Does the EU AI Act apply outside the EU?

How it works

The three Article 2 hooks that matter most

The AI Act's external reach is built into Article 2(1). For a non-EU organisation, the three practical hooks are these. First, you are in scope if you place an AI system on the Union market or place a general-purpose AI model on the Union market, even if you are established in a third country. Second, you are in scope if you put an AI system into service in the Union. Third, you are in scope if you are a provider or deployer in a third country and the output produced by the AI system is used in the Union.

Those hooks sit alongside other in-scope roles such as importers, distributors, product manufacturers, authorised representatives and affected persons in the Union. So the scope question is not just "are we a provider?" It is also "are we acting through an importer or distributor, are we bundling AI into another product, and who uses the output?"

The definitions in Article 3 make the mechanics more concrete. "Placing on the market" means first making available on the Union market. "Making available" covers supply for distribution or use on the Union market in the course of a commercial activity, whether paid or free. "Putting into service" means first supply for direct use by the deployer, or for own use in the Union, for the system's intended purpose.

Why server location is not the decisive test

A common mistake is to treat scope as a hosting question. The AI Act does not use a server location test. Its territorial logic is tied to the Union market and to use of outputs in the Union.

Recital 22 is especially important here. It explains that the Act is meant to catch certain digitally delivered AI systems even when they are not placed on the market, put into service or used inside the Union in the ordinary physical sense. The recital gives the example of an operator in the Union contracting with a third-country operator for a high-risk AI activity performed abroad, then using the resulting output in the Union. The goal is to prevent easy circumvention by offshoring processing while keeping the practical effect in the EU.

The Act's operative text says the output is "used in the Union". The recital frames the same anti-circumvention idea in terms of output "intended to be used" in the Union. In practice, this means non-EU organisations should assess both actual EU use and the design, sales and contractual reality of EU-facing use. If your workflow is built to support an EU customer, an EU employer, an EU public authority or an EU operational process, being offshore is not a safe shortcut out of scope.

What "placing on the market" and "putting into service" look like in practice

For software and model businesses, "placing on the market" is usually the commercial release point. If you first supply an AI system or model for EU distribution or use, including for free as part of a commercial activity, you are likely in the scope path that starts at Article 2(1)(a). That can cover direct sales, API access, platform availability, private beta access for EU customers, or release through a channel that targets EU use.

"Putting into service" matters where the product is activated for first use in the Union, including own use in the Union for its intended purpose. This can matter when a provider does not "sell a copy" in a traditional sense but deploys or switches on a system for an EU customer, affiliate or internal EU operation.

For non-EU SMEs, the practical point is this: a paid invoice is not the only way to enter scope. Product release, onboarding and operational activation matter too.

When a non-EU provider needs an authorised representative

There is no single rule saying every non-EU AI company must appoint an EU authorised representative. The answer depends on what you provide.

For high-risk AI systems, Article 22 requires a provider established in a third country to appoint an authorised representative in the Union before making those high-risk systems available on the Union market. The representative is not just a mailbox. The mandate must enable the representative to verify that the EU declaration of conformity and technical documentation exist and that the relevant conformity assessment has been carried out; keep core records for 10 years; provide information and documentation to authorities on reasoned request; cooperate with authorities on risk reduction and mitigation; and, where relevant, handle or verify registration obligations. If the representative concludes that the provider is acting contrary to the Act, it must terminate the mandate and inform the relevant authority.

For general-purpose AI models, Article 54 already imposes a separate authorised representative requirement on third-country providers before placing a GPAI model on the Union market. The representative must verify that the required technical documentation exists and that the provider has fulfilled the Article 53 obligations, and where relevant Article 55 obligations for systemic risk models; keep records for 10 years; provide information to the AI Office and national competent authorities on reasoned request; and cooperate with the AI Office and authorities. This obligation does not apply to providers of free and open-source GPAI models unless the model presents systemic risk.

The timing point is critical. As of 21 July 2026, the adopted Digital Omnibus on AI had not yet been published in the Official Journal. That means the current law formally still points to the original application dates of Regulation (EU) 2024/1689. Under that current law, the high-risk system provisions in Chapter III Section 3, including Article 22, are due to apply from 2 August 2026. But the adopted Omnibus text would move the main Chapter III Sections 1 to 3 timetable to 2 December 2027 for Annex III standalone high-risk systems and to 2 August 2028 for Annex I embedded-product high-risk systems, once the amending regulation is published and enters into force. By contrast, the GPAI rules in Chapter V, including Article 54, are already applicable and are not moved by the Omnibus.

