Does the EU AI Act apply to US companies?
Yes, it can. Article 2 covers companies outside the EU when they sell or supply an AI system in the EU, or when the output of their AI system is used in the EU. No EU office is needed.
The Article 2 scope test for a US company
The scope test in the Act looks at where the AI system is offered and where its output lands, and it ignores where the company is registered. A US company with a chat agent answering EU visitors, an AI feature inside software sold to EU customers, or an AI tool screening EU job applicants can all be covered. When we write an AI roadmap as part of our AI consulting and implementation work, this is one of the first questions we mark for each system: does any of its output reach people in the EU?
Article 2(1) lists who the Act applies to. Three of the points can reach a US company directly:
- Point (a): providers placing AI systems on the market or putting them into service in the EU, "irrespective of whether those providers are established or located within the Union or in a third country".
- Point (c): providers and deployers located in a third country "where the output produced by the AI system is used in the Union".
- Point (e): product manufacturers placing an AI system on the EU market together with their product, under their own name or trademark.
The text above is from the European Commission's AI Act Service Desk, Article 2, which reflects the consolidated text as at July 27, 2026, read October 30, 2026. This page explains the rules; it is not legal advice, and your own case should be checked by a lawyer.
What is the difference between a provider and a deployer?
A provider develops an AI system, or has one developed, and offers it under its own name. A deployer uses an AI system in its work. Most US businesses that buy AI tools are deployers; software companies that sell AI features are providers.
Your role decides your duties, and one company can hold different roles for different systems. These definitions come from Article 3:
| Role | What Article 3 says | A typical US example |
|---|---|---|
| Provider | Develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark, paid or free | A US software company that sells a product with a built-in AI assistant to EU customers |
| Deployer | Uses an AI system under its authority, except for personal non-professional use | A US clinic chain or law firm running a chat agent on its website for clients, including EU clients |
| Authorised representative | A person or company in the EU with a written mandate from a non-EU provider | The EU contact a US provider of a high-risk system must appoint (Article 22) |
| Importer | Located in the EU and places on the market a system bearing a non-EU company's name or trademark | An EU reseller of a US AI product |
If we build an AI agent for you on your accounts, you are usually the deployer of that agent, and the model company behind it is a provider of the underlying model. Our page on who owns the automations and data we build explains why the accounts sit in your name.
Which US company situations fall under the EU AI Act?
Any situation where your AI system is sold into the EU or its output is used there. A website chatbot talking to EU visitors, AI features sold to EU customers and AI hiring tools used on EU applicants are the common cases.
We built this table from Articles 2, 3, 4, 26, 50 and Annex III as published on the Service Desk, read October 30, 2026. The "likely" column is our reading of the text, not a legal opinion. The Act does not define in detail when output counts as "used in the Union", so the borderline rows need a lawyer's view.
| Situation | Your likely role | In scope? | Main duties | From |
|---|---|---|---|---|
| Chat or voice agent on your site answers visitors, some in the EU | Deployer (the platform is the provider) | Likely yes, point (c) | Article 50(1) makes the provider design the agent to tell people it is an AI; keep that disclosure switched on. Staff AI literacy (Article 4) | Transparency from August 2026 |
| You sell software with an AI feature to EU customers | Provider | Yes, point (a) | Design for the Article 50 disclosure; mark AI-generated content in a machine-readable way if the system generates it; AI literacy | Transparency from August 2026 |
| You use AI to screen or rank applicants for jobs in the EU | Deployer of a high-risk system (Annex III, point 4) | Yes | Article 26: follow instructions, human oversight by trained staff, keep logs at least six months, inform workers and applicants | December 2, 2027 |
| You sell an AI credit scoring or life and health insurance pricing tool used on EU residents | Provider of a high-risk system (Annex III, point 5) | Yes | High-risk provider duties, and an EU authorised representative before sale (Article 22) | December 2, 2027 |
| You publish AI-generated images or video that look real, seen by EU audiences | Deployer | Likely yes, point (c) | Disclose that deepfake content is AI-generated or manipulated (Article 50(4)) | Transparency from August 2026 |
| Staff use an AI writing tool for internal US work, nothing reaches the EU | Deployer | Likely no | None under the Act; US law still applies | Not applicable |
| Engineers test a model in-house before any launch | Provider (later) | No while it stays pre-market (Article 2(8)); real-world testing is not excluded | Plan for duties at launch | At launch |
Most of the AI agents service businesses run, such as an AI receptionist or a website chat agent, sit in the "transparency risk" tier. They are not high-risk unless they start making decisions in an Annex III area such as hiring, credit or insurance pricing.
