Does the EU AI Act apply to US companies?

Yes, in three situations: if you place an AI system on the EU market, if you are a deployer established in the EU, or if the output of your system is used in the Union. No EU establishment, EU customer entity or EU data centre is required for the third limb to apply.

Does the EU AI Act apply to the UK after Brexit?

It applies to UK companies on exactly the same basis as any other third-country company. A UK provider selling into the EU, or whose system's output is used there, is in scope; a UK company serving only UK customers is not caught by Article 2.

Can we avoid scope by blocking EU users?

Potentially, if the block is real and the output genuinely is not used in the Union. It has to be enforced technically and contractually, and documented — an unenforced terms-of-service clause saying the product is not for EU use will not survive scrutiny if EU customers are demonstrably using it.

EU AI Act glossary · Core concepts· Art. 2

Extraterritoriality

The EU AI Act applies regardless of where a company is established: if an AI system is placed on the EU market, or its output is used in the EU, the provider or deployer is in scope — even a US or UK company.

Article 2 sets the scope. Like the GDPR, the Act reaches beyond the EU's borders in three ways: providers placing a system on the EU market wherever they are established, deployers established in the EU, and — the widest limb — providers and deployers in third countries where the output produced by the system is used in the Union. A non-EU provider of a high-risk system must also appoint an EU authorised representative before that system reaches the market.

Where Extraterritoriality sits in the Regulation

Art. 2
Art. 22
Art. 54

Who it binds

Extraterritoriality: why it matters

The output limb is what catches companies that believe they have no EU exposure. A model hosted entirely in the United States, trained on US data, operated by US staff, is in scope the moment its output is used in the Union — the system never crosses the border, only the result does. Because the authorised-representative appointment is a precondition rather than a formality, an EU importer or distributor is obliged to refuse the product until it exists, which turns a legal question into a sales blocker.

Worked example

Extraterritoriality in practice

A US HR-tech company sells résumé screening to a multinational whose recruiters in Dublin and Madrid use the scores to shortlist candidates. The vendor has no EU entity and does not consider itself an EU business, but the shortlisting decisions happen in the Union, so it is a provider of an Annex III high-risk system, needs an Article 22 authorised representative, and owes its EU deployers the information and instructions they need to meet their own Article 26 duties.

Correction

Extraterritoriality: the mistake people make

Believing that hosting data and infrastructure outside the EU keeps you out of scope. Location of servers is irrelevant to Article 2; what matters is where the system is placed on the market and where its output is used. A geo-block on EU users is a scoping measure, an EU-region data centre is not.

Questions

Extraterritoriality: common questions

Does the EU AI Act apply to US companies?: Yes, in three situations: if you place an AI system on the EU market, if you are a deployer established in the EU, or if the output of your system is used in the Union. No EU establishment, EU customer entity or EU data centre is required for the third limb to apply.
Does the EU AI Act apply to the UK after Brexit?: It applies to UK companies on exactly the same basis as any other third-country company. A UK provider selling into the EU, or whose system's output is used there, is in scope; a UK company serving only UK customers is not caught by Article 2.
Can we avoid scope by blocking EU users?: Potentially, if the block is real and the output genuinely is not used in the Union. It has to be enforced technically and contractually, and documented — an unenforced terms-of-service clause saying the product is not for EU use will not survive scrutiny if EU customers are demonstrably using it.

Keep reading

Extraterritoriality: terms that come up alongside it

ProviderArt. 3(3)

The role that builds and brands the system — and carries the largest obligation set.

Authorised representativeArt. 22

The mandatory EU contact point a third-country provider must appoint before selling.

DeployerArt. 3(4)

The role most companies hold: using someone else's AI in your own operations.

EU AI ActReg. (EU) 2024/1689

The EU's risk-tiered AI regulation, phased in from 2025 to 2028.

Does it apply to US companies?

See how Extraterritoriality applies to your systems

Run the free 2-minute EU AI Act checker — no sign-up.

Run the free check