AI Compliance for Professional Services: What the EU AI Act, UK GDPR, and Shadow AI Mean for Your Business

If you run an accountancy practice, law firm, HR consultancy, or marketing agency, AI compliance is no longer a matter for your IT department alone. Regulatory frameworks are tightening across multiple jurisdictions simultaneously, enforcement agencies are already acting, and the penalties attached to non-compliance are substantial. Whether your business operates in London, Toronto, Dubai, or Singapore, the compliance landscape is shifting beneath your feet — and the window to prepare is narrowing.

This briefing sets out what you need to know, and what you need to do.

The EU AI Act: A Timetable You Cannot Afford to Ignore

The EU AI Act entered into force on 1 August 2024, and its obligations are rolling out in stages. Two dates have already passed. From 2 February 2025, rules on prohibited AI practices and AI literacy requirements became applicable. From 2 August 2025, governance requirements for General-Purpose AI (GPAI) systems — the large language models and foundation models that underpin many of the productivity tools professional services firms rely on daily — came into effect.

The next major deadline is 2 August 2026, when obligations for high-risk AI systems become enforceable. This category explicitly includes AI used in employment, recruitment, education, and legal contexts. If your firm uses AI to screen CVs, assess employee performance, assign tasks, or support legal or financial decision-making, you are likely operating within scope of high-risk AI classification.

The penalties are not symbolic. Violations of prohibited AI practices carry fines of up to €35 million or 7% of global annual turnover. Breaches of high-risk AI requirements attract penalties of up to €15 million or 3% of global turnover. For a mid-sized professional services firm, either figure could be existential.

Critically, the EU AI Act applies based on where AI systems are deployed and where their outputs are used — not merely where the developer is based. If your firm has clients, offices, or employees in the EU, or if you are offering services to EU-based organisations, the Act is relevant to you regardless of your headquarters location.

The UK Position: Principles-Based, But Not Consequence-Free

The UK has chosen a different regulatory path. Rather than a single AI Act, the government has directed existing regulators to apply current law to AI systems. In practice, this means the Information Commissioner's Office (ICO) is the primary enforcement body for AI-related data risks, working through UK GDPR and the Data Protection Act 2018.

The ICO has updated its guidance to make clear that most AI projects involving personal data require a Data Protection Impact Assessment (DPIA). Fairness, transparency, and accountability are not aspirational principles under this framework — they are enforceable obligations. A firm that deploys an AI tool to process client data, employee records, or financial information without a documented DPIA is already in breach.

The Data (Use and Access) Act 2026, which received Royal Assent on 19 June 2025, has introduced further changes to the data protection landscape. The current government has also signalled an intention to introduce AI-specific legislation, particularly targeting the most powerful AI models. The UK's principles-based approach should not be mistaken for regulatory inactivity — it simply means the rules already exist, and enforcement is already happening under existing powers.

Shadow AI: The Compliance Risk Already Inside Your Business

Regulatory frameworks are one challenge. The behaviour of your own workforce is another — and in many firms, it is the more immediate one.

Shadow AI refers to unsanctioned AI tools used by employees without the knowledge or approval of their employer. A solicitor drafting a letter using a free AI writing tool. A payroll administrator uploading salary data to a consumer-grade AI assistant to check calculations. An HR consultant running a candidate's CV through an unauthorised screening tool. These scenarios are not hypothetical — they are occurring daily across professional services businesses of every size.

The compliance consequences are significant. Shadow AI dramatically increases the attack surface for data breaches, complicates incident response, and can result in client data being processed by third-party systems in jurisdictions your firm has never assessed, under terms your firm has never reviewed. Under GDPR and its international equivalents, the controller — your business — remains responsible for how personal data is processed, regardless of whether the tool was officially sanctioned.

Enforcement agencies are increasingly attuned to this risk. The US Federal Trade Commission's Operation AI Comply, launched in September 2024, specifically targeted companies where AI use had created deceptive or unfair outcomes. The US Department of Justice has prioritised scrutiny of corporate compliance programmes for AI-specific risks. The message to firms globally is consistent: ignorance of what your employees are doing with AI is not a defence.

Specific Risks by Sector

HR and Recruitment Firms: AI hiring tools carry discrimination risk even when audits appear clean. Bias can be embedded in training data in ways that are not immediately visible. New York City's Local Law 144 already requires independent bias audits for automated employment decision tools, with daily penalties for non-compliance. Similar provisions are emerging in other jurisdictions. If your firm operates internationally, you must understand the specific requirements of each market.

Accountancy and Payroll Practices: Automated timekeeping and payroll systems that process data at machine speed can generate regulatory violations faster than any human compliance team can identify them. Agentic AI — systems capable of taking actions autonomously — can process thousands of data points before a compliance flag is raised. The financial and reputational exposure from a single misconfigured system can be severe.

Legal Practices: Solicitors and law firms handling client data through AI tools face obligations under both data protection law and professional conduct rules. The duty of confidentiality does not diminish because a task has been delegated to an AI system.

Marketing Agencies: Profiling, behavioural targeting, and consent management are areas of sustained regulatory attention. AI-driven campaign tools that process personal data without a lawful basis or adequate transparency disclosures are in direct conflict with GDPR obligations across the UK and EU.

What Good Compliance Practice Looks Like Now

Across all sectors and jurisdictions, the firms managing AI compliance effectively share several characteristics. They have conducted a full AI inventory — mapping every AI tool in use, including those adopted informally by staff. They have documented their lawful basis for processing personal data through each system. They have completed or updated DPIAs for AI projects. They have implemented internal AI governance policies that employees understand and are trained on. And they are actively monitoring the regulatory calendar across every jurisdiction in which they operate.

This is not a one-time exercise. The regulatory environment is evolving quickly, and what constitutes adequate compliance in 2025 may be insufficient by 2026.

The Cost of Waiting

Professional services firms occupy a position of particular exposure. You handle sensitive client data, you operate across multiple jurisdictions, and your professional reputation is a core commercial asset. A breach, a regulatory fine, or a public enforcement action does not simply carry a financial cost — it can sever client relationships that took years to build.

The firms that will navigate this period successfully are those treating AI compliance as a strategic priority today, not a crisis to manage tomorrow.

Ops Intel works with professional services businesses to assess AI risk, build compliance frameworks, and prepare for regulatory obligations across the EU, UK, US, Canada, and beyond. If you are uncertain about your current exposure or want to understand what compliance looks like in practice for your firm, contact Ops Intel today to arrange a consultation.