What does a US company have to do under the EU AI Act, and from when?
It depends on the risk tier. Banned practices and the AI literacy duty already apply. Chatbot and deepfake disclosure applies from August 2026. High-risk duties apply from December 2, 2027 for Annex III uses and August 2, 2028 for AI in regulated products.
The European Commission groups AI systems into four tiers on its AI Act regulatory framework page (last updated October 19, 2026, read October 30, 2026):
| Tier | Commission examples | What it means for you | Applies from |
|---|---|---|---|
| Unacceptable risk (banned) | Social scoring, harmful AI manipulation, emotion recognition at work or in schools | Do not build or use these where output reaches the EU | February 2, 2025; a ninth ban on AI-generated non-consensual sexual content from December 2026 |
| High risk | CV sorting for recruitment, credit scoring, exam scoring, AI in robot-assisted surgery | Risk management, data quality, logging, documentation and human oversight | December 2, 2027 (Annex III) and August 2, 2028 (Annex I products) |
| Transparency risk | Chatbots, deepfakes, AI-generated text published on matters of public interest | Tell people they are dealing with an AI; label deepfakes | August 2026 |
| Minimal or no risk | Spam filters, AI in video games | No specific rules; the Commission says most AI systems in the EU fall here | Not applicable |
Two duties cut across the tiers. Article 4 says providers and deployers "shall take measures to support the development of AI literacy" of the people who run AI systems for them, and, after the 2026 amendment, that this "does not require providers or deployers to guarantee any specific level of AI literacy". Article 50(5) says disclosures must be clear and given "at the latest at the time of the first interaction or exposure".
The high-risk dates moved. The AI Omnibus, which the Commission says entered into force on July 27, 2026, pushed Annex III high-risk rules to December 2, 2027 and Annex I product rules to August 2, 2028, and extended simpler SME requirements to small mid-cap companies.
What are the fines for breaking the EU AI Act?
Up to EUR 35 million or 7% of worldwide annual turnover for banned practices, up to EUR 15 million or 3% for most other duties, including transparency, and up to EUR 7.5 million or 1% for misleading information. For SMEs the lower figure applies.
EU AI Act fine ceilings (Article 99)
The ceilings are set in Article 99. Member States set the actual penalty rules within them. For most companies the higher of the two amounts is the ceiling; for SMEs, including start-ups, Article 99(6) says the ceiling is whichever is lower. After the AI Omnibus, the lower-of rule also covers small mid-caps for the 3% and 1% tiers.
| Breach | Ceiling (higher of) | Example: SME with EUR 40 million turnover | Example: company with EUR 400 million turnover |
|---|---|---|---|
| Banned practice (Article 5) | EUR 35 million or 7% | Lower of EUR 35M and EUR 2.8M = EUR 2.8 million | Higher of EUR 35M and EUR 28M = EUR 35 million |
| Other duties, incl. Article 26 deployer duties and Article 50 transparency | EUR 15 million or 3% | Lower of EUR 15M and EUR 1.2M = EUR 1.2 million | Higher of EUR 15M and EUR 12M = EUR 15 million |
| Incorrect or misleading information to authorities | EUR 7.5 million or 1% | Lower of EUR 7.5M and EUR 0.4M = EUR 0.4 million | Higher of EUR 7.5M and EUR 4M = EUR 7.5 million |
The two companies are illustrative. The SME column assumes the firm meets the EU SME definition: fewer than 250 staff and turnover up to EUR 50 million or a balance sheet up to EUR 43 million. These are maximums; Article 99 does not set a minimum fine. Breaching the AI literacy duty in Article 4 is not listed in the Article 99 fine tiers we read.
Does the EU AI Act apply to UK companies too?
Yes, on the same test. The UK is outside the EU, so a UK company is in scope when it supplies an AI system in the EU or when its AI system's output is used in the EU, exactly like a US company.
Article 2 does not treat the UK differently from any other non-EU country. The same goes for companies in Canada, Australia and the UAE. What changes by country is the home law that applies alongside it.
