EU AI Act for Australian Companies: How Article 2 Reaches You

A Sydney SaaS company whose AI recruitment tool is used by an employer in Amsterdam is bound by the EU AI Act — even though Australia has, as of mid-2026, chosen voluntary guidance over a mandatory AI law. This is the part Australian companies most often miss. The EU AI Act is not Australian law and never becomes Australian law; there is no Australian application date. But Article 2 of Regulation (EU) 2024/1689 gives the Act deliberate extraterritorial reach, and it catches Australian providers and deployers the moment they place an AI system on the EU market or their system's output is used in the Union. Australia's decision not to legislate mandatory guardrails does nothing to soften that reach.

---

Australia is a third country: the Act never becomes Australian law

Australia is not an EU Member State and not part of the European Economic Area (EEA). There is no transposition route, no EEA incorporation, by which the EU AI Act enters Australian federal or state law. So for an Australian company the only question that matters is the extraterritorial one: does your activity bring you within Article 2?

Australia chose voluntary guidance — there is no Australian AI Act to wait for

In 2024 the Australian Government consulted on mandatory guardrails for high-risk AI alongside a Voluntary AI Safety Standard (ten guardrails). But in December 2025 the National AI Plan confirmed that Australia will rely on existing, technology-neutral laws and sector regulators — supported by voluntary guidance and a new AI Safety Institute — rather than introduce a standalone AI Act or immediate mandatory guardrails. The earlier proposal for a dedicated high-risk AI regime was effectively paused. The practical effect for compliance teams: there is no comprehensive Australian AI statute in force, and the voluntary guardrails are not law.

Australia's actual AI landscape is voluntary plus general law

In place of an AI Act, Australian AI governance runs through the Privacy Act and other existing technology-neutral laws, sector regulators, the Voluntary AI Safety Standard, and the National AI Centre's guidance for AI adoption. None of that is a substitute for the EU AI Act, and the EU AI Act is not a substitute for any of it. An Australian company selling AI into the EU faces both pictures in parallel — treat the Australian side as fast-moving and a matter for separate Australian counsel.

---

Article 2: the two limbs that catch Australian companies

Article 2 sets the Regulation's scope, and it is written to reach beyond EU borders so that non-EU providers cannot undercut EU ones by staying offshore.

Placing AI on the EU market (Article 2(1)(a))

Under Article 2(1)(a), any provider that places an AI system on the EU market or puts it into service in the Union is in scope, regardless of where it is established. An Australian company that sells, licenses, or otherwise makes its AI product available to customers in Germany, France, or Ireland is caught — incorporation in New South Wales and servers in Sydney change nothing.

Output used in the Union (Article 2(1)(c))

Under Article 2(1)(c), a provider or deployer established in a third country is in scope where the output of the AI system is used in the Union. The test is where the effect lands, not where the company or server sits. An Australian company whose model scores, ranks, or generates content about people in the EU is caught on this limb even with no EU customer contract.

The authorised-representative obligation (Article 22)

An Australian provider of a high-risk system must, before placing it on the EU market, appoint an authorised representative established in the Union under Article 22. This is a designated in-Union point of contact and accountability — structurally similar to the EU-representative requirement Australian firms may already meet under the GDPR, but a separate appointment under a separate statute.

---

Timeline: the EU dates apply to in-scope Australian companies

There is no separate Australian date. An Australian company in scope through Article 2 plans against the EU statutory calendar.

The Digital Omnibus high-risk deferral

The Digital Omnibus on AI is law: Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. The amended Regulation now sets one date for each tier: stand-alone Annex III high-risk obligations apply from 2 December 2027, and product-embedded Annex I high-risk obligations from 2 August 2028.

What did not move

The deferral moved the high-risk dates, not the obligations already in force. Article 5 prohibitions and Article 4 literacy have applied since 2 February 2025 (Article 4 in its softer "measures to support AI literacy" wording since 27 July 2026); GPAI obligations under Articles 51–55 since 2 August 2025. For Australian foundation-model and GPAI providers placing models on the EU market, the GPAI duties are live now — and models on the EU market before 2 August 2025 have until 2 August 2027 to comply under the transitional provision.

---

What in-scope Australian companies actually have to do

The obligations are the EU obligations

Because the Act binds through Article 2 rather than any Australian transposition, an in-scope Australian provider or deployer faces the same role-based duties as an EU company. There is no Australia-lite version. The roles map identically: provider, deployer, importer, distributor — with importer duties at Article 23 and distributor duties at Article 24.

The Article 25 role-shift

A deployer, distributor, or importer becomes a provider under Article 25 the moment it puts its own name or trademark on a high-risk system, substantially modifies it, or changes its intended purpose. An Australian company that fine-tunes a base model into a new high-risk purpose, or rebrands a high-risk EU tool, can inherit the full provider stack without realising it.

High-risk duties and penalties

For a stand-alone Annex III high-risk system, the provider stack applies in full: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness (Articles 9–15), conformity assessment, the Article 49 registration, and provider obligations under Article 16. Penalties are the Article 99 tiers — identical figures, calculated on worldwide turnover, not EU or Australian revenue: up to €35 million or 7% for Article 5 breaches (Article 99(3)); up to €15 million or 3% for most other obligations including high-risk provider duties (Article 99(4)); up to €7.5 million or 1% for supplying incorrect or misleading information (Article 99(5)). For SMEs, Article 99(6) caps the fine at the lower of the fixed amount or the percentage. Separately, GPAI model providers are fined by the Commission under Article 101 (up to €15 million or 3%), not under Article 99.

---

Worked example: a Sydney SaaS firm selling AI recruitment software into the EU

Coralline Pty Ltd is a roughly 130-employee Sydney SaaS company with around AUD $24 million in annual revenue. It sells an AI candidate-screening and ranking tool, and several customers are employers in the Netherlands and Ireland.

Why Coralline is in scope now

As a provider placing the system on the EU market, Coralline is in scope under Article 2(1)(a) today — no EU office is required, and the absence of a European entity is irrelevant. Its tool is high-risk under Annex III point 4(a) (recruitment and selection of natural persons), which triggers the full provider stack under Articles 9–15. Even where Coralline has no direct EU contract, Article 2(1)(c) can catch it where the tool's output is used to assess candidates in the Union.

The prohibited-practice gate comes first

Before any high-risk work, Coralline must clear the hard gate at Article 5(1)(f): emotion recognition in the workplace context is a prohibited practice. If the screening flow infers emotion from video interviews — reading "confidence" or "enthusiasm" from facial expression or tone — that feature must be removed for the EU market regardless of high-risk status. A prohibited practice cannot be cured by documentation; it is simply banned.

Coralline's pre-market checklist

• Appoint an Article 22 authorised representative established in the Union before placing the system on the EU market.
• Build the Article 11 / Annex IV technical documentation and the Article 47 / Annex V EU declaration of conformity.
• Run the conformity assessment and register the system under Article 49.
• Note the exposure: a high-risk provider breach sits in the Article 99(4) tier; as an SME, Coralline benefits from the Article 99(6) cap at the lower of the fixed amount or the percentage, so 3% of revenue is the operative ceiling, not the €15 million figure.
• Keep Australian obligations — the Privacy Act, the Voluntary AI Safety Standard — running in parallel; the EU file does not discharge them, and vice versa.

---

What Australian companies should do now

Map your EU exposure, not your Australian status

Do not start from "is there an Australian AI law?" — there is no comprehensive one in force, and the voluntary guardrails are not law. That does not reduce your EU exposure by a single obligation. Start from "do we touch the EU market?" If you place AI on the EU market or your output is used in the Union, the EU timeline binds you through Article 2.

A five-step starting checklist

1. Map your AI systems against Article 2 to confirm where you place systems on the EU market or your output reaches the Union.
2. Classify each system: clear the Article 5 prohibited-practice gate first, then assess Article 6 / Annex III for high-risk status.
3. Assign roles — provider, deployer, importer, distributor — and run the Article 25 conversion check on anything you rebrand, fine-tune, or repurpose.
4. For high-risk systems, appoint an Article 22 authorised representative in the Union before market placement.
5. Build the compliance file: risk management, Annex IV documentation, conformity assessment, and the Annex V declaration of conformity — and keep your Australian obligations running in parallel.

Two developments to monitor

Track two moving pieces for legal review: EU implementing guidance for the high-risk regime (the Commission's draft Article 6 classification guidelines of May 2026, and harmonised standards still being finalised), and whether Australia revives mandatory guardrails or a dedicated AI Act — which may add Australian obligations but will not displace the EU AI Act's extraterritorial reach.

---

How Confir helps Australian companies

Confir derives your provider, deployer, importer, or distributor role and classifies your systems under Articles 5 and 6 with Annex III logic from plain-language intake. The engine is deterministic and rule-based — no model inference, no hallucination — so the same intake always yields the same audit-defensible finding with a human-readable explanation of which rule fired.

Confir generates the Article 11 / Annex IV technical documentation pack and the Article 47 / Annex V declaration of conformity, and supports the Article 27 Fundamental Rights Impact Assessment where it applies. The aim is to give an Australian company an EU-market compliance file that stands on its own, separate from whatever Australian federal and state obligations apply. The GPAI workflow (Articles 51–55) is partial and on the roadmap, not presented as complete. Confir is EU-hosted, at confir.eu.

Related guides

• EU AI Act extraterritorial reach for non-EU companies
• EU AI Act for US companies: Article 2 reach
• EU AI Act scope explained (Article 2)
• EU AI Act high-risk classification (Article 6)
• EU AI Act deadlines and application dates