Source: UK Department for Business, Innovation, Science and Trade, "Guidance on the EU AI Act in Northern Ireland", 4 November 2026, page 5, cropped by us on November 9, 2026.
Say a six-person firm in Belfast does two things. It sells a connected heating controller with an AI fault-detection mode built in, and it uses an AI assistant to draft its customer emails. That is our illustration, not a case. Under the UK's guidance, from November 10, 2026 the first activity carries EU AI Act duties in Northern Ireland. The second carries none.
That split is the whole story, and the headlines about the AI Act "coming to Northern Ireland" bury it. On November 4 the Department for Business, Innovation, Science and Trade (DBT) published an explanatory memorandum and guidance on adding a modified EU AI Act to the Windsor Framework. The memorandum said the UK intended to agree this at the UK-EU Withdrawal Agreement Joint Committee on 10 November 2026, and the Committee adopted it that day as Decision No 3/2026. I read the memorandum in full on November 9, and the guidance's scope, supply-chain, transparency, timeline and examples sections.
My take: this is a product-safety rule, not an AI-use rule
The guidance says it in one sentence: "standalone software, online AI tools and apps are generally out of scope of these requirements." The Act applies in Northern Ireland only "where an AI system is closely integrated with a tangible physical product that is placed on the NI market." The use of AI is not regulated at all, except that deployers of in-scope high-risk systems must report risks to the provider. The ban on certain uses of AI does not apply either: only the placing on the market of a banned system built into a product does.
My reading: that is narrower than the headline suggests, and sharper for the few who are caught. A software-only company has nothing to do. A hardware maker has a manufacturer's job: the guidance puts the "core compliance responsibilities" on the manufacturer, with importers and distributors behind it.
The test: two conditions, and "same maker" is not one of them
The guidance gives a two-question test. An AI system is closely integrated if either holds:
- Condition A: it is embedded or pre-installed in the product when the product is placed on the market.
- Condition B: it is downloaded separately, but the product is specifically designed to be used by that system only, to carry out the product's intended functionality (what the product is "designed, marketed and documented to provide").
Two details trip people. First, a same-manufacturer app is not automatically covered: if it "does not form part of the product's intended functionality, it is not considered closely integrated." The guidance's example is a smart speaker whose maker offers an optional AI recipe app. Out of scope. Second, a third-party app built for one watch and launched separately is out too, because the watch was not designed to depend on it.
The guidance also has a footnote that matters for small firms: if you put a system into service only for internal use, for example in a company or a school in Northern Ireland, and never place it on the market, the rules do not apply. They would start to apply if you later sell it.
Source: UK DBT, "Guidance on the EU AI Act in Northern Ireland", 4 November 2026, page 30 (Table 2), cropped by us on November 9, 2026.
| Product | Condition A | Condition B | In scope? |
|---|---|---|---|
| Smart speaker sold with a built-in AI assistant | Yes | n/a | Yes |
| Gas boiler with embedded AI that monitors for carbon monoxide leaks | Yes | n/a | Yes |
| AI medical imaging device that analyses scans | Yes | n/a | Yes |
| Smartwatch that needs the maker's own AI health app | No | Yes | Yes |
| AR glasses that need the maker's AI software package | No | Yes | Yes |
| Laptop where the user downloads a general-purpose AI assistant | No | No | No |
| Standalone AI recruitment tool used by an employer | No | No | No |
| Vehicle with a navigation app the driver chose | No | No | No |
All eight rows come from the guidance's own Tables 1 and 2. The recruitment-tool row is the one to note: a hiring tool that the Act would call high-risk in the EU is out of scope in Northern Ireland, because it is software.
What applies, and from when
Source: UK DBT, "Guidance on the EU AI Act in Northern Ireland", 4 November 2026, page 25, cropped by us on November 9, 2026.
| Date | What starts for providers of in-scope products |
|---|---|
| 10 Nov 2026 (UK guidance date; the Joint Committee decision is in force from 11 Nov) | Article 5 ban on placing prohibited AI on the market; Article 4 AI literacy; Article 50(1) telling users they are talking to an AI |
| 2 Dec 2026 | Article 50(2) machine-readable marking of synthetic audio, image, video or text; the Article 5 bans on non-consensual intimate imagery and child sexual abuse material |
| 2 Dec 2027 | High-risk duties for Annex III uses built into a physical product |
| 2 Aug 2028 | High-risk duties for safety components in Annex I regulated products (toys, lifts, medical devices) |
The December 2027 and August 2028 dates match the consolidated EU text, which now applies Chapter III from 2 December 2027 and 2 August 2028. I covered the EU's December 2026 marking and nudification dates and Article 50 in separate posts, and the Annex III list there is the same list that applies here, minus every software-only use.
