Does the EU AI Act apply to a US company?

Last verified October 31, 2026, against the AI Act as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744).

It can. The EU AI Act reaches companies outside the EU through four routes in Art. 2(1): placing AI systems or general-purpose AI models on the EU market, using AI through an EU establishment, having a system’s output used in the EU, and distributing AI or building it into products sold in the EU. No EU office is needed.

Route	Article	Example for a US company
1. Placing on the EU market or putting into service there	2(1)(a)	You sell an AI feature to customers in Germany, paid or free
2. Deployer established in the EU	2(1)(b)	Your Amsterdam subsidiary screens applicants with an AI tool
3. Output used in the EU	2(1)(c)	Your model, run in the US, scores EU job applicants for an EU client
4. Import, distribution, products with AI built in	2(1)(d)-(e)	Your EU entity imports AI systems, or you sell a product with built-in AI under your name in the EU

This article walks through each route. For roles, risk tiers and dates, see The EU AI Act for US companies.

First: is it an AI system?

An AI system is a machine-based system that, with some autonomy, infers from its input how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments (Art. 3(1)). The word that does the work is “infers”. A tool that only applies rules your team wrote may fall outside; a model that learned from data to score, rank, classify or generate will usually fall inside. Decide this per system and note why.

The four routes into scope

1. You place a system on the EU market or put it into service there

The Act applies to providers that place AI systems on the market or put them into service in the EU, and to providers that place general-purpose AI models on the EU market, “irrespective of whether those providers are established or located within the Union or in a third country” (Art. 2(1)(a)).

Three definitions matter here (Art. 3(9)-(11)):

Placing on the market is the first making available of a system on the EU market.
Making available is supplying it for distribution or use on the EU market in the course of a commercial activity, whether paid or free.
Putting into service is supplying a system for first use directly to a deployer, or for your own use, in the EU for its intended purpose.

So a US software company that sells an AI feature to customers in Germany is placing it on the EU market, and is its provider. A free tier counts too. A company that builds, or has someone build, an AI tool for its own staff in Ireland puts it into service there.

2. You use AI from an establishment in the EU

Deployers “that have their place of establishment or are located within the Union” are in scope (Art. 2(1)(b)). If your EU subsidiary or branch uses an AI system, for example to screen applicants for roles in Amsterdam, that entity is a deployer in the EU, whoever built the tool.

3. The output of your system is used in the EU

Providers and deployers established outside the EU are in scope “where the output produced by the AI system is used in the Union” (Art. 2(1)(c)). This route is easy to miss.

Recital 22 explains the aim: to stop the rules being avoided by running a system outside the EU. Its example is an EU company that contracts a service from a company abroad, whose AI system processes data collected in the EU and sends the result back for use in the EU. The recital speaks of output “intended to be used in the Union”, while the article says “used”. Recitals help read the article but do not override it, and neither defines “used” further, so borderline cases need advice on the facts.

Cases worth examining: you run an AI model in the US that scores EU job applicants for an EU client, or that produces credit or risk scores your EU customers act on.

4. You distribute AI, import it through an EU entity, or build it into a product

The Act also covers importers and distributors of AI systems, and product manufacturers that place an AI system on the market together with their product under their own name (Art. 2(1)(d)-(e)). An importer is located or established in the EU and places on the market a system that carries the name of a company established outside the EU (Art. 3(6)), so a US company with no EU presence is not the importer. If you sell through an EU reseller, your reseller may be the importer, and you remain the provider.

From December 2, 2027 (Annex III) or August 2, 2028 (Annex I), a non-EU provider of a high-risk system must appoint an authorized representative in the EU, by written mandate, before making the system available there (Art. 22).

What keeps a system out

Art. 2 also excludes some uses. Each exclusion is narrow:

systems placed on the market, put into service or used only for military, defense or national security purposes (2(3));
systems and models, with their output, developed and put into service for the sole purpose of scientific research and development (2(6));
research, testing and development before a system is placed on the market or put into service, though testing in real-world conditions is not excluded (2(8));
the deployer duties of individuals using AI in a purely personal, non-professional activity (2(10));
systems released under free and open-source licenses, unless they are placed on the market or put into service as high-risk systems or fall under Art. 5 or Art. 50 (2(12)).

If none of the four routes applies, for example an internal tool used only by US staff on US matters with no output used in the EU, the Act does not reach that system.

What being in scope means

Being in scope tells you the Act applies. Your duties then depend on your role and the system’s risk tier:

The Art. 5 bans apply to every system in scope, since February 2, 2025, with two more from December 2, 2026.
Art. 4 AI literacy measures apply to every provider and deployer in scope.
Art. 50 transparency duties apply since August 2, 2026 to systems that interact directly with people, generative systems, emotion recognition, biometric categorization, deep fakes and some AI-generated text, each to its own role; generative systems placed on the market before August 2, 2026 have until December 2, 2026 for output marking (Art. 111(4)).
Providers of general-purpose AI models have their own duties since August 2, 2025 (Art. 53 to 55); models placed on the market before that date have until August 2, 2027 (Art. 111(3)).
High-risk duties apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I) (Art. 113), with a transition rule for systems already on the market (Art. 111(2)).

Many AI systems carry only the first two. That is why the role question comes next: Provider or deployer: your EU AI Act role.

Without an EU establishment, the GDPR reaches a company when it processes personal data of people in the EU in offering them goods or services or monitoring their behavior there (GDPR Art. 3(2)). The AI Act uses different tests: the market, an EU establishment, and where the output is used. A company can be in scope of one law and not the other. An AI system that processes personal data of people in the EU can be in scope of both, and the AI Act leaves the GDPR in place (Art. 2(7)). See GDPR for US companies with EU users and GDPR basics for US companies with EU users.

Questions to answer for each system

Does it infer its outputs, or only follow rules people wrote?
Do we offer it, paid or free, to anyone in the EU?
Do we, or an EU entity of ours, use it in the EU?
Is its output used in the EU, by us or by a customer?
Does it reach the EU through a reseller, an importer or one of our products?
Does an Art. 2 exclusion clearly apply?

Write the answers down with the date; they change as your product and customers change.

Sources

AI Act Service Desk (text as amended by the Digital Omnibus): Art. 2, Art. 3, Art. 4, Art. 5, Art. 22, Art. 50, Art. 53, Art. 111, Art. 113, Recital 22
Regulation (EU) 2024/1689, Official Journal
Regulation (EU) 2016/679 (GDPR), Official Journal, Art. 3

This page is general information, not legal advice.