EU AI rules now reach Northern Ireland: what NZ exporters should check

What the UK government confirmed

On 4 November 2026 the UK Department for Business and Trade published guidance on the partial application of the EU AI Act in Northern Ireland. The guidance runs to 32 pages and takes effect on 10 November 2026. It's written for developers, deployers, manufacturers, importers and distributors. It helps them work out whether a product is in scope, who in the supply chain holds which responsibility, and when the rules on prohibited, high-risk and limited-risk AI systems start to apply.

The scope is narrow. Resultsense, reporting on BBC coverage of the announcement, says the rules cover AI that's closely integrated into goods sold in Northern Ireland. Software a business uses to run its own operations falls outside them. The government's examples of covered goods include a smart speaker with a built-in voice assistant and a smartwatch that depends on its maker's AI health app. Its examples of goods that could be banned include an AI-connected toy that rewards children for riskier behaviour and a camera that reads employees' emotions. According to the same report, the transparency duties in Article 50(1) apply from 10 November 2026. Duties for Annex III high-risk systems start on 2 December 2027, and duties for Annex I systems start on 2 August 2028.

The two later dates match the EU's own revised timetable. Under the Digital Omnibus amendments, Loyens & Loeff reports that stand-alone high-risk systems must comply from 2 December 2027. AI that acts as a safety component of products covered by EU sectoral safety law must comply from 2 August 2028.

The decision ends a long stand-off. In March 2025 the European Commission said the AI Act should be added to Annex 2 of the Windsor Framework, which lists the EU laws that still apply in Northern Ireland. At the time, Irish Legal News reported that the UK government wouldn't commit either way. The government said the substantive provisions could only apply if the UK agreed at the Withdrawal Agreement joint committee. With the guidance now published, the UK has accepted the product-related part of the Act.

Why a Belfast rule reaches an Auckland product team

Most NZ businesses will never sell into Northern Ireland directly. The firms that should pay attention make or export physical products with AI features: sensors and cameras with on-board models, wearables, farm and industrial equipment that makes automated decisions, and consumer devices with voice assistants. If those products reach the UK through a distributor, some stock may end up in Northern Ireland. The obligations then attach to the goods in that market, whatever the exporter assumed about the UK's lighter regulatory approach.

In a written statement on 4 November, Cabinet Office minister Hamish Falconer said the change wouldn't create "a new regulatory border" within the UK. He described prohibited and high-risk products as relatively rare and said most affected suppliers already follow EU law (Resultsense). That's the government's own assessment, and for NZ exporters already selling into the EU it's probably accurate. Their EU compliance work should carry across. A firm that sells into Great Britain but has stayed out of the EU is in a different position. Its UK distributor may now ask for documentation the firm has never produced, and the distributor will want to know which party carries the importer's duties if goods cross into Northern Ireland.

The timing gives NZ firms some room. Most of the heavy obligations don't start until December 2027 or August 2028. Product design cycles are long, though. A device going into production in 2027 will be on shelves when those duties apply, so the classification decisions belong in the current design round.

NZ law already covers part of this

The emotion-reading camera in the UK government's examples isn't a remote concern for NZ businesses that buy and use such equipment. New Zealand's Biometric Processing Privacy Code applies to biometric processing that began after 3 November 2025. Systems already running on that date had until 3 August 2026 to comply (Bell Gully). Bell Gully notes that inferring mood or emotion from biometric data counts as biometric categorisation under the Code. An organisation using it has to show the processing is necessary, effective and proportionate, and it has to give enhanced notice. If an organisation can't show those things, it can't go ahead.

The two regimes come at the same technology from different directions. The EU rules regulate the product and the businesses that place it on the market. The NZ Code regulates the organisation that collects and uses the biometric information. A NZ manufacturer exporting AI cameras could face EU-style product obligations in Northern Ireland, while its NZ customers carry privacy obligations at home for the same device.

Practical next steps

• Build a register of AI features in your products. For each product, record the AI functions, whether the model runs on the device or in a companion app, and every market it's sold in. Most firms don't have this list, and every regulator will ask for it.
• Ask your UK distributors where stock goes. Find out whether any goods are sold or shipped into Northern Ireland, and confirm in writing who acts as importer and distributor under the EU rules.
• Classify early. Check whether a product falls under EU product safety legislation. If it does, any AI acting as a safety component puts the product on the August 2028 timetable. Settle that classification before the next hardware revision is locked.
• Check user-facing disclosures. Voice assistants and chat features built into products are the most likely to trigger transparency duties. Review what users are told when they interact with an AI system.
• Keep compliance records with product data. Technical documentation, risk assessments and version histories are easier to produce on request when they live alongside the bill of materials in your ERP or product data system rather than in scattered folders.
• Review your biometric devices at home. If your business uses cameras or sensors that infer mood, attention or identity, run the Code's proportionality test and keep the reasoning on file.

The UK guidance shows hard AI law reaching NZ businesses through their export markets before any equivalent arrives in New Zealand. Most exporters won't be affected by this rule. The ones that are can save effort by building one product-level AI register that works for EU, UK and NZ requirements together. If you need help setting up that register or an AI governance framework around it, our AI consultancy team works with NZ and Australian organisations on this.