What should a US company do first?
List every AI system you run or sell, mark which ones reach people in the EU, set your role for each, then check for banned uses, chatbot disclosure, high-risk use cases and staff training, in that order.
- Inventory. Every AI tool, agent and AI step inside a workflow, including ones inside your CRM or helpdesk.
- EU reach. For each, note whether EU residents talk to it, receive its output, or are judged by it.
- Role. Provider or deployer, using the table above.
- Banned uses. Check nothing falls in the Article 5 list. This is rare for normal business tools, but check emotion recognition on staff.
- Disclosure. Chat and voice agents say they are AI at the first interaction. Our guide to whether AI calling is legal covers the US disclosure rules for phone agents.
- High-risk check. Compare each use with Annex III: hiring, credit, insurance pricing, education and the other listed areas.
- Training. Short written guidance for the people who run each system, which also serves the Article 4 literacy duty.
This inventory is the same one we build during a free audit, before any paid consulting. Our AI readiness assessment checklist folds these checks into a wider review of data, tools and ownership.
More questions about the EU AI Act and US companies
Does the EU AI Act apply if we have no office in the EU?
Yes, it can. Article 2(1)(a) covers providers "irrespective of whether those providers are established or located within the Union or in a third country", and point (c) covers non-EU providers and deployers when the AI output is used in the EU. Where your company is registered does not decide scope; where your AI system is sold or its output used does.
Is a website chatbot a high-risk AI system?
Usually not. The Commission lists chatbots as transparency risk, which means people must be told they are dealing with an AI unless that is obvious. A chatbot becomes high-risk only if it is used for an Annex III purpose, for example to filter job applications or evaluate creditworthiness. A chatbot that answers questions and books appointments stays in the transparency tier.
Does using ChatGPT at work put a US company under the EU AI Act?
Not by itself. The Act reaches a non-EU deployer when the AI system's output is used in the EU. Staff drafting internal US documents with a chat tool is unlikely to meet that test. Sending AI-written replies to EU customers, or publishing realistic AI images seen in the EU, can. The model company has its own duties as a provider of general-purpose AI models.
Does the GDPR still apply alongside the EU AI Act?
Yes. Article 2(7) says EU data protection and privacy law applies to personal data processed in connection with the Act, and that the Act does not affect Regulation (EU) 2016/679, which is the GDPR, apart from two named articles. A US company offering an AI agent to EU residents usually has GDPR questions to answer as well as AI Act ones.
Are open-source AI systems exempt from the EU AI Act?
Partly. Article 2(12) says the Act does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk systems, as a banned practice under Article 5, or as a system covered by the Article 50 transparency duties. An open-source chatbot you deploy for customers still needs the AI disclosure.
Is there a US equivalent of the EU AI Act?
There is no single federal AI statute that mirrors it. US regulators apply existing law to AI instead: when the FTC announced five actions under Operation AI Comply on September 25, 2024, its Chair said "there is no AI exemption from the laws on the books". The NIST AI Risk Management Framework is voluntary guidance, not law.
When do US companies have to comply?
Some duties already apply. Banned practices and AI literacy applied from February 2, 2025, and the Act became applicable on August 2, 2026, when transparency rules took effect. High-risk duties follow on December 2, 2027 for Annex III uses and August 2, 2028 for AI built into regulated products, after the 2026 AI Omnibus moved those dates.
Who should a US company ask about its own case?
A lawyer who practises EU technology law, for any system that touches hiring, credit, insurance or health decisions. For the inventory, disclosure wording and human handover rules in your agents, we can help as part of an audit. We build these into the systems we deliver, and say plainly when a question needs legal advice instead.
Sources and further reading
- AI Act Service Desk, Article 2: scope (consolidated text as at July 27, 2026; read October 30, 2026)
- AI Act Service Desk, Article 3: definitions
- AI Act Service Desk, Article 4: AI literacy
- AI Act Service Desk, Article 26: deployer obligations for high-risk systems
- AI Act Service Desk, Article 50: transparency obligations
- AI Act Service Desk, Article 99: penalties
- AI Act Service Desk, Annex III: high-risk use cases
- European Commission, AI Act regulatory framework, risk tiers and timeline (updated October 19, 2026)
- European Commission, SME definition
- FTC, Operation AI Comply press release, September 25, 2024
