EU AI Act for Non-EU Companies: When US, UK and Other Providers Must Comply

Yes: the EU AI Act applies to a US, UK or other non-EU company when it places an AI system or GPAI model on the Union market or puts it into service in the Union (Article 2(1)(a)), or when its AI system's output is used in the Union (Article 2(1)(c)).

The EU AI Act is Regulation (EU) 2024/1689 (OJ L, 2024/1689, 12.7.2024), in force since 1 August 2024 and amended by Regulation (EU) 2026/1744 of 8 July 2026 (OJ L, 2026/1744, 24.7.2026), in force since 27 July 2026. Its general date of application is 2 August 2026 (Article 113, second paragraph), but duties for non-EU companies start on seven dates between 2 February 2025 and 2 August 2028.

Does the EU AI Act Apply to US, UK and Other Non-EU Companies?

Article 2(1) names seven addressee groups, and three connecting factors reach companies outside the Union: market access, output use and the supply chain. The seven groups, points (a) to (g), apply since 2 February 2025 (Article 113, third paragraph, point (a)), and point (c) is not amended by Regulation (EU) 2026/1744; each factor rests on its own provision and operative words:

The grouping into three factors is our reading of Article 2(1), not wording of the act. One company can meet two factors at once, for example as provider under point (a) of a system that an EU importer places on the market under point (d).

The full Article 2 test of who the EU AI Act applies to also covers exclusions, such as military uses (Article 2(3)).

Placing on the Union Market or Putting into Service: Article 2(1)(a)

Article 2(1)(a) covers a non-EU provider as soon as it places an AI system or GPAI model on the Union market or puts an AI system into service in the Union, wherever it is established. Placing on the market is "the first making available of an AI system or a general-purpose AI model on the Union market" (Article 3(9)). Putting into service, the supply for first use directly to the deployer or for own use in the Union (Article 3(11)), covers AI systems only. The Commission GPAI guidelines (C(2025) 7719 final of 19 November 2025) name four groups of ways a model is placed on the Union market.

• Software libraries, packages and public repositories.
• Application programming interfaces (APIs) and cloud services.
• Copies onto a customer's own infrastructure, and physical copies.
• Chatbot web interfaces and mobile apps distributed through app stores.

The guidelines are non-binding; the Commission's Q&A on the guidelines (checked 24 October 2026) states: "An authoritative interpretation of the AI Act may only be given by the Court of Justice of the European Union." The Article 3(9) and (11) definitions of placing on the market and putting into service remain the legal test.

Output Used in the Union: Article 2(1)(c) and Recital 22

Article 2(1)(c) covers providers and deployers established or located in a third country "where the output produced by the AI system is used in the Union". It reaches companies that never place a system on the Union market. The article and recital 22 use different words.

The article says "is used"; the recital adds "intended"; this page quotes both without merging them. Illustration (our reading): a provider in the US that runs a credit-scoring system on servers in the US and sends the scores to a lender in France can fall under point (c), because the output is used in the Union. Credit scoring of natural persons is a high-risk use case under Annex III, point 5(b).

The output test also appears in national law: Act LXXV of 2025, § 1, covers third-country providers and deployers whose AI system output is used in Hungary, in force since 1 December 2025 (Nemzeti Jogszabálytár, as of 24 October 2026), as part of the implementation law described under AI Act in Hungary.

Products and Supply Chains: Article 2(1)(d), (e) and (f)

Three further Article 2(1) groups bring non-EU AI into the act through EU-based actors or products: importers and distributors (d), product manufacturers (e) and authorised representatives (f).

• Importers and distributors (point (d)): the importer is established in the Union and places on the market a system bearing a third-country name or trademark (Article 3(6)).
• Product manufacturers (point (e)) placing an AI system on the market with their product under their own name or trademark.
• Authorised representatives of non-EU providers (point (f)), established in the Union under a written mandate (Article 3(5)).

Which Role Does a Non-EU Company Hold under the AI Act?

