Does it apply outside the EU?

"We're not a European company, so this doesn't apply to us" is the most common and most expensive misreading of the EU AI Act. Article 2 reaches providers and deployers irrespective of where they are established. Incorporation is not the test. What matters is where your system is placed on the market, where your deployer sits, and - the catch-all almost everyone misses - where the output is used.

Article 2(1)(c) applies the Regulation to providers and deployers in third countries "where the output produced by the AI system is used in the Union". A San Francisco company with no EU entity, no EU servers and no EU staff is in scope the moment a customer in Dublin uses what its model produces.

The seven ways you are in scope

The cases that actually come up

US SaaS with EU customers. In scope. You are the provider of the AI features you ship, and your customers' use puts the output in the Union. Delaware incorporation is irrelevant. SaaS specifics.

UK company post-Brexit. The UK is a third country for these purposes, so the analysis is identical to the US one - EU users means in scope. The UK has no equivalent statute of its own, which means UK companies get the AI Act's obligations without a domestic regime to align them with.

EU company selling only outside the EU. Still in scope as a deployer under 2(1)(b) for systems you use yourself, because that limb turns on where you are established, not where your customers are. Your internal AI tooling is caught even if no customer is European.

Non-EU company, EU staff. Your use of AI on those employees is deployer activity affecting people in the Union. HR tooling is the usual trigger - and it is also the Annex III area with the heaviest obligations. HR detail.

Processing EU personal data but output used elsewhere. This is where the AI Act and the GDPR come apart. GDPR follows the personal data. The AI Act follows the system, the market and the output. You can be squarely in GDPR scope and outside the AI Act, or the reverse. The mapping, for privacy teams.

Non-EU providers of high-risk systems need someone in the Union

Under Article 22, a provider established in a third country must appoint, by written mandate, an authorised representative established in the Union before making a high-risk AI system available on the Union market. The representative holds documentation, cooperates with authorities and can terminate the mandate if the provider acts contrary to its obligations.

There is a parallel requirement for third-country providers of general-purpose AI models under Article 54.

This is the obligation most non-EU teams discover last, because it is administrative rather than technical - and it is a precondition for market access, not a filing you catch up on afterwards. It only applies if something you ship is genuinely high-risk, which is worth establishing before you go looking for a representative.

What is genuinely out of scope

The open-source exclusion is the one most often over-claimed. Releasing a model under a permissive licence does not exempt it if it is put into service as a high-risk system, if it engages a prohibited practice, or if Article 50 transparency duties apply.

Being in scope is not the same as being burdened

This is the part that gets lost. Scope and tier are separate questions, and almost every non-EU company that panics about the first discovers the second is undemanding.

Most non-EU SaaS companies in scope end up as providers of limited or minimal risk systems. What that means in practice: Article 50 disclosure if your product converses with users, Article 4 literacy for staff, and an Article 5 check. Chapter III - conformity assessment, CE marking, EU database registration - applies only if something you ship is genuinely Annex III high-risk.

The deliverable that actually matters for a non-EU company is a dated written position: which of your systems are in scope, under which limb of Article 2, at which tier, and what follows. That is what EU enterprise procurement asks for, and it is usually a day's work rather than a compliance programme.

Territorial scope is settled by Article 2 on the facts of your deployment, not by where your servers sit. Hosting in the US does not remove you from scope, and hosting in the EU does not put you in it. The free check works through the Article 2 limbs before it looks at tier, because getting scope wrong makes everything downstream wrong.

Frequently asked questions

Does the EU AI Act apply to US companies?

Yes, in most cases where EU users are involved. Article 2(1)(a) covers providers placing AI systems on the Union market irrespective of whether they are established in the Union or a third country, and Article 2(1)(c) covers providers and deployers in third countries where the output produced by the AI system is used in the Union. Delaware incorporation is irrelevant to the analysis.

Does the EU AI Act apply to UK companies after Brexit?

Yes. The UK is a third country for these purposes, so the analysis is identical to the US one: if you place an AI system on the Union market, or the output of your system is used in the Union, you are in scope. The UK has no equivalent domestic statute, so UK companies get the obligations without a home regime to align them with.

What does "output used in the Union" mean?

It is the catch-all limb in Article 2(1)(c). If a person or organisation in the EU uses what your AI system produces - a score, a classification, generated content, a recommendation - you are in scope even with no EU entity, no EU staff and no EU infrastructure.

Does hosting outside the EU keep me out of scope?

No. Territorial scope under Article 2 is settled by where the system is placed on the market, where the deployer is established, and where the output is used. Server location is not one of the tests. Equally, hosting in the EU does not by itself put you in scope.

Do non-EU companies need an EU representative?

Only providers of high-risk AI systems. Article 22 requires a provider established in a third country to appoint, by written mandate, an authorised representative established in the Union before making a high-risk system available on the Union market. Article 54 imposes a parallel requirement on third-country providers of general-purpose AI models.

Is open-source AI exempt from the EU AI Act?

Only partly. Article 2(12) excludes free and open-source AI systems, but not where they are placed on the market or put into service as high-risk systems, nor where Article 5 prohibited practices or Article 50 transparency duties apply. Releasing under a permissive licence does not by itself create an exemption.

Is research and development excluded?

Yes, within limits. Article 2(6) excludes systems developed and put into service for the sole purpose of scientific research and development, and Article 2(8) excludes pre-market research, testing and development activity - but that ends at real-world testing, and entirely once the system is placed on the market.

Is my EU company in scope if all my customers are outside the EU?

For systems you use yourself, yes. Article 2(1)(b) catches deployers established or located in the Union regardless of where their customers are, so your internal AI tooling is in scope even if no customer is European.