What the EU AI Act means for UK clinics, salons and spas

New EU AI rules could affect some UK aesthetic businesses while also signalling how expectations around AI transparency, staff training and accountability are changing closer to home

AI is already becoming part of everyday business in clinics, salons and spas, whether it is being used to draft marketing content, power a website chatbot, automate customer communications or sit behind features in booking and management software.

Now, new requirements under the European Union's AI Act are putting greater emphasis on transparency around how artificial intelligence is used.

Although the legislation applies in the EU, that does not mean UK aesthetic businesses can ignore it. Some UK companies can fall within the Act's territorial scope, while the rules are also likely to influence the international software platforms used by British clinics and salons.

Meanwhile, the UK is developing its own approach to AI governance, with existing regulators including the Information Commissioner's Office (ICO) and Advertising Standards Authority (ASA) already addressing areas such as AI, personal data, automated decision-making and advertising.

So, what do aesthetic business owners actually need to know?

What is the EU AI Act?

The EU AI Act is a wide-ranging regulatory framework governing the development and use of artificial intelligence within the European Union.

Rather than treating every use of AI in the same way, the legislation takes a risk-based approach, with different requirements depending on what an AI system does and the potential harm it poses.

Several parts of the Act have been introduced in stages. AI literacy requirements began applying in February 2025, while transparency obligations under Article 50 took effect from August 2, 2026.

These transparency requirements cover particular uses of AI rather than every occasion on which a business uses an AI tool.

For example, providers of AI systems designed to interact directly with people – including certain chatbots and AI agents – are required to ensure users are informed that they are interacting with AI unless this is already obvious.

There are also requirements concerning the marking of AI-generated content, as well as disclosures around deepfakes, emotion-recognition systems, biometric categorisation and certain AI-generated content published on matters of public interest.

Importantly for businesses using generative AI for everyday marketing, the rules do not mean that every piece of copy which has been assisted by ChatGPT, Gemini, Claude or another AI tool automatically requires an "AI-generated" label.

The European Commission's guidance makes distinctions based on both the type of content and how AI has been used. AI-generated text published to inform the public on matters of public interest, for example, is subject to particular disclosure rules, but an exemption can apply where the content has undergone meaningful human review or editorial control and someone takes editorial responsibility for it.

Does the EU AI Act apply to UK businesses?

Potentially – but the answer is more nuanced than simply asking where a business is registered.

The Act has some extraterritorial reach. Its scope includes certain providers and deployers established outside the EU where the output produced by an AI system is intended to be used within the Union.

Marnie Wills, AI strategist and trainer at Business With AI Strategist, says this is one reason UK businesses should understand the legislation rather than assuming it stops at the border.

"The Act reaches beyond the EU's borders. It applies extraterritorially – much like GDPR did – so a UK business can be in scope even without an EU office or an EU subsidiary," she explains.

Exactly when a UK business falls within the Act's territorial scope will depend on the circumstances, so businesses with European operations, partners, customers or AI deployments should take specific legal advice where necessary.

However, direct legal exposure is only part of the picture. Wills expects the legislation to have an indirect impact on UK businesses through the technology they already use.

"Just as GDPR became a global baseline that most software simply built to, regardless of a company's individual exposure, most AI vendors – booking platforms, chatbot providers, marketing tools – sell into the EU as a matter of course," she says.

"They build transparency, disclosure and data-handling features to EU AI Act standards by default, because building two versions of a product costs more than building one to the highest common standard."

For UK clinics,salon and spa owners, that could mean seeing new AI disclosures, settings, data controls or governance features appearing within existing software, even if their businesses operate solely in Britain.

Where could AI already be used in an aesthetic clinic?

One of the challenges for businesses is that AI is no longer confined to standalone tools such as ChatGPT. AI functionality can increasingly be embedded within software businesses already use, potentially including:

• booking and scheduling platforms
• website chatbots and digital assistants
• automated phone or virtual reception services
• customer relationship management systems
• email and SMS marketing platforms
• social media and content creation tools
• ecommerce and product recommendation systems
• recruitment software
• business analytics and reporting tools

For clinics and advanced skincare businesses, AI may also appear in consultation, imaging or skin-analysis technology, although the regulatory position of these systems depends heavily on their intended function and should be assessed individually.

Wills recommends starting with an audit of existing systems.

"Start with an honest audit – not of 'have I bought AI' but of 'what has AI been switched on inside'," she says.

"List every piece of software the business uses and check the settings and update notes for anything described as 'AI', 'smart', 'automated' or 'assistant'."

An audit can also identify cases of shadow AI, where employees use tools independently without formal approval from the business.

