Does the EU AI Act Apply to Non-EU Companies? The Extraterritorial Reach
The EU AI Act reaches non-EU companies: it applies if you place AI on the EU market, or if your system's output is used in the EU — wherever you are based.
Yes — the EU AI Act, Regulation (EU) 2024/1689, reaches well beyond the EU's borders. Like the GDPR before it, the Act applies based on where the AI is placed on the market or used, not on where the company is established. A US, UK or APAC company can be squarely in scope without an EU office.
The scope triggers (Article 2)
Article 2 brings you into scope if any of these apply:
- you are a provider placing an AI system (or GPAI model) on the EU market or putting it into service in the EU, irrespective of where you are established;
- you are a deployer of an AI system located within the EU;
- you are a provider or deployer established outside the EU, where the output produced by the AI system is used in the EU.
That third trigger is the long arm: even if you and your system sit outside the EU, if its output is used in the Union, the Act can apply.
What being in scope means for a non-EU company
If you are a non-EU provider of a high-risk system in scope, you must meet the provider obligations (Articles 9–16), run the conformity assessment, and — importantly — appoint an EU authorised representative under Article 22 before placing the system on the market. A non-EU GPAI model provider must appoint a representative under Article 54. So the Act gives EU authorities a point of contact inside the Union even for foreign providers.
What is carved out
Article 2 also sets exclusions: AI systems used purely for military, defence or national-security purposes; scientific research and development; purely personal, non-professional use by individuals; and (narrowly) free and open-source systems that are not high-risk, prohibited, or subject to Article 50 (Article 2(12)). These limit the reach at the edges.
Worked example: a US SaaS vendor
A US SaaS company embeds an AI feature and sells to EU customers. Because it places the system on the EU market, it is in scope under Article 2 — and if the feature is high-risk, it must meet the provider obligations and appoint an Article 22 authorised representative. Even a US company that only processed EU users' data and returned output used in the EU could be caught by the third trigger. Being outside the EU is not, by itself, being outside the Act.
How Confir helps
Confir helps a non-EU company determine whether it is in scope under Article 2 — by where it places systems and where output is used — and, if so, scope the provider or deployer obligations and the authorised-representative requirement. The engine is deterministic and rule-based, so the scope conclusion is documented and reproducible.
Frequently asked questions
Does the EU AI Act apply to companies outside the EU?
Yes. Under Article 2 it applies to providers placing AI systems or GPAI models on the EU market regardless of where they are established, to deployers located in the EU, and to non-EU providers and deployers where the system's output is used in the EU. Establishment outside the EU does not put you out of scope.
What is the "output used in the EU" trigger?
It is the provision in Article 2 that brings non-EU providers and deployers into scope where the output produced by their AI system is used within the EU, even if the company and the system sit outside the Union. It is the Act's longest reach.
What must a non-EU provider do?
Meet the provider obligations for its risk tier, run the conformity assessment for high-risk systems, and appoint an EU authorised representative under Article 22 (or Article 54 for GPAI models) before placing the system on the EU market. The representative is the EU-side point of accountability.
What is excluded from scope?
AI for military, defence or national security; scientific research and development; purely personal, non-professional use; and, narrowly, free and open-source systems that are not high-risk, prohibited, or subject to Article 50 transparency under Article 2(12).
How is this like the GDPR?
Both apply based on market and effects rather than establishment. Just as the GDPR reaches non-EU companies processing EU residents' data, the AI Act reaches non-EU companies placing AI on the EU market or whose AI output is used in the EU.
Related guides
- Does the EU AI Act apply to your company?
- Authorised representative under the AI Act
- Who enforces the EU AI Act?
- Provider versus deployer roles
- How AI risk classification works
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →