Does the EU AI Act Apply Outside the EU?
The EU AI Act can reach a business with no EU office. Article 2 sets three triggers, including output used in the Union. Here is how to check yours.
Yes, the EU AI Act can apply to a business established entirely outside the EU. Having no European office, no European entity and no European marketing does not put you outside its scope. Article 2 ties the rules to where an AI system is placed on the market, where it is used, and where its output is used, not to where the company sits. The practical question is not whether the Act could reach you but which of three triggers it reaches you through, because that decides what you actually have to do.
This post covers scope only. For the dates and what landed when, see our posts on the high-risk deadline and the transparency rules that took effect in 2026.
The three triggers in Article 2
Reading Article 2 directly is quicker than reading commentary about it. Three paragraphs do the work for anyone outside the Union.
Provision | Who it catches | Plain reading |
|---|---|---|
Article 2(1)(a) | Providers placing an AI system or general-purpose AI model on the Union market | Applies "irrespective of whether those providers are established or located within the Union or in a third country" |
Article 2(1)(c) | Providers and deployers in a third country "where the output produced by the AI system is used in the Union" | No EU presence and no EU sales needed. The output arriving in the EU is enough |
Article 2(1)(g) | Affected persons located in the Union | The people on the receiving end are protected wherever the system was built |
Article 2(1)(f) adds authorised representatives of providers not established in the Union, which is the mechanism by which a non-EU provider is expected to have someone answerable inside the bloc.
The output trigger is the one that surprises people
Article 2(1)(a) is intuitive. Sell into the EU, follow EU rules. Article 2(1)(c) is the one worth sitting with, because it does not require you to sell anything there.
Consider a freelancer in a third country who screens job applicants with an AI tool for a client, and some of those applicants are in the EU. Or a support product whose summaries are read by a European team. Or a scoring system run entirely on servers far from Europe whose decisions are acted on by someone in Dublin. In each case the system sits outside the Union and the output is used inside it. That is the trigger, and it does not care about your billing address.
Two caveats keep this from being as alarming as it first sounds. Scope is not the same as obligation: being in scope means the Act's framework applies, and what you must then do depends on your role and the risk tier of the use. The Act's heaviest duties attach to a defined set of high-risk uses, not to everything that produces output.
Provider or deployer, and why it decides everything
The Act's duties are split by role, and the roles are easy to get wrong because the everyday words do not match the legal ones.
Provider. Broadly, you develop an AI system or model and place it on the market or put it into service under your own name. Providers carry the heavier obligations.
Deployer. Broadly, you use an AI system under your own authority in a professional context. Deployer duties are lighter but real, and they are the ones most small businesses land in.
Most people building with existing models are deployers of someone else's system. The trap is that putting your own name on a system, or materially changing what it does, can move you into provider territory for that system. If you resell an assistant as your own product, assume you are closer to provider than you feel. Our piece on EU AI Act information requests works through the same split in the context of a regulator getting in touch.
How to check your own position
Name the system. Not "we use AI", but the specific system and the specific use. Scope is assessed per system and per use, not per company.
Decide your role for that system: provider or deployer, per the definitions rather than the job title.
Ask where the output lands. If any of it is used in the Union, note it. This is the trigger people miss.
Check the risk tier for that use. Most ordinary business uses are not high-risk, and the difference in obligations between tiers is large.
Check the transparency duties separately. These can apply even where the risk tier is low, particularly when people interact with an AI system or when content is generated.
Write down the answer and the date. The value of this exercise is having a record that you did it before anyone asked.
Step five is the one that catches consumer-facing products, and it overlaps with a question we covered separately in whether you need to label AI-generated content.
What this is not
This is an explainer, not legal advice, and the Act is being amended. In May 2026 EU legislative bodies reached a political agreement on proposed amendments, which still required formal adoption at the time of writing, so treat specific deadlines as moving and verify them against a current source before you rely on one. The territorial logic in Article 2 is the stable part, and it is the part most coverage leaves out.
For the broader set of exposures that come with shipping AI features, see our overview of AI risks.
Frequently asked questions
I have no EU customers. Am I out of scope?
Not necessarily. Article 2(1)(c) brings in providers and deployers in third countries where the output produced by the AI system is used in the Union, which can happen without you selling to anyone there.
Does the Act apply to me if I only use ChatGPT for admin work?
Using a general assistant for internal tasks sits at the light end. You would be a deployer, and ordinary internal use is not among the high-risk categories that carry the heavy obligations. Transparency duties still deserve a check if output reaches customers.
What is the difference between a provider and a deployer?
A provider develops an AI system or model and places it on the market or puts it into service under its own name. A deployer uses such a system under its own authority. Providers carry the heavier duties, and putting your own brand on a system can move you toward provider status.
Do I need an authorised representative in the EU?
Article 2(1)(f) covers authorised representatives of providers not established in the Union, so the requirement attaches to providers in specific circumstances rather than to everyone in scope. Check against your role and risk tier rather than assuming either way.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
