at 19.95% of EU enterprises with 10 or more employees in 2025, up 6.47 percentage points in a year. The ONS puts the UK at about 35% in June 2026, up from about 12% in late 2023. In the UK, only 10% of adopting firms report extensive use.
• Size and sector decide who is ahead. In the EU, 55% of large enterprises use AI against 17% of small ones. Information and communication sits near 60% in both regions. Construction sits near 10% to 13%.
• Skills come first on the barrier list. 71% of EU enterprises that considered AI and did not adopt it cite missing expertise. In the UK, 67% of adopters cite limited skills.
• The EU rulebook moved, it did not go away. Regulation (EU) 2026/1744, in force since 27 July 2026, pushed the high-risk obligations to 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I systems). Transparency, data protection and cyber rules apply now.
• The UK relies on existing regulators. The government's January 2026 review of its AI Opportunities Action Plan reports 38 of 50 actions met and describes sector regulators and sandboxes. It does not mention an AI bill.
• A company operating in both markets needs one controls baseline, built to the stricter EU documentation duties and reused for UK regulators. Section 4 lists the five traits that decide whether that works, and section 6 gives the plan.

Both regions have seen a steep rise in the share of companies using AI. The two official series count different things, so read them side by side and do not subtract one from the other. Eurostat asks about specific AI technologies in enterprises with 10 or more employees. The ONS asks, in a voluntary fortnightly survey, whether a business uses AI at all.

The government's own 2026 adoption survey, run by telephone from January to April 2026 with 3,503 businesses, gives a third figure: 32% of UK businesses using at least one AI technology, up from 16% in 2025, and 52% among larger firms. Three surveys with three methods agree on direction and disagree on level. Quote the one whose definition matches your question.

The spread inside the EU is wide. Denmark leads at 42.03%, followed by Finland (37.82%) and Sweden (35.04%). Romania (5.21%), Poland (8.36%) and Bulgaria (8.55%) sit at the bottom. A company selling across the bloc meets customers and suppliers at very different levels of readiness.

Adoption is wide and thin. The ONS reports that the average adopting UK business uses about 1.6 AI technologies, up from about 1.4 in 2023, and that 10% of adopters with 10 or more employees describe their use as extensive. Eurostat's list of purposes points the same way: among EU companies that use AI, 34.70% apply it to marketing or sales and 31.05% to business administration, while only 6.08% use it in logistics. Most firms have found one place where a language model saves an hour. Few have rebuilt a process around it.

In the UK survey, administration (81%), marketing (71%) and IT functions (66%) lead the list of uses, and 77% of those using or planning AI mention approaches built on large language models. 71% give efficiency and productivity as the main reason. In the EU, Eurostat's most common application is the analysis of written language, at 11.8% of all enterprises.

Security shows the sharpest gap between small and large firms. Among EU companies that use AI, 47.51% of large ones apply it to ICT security against 14.51% of small ones. Small companies are buying the assistant first and the control second, and that ordering is where the risk sits (section 5).

Regulated sectors move more carefully. The UK survey finds more caution in finance, legal services, transport and healthcare, because of data sensitivity and compliance exposure. Those sectors are also where the first high-risk obligations under the EU AI Act will bite, which is a reason to start the documentation work now even though the deadline moved.

The EU writes the rules down. The AI Act sorts systems by risk and attaches duties to each tier. Prohibited practices and the AI literacy duty have applied since 2 February 2025, and obligations for providers of general-purpose AI models since 2 August 2025. The part that most business users care about, the high-risk regime, has been postponed. Regulation (EU) 2026/1744 of 8 July 2026, known as the Digital Omnibus on AI, entered into force on 27 July 2026 and moved the dates as follows.

A delay changes the project plan and leaves the obligation in place. The documentation a high-risk system needs (data governance, logging, human oversight, accuracy testing) takes months to produce for a system that already exists, and is cheap to produce while it is being built.

The UK works through existing regulators. The government's one-year review of the AI Opportunities Action Plan (29 January 2026) reports 38 of the plan's 50 actions as met. It lists five AI Growth Zones, credited with £28.2 billion of investment and more than 15,000 jobs, a Sovereign AI Unit backed by up to £500 million, £2 billion committed to expand UK compute twentyfold by 2030, and a target to upskill 10 million workers by 2030. On regulation it describes sector regulators and sandboxes (the FCA's Supercharged Sandbox, the MHRA's Airlock, the AI Growth Lab) and says regulators will publish plans for enabling safe AI-powered innovation. It does not mention a general AI statute, and the King's Speech of 13 May 2026 left out a standalone AI bill.

That does not leave UK companies unregulated. UK GDPR and the Data (Use and Access) Act 2025, which includes a section on automated decision-making, apply to personal data in AI systems. The FCA, the ICO and the sector regulators each expect firms to be able to explain and evidence what their systems do.

What this means for a company in both markets. The EU asks for the paper trail up front, and the UK asks for it when a regulator calls. Building to the EU standard once costs less than keeping two sets of controls.