Two examples show how far the line cuts. The memorandum says an AI toy that nudges a child to climb out of a window is in scope, because the prohibited function is inside the product. A chatbot that impersonates a friend to harvest financial data is out, because it is not. It also says a retailer's customer-service chatbot has no Article 50(1) duty here, while a phone with an embedded assistant does.
The memorandum puts one figure on the medical-device side. Of 3.8 million devices registered in Great Britain, about 130,000 (3.4%) need third-party conformity assessment under the EU medical-device rules that apply under the Windsor Framework. Over 95% of those, about 123,000, are already CE marked. The AI Act can only reach the AI-enabled subset where the AI performs a safety function.
What a small team does this week
- Run the two-question test on every product you ship in Northern Ireland. Software only? Stop. Write one line in your AI register saying why, and keep the guidance page with it.
- If you sell hardware, list each AI feature and mark it A, B or neither. Mark B features as a decision, not an accident: the guidance says "intended functionality" is read from your technical documentation and marketing materials, so how your data sheet describes an app can decide the question.
- Check your role. The guidance points to Article 25(1): a distributor, importer or other third party that puts its name on a high-risk system already on the market, substantially modifies it, or changes its purpose so it becomes high-risk becomes the provider.
- For November 10 (the guidance's date): disclosure and literacy. If a covered device talks to people, it must say it is an AI (Article 50(1)). Providers of covered products must also support AI literacy among staff and contractors who operate the system for them (Article 4), which the memorandum calls "very light-touch" in this form.
- Diary December 2. Any covered product that generates speech, images or text needs machine-readable marking by then. A connected toy that speaks with AI is the guidance's own example.
- Keep a log of firmware and app updates. The guidance says a manufacturer-controlled update can change whether the AI is closely integrated, and tells businesses to record major updates.
If you also sell into the EU itself, none of this narrows your duties there. The full Act applies to you in the EU market regardless. Northern Ireland only decides whether a Belfast shop shelf is treated like a Dublin one.
Who has said what on the record
I found no Northern Ireland small-business testimony I could read, so this is the record I could verify, with dates:
- DBT, 4 November 2026 (memorandum, paragraph 51): "stakeholder engagement suggests products currently on the market in Northern Ireland that meet this definition are likely to be rare," and "industry supplying Northern Ireland, and often Great Britain, is often EU-facing," so the impact is "expected to be generally minimal."
- DBT, 4 November 2026 (memorandum, paragraph 81): the government "held informal discussions with key UK industry stakeholders to gather views on the potential impact of the partial application" of the Act in Northern Ireland, and says "This did not constitute a formal consultation."
- DSIT, 30 January 2026 (memorandum on the Digital Omnibus on AI): about the EU's own simplification proposal, not the Northern Ireland rule, the government says it "has not conducted specific consultation with Northern Ireland businesses on this proposal" (see the memorandum).
- Ulster University, 28 May 2025: a chapter on how the Act applies in Northern Ireland under the Windsor Framework (pages 105 to 106 of AI for NI). Only the abstract was readable, so I do not cite its argument.
For me paragraph 81 carries the point: the stakeholder input behind a rule that starts on a fixed date was informal, and the memorandum does not say whom it covered or how many. The "likely to be rare" finding in paragraph 51 draws on it.
What we don't know
I read the guidance and memorandum as published on November 4, and on November 11 I read the Joint Committee's decision itself: Decision No 3/2026, adopted on 10 November 2026 and published by the Cabinet Office with the co-chairs' joint statement. It adds Regulation (EU) 2024/1689 to Annex 2 of the Windsor Framework "as regards conditions and technical specifications for the placing on the market of products", leaving out Articles 102, 108 and 110, and says it "shall enter into force on the day following the date of its adoption", which is 11 November. That is a day later than the 10 November the guidance gives for the requirements, and I could not reconcile the two: the decision text has no 10 November date and no "closely integrated" test, and the gov.uk guidance page still shows its 4 November first publication with no later change note. The scope and the dates in the table above therefore remain the UK guidance's description, not decision text. I searched gov.uk and found no Commission or Official Journal copy. The guidance says the Commission's own guidance on the high-risk and transparency rules is still the technical reference, and the Commission's transparency guidelines are still marked as drafts there. A separate UK consultation on AI in product safety for Great Britain, which none of this covers, closed on 23 June 2026 and was still being analysed in August. I have not seen how a market surveillance authority in Northern Ireland will test "closely integrated" for a borderline product. If your product sits on the line, ask the authority, not a blog.
Not legal advice.
