Who Does the EU AI Act Apply To? Material, Personal and Territorial Scope (Article 2)

The EU AI Act applies to providers that place AI systems or general-purpose AI models on the Union market wherever they are established, to deployers in the Union, and to non-EU providers and deployers whose AI output is used in the Union (Article 2(1)). Article 2(1) names seven addressee groups in total: providers, deployers, third-country providers and deployers, importers and distributors, product manufacturers, authorised representatives, and affected persons located in the Union. Article 2 reaches them in three dimensions: material, personal and territorial.

Article 2 has applied since 2 February 2025, in an act in force since 1 August 2024. Regulation (EU) 2024/1689, the EU AI Act, was amended by Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, in force since 27 July 2026; Article 2 is cited here in that amended wording. This page gives an orientation, not a legal assessment.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.

What Article 2 Covers: Three Dimensions of Scope

Article 2 sets the scope of the EU AI Act in three dimensions: what is regulated (AI systems and general-purpose AI models), who is regulated (seven addressee groups) and where (market access, establishment or output use in the Union). In legal terms, the scope of the AI Act is the set of AI systems, general-purpose AI models and persons that Article 2 brings under the Regulation, less the activities that Article 2 excludes. Article 2 holds 13 paragraphs since Regulation (EU) 2026/1744 added paragraph 13.

Paragraph 1 defines who is covered; paragraphs 3, 4, 6, 8, 10 and 12 remove activities; paragraphs 5, 7, 9 and 11 keep other Union law in place; paragraphs 2 and 13 adjust the Annex I regime. The current text, reproduced in the EU AI Act full text, holds 119 numbered articles.

Material Scope: Which Systems and Models Article 2 Covers

Article 2 covers two objects: AI systems as defined in Article 3(1) and general-purpose AI models as defined in Article 3(63). An AI system is a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. The general-purpose AI model definition excludes models used for research, development or prototyping before placing on the market, and the Chapter V duties of general-purpose AI models attach to the model provider.

Placing on the market (Article 3(9)) and making available on the market (Article 3(10)) cover both AI systems and general-purpose AI models, while putting into service (Article 3(11)) covers AI systems only, so a general-purpose AI model is never put into service.

Personal Scope: The Seven Addressee Groups of Article 2(1)

Article 2(1) names seven addressee groups, points (a) to (g): six of them are operators under Article 3(8), and the seventh is the group of affected persons located in the Union:

Article 2(1) of Regulation (EU) 2024/1689, not amended by Regulation (EU) 2026/1744.

Of the six Article 3(8) operators (provider, product manufacturer, deployer, authorised representative, importer, distributor), only the product manufacturer has no Article 3 definition, because recital 87 refers to the sector legislation.

Territorial Scope: Market Access, Establishment and Output Use in the Union

Three connecting factors bring an operator into territorial scope: placing on the Union market or putting into service in the Union (point (a)), establishment or location in the Union (point (b)), and use of the output in the Union (point (c)). Point (a) applies wherever the provider is established, and point (c), reaching third-country providers and deployers, prevents circumvention (recital 22).

Article 2(1), point (c), covers third-country operators "where the output produced by the AI system is used in the Union", while recital 22 speaks of output that "is intended to be used in the Union"; the two wordings differ. Third-country providers of high-risk AI systems and general-purpose AI models also appoint an authorised representative in the Union by written mandate (Articles 22(1) and 54(1), with an open-source exception in Article 54(6)).

The Scope Section of This Guide: Four Pages and What Each Answers

The scope of the AI Act divides into four detailed topics beyond Article 2(1): non-EU companies, the Article 2 exclusions, open-source AI and systems already on the market.

Open-source AI rests on four separate provisions of the act rather than on one exemption, and none of them frees a system from Article 5.

Does the AI Act Apply to Your Organisation? A Four-Question Scope Test

Four questions decide whether the AI Act applies to an organisation: the object, any Article 2 exclusion, the Article 2(1) role and the Union link. The test gives an orientation, not a legal assessment:

1. Object: an AI system under Article 3(1) or a general-purpose AI model under Article 3(63); anything else falls outside Article 2.
2. Exclusion: an activity removed by Article 2(3), (4), (6), (8), (10) or (12).
3. Role: one of the seven groups of Article 2(1), points (a) to (g).
4. Union link: placing on the market or putting into service in the Union, establishment or location in the Union, or output used in the Union.

