Does the EU AI Act Apply to US Companies? (2026)

Article 2 defines the Act's reach, and it is deliberately broad. You are covered if any of these is true:

• You place an AI system on the EU market or put it into service in the EU — regardless of where you are established.
• You are a provider or deployer whose AI system's output is used in the EU, even if the system itself runs elsewhere.
• You are a deployer established or located in the EU.

The second point is the one that catches US companies off guard: a model you run entirely on US infrastructure can still be in scope if its outputs are used by people in the EU.

Concrete examples of US companies pulled in:

• A US SaaS vendor selling an AI hiring tool to European employers — a high-risk system under Annex III.
• A US company whose chatbot or generative feature is available to EU users — transparency duties under Article 50.
• A US model provider whose foundation model is offered in the EU — GPAI obligations (Art. 53) since 2 August 2025.

Use the free risk checker to see which tier your system falls into, and read obligations by operator role to find whether you're a provider or a deployer.

A non-EU provider of a high-risk AI system must appoint an authorised representative established in the EU (Article 22) before placing the system on the market. The representative keeps documentation available to authorities and acts as a point of contact. GPAI model providers outside the EU have a parallel duty under Article 54.

This is a hard requirement, not a formality: without an appointed representative, an importer or distributor must refuse to place your high-risk system on the EU market.

1. Inventory the AI systems you offer to, or whose outputs reach, the EU.
2. Classify each one (prohibited / high-risk / limited / minimal) — see the complete guide and the Annex III high-risk list.
3. Identify your role for each system (provider vs deployer).
4. For high-risk systems, plan the conformity assessment and appoint an EU authorised representative.
5. Track the deadlines — high-risk obligations apply from 2 August 2026.

Starting early matters: conformity work takes months, and enforcement penalties reach €35M or 7% of global turnover for the most serious breaches.