Does the EU AI Act Apply Outside the EU?

📋 What this article covers: How the EU AI Act's extraterritorial scope works, which non-EU companies are caught and why, how "output used in the EU" is interpreted, what the authorised representative requirement means, scenario-by-scenario analysis for US, UK, Canadian, and other non-EU companies, and the revised deadlines after the 2026 Digital Omnibus postponed the high-risk rules.

A software company in San Francisco selling an AI-powered hiring tool to European enterprises. A fintech in Singapore running credit decisions for EU customers. A UK health tech firm whose AI triage tool is used in Irish hospitals. A Canadian legaltech company with EU law firm subscribers. None of these companies are based in the EU. All of them are in scope of the EU AI Act.

The extraterritorial reach of EU regulation has become one of the defining features of the digital regulatory landscape. The GDPR established the template: if you process data about EU residents, you are subject to EU law regardless of where you are based. The EU AI Act - Regulation (EU) 2024/1689 - follows the same logic, and then extends it further in ways that catch companies who genuinely believe they are outside its reach.

This article gives you a precise, practical answer to whether the EU AI Act applies to your company - not a general principle, but scenario-by-scenario analysis covering the situations that actually generate confusion. If you are a non-EU company with any exposure to EU markets, customers, or users, you need to know where you stand before your compliance deadline arrives. First, the facts at a glance.

How the Extraterritorial Scope Actually Works

Article 2 of the EU AI Act sets out its scope. Two provisions do the extraterritorial work: Article 2(1)(a), the bright-line market rule, and Article 2(1)(c), the output hook. (Article 2(1)(b) covers deployers established in the EU, and 2(1)(d) covers importers and distributors.)

First, under Article 2(1)(a), the Act applies to "providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country." This is the clean rule: if you sell or make available an AI system to EU customers or organisations, you are a provider under the Act and you carry provider obligations.

Second - and this is where many non-EU companies are surprised - Article 2(1)(c) applies the Act to "providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union." This catches situations where the AI system is not marketed to EU customers but its outputs reach EU persons anyway: a non-EU company whose AI makes decisions about EU employees, a non-EU algorithmic pricing system used in EU markets, a foreign AI system whose outputs affect EU citizens.

What the Act does not do is create different tiers of obligation based on where a company is established. A US company selling a high-risk AI system to an EU hospital has exactly the same provider obligations as an EU company doing the same thing. There is no lighter regime for being based outside the EU. The only structural difference is the additional requirement - for non-EU providers of high-risk AI - to appoint an authorised representative established within the EU.

The Key Trigger: "Output Used in the EU"

The "output used in the EU" trigger is the most expansive and the least understood part of the extraterritorial scope. It needs unpacking carefully because it catches companies who have never deliberately targeted EU markets.

The Act does not define "output used in the EU" exhaustively, but the recitals make clear that it is designed to prevent circumvention through relocation. If a company establishes its AI operations in a non-EU jurisdiction specifically to avoid EU AI Act obligations while still serving EU users or affecting EU persons, the Act applies regardless.

In practice, the trigger activates when any of the following applies.

Where the trigger does not activate: a non-EU company that uses AI exclusively for internal operations with no EU market activity, no EU customers, no EU employees affected by AI decisions, and no AI outputs reaching any person in the EU. That company is genuinely outside scope - but the bar for being genuinely outside scope is higher than most companies assume when they first assess their position.

Scenario-by-Scenario Analysis

The abstract scope rules become clearer through concrete scenarios. The following covers the situations that generate the most genuine uncertainty for non-EU companies assessing their position.

By Country: US, UK, Canada, and Others

The EU AI Act treats all non-EU countries identically for scope purposes. There is no equivalent treaty arrangement, no adequacy decision, and no preferential treatment for any particular non-EU jurisdiction. However, the practical implications vary by country because of differences in existing regulatory frameworks and the maturity of mutual recognition discussions.

🇺🇸 United States

The US has no equivalent federal AI regulation at the same level of comprehensiveness as the EU AI Act. US companies operating in EU markets are fully subject to the EU Act with no domestic equivalent to align against. This creates a dual-track compliance burden for US AI companies with EU customers: US-specific state-level AI regulations on one side, EU AI Act on the other, with limited overlap in their requirements. US companies should not assume that NIST AI RMF adoption or state AI bias laws provide any credit toward EU AI Act obligations - the frameworks are substantially different in structure and requirements.

🇬🇧 United Kingdom

The UK has explicitly chosen a different regulatory approach - a principles-based, sector-led AI framework rather than a comprehensive horizontal regulation. This means there is no UK equivalent of the EU AI Act and no prospect of mutual recognition in the short term. UK companies with EU customers or EU market presence are in exactly the same position as US companies: fully subject to EU AI Act obligations when they meet the scope criteria, with no domestic framework that maps onto EU requirements. UK companies already complying with ICO guidance on AI and data protection, or with FCA expectations around algorithmic models, should treat this as useful groundwork but not as EU AI Act compliance.

