Does the EU AI Act Apply to UK, US and Non-EU Companies?

Yes, the EU AI Act applies to many non-EU companies. Under Article 2 it covers any provider placing AI on the EU market, wherever it is based, and any provider or deployer outside the EU whose AI output is used in the EU. UK, US and Indian companies serving EU customers or EU-based people are therefore often in scope.

Key takeaways

• The AI Act follows the market and the output, not the company's headquarters.
• The UK is not bound domestically, but UK businesses that sell AI into the EU, or use AI whose output affects people in the EU, can be caught.
• Non-EU providers of high-risk AI systems must appoint an EU authorised representative by written mandate before placing the system on the market (Article 22).
• EU importers and distributors carry their own checks, so non-EU vendors will feel the Act through their contracts even where they are not directly targeted.
• Fines are calculated on worldwide annual turnover, up to €35 million or 7% for prohibited practices.

How the AI Act reaches beyond the EU (Article 2)

Article 2 of Regulation (EU) 2024/1689 sets the territorial scope. In short, the Act applies to:

• providers placing AI systems on the market or putting them into service in the EU, or placing general-purpose AI models on the EU market, whether they are established in the EU or in a third country;
• deployers established or located in the EU;
• providers and deployers established or located in a third country, where the output produced by the AI system is used in the EU;
• importers and distributors of AI systems;
• product manufacturers placing an AI system on the market together with their product under their own name or trademark;
• authorised representatives of providers not established in the EU; and
• affected persons located in the EU.

The third bullet is the one that surprises people. A company with no EU office, no EU servers and no EU contracts can still be in scope if the predictions, recommendations, content or decisions its AI produces are used in the EU. You can read the full wording of Article 2 on scope; for the wider structure of the Act, see our EU AI Act guide.

To check quickly how this applies to your own systems, markets and roles, use the free EU AI Act readiness assessment; it ends with governance documents written from your answers.

There are exclusions: AI used exclusively for military, defence or national security purposes, AI developed and used solely for scientific research and development, research and testing before a system is placed on the market (real-world testing excepted), purely personal non-professional use, and many free and open-source systems unless they are high-risk, prohibited or covered by Article 50.

Will the EU AI Act apply to the UK?

Not as UK law. The UK left the EU before the AI Act was adopted, and it has not adopted the regulation into domestic law. As of October 2026, the UK continues to rely mainly on existing regulators and sector rules rather than a single horizontal AI statute, so check for UK developments separately.

But the AI Act still reaches UK businesses in three common situations:

1. You sell or license an AI system to customers in the EU. You are a provider placing it on the EU market.
2. You use AI whose output is used in the EU. For example, a UK-based team scoring applications from EU residents.
3. Your AI is built into a product sold in the EU. The product manufacturer and its supply chain will need AI Act conformity.

A UK company using AI only on UK staff and customers, with no output used in the EU, is generally outside the Act.

What about US companies?

The position for US companies is the same as for UK ones: the Act does not care where the provider is incorporated. A US SaaS vendor with EU customers is a provider placing AI on the EU market. A US employer screening candidates in Germany or Ireland is a deployer whose output is used in the EU. US providers of general-purpose AI models available in the EU have been subject to the GPAI obligations since 2 August 2025, and must appoint an EU authorised representative for their models under Article 54.

US companies are often already familiar with this pattern from GDPR. The scope tests are not identical, though. Our article on how the EU AI Act and GDPR interact explains where they overlap and where they diverge.

Roles decide your obligations

Being in scope does not tell you what you must do. That depends on your role for each system and on the system's risk tier. A provider of a high-risk system carries the heaviest load: risk management, technical documentation, conformity assessment, CE marking, registration and post-market monitoring. A deployer of the same system has lighter, but real, duties under Article 26. The provider vs deployer obligations guide sets them side by side, and the four risk tiers explain which systems carry which duties.

The EU authorised representative (Article 22)

A provider established outside the EU must, before making a high-risk AI system available on the EU market, appoint an authorised representative established in the EU by written mandate. The provider must enable the representative to carry out the tasks in the mandate. Those tasks include:

The mandate must allow authorities to address the representative, in addition to or instead of the provider, on compliance matters. If the representative believes the provider is acting contrary to the Act, it must terminate the mandate and inform the market surveillance authority and, where relevant, the notified body. In other words, the representative is not a letterbox; it carries real responsibility and will want contractual protection and evidence. With the Digital Omnibus, these duties bite from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, as set out in the EU AI Act timeline.