A non-EU company is most often the provider or the deployer, and never the importer or authorised representative, because Article 3(5) and (6) require those two to be located or established in the Union. Article 3(8) groups six roles under the term operator, and Article 3 defines each of them:

Each of the AI Act roles carries its own duties, and one company can hold two at once, for example provider of one system and deployer of another.

A non-EU company can also become the provider of a high-risk AI system under Article 25(1) in three cases: it puts its name or trademark on the system, makes a substantial modification, or changes the intended purpose so that the system becomes high-risk. A company that stays a deployer carries the deployer obligations of Article 26.

What Non-EU Providers and Deployers Must Do, by Risk Category and Date

Non-EU providers and deployers carry the same duties as EU operators, starting on seven dates between 2 February 2025 and 2 August 2028. The AI literacy duty in Article 4 applies since 2 February 2025 and, in its wording since 27 July 2026, requires providers and deployers to "take measures to support the development of AI literacy". The seven dates split by category:

Article 5 Bans: Since 2 February 2025 and from 2 December 2026

The Article 5 bans bind non-EU providers and deployers without transition: points (a), (b) and (c) to (h) since 2 February 2025, the new points (ba) and (bb) from 2 December 2026. The current Article 5(1) holds ten lettered points of prohibited AI practices (the Commission counts nine practices), and an infringement falls in the highest fine tier, Article 99(3).

When High-Risk Duties Reach Non-EU Providers

High-risk duties of non-EU providers apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c)(i) and (ii), as amended by Regulation (EU) 2026/1744). Before 27 July 2026, the act set 2 August 2026 and 2 August 2027; the Digital Omnibus on AI moved both dates.

From those dates, a non-EU provider of a high-risk system carries the 12 provider duties of Article 16, points (a) to (l), such as the quality management system of Article 17. Annex III lists 8 areas and 25 use cases. Article 6(3) sets four alternative conditions under which an Annex III system is not high-risk, and any one suffices; a system that performs profiling of natural persons is always high-risk.

The Commission guidelines on high-risk classification under Article 6(5) are a draft of 19 May 2026, still a draft on 24 October 2026; the Commission announced on 19 May 2026 that the final guidelines will be adopted by the end of 2026. Until they are adopted, the classification of high-risk AI systems rests on Article 6 and Annexes I and III.

Article 50 Duties for Non-EU Chatbot and Content Providers

Article 50 applies since 2 August 2026 to non-EU providers of chatbots and generative systems and to non-EU deployers whose output is used in the Union, with separate duties for each:

• Providers of AI systems that interact with natural persons, such as chatbots, inform people that they are interacting with an AI system (Article 50(1)).
• Providers of generative systems mark synthetic content (Article 50(2)).
• Deployers of emotion recognition or biometric categorisation systems inform the persons exposed (Article 50(3)), and deployers disclose deep fakes and AI-generated text published to inform the public on matters of public interest (Article 50(4)).

Our reading: a deployer established outside the Union falls under Article 50(3) and (4) through Article 2(1)(c) when the output of its system is used in the Union. Generative systems placed on the market before 2 August 2026 comply with Article 50(2) by 2 December 2026 (Article 111(4)); Article 50 has no other transition.

Breaches of the transparency obligations under Article 50, for chatbots and deep fakes alike, sit in the Article 99(4) fine tier.

Chapter V: Model Providers Established outside the Union

Chapter V applies since 2 August 2025 to every provider placing a GPAI model on the Union market, irrespective of establishment, and models placed before that date comply by 2 August 2027. Article 53(1) sets four duties for every such provider:

• Technical documentation, at minimum Annex XI, for the AI Office and national authorities (point (a)).
• Information for providers that integrate the model, at minimum Annex XII (point (b)).
• A policy to comply with Union copyright law (point (c)).
• A public summary of the training content on the AI Office template (point (d)).