"The biggest mistake is adopting tools because they're available, not because there's a clear use case," says Wills.

"Close behind is shadow AI, where staff use consumer tools the business never approved or knew about, often with patient data going in without anyone realising."

Do salons need to tell patients when they are talking to AI?

Transparency becomes particularly important where AI interacts directly with patients. Under Article 50 of the EU AI Act, providers of qualifying AI systems designed for direct interaction with people must ensure that users are informed that they are interacting with AI unless this is obvious from the context.

The European Commission says this information should be provided from the beginning of the first interaction in a clear and distinguishable way.

For a clinic using a third-party chatbot or AI receptionist, the precise legal responsibility may sit differently depending on whether the business is the provider or deployer of the system. Nevertheless, owners should check that customer-facing technology provides appropriate disclosure rather than assuming the software supplier has dealt with it.

Wills recommends making the wording straightforward.

"Plain, upfront, and impossible to miss – not buried in the terms and conditions," she says.

"Something as simple as 'You're chatting with our AI assistant' at the very start of a conversation does the job."

This is particularly relevant as voice AI becomes more sophisticated. A caller may not realise that a natural-sounding virtual receptionist arranging their appointment is not human.

Do AI-generated social posts and marketing need to be labelled?

This is one area where businesses should avoid overinterpreting the new rules. Using AI to brainstorm social media ideas, improve a treatment description or edit the wording of an email does not automatically mean the finished content requires an AI label under the EU AI Act.

Wills suggests distinguishing between AI-assisted and AI-generated work.

"If a human wrote the substance and used AI to tidy grammar or suggest phrasing, that's assistance," she says.

"If AI produced the actual content – an image, a video, a block of text, a voice – and a human's role was picking or lightly editing it, that's generation."

There are additional requirements under the EU Act for certain synthetic content and deepfakes, while the rules around AI-generated text focus specifically on content published to inform the public on matters of public interest.

For UK businesses, meanwhile, there is currently no blanket ASA requirement to label every advert created using AI.

However, existing advertising standards still apply regardless of how an advert was produced. That is especially important in aesthetics, where visual results can directly influence purchasing decisions.

The ASA has warned that using an AI-generated image to demonstrate an effect that a cosmetic product cannot genuinely achieve could be materially misleading. Existing rules also cover misleading testimonials and endorsements, harmful stereotypes and irresponsible advertising.

For aesthetics businesses, this means an AI disclosure cannot make an otherwise misleading claim acceptable.

AI-generated before-and-after imagery purporting to demonstrate a real treatment result, a fabricated patient testimonial or a realistic synthetic endorsement could therefore create much bigger problems than simply failing to add an "AI-generated" label.

Wills says, "If you wouldn't be comfortable telling a patient outright 'this was AI-generated,' don't publish it unlabelled."

What about patient data and AI?

AI governance is not only about transparency. Clinics, salons and spas routinely handle personal information, while some businesses also process information relating to patients' health, medical history, allergies or treatment contraindications.

Existing UK data protection rules therefore remain relevant when AI is introduced into these processes.

The ICO already provides guidance on applying UK GDPR principles to AI and automated decision-making.

Wills recommends asking suppliers several questions before allowing AI features to process business or patient information.

"What data does this feature use, and where is it processed and stored? Is our data – including patient data – used to train your models, and can we opt out? What happens to our data if we leave the platform? Who is legally responsible if the AI gets something wrong – us or you? Can you show us how bias or accuracy has been tested? And, critically: is there a written data processing agreement in place?"

Staff using public generative AI platforms should also understand what information they are permitted to enter.

"Personal data – names, health information, anything about a real patient – needs extra care and, generally, shouldn't be pasted into a public tool at all," says Wills.

Aesthetic businesses should keep humans in the loop

The consequences of an AI error depend heavily on what the technology is being asked to do. Using AI to brainstorm ideas for a staff meeting carries very different risks from allowing an automated system to communicate treatment advice, process sensitive data or influence a recruitment decision.

Wills suggests a simple test.

"The dividing line I'd give a salon owner is: does this AI output reach a real person – patient or candidate – without a human checking it first? If yes, that's where the oversight needs to sit."

Recruitment is particularly worth reviewing. The EU AI Act identifies certain systems used to analyse applications, filter candidates or evaluate people during recruitment as potentially high-risk AI uses, which are subject to a separate regulatory framework and implementation timetable.

UK regulators are also paying attention to automated recruitment. The ICO has been examining AI and automated decision-making in hiring and consulted on updated guidance in 2026.

For an aesthetic business, using generative AI simply to improve the wording of a job advert is therefore very different from allowing software to autonomously score or reject applicants.