AI systems add four places to attack: the training data (poisoned or leaked), the model (backdoored or stolen through its API), the algorithm (fooled by crafted inputs) and the platform underneath (unpatched software). Language-model systems add prompt injection and over-trusted tool access. The UK's National Cyber Security Centre published guidelines for secure AI system development in November 2023, written with the US CISA and endorsed by agencies from 18 countries. They cover four stages: secure design, development, deployment, and operation and maintenance.

European law adds specific duties on top of the engineering practice. Which ones apply depends on who you are.

Governance matters most where explanation matters most. A credit decision, a hiring screen or a clinical triage tool has to be explainable to the person affected, and a model nobody can interrogate fails that test regardless of its accuracy. Bias enters through training data selection and through who builds and reviews the system, so the controls that help are data governance across the lifecycle and a review team that does not share one background.

Months 1 to 3: find out where you are

• Run the five-trait test above and score each trait red, amber or green with a named owner.
• Inventory every AI system in use, including the assistants staff bought themselves. For each, record the data it sees, the supplier, the country it runs in and who approved it.
• Classify each system against the AI Act tiers. Most will be minimal risk. Mark any that touch hiring, credit, education, insurance or essential services, because those are the Annex III candidates.
• Check that staff who use AI have had training, since the literacy duty already applies.

Months 4 to 6: prove one thing with a number

• Pick one process with a measured cost and run a fixed-scope pilot with a written success threshold and a no-go condition. Our ten questions to ask before you fund an AI pilot is the checklist we use.
• Build the evaluation set first. Known inputs with expected outputs, scored before and after every change, are the evidence a regulator, a customer and your own board will ask for.
• Choose the deployment target deliberately. If the data must stay in a region, price a private cloud or open-weight model against a per-token API at your expected volume.

Months 7 to 12: build the platform and the controls

• Move the pilot to production with monitoring, logging and a rollback path, and keep the logs. They serve operations now and AI Act record-keeping later.
• Write the governance routine: who approves a new system, how often models are re-evaluated, who handles an incident, and what is reported to the board.
• For any high-risk candidate, start the technical documentation now. December 2027 is further away than it was, and the work does not shrink with the calendar.
• Plan the second and third use cases from the same platform, so the second costs less than the first.

We are a consultancy based in London that builds and advises on AI for companies in the UK and the EU. The work follows the plan above.

• Advice and readiness. Strategic AI and data advisory and a fractional head of AI for companies that need senior ownership before they can hire it.
• Building. Generative AI and intelligent agents, advanced machine learning and fraud detection, with the evaluation set and the success threshold agreed before the build starts.
• Running it. MLOps and production AI and data engineering, so the system keeps working after the project team leaves.
• Securing it. AI security audits and secure deployment, including hosting inside your own cloud account or on your own hardware.
• Skills. Team augmentation and training, which address the barrier both surveys put first.

The first call is free. We go through the five traits with you and leave you with a view on where to start, whether or not you hire us.

Figures are quoted as published and were read between October and November 2026. We did not run a survey of our own. Where two sources measure differently, the table in section 1 says so.

• Eurostat, Use of artificial intelligence in enterprises (2025 data, extracted December 2025): adoption by size, sector and country, purposes of use, barriers.
• Office for National Statistics, Artificial intelligence in UK businesses: 2023 to 2026 (20 July 2026). Business Insights and Conditions Survey wave 159, 5 to 28 June 2026, 26.7% response rate, finance and insurance and public administration excluded.
• Department for Science, Innovation and Technology, AI adoption survey 2026: executive summary. Fieldwork 7 January to 21 April 2026, 3,503 interviews.
• IAPP, King's Speech signals diffuse UK digital policy agenda, but no AI bill (14 May 2026).
• European Commission, AI Act regulatory framework: application timeline, including 2 August 2025 for general-purpose AI models.
• UK Government, AI Opportunities Action Plan: One Year On (January 2026).
• Future of Life Institute, Digital Omnibus on AI explorer: text of Regulation (EU) 2026/1744 as amended into the AI Act. Check the Official Journal text before relying on a date in a legal decision.
• Legislation.gov.uk, Data (Use and Access) Act 2025, section 80.
• European Data Protection Board, Opinion 28/2024 on data protection aspects of AI models, adopted 18 December 2024.
• NCSC, Guidelines for secure AI system development.
• McCann FitzGerald, DORA applies from 17 January 2025. European Commission, NIS2 Directive (transposition deadline 17 October 2024).
• IDC, Capitalizing on Artificial Intelligence Opportunities, white paper #META49280922 (June 2022, Melih Murat, sponsored by SBM and IBM). It covers Saudi Arabia. We took its five-trait readiness frame and its security and governance themes as the starting outline, and wrote the evidence, the regulation and the recommendations from European and UK sources.

This paper describes the law and official statistics as we read them. It is not legal advice.