What this means for UK and US organisations serving EU customers

For AI Act purposes, both UK and US organisations are third-country organisations. Neither needs an EU establishment to be caught.

If a UK or US company sells an AI system into the EU, offers a GPAI model to EU customers, or runs an offshore system whose output feeds an EU workflow, it should assume the AI Act is a live scoping question. In practice, EU customers will increasingly ask for role mapping, intended purpose statements, transparency notices, compliance roadmaps, and, where relevant, details of your authorised representative and conformity process.

If the system is not high-risk and not covered by the GPAI rules, the Act may still matter through Article 50 transparency obligations from 2 August 2026, for example where users interact with AI, emotional or biometric inferences are involved, or synthetic content labelling duties apply. If none of the territorial hooks is met, and the system is purely internal with no EU market placement, no EU putting into service and no output used in the Union, the AI Act is much less likely to apply. That said, the AI Act is not the only EU-facing rule. Data protection, consumer, sectoral and product rules may still matter separately.

The dates that matter now, and the dates that may change

The baseline law in force is Regulation (EU) 2024/1689, in force since 1 August 2024. Under that law as it formally stands on 21 July 2026, AI literacy and the Article 5 prohibitions have applied since 2 February 2025. Chapter III Section 4 on notified bodies, Chapter V on GPAI, Chapter VII on governance, Chapter XII on penalties and Article 78 have applied since 2 August 2025. The general application date for the rest of the Regulation, including Article 50 transparency, is 2 August 2026. Article 6(1) and its corresponding obligations are set for 2 August 2027.

The adopted Digital Omnibus on AI changes that timetable, but only once it is published in the Official Journal and enters into force on the third day after publication. On 21 July 2026, the European Parliament's OEIL file still showed the procedure as completed and awaiting publication in the Official Journal. So the legally careful position is this: the current AI Act dates formally remain in place until the Omnibus enters into force.

Once it does, the practical date changes most relevant to non-EU businesses are narrower than many headlines suggest. The Omnibus does not move the Article 4 AI literacy duty, the prohibitions already in force, the GPAI timetable, or the general date from which Article 50 applies. It does, however, create a transitional rule for providers of synthetic-content systems already placed on the market before 2 August 2026, giving them until 2 December 2026 to comply with Article 50(2). It also moves the main Annex III standalone high-risk obligations to 2 December 2027 and the Annex I embedded-product high-risk obligations to 2 August 2028.

A short note on the Brussels effect

In practice, some non-EU organisations will not build one EU-only compliance stack and one rest-of-world stack forever. They will decide that maintaining different models, notices, governance controls and product defaults by geography is too costly or too brittle, and will instead raise their global baseline to the stricter standard. That dynamic is often called the "Brussels effect". It is not inevitable, and geo-fencing or regional product segmentation can still work, but the pull is strongest where services are digital, centrally managed and sold across borders.

A practical checklist for a non-EU SME deciding whether it is in scope

Ask these questions in order.

First, what role are you actually playing under the Act: provider, deployer, importer, distributor, product manufacturer or GPAI provider?

Second, what is the Union connection: are you placing a system or model on the Union market, putting an AI system into service in the Union, or producing outputs used in the Union?

Third, what category are you dealing with: prohibited practice, Article 50 transparency case, high-risk AI system, or GPAI model?

Fourth, if you are a non-EU provider, do you need an authorised representative now: for GPAI, often yes already; for high-risk systems, the answer depends on whether you are following the current law formally still in force or the Omnibus-adjusted timeline once the amending regulation enters into force.

Fifth, do your product materials clearly define intended purpose, context of use, customer territory and who is allowed to use the output? Those facts matter for scoping and classification.

Sixth, are your commercial, technical and governance teams aligned on the dates? As of 21 July 2026, you need a dual-track plan: comply with rules already applicable now, prepare for Article 50 on 2 August 2026, and keep an updated timetable ready for the Omnibus high-risk shifts once publication occurs.

If the answer to every territorial hook is no, you may be out of scope for now. But review again whenever you add EU customers, EU-facing features, distributor relationships, or offshore support for EU operations.