🇨🇦 Canada

Canada is developing its own AI regulation through the Artificial Intelligence and Data Act (AIDA), though the timeline for AIDA's entry into force remains uncertain. Canadian companies with EU exposure face the EU AI Act's full scope requirements independently of whatever AIDA ultimately requires. The frameworks share some conceptual overlap - high-risk classification, transparency, human oversight - but their specific requirements differ enough that AIDA compliance would not constitute EU AI Act compliance even if AIDA were fully in force.

🇨🇭 Switzerland

Switzerland is not an EU member but has extensive EU market integration through bilateral agreements. Swiss companies placing AI on the EU market or into service in EU member states are subject to the EU AI Act under its standard extraterritorial provisions. Switzerland's approach to AI regulation is still developing and does not currently provide a passporting equivalent for EU AI Act compliance.

All other non-EU countries

The analysis is identical. Establishment in Japan, South Korea, Brazil, India, Singapore, Australia, or any other non-EU country does not create any preferential scope treatment. The EU AI Act applies whenever the scope conditions are met - EU market access or EU-directed AI output - regardless of the company's home jurisdiction. Whether or not a company's home country has its own AI regulation is irrelevant to EU AI Act scope.

The Authorised Representative Requirement

Article 22(1) is explicit: "Prior to making their high-risk AI systems available on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative which is established in the Union." The authorised representative is defined in Article 3(5) as a person located or established in the Union who has received and accepted a written mandate from a provider to perform the obligations and procedures under the Regulation on its behalf.

The authorised representative is not merely a postal address. Under Article 22 the representative verifies that the EU declaration of conformity and technical documentation have been drawn up, keeps that documentation available to competent authorities, acts as the contact point for authorities, and terminates the mandate if it considers the provider is acting contrary to its obligations. This is a substantive role, not an administrative formality.

What the authorised representative must do

Who qualifies as an authorised representative?

Any legal or natural person established in an EU member state can serve as an authorised representative - a law firm, a compliance consultancy, an EU subsidiary of the non-EU company, or a dedicated regulatory representation service. If the non-EU company has an EU subsidiary or affiliate, that entity can take on the role, which is often the simplest structural solution. Third-party representation services are emerging, similar to those that developed in the GDPR market, though the AI Act's requirements are more substantive.

What Non-EU Companies in Scope Actually Need to Do

If you have determined that the EU AI Act applies to your company, the obligations that follow depend on your role in the AI value chain and the risk classification of your AI systems. The following maps out the core action areas for the most common non-EU company profiles.

If you are a non-EU provider of high-risk AI systems (2 December 2027, or 2 August 2028 if embedded in a regulated product)

After the Digital Omnibus, standalone high-risk systems (Annex III) must comply by 2 December 2027 and high-risk AI embedded in regulated products (Annex I) by 2 August 2028. The obligations themselves are unchanged - only the dates moved.

• Appoint an EU authorised representative - and do it well before your compliance deadline, because the representative needs time to prepare the documentation they will be responsible for.
• Build a risk management system for each high-risk AI system, as required by Article 9 - a continuous, iterative process covering the full lifecycle of the system.
• Prepare technical documentation under Article 11 and Annex IV - a detailed, maintained record of the system's design, development, testing, and performance characteristics.
• Implement human oversight measures under Article 14 - the system must be designed to allow EU deployers to understand, monitor, and where necessary override its outputs.
• Conduct a conformity assessment appropriate to your system type - either a self-assessment or third-party assessment depending on whether your system falls under a regulated product sector.
• Register the system in the EU AI database before it is placed on the EU market or put into service.
• Produce a declaration of conformity and affix the CE marking where required.
• Update EU customer contracts to include the required information for deployers - including instructions for use, intended purpose limitations, and information needed for the deployer to carry out their own obligations.

If you are a non-EU provider of a general-purpose AI model (already in force since 2 August 2025)

• Prepare and maintain technical documentation - covering training methodology, training data, evaluation results, and known limitations.
• Provide information to downstream providers who build on your model - including a model card or equivalent that allows them to assess the model's capabilities and risks for their specific use cases.
• Put in place a copyright compliance policy - evidence that your training data sourcing and processing respects EU copyright law, including opt-outs under the text and data mining exception.
• If your model is systemic risk (training compute greater than 10^25 FLOP): adversarial testing, incident reporting to the EU AI Office, and enhanced cybersecurity obligations apply in addition to the above.