The section on placing on the market of guidelines C(2025) 7719 final treats a model supplied outside the Union and integrated into an AI system placed on the Union market as placed when that system is. The upstream actor remains the model provider unless it excluded distribution and use in the Union "in a clear and unequivocal way"; in that case the integrator becomes the model provider.

Among general-purpose AI models, those trained with cumulative compute greater than 10^25 FLOP carry the systemic-risk presumption (Article 51(2)), and their providers notify the Commission within two weeks (Article 52(1)). The voluntary GPAI Code of Practice, published 10 July 2025, gives no presumption of conformity.

Does a Non-EU Provider Need an EU Representative?

Only two kinds of non-EU provider must appoint an authorised representative established in the Union by written mandate: providers of high-risk AI systems (Article 22(1)) and providers of GPAI models (Article 54(1)). Article 54(6) exempts providers of GPAI models released under a free and open-source licence with publicly available parameters, unless the model presents systemic risks. The representative keeps the documentation for 10 years (Article 22(3)(b) and Article 54(3)(b)), and the two articles differ in trigger, timing, exception and fine:

Importers check the conformity assessment, the documentation, the CE marking and the appointed authorised representative before placing a high-risk system on the market (Article 23(1), points (a) to (d)). The mandate of an authorised representative sets its tasks and its termination, and the remaining Article 23 duties make up the importer obligations.

How Is the AI Act Enforced against Non-EU Companies, and Which Fines Apply?

Enforcement reaches non-EU companies through their authorised representative, importer and distributors, the national market surveillance authorities and, for GPAI models, the Commission's AI Office.

Market Surveillance Authorities and the Commission's Exclusive Competence

National market surveillance authorities supervise AI systems, and the AI Office is exclusively competent for AI systems built on a GPAI model by the same provider and for AI systems in designated very large online platforms and search engines (Article 75(1) as replaced). Article 70 obliges each Member State to designate at least one notifying authority, at least one market surveillance authority and a single point of contact by 2 August 2025, and the market surveillance authorities of the 27 Member States are listed by country.

Article 75(1) excludes four kinds of same-provider system from that competence: Annex I products, Annex III point 2, systems of law enforcement, border management and financial institutions falling under Article 74(6), and Annex III point 8 administration of justice. Deployers fall under AI Office competence only when they are also the provider or belong to the same undertaking. The AI Office is a Commission function (Article 3(47)), not an EU agency.

Maximum Fines for Non-EU Providers and Their Representatives

Article 99 sets the maximum fines that national penalty rules must provide for (Article 99(1)), in the same tiers for non-EU and EU operators, up to EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher. The Article 99 tiers apply since 2 August 2025 (Article 113, third paragraph, point (b)), and Article 101 fines on GPAI model providers since 2 August 2026.

Within these caps, EU AI Act penalties are calculated under the Article 99(7) factors, such as gravity, duration and the size of the operator. The small mid-cap relief (Article 99(6a)) was inserted by Regulation (EU) 2026/1744.

Article 101 fines are the only fines the Commission imposes directly, with no SME reduction.

Compliance Steps for a Non-EU Company: From Scope Check to Conformity Assessment

Seven steps take a non-EU company from the scope check to market access.

1. Check Article 2(1)(a) and (c) for each system and model, for example with the EU AI Act Compliance Checker.
2. Determine the role per system (Articles 3(8) and 25(1)).
3. Screen every system against Article 5: points (a), (b) and (c) to (h) since 2 February 2025, points (ba) and (bb) from 2 December 2026.
4. Classify each system against Annexes III and I and Article 6(3).
5. Appoint an authorised representative where Article 22(1) or 54(1) requires one.
6. Prepare the conformity assessment of each high-risk system under its Article 43 route.
7. Implement the Article 50 and Article 4 measures.