Worked examples

1. A US SaaS company selling into the EU

A US company sells a customer-support platform with a built-in AI chatbot and an AI feature that drafts replies. It has customers in France and the Netherlands but no EU entity. It is a provider placing AI on the EU market. The chatbot falls under Article 50: since 2 August 2026, it must be designed so people are told they are interacting with AI, unless that is obvious. If the reply-drafting feature generates synthetic text, machine-readable marking applies too, with a grace period to 2 December 2026 only if it was on the market before 2 August 2026. If the company built on a third-party general-purpose model, it relies on that model provider's documentation. None of this is high-risk, so no authorised representative is required for these features. If it later adds an AI module that scores customers' creditworthiness for EU lenders, that module is Annex III high-risk and an authorised representative becomes mandatory.

2. A UK employer using AI screening for EU candidates

A UK retailer hires for stores in Ireland and Spain and uses an AI tool to rank applicants. The retailer is a deployer, and because the ranking output is used to make decisions about candidates in the EU, the Act applies. Employment uses in Annex III point 4 are high-risk, so from 2 December 2027 the retailer must use the tool according to its instructions, assign trained people to oversee it, ensure input data is relevant, monitor operation, keep logs for at least six months and inform workers' representatives and candidates as required by Article 26. If the tool analyses facial expressions in video interviews to infer emotions, it is not just high-risk: emotion recognition in the workplace has been prohibited since February 2025. The vendor, if established outside the EU, needs an EU authorised representative.

3. An Indian IT services firm building AI for EU clients

An IT services company in Bengaluru builds a claims-triage model for a German insurer. Who is the provider? Usually the party that places the system on the market or puts it into service under its own name. If the insurer puts the system into service under its own name, the insurer is the provider and the Indian firm is a supplier whose contract must deliver the documentation, data-governance evidence and logging the insurer needs. If the Indian firm sells the same model as its own product to several EU insurers, it becomes the provider. Pricing and risk assessment in life and health insurance is Annex III high-risk, so it would then need an EU authorised representative, conformity assessment and registration. Either way, AI literacy measures for the delivery team and Article 50 checks apply now.

Penalties for non-EU companies

Non-EU companies face the same ceilings as EU ones, calculated on worldwide annual turnover: up to €35 million or 7% for prohibited practices, and up to €15 million or 3% for most other breaches. Authorities can direct enforcement at the authorised representative, and EU importers and distributors can refuse or withdraw non-compliant products. See EU AI Act penalties and fines for the full tier table.

A practical checklist for non-EU companies

1. List every AI system you build, sell or use, and mark where its output is used.
2. For each EU-touching system, record your role: provider, deployer, importer, distributor or product manufacturer.
3. Check for prohibited uses and Article 50 duties first; both already apply.
4. For high-risk systems you provide, appoint and contract an EU authorised representative well before the deadline.
5. Update customer and supplier contracts so documentation, logs and incident information flow to whoever needs them.
6. Record AI literacy measures for staff who build or operate AI used in the EU.

Frequently asked questions

Does the EU AI Act apply to US companies?

Yes, where they place AI systems or general-purpose AI models on the EU market, or where the output of their AI is used in the EU. Incorporation in the US makes no difference. US providers of high-risk systems and GPAI models must appoint an EU authorised representative, and fines are based on worldwide turnover.

Do we need an EU authorised representative?

You need one if you are a provider established outside the EU and you make a high-risk AI system available in the EU (Article 22), or if you provide a general-purpose AI model in the EU (Article 54). The appointment must be by written mandate and made before the system or model is placed on the market. Deployers do not need one.

What if we only use AI internally, outside the EU?

If neither the system nor its output is used in the EU, the AI Act generally does not apply. The test is where the output is used, not where the server sits. A group with EU subsidiaries that rely on centrally produced AI outputs, such as HR scoring or credit decisions, will usually be in scope for those uses.

Is an AI system from a US vendor our problem or the vendor's?

Both. The vendor, as provider, carries provider duties, but as the deployer you carry Article 26 duties for high-risk systems and Article 50 duties for certain uses. Your contract should require the documentation, instructions, logging and incident information you need to meet your own obligations.

Find out where your business stands

Scope questions are easier to answer system by system. Opsio's free AI governance assessment takes about 40 minutes across 14 steps and gives you four editable Word documents written from your answers: an AI Governance Framework, AI Acceptable Use Policy, AI Vendor Due Diligence Checklist and AI Risk Assessment Template, plus a maturity score across ten governance areas. Free, no card, no obligation.

This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Statements reflect the position as of October 2026.