An exclusion does not always end the test: a system under a free and open-source licence returns to scope when placed on the market or put into service as a high-risk, Article 5 or Article 50 system (Article 2(12)). The role decides the duties: one AI system can carry provider duties for its developer and deployer duties for each organisation using it (Article 3(3) and 3(4)).

Exclusions, Partial Regimes and Possible Limits in Article 2 at a Glance

Article 2 removes six activities from the act, keeps a limited regime for Annex I Section B products, and allows the Commission to limit requirements for some Section A products:

Article 2 as amended by Regulation (EU) 2026/1744; status 24 October 2026.

Purpose, not entity type, decides the military exclusion (Article 2(3)). A system used for an excluded purpose and also for a civilian or law-enforcement purpose falls within scope (recital 24; Commission Guidelines on prohibited AI practices, C(2025) 5052 final of 29 July 2025, paragraph 25).

Where Article 2 Leaves Other Law Untouched: GDPR, DSA, Consumer and Worker Protection

Four without-prejudice clauses keep other Union law in place: data protection law (Article 2(7)), the intermediary liability rules of Chapter II of Regulation (EU) 2022/2065 (Article 2(5)), consumer protection and product safety law (Article 2(9)) and more favourable worker protection (Article 2(11)). Article 4a, inserted by Regulation (EU) 2026/1744 in place of Article 10(5), now holds the rule on processing special categories of personal data for bias detection. Where an AI system processes personal data, both regimes apply side by side, and the comparison of AI Act vs GDPR shows where the two regulations overlap.

Under Article 2(11), the Union or the Member States may maintain or introduce laws more favourable to workers on the use of AI systems by employers, or allow more favourable collective agreements.

What Applies after the Scope Test: Prohibited Practices, High-Risk Rules, Transparency and GPAI Duties by Date

Being in scope triggers different duties per tier and track: the Article 5 prohibitions in points (a), (b) and (c) to (h) since 2 February 2025 and in points (ba) and (bb) from 2 December 2026, general-purpose AI model duties since 2 August 2025, Article 50 transparency since 2 August 2026, and the high-risk rules of Chapter III Sections 1 to 3 from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). The tiers of unacceptable, high, transparency and minimal risk are Commission vocabulary (Guidelines C(2025) 5052, paragraph 2), not defined terms, and general-purpose AI models form a separate track:

Dates as amended by Regulation (EU) 2026/1744; before 27 July 2026 the act set 2 August 2026 and 2 August 2027 for the high-risk rules, dates that are now history.

Annex I Section B covers nine Union acts in points 13 to 21. For vehicles under points 14, 15, 18 and 19, Articles 4, 5 and 50 and Chapter V still reach in-vehicle AI.

Breaches of Article 5 carry the highest fine tier, EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher (Article 99(3)), and for SMEs and start-ups whichever is lower (Article 99(6)). These are the maximum fines national penalty rules must provide for (Article 99(1)), as the guide to EU AI Act penalties explains.

A scope position needs a date check as well, because the act applies on staggered dates. The EU AI Act timeline sets out every application date, including the Article 111 transition deadlines. The general date of application, 2 August 2026 (Article 113, second paragraph), does not cover Chapter III Sections 1 to 3 or the added Article 5 points.

What Regulation (EU) 2026/1744 Changed in Article 2: Paragraphs 2, 7 and 13

Regulation (EU) 2026/1744 amended Article 2(2) and 2(7) and added Article 2(13), with effect from 27 July 2026:

The Section B regime gained Article 60a and Articles 110 and 111, while Articles 58 and 59 joined Article 57 as provisions that apply only as integrated in sector legislation. On the same date, Annex I Section A point 1 (Directive 2006/42/EC) was deleted and machinery under Regulation (EU) 2023/1230 entered Section B as point 21.

Article 2(13) limits require that the Annex I Section A legislation gives an equivalent or higher level of protection and that the overall level of protection is not reduced. Every other change made by Regulation (EU) 2026/1744 is traced across the act in the omnibus guide. The delegation runs for five years from 27 July 2026 (Article 97(2)), and the European Parliament and the Council have three months, extendable by three, to object (Article 97(6)).