Staff AI training is becoming a business responsibility

Another part of the EU AI Act that is easy to overlook is AI literacy.

Requirements relating to AI literacy began applying in February 2025. The European Commission says providers and deployers should take measures to support an appropriate level of AI literacy among staff and others using AI systems on their behalf, taking their knowledge, experience and circumstances into account.

This does not mean every member of staff needs to become an AI specialist.

"It doesn't need to be technical – it needs to be practical," says Wills.

Staff should understand which tools they are permitted to use, what information they should never upload, when an AI output needs checking and how to report problems, she adds.

"A 30–60 minute session covering exactly this, repeated when tools change, does more good than a generic 'AI awareness' course."

What should salons, spas and clinics do about AI now?

Even where a UK business is not directly subject to the EU AI Act, introducing some basic AI governance can reduce data, reputational and operational risks.

Wills recommends four immediate actions:

1. Map where AI is being used

List software and tools across booking, customer service, marketing, HR and operations, and establish which include AI-powered functions.

2. Question your suppliers

Find out what data AI features access, how that information is processed, whether it is used for model training, what controls are available and where responsibility sits when something goes wrong.

3. Introduce a simple AI policy

"It doesn't need to be – and shouldn't be – a 40-page compliance manual," says Wills.

She recommends covering approved tools, prohibited data, human review, disclosure wording, responsibility for approving tools and a date for reviewing the policy.

4. Give one person responsibility for AI

This is Wills's biggest recommendation for SMEs.

"Name one person who owns it. Not a policy, not a tool, not a training course first – a person," she says.

"Almost every governance gap I see in small businesses traces back to the same root cause: nobody is actually accountable for AI, so nothing gets reviewed, questioned or fixed."

Is the UK likely to introduce similar AI rules?

The UK is moving towards greater AI governance, but it is not currently following the EU by introducing an identical AI Act.

Instead, the Government has continued to pursue a more regulator-led and pro-innovation approach.

In October 2025, the Government announced a new blueprint for AI regulation involving AI Growth Labs, where products could be tested within controlled regulatory environments. The approach emphasised adapting existing regulation and working with individual regulators rather than immediately creating a single EU-style law.

Wills expects that pattern to continue.

"Rather than one law with one risk-tiering system, the UK is stitching AI expectations into what already exists – data protection through the ICO, advertising standards through the ASA, employment law through ACAS and the Equality Act, financial services through the FCA," she says.

"It's less tidy on paper than the EU's model, but it means businesses are already, in effect, under AI-relevant scrutiny today through regulators they already deal with – they just haven't necessarily clocked it as 'AI regulation' yet."

The ICO is also developing a statutory code of practice covering AI and automated decision-making, intended to provide organisations with practical guidance on areas including transparency, explainability and people's rights.

For salon, spa and clinic owners, the takeaway is therefore not to wait for a piece of legislation carrying the words "UK AI Act".

Some of the issues raised by AI – from data protection and automated recruitment to misleading advertising – already sit within existing rules.

Meanwhile, the EU's approach is likely to continue influencing the technology businesses buy and broader expectations around what responsible AI use looks like.

As Wills puts it, "None of this requires waiting for UK law to catch up – it's what 'well-run' already looks like."

This article provides general information and should not be considered legal advice. Businesses unsure whether the EU AI Act or other AI-related regulation applies to them should seek appropriate professional advice.

FAQs

Does the EU AI Act apply to UK aesthetic businesses?
It can in some circumstances. The Act has extraterritorial provisions covering certain AI providers and deployers outside the EU where AI outputs are intended to be used within the EU. UK businesses with EU operations or relevant AI use should assess their individual position.

Do salons have to tell patients when they use an AI chatbot?
Under the EU AI Act, providers of qualifying AI systems that directly interact with people must ensure users know they are interacting with AI unless this is obvious. UK businesses should also consider transparency and patient trust when using AI chatbots or virtual receptionists.

Do AI-generated social media posts need to be labelled?
Not automatically. The EU AI Act contains specific rules for certain AI-generated or manipulated content rather than requiring every AI-assisted piece of marketing copy to carry a label. UK advertising rules still require AI-generated adverts to be truthful and not misleading.

Should aesthetic businesses have an AI policy?
A simple AI policy can help salons, spas and clinics control which tools staff use, protect patient information, establish human oversight and decide when AI use should be disclosed.

Is the UK introducing its own AI Act?
The UK has so far favoured using existing regulators and sector-specific regulation rather than copying the EU's single AI Act model. However, guidance and regulatory expectations around AI, data protection and automated decision-making are continuing to develop.