If you are a non-EU deployer of high-risk AI with EU operations

• Verify that the AI system you are deploying is compliant - request documentation from the provider and confirm that required conformity assessments have been conducted.
• Use the AI system only for its intended purpose as documented by the provider - using a system outside its intended scope can transfer provider obligations to you.
• Implement human oversight appropriate to the specific use case and ensure staff responsible for AI-assisted decisions are trained in the system's operation and limitations.
• Monitor performance on an ongoing basis and report malfunctions or risks to the provider and, where required, to national competent authorities.
• Inform and protect affected persons where required - including informing employees when AI is used in decisions about them, and providing the transparency notices required for certain AI applications.

When You Are Genuinely Out of Scope

Given how broad the extraterritorial reach is, it is worth being precise about the conditions under which a non-EU company is genuinely outside scope. All of the following must be true simultaneously.

If any of these conditions is not met - or may not be met in the future as you grow - you should treat yourself as in scope and take compliance steps accordingly. The cost of incorrectly self-assessing as out of scope and later being found in breach is substantially higher than the cost of building compliance infrastructure proactively.

Frequently Asked Questions

Did the Digital Omnibus change the deadline for non-EU high-risk AI providers?

Yes. The Digital Omnibus on AI, adopted by the Council on 29 June 2026 after the Parliament's vote on 16 June 2026, moved the standalone high-risk deadline from 2 August 2026 to 2 December 2027, and the deadline for high-risk AI embedded in regulated products from 2 August 2027 to 2 August 2028. The change applies to non-EU and EU providers alike. It does not touch the Article 50 transparency obligations, which still apply from 2 August 2026, or the prohibitions, AI literacy, general-purpose AI, governance and penalty rules that are already in force.

Does the EU AI Act apply to us if we only have one EU customer?

Scope under the EU AI Act is not conditional on the number of EU customers. If you place an AI system on the EU market - including by making it available to a single EU customer - you are in scope as a provider for that system. The risk classification of the AI system and the nature of your obligations is what varies, not whether the Act applies at all.

We are a US company but we have an EU subsidiary - which entity has the obligations?

If the EU subsidiary places the AI system on the EU market under its own name or as the responsible entity, the EU subsidiary is the provider and carries the full provider obligations. If the US parent develops and places the system on the market while the EU subsidiary only distributes or deploys it, the US parent is the provider and the EU subsidiary may be the deployer or distributor. The entity that controls the AI system and determines how and where it is placed on the market is the provider. In practice, many groups find that routing obligations through the EU subsidiary is the cleanest structure, as it removes the need for a separate authorised representative appointment.

Is the extraterritorial reach actually enforceable against non-EU companies?

The GDPR's extraterritorial enforcement provides the relevant precedent. Non-EU companies with no EU assets or physical presence are harder to fine directly, but EU authorities have tools including market access restrictions - banning non-compliant AI systems from the EU market - which are highly effective against any company that values EU revenue. The authorised representative requirement also creates an EU-based enforcement hook. Companies that routinely ignore EU regulatory requirements find themselves effectively excluded from EU market access, which is often a more commercially significant consequence than the fine itself.

Does Brexit mean UK companies get any different treatment?

No. Since Brexit, the UK is treated as a third country under EU law. UK companies placing AI on the EU market or with AI outputs used in the EU are subject to the EU AI Act on exactly the same basis as a US, Canadian, or Australian company. There is no mutual recognition arrangement for AI regulation between the EU and UK, and none is imminent. UK companies need EU AI Act compliance entirely separately from their domestic UK AI obligations.

Mapping your EU AI Act scope with Venvera

Scope and risk classification are the first things to get right, because the obligations and the cost follow from them. The Venvera EU AI Act module turns the Article 2 scope tests, the provider and deployer roles, and the risk classification into a structured gap assessment, so you can see for each AI system whether it is in scope, what role you hold, and which obligations attach. Where the AI Act overlaps with controls you already run, the crosswalk engine lets you reuse evidence from ISO 27001, NIST CSF, and your existing security programme rather than starting from zero, with EU data residency as standard.

If you want a fast read on where you stand, run a free compliance check and use the scope questions above as your starting point.

Primary sources

This guide is drawn from the regulation and official EU material: Regulation (EU) 2024/1689 (the full AI Act text, including Article 2 scope, Article 3 definitions, Article 22 authorised representatives, Article 99 penalties, and Article 113 application dates); the European Commission's AI Act policy pages; and the Council of the EU press release Council gives final green light to simplify and streamline AI rules (29 June 2026) on the Digital Omnibus deadline changes. Always confirm the current text before relying on a specific date or figure.

Written by the Venvera compliance team. This article reflects the EU AI Act as amended by the Digital Omnibus adopted on 29 June 2026, which enters into force on publication in the Official Journal. It does not constitute legal advice. Last updated: July 2026.