How to Confirm Your Position: Compliance Checker, Service Desk Tool and Next Steps

Two tools help confirm a scope position: the Commission's AI Act Service Desk compliance checker and the EU AI Act compliance checker of this guide. The Service Desk compliance checker describes itself as "Currently in its beta version ... an ongoing project", and its page shows no mention of Regulation (EU) 2026/1744 as of 24 October 2026.

The independent checker of this guide covers the role, Article 2, Article 5, the Annex I and Annex III routes, Article 50 and general-purpose AI model duties, with the legal reference and date for each route. It never returns a "compliant" verdict, and neither tool decides an individual case.

Once scope is confirmed, the guide to EU AI Act compliance sets out a step-by-step programme for providers and deployers. The EU AI Act checklist then sorts the obligations by role and risk class.

Scope of the EU AI Act: Related Questions

Article 3(3), recital 23, Article 3(14b), Article 111 and Article 70 answer the questions on providers, Union institutions, company size, legacy systems and supervision.

Who Is Considered a Provider?

A provider develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge (Article 3(3)). The provider vs deployer roles divide the duties of the act between the development side and the use side. Article 25(1) adds three cases in which another operator is deemed to be a provider.

Are EU Institutions, Bodies and Agencies Covered?

Union institutions, bodies, offices and agencies fall within scope when they act as provider or deployer of an AI system (recital 23). The European Data Protection Supervisor acts as their competent authority (Article 70(9)) and may impose administrative fines on them under Article 100: up to EUR 1 500 000 for breaches of Article 5 and up to EUR 750 000 for other breaches.

Does Company Size Change Whether Article 2 Applies?

Article 2 applies regardless of company size; none of its paragraphs sets a size threshold. Size changes duties and fine caps rather than scope, as the guide to the AI Act for SMEs, start-ups and small mid-caps shows. A small mid-cap (Article 3(14b)) has fewer than 750 persons, a turnover not exceeding EUR 150 million or a balance sheet not exceeding EUR 129 million and is not an SME (Recommendation 2003/361/EC, Article 3(14a)); the Commission estimates about 38 000 in the EU (SWD(2025) 836, page 77).

Do the Rules Reach Systems Placed before the Application Dates?

Article 5 applies to every AI system whatever its placing date, since Article 111(1) and (2) apply without prejudice to Article 5. High-risk AI systems placed on the market or put into service before "the date of application of Chapter III referred to in Article 113" fall under the act only if their design changes significantly from that date, and those intended for use by public authorities comply by 2 August 2030 (Article 111(2)).

Which Authorities Supervise Operators in Scope?

National market surveillance authorities supervise operators in scope, except where the European AI Office is competent. Member States had to designate at least one notifying authority, at least one market surveillance authority and a single point of contact by 2 August 2025 (Article 70), and the national competent authorities they designated differ by Member State. The AI Office, a Commission function, is exclusively competent for same-provider AI systems based on a general-purpose AI model, subject to the exceptions in Article 75(1), point (a)(i) to (iv), and for systems integrated into designated very large online platforms or search engines (Article 75(1)).

Frequently Asked Questions about the Scope of the EU AI Act

Who does the EU AI Act apply to?

It applies to the seven groups of Article 2(1), from providers and deployers to affected persons, whenever a system or model reaches the Union market, an operator is in the Union or the output is used in the Union.

Does the AI Act apply to personal, non-professional use?

No deployer obligations apply to natural persons using an AI system in a purely personal non-professional activity (Article 2(10)). Providers, importers, distributors and professional deployers of the same system stay bound.

Does the AI Act apply to AI built only for military purposes?

No, where the system is placed on the market, put into service or used exclusively for military, defence or national security purposes (Article 2(3)).

Does the AI Act apply to AI used only for scientific research?

No, for AI systems and models, including their output, specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)). Testing in real-world conditions is not excluded (Article 2(8)).

Since when does Article 2 apply?

Since 2 February 2025 (Article 113, third paragraph, point (a)), in an act in force since 1 August 2024; paragraphs 2, 7 and 13 read as amended since 27 July 2026.