Article 43 sets three routes: internal control (Annex VI) for Annex III points 2 to 8; for point 1, internal control only with harmonised standards or common specifications applied in full, otherwise a notified body (Annex VII); the sector procedure for Annex I Section A products. EN 18286:2026 on quality management systems is the only harmonised standard cited under the act, by Commission Implementing Decision (EU) 2026/2274 (OJ L, 2026/2274, 14.10.2026), with a presumption of conformity for the Article 17 requirements it covers. Third-country bodies act as notified bodies only under a Union agreement (Article 39), and no notified body is listed in NANDO under the AI Act (legislation id 168380) as of 24 October 2026.

Recital 178 encourages providers of high-risk AI systems to start complying on a voluntary basis during the transitional period.

Each of the seven steps maps to dated obligations, which the EU AI Act compliance checklist sorts by role and date.

The steps give an orientation on what the act requires; they do not decide whether a specific system is in scope, high-risk or exempt.

Where Does the AI Act's Reach End? The UK, the EEA, Switzerland and the US

The AI Act ties its reach to the Union market and to use in the Union, so a company in the UK, Switzerland or the US is a third-country operator.

The territorial scope of Article 2 applies together with the material scope and the exclusions in Article 2(3) to (12).

UK Companies after Brexit

A UK company is a third-country operator, caught under Article 2(1)(a) or (c) exactly like a US company. Illustration (our reading): a UK provider that runs a candidate-ranking system on UK servers and sends the rankings to an employer in Ireland can fall under point (c); if the Irish employer uses the system itself, the UK provider places it on the Union market under point (a). Evaluating candidates is a high-risk use case under Annex III, point 4(a). Articles 22 and 54 apply to a UK provider like any other third-country provider. This page covers only the EU act, not UK domestic rules on AI.

Norway, Iceland and Liechtenstein (EEA)

The status of the AI Act in Norway, Iceland and Liechtenstein, the three EEA EFTA States, is covered on AI Act in the EEA.

US Companies

A US company is a third-country operator under Article 2(1), because the AI Act ties its reach to the Union market and to use in the Union, not to the law of the company's home state. Compliance with US AI rules therefore does not replace AI Act compliance, and the differences between the two regimes are set out in EU AI Act vs US AI laws.

EU AI Act for Non-EU Companies: Related Questions

Article 3 GDPR, the exclusions in Article 2(3), (4) and (12) and the Article 2(1) tests answer the remaining questions of non-EU companies.

How Does the GDPR's Territorial Test Differ?

The GDPR reaches non-EU controllers through establishment (Article 3(1) GDPR) and through offering goods or services to, or monitoring, people in the Union (Article 3(2) GDPR), while the AI Act uses market access and output use. A non-EU company that processes personal data of people in the Union with an AI system can fall under both acts at once, an overlap for non-EU companies compared in AI Act vs GDPR.

Exclusions That Matter to Non-EU Actors

Three exclusions in Article 2 concern non-EU situations directly:

• Systems not placed on the market in the Union whose output is used there exclusively for military, defence or national security purposes (Article 2(3), third subparagraph).
• Third-country authorities and international organisations in law-enforcement and judicial cooperation, with adequate safeguards (Article 2(4)).
• Open-source systems, except high-risk, Article 5 and Article 50 systems (Article 2(12)), one of the AI Act exemptions in Article 2.

Frequently Asked Questions

Does the EU AI Act apply if a non-EU company has no office in the EU?

Yes: Article 2(1)(a) applies "irrespective of whether those providers are established or located within the Union or in a third country".

Do non-EU deployers have duties under the AI Act?

Yes, where the output is used in the Union (Article 2(1)(c)); Article 50(3) and (4) apply since 2 August 2026. Deployers established in the Union are covered separately, under Article 2(1)(b).

Does a non-EU chatbot provider need an EU representative?

No, unless the chatbot is a high-risk AI system or the company also provides a GPAI model; only Articles 22 and 54 require a representative. The chatbot provider still informs people that they are interacting with an AI system (Article 50(1)).

Does the EU AI Act apply to UK companies?

Yes, on the same Article 2(1) tests as any third-country company. The UK is a third country for the AI Act, so Articles 22 and 54 apply to a UK provider of a high-risk system or GPAI model.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.