Does the EU AI Act Apply to Companies Outside the EU?

The Short Answer: Your Address Does Not Save You

If you sell into the EU, serve EU users, or your AI's output lands in the EU, the EU AI Act applies to you. It does not matter that your company sits in San Francisco, London, or Singapore. The Act follows your AI's reach, not your postcode. If you have lived through GDPR, this will feel familiar.

So the real question is not "are we exempt because we're outside the EU?" It is "does our AI touch the EU?" The free risk check answers that in about 90 seconds, with no signup to see your result.

See if the Act reaches you (90 seconds)

The Three Ways a Non-EU Company Gets Pulled In

Article 2 draws the boundary, and it is wide. You are in scope if any one of these is true:

• You place an AI system on the EU market or put it into service in the EU. Selling or offering your AI to EU customers counts, established in the EU or not.
• You are a deployer located in the EU. An EU branch or subsidiary using AI is covered directly.
• Your system's output is used in the EU. Even if you and your users sit outside the EU, output that ends up used in the EU puts you in scope.

That third test is the one non-EU companies miss. Your servers, your staff, and your customers can all sit outside Europe, and a single result that lands in the EU still pulls you in.

What "Output Used in the EU" Looks Like

A few concrete cases make it real:

• A US hiring platform scores candidates, and some of those candidates are in the EU. The output (a ranking) is used in the EU.
• A non-EU analytics vendor produces an AI risk score that a client relies on to make a decision about a person in Germany. The output is used in the EU.
• A content tool generates copy that gets published to an EU audience. The output reaches the EU.

In each case the company never set up shop in Europe. The Act still applies.

Not sure which row is you? The risk check settles it in about 90 seconds.

Check your EU exposure free

Non-EU Providers of High-Risk Systems Need an EU Representative

If you are a provider based outside the EU putting a high-risk system on the EU market, Article 22 adds a step you cannot skip: you must appoint an authorised representative established in the EU, in writing, before the system goes on the market. They hold your technical documentation and act as the contact point for the authorities. Providers of general-purpose AI models have a parallel duty under Article 54.

This one surprises non-EU teams, because it is a real appointment with a real paper trail, not a box to tick later.

"Isn't This Just Like GDPR?"

Yes, in spirit. GDPR reached you if you handled the data of people in the EU, wherever your servers lived. The AI Act borrows the same logic for AI systems. The rough rule of thumb: if GDPR applied to your business, the AI Act deserves a look too. We break down where the two overlap and where they differ in our guide to the EU AI Act vs GDPR.

What Non-Compliance Costs, Wherever You Are

The penalties do not stop at the border. Fines reach €35 million or 7% of global turnover for prohibited practices, and €15 million or 3% for most other breaches. For SMEs, the Act charges the lower of the two. Enforcement reaches non-EU companies through their EU representatives, their importers, and plain market access: a system that cannot show compliance can be kept off the EU market. See our full breakdown of fines and penalties.

In Scope. Now What?

Finding out you are in scope is not the disaster it sounds like. For most non-EU companies the path is short:

• Classify each system's risk tier. Most land in limited or minimal risk.
• If anything is high-risk, appoint your EU authorised representative and assemble the technical file.
• Add the Article 50 transparency notices wherever they apply.
• Keep the evidence in one place, so you can show it the moment an authority or an enterprise customer asks.

UK and US companies sit squarely in this bucket. Since Brexit, the UK is a third country like any other, so a UK firm whose AI output reaches the EU is treated the same as a company in New York or Toronto.

Your Next 90 Seconds

1. Check your reach. The risk check tells you whether the Act applies and at what risk tier, in about 90 seconds.
2. Map the duties. AI Comply HQ™ turns the answer into your exact obligations and drafts the documentation. A consultant charges €10,000 or more for the same scoping. Our plans start at $97 a month, and the check is free.
3. Stay ready. One dashboard tracks your systems, your representative duties, and every deadline.

Start your free 7-day trial

Frequently Asked Questions

We have no office or staff in the EU. Are we still covered? Possibly. If your AI's output is used in the EU, or you offer the system to EU customers, Article 2 brings you into scope no matter where you are based.

We are a US SaaS with a handful of EU customers. Does the Act apply? Most likely yes. Serving EU users, or producing output used in the EU, is enough. The size of your EU footprint affects the relief you get, not whether the law applies.

Do we need an EU authorised representative? If you are a non-EU provider of a high-risk system or a general-purpose AI model, yes. Articles 22 and 54 require one, appointed in writing before the system reaches the EU market.

Does this work the same way as GDPR? The extraterritorial logic is the same: the law follows the people affected, not your company's location. If GDPR applied to you, plan for the AI Act too.

For more, see whether small companies have to comply, how to tell if you are a provider or a deployer, what your AI chatbot owes, and the full EU AI Act FAQ.

Update: The Digital Omnibus Is Now Law (September 27, 2026)

In July 2026 the EU changed some AI Act dates. The change is called the Digital Omnibus on AI (Regulation (EU) 2026/1744). It has been law since July 27, 2026. The dates in this article follow it.

What changed:

• High-risk rules start later (Article 113). AI used for hiring, credit scoring, education, and the other listed uses (Annex III) must comply from December 2, 2027. AI built into products like medical devices and toys (Annex I, Section A) follows on August 2, 2028. Machinery, vehicles, drones, and other Section B products get their AI rules through their own EU laws (Article 2(2)).
• Two new bans start December 2, 2026 (Article 5). AI that makes intimate images of real people without their consent will be banned. So will AI that makes child sexual abuse material.
• The AI literacy duty changed (Article 4). You must take steps to support your team's AI literacy. The law no longer asks for a set level of skill.

What did not change:

• The bans that started on February 2, 2025 still apply.
• Rules for the large models behind tools like ChatGPT (general-purpose AI models) have applied since August 2, 2025. So have the penalty rules.
• Transparency duties, like telling people they are talking to an AI (Article 50), have applied since August 2, 2026. Generative AI already on the market before then has until December 2, 2026 to mark its output as AI-made (Article 111(4)).

To see which dates apply to you, run the free 90-second risk check. For every date in one place, see our EU AI Act timeline.