EU AI Act for US Companies: How Article 2 Reaches American AI Providers

A San Francisco SaaS company whose AI hiring tool is used by an employer in Berlin is bound by the EU AI Act — even though the company has no European office, no European entity, and no intention of "complying with EU law." This is the part US companies most often get wrong. The EU AI Act is not US law and never becomes US law; there is no US application date. But Article 2 gives the Regulation deliberate extraterritorial reach, and it catches US providers and deployers the moment they place an AI system on the EU market or their system's output is used in the Union. For a US company, Article 2 is not a bridge to some future domestic regime — it is the entire and permanent basis on which the Act can bind you.

---

The US is a third country: the Act never becomes US law

The United States is not an EU Member State and not part of the European Economic Area (EEA). There is no mechanism — no transposition, no EEA incorporation — by which Regulation (EU) 2024/1689 becomes US federal or state law. So the only question that matters for a US company is the extraterritorial one: does your activity bring you within Article 2?

No US application date to wait for

For an EU company, the Act applies on fixed EU calendar dates. For a US company, those dates are not a domestic switch-on; they are simply the dates on which US companies already in scope through Article 2 must comply. There is no separate "US date," and waiting for one is waiting for something that will never come.

The US's own AI landscape is separate and fragmented

The US has no single federal AI statute equivalent to the EU AI Act. Federal activity has run through executive action and agency guidance, while a growing patchwork of state laws (Colorado's since-repealed AI Act — replaced in 2026 by a narrower disclosure framework — and various state measures on automated decision-making, deepfakes, and biometric data) adds sector- and state-specific obligations. None of that satisfies the EU AI Act, and the EU AI Act does not satisfy any of it. A US company selling into the EU faces both regimes, in parallel — treat the US picture as fast-moving and a matter for separate US counsel.

---

Article 2: the two limbs that catch US companies

Article 2 sets the Regulation's scope, and it is written to reach beyond EU borders precisely so that non-EU providers cannot undercut EU ones by staying offshore.

Placing AI on the EU market (Article 2(1)(a))

Under Article 2(1)(a), any provider that places an AI system on the EU market or puts it into service in the Union is in scope, regardless of where it is established. A US company that sells, licenses, or otherwise makes its AI product available to customers in Germany, France, or Ireland is caught — incorporation in Delaware and servers in Virginia change nothing. Placing the system on the EU market is what brings you in.

Output used in the Union (Article 2(1)(c))

Under Article 2(1)(c), a provider or deployer established in a third country is in scope where the output of the AI system is used in the Union. US companies already know this logic from the GDPR: the test is where the effect lands, not where the company or the server sits. A US company whose AI output reaches people in the EU is caught on this limb even with no EU customer contract — for example, where a US-built model scores or generates content about people in the EU.

The authorised-representative obligation (Article 22)

A US provider of a high-risk system must, before placing it on the EU market, appoint an authorised representative established in the Union under Article 22. This parallels the EU-representative requirement many US firms already meet under the GDPR (GDPR Article 27) — a separate appointment under a separate statute, but the same structural need for an in-Union point of contact and accountability.

---

Timeline: the EU dates apply to in-scope US companies

There is no separate US date. A US company in scope through Article 2 plans against the EU statutory calendar.

The Digital Omnibus high-risk deferral

Under the Digital Omnibus, stand-alone Annex III high-risk obligations are deferred from 2 August 2026 to 2 December 2027, and product-embedded Annex I high-risk obligations from 2 August 2027 to 2 August 2028. The European Parliament adopted the package in its plenary vote of 16 June 2026 and the Council on 29 June 2026; it was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 and has been in force since 27 July 2026. Both dates are now written into the Act itself.

What did not move

The co-legislators adopted fixed dates instead of the Commission's November 2025 "stop the clock" proposal. Article 5 prohibitions and Article 4 literacy have applied since 2 February 2025; GPAI obligations under Articles 51–55 since 2 August 2025; general application, including Article 50 transparency, since 2 August 2026. For US foundation-model and GPAI providers placing models on the EU market, the GPAI duties are live now — and models on the EU market before 2 August 2025 have until 2 August 2027 to comply under the transitional provision.

---

What in-scope US companies actually have to do

The obligations are the EU obligations

Because the Act binds through Article 2 rather than any US transposition, an in-scope US provider or deployer faces the same role-based duties as an EU company. There is no US-lite version. The roles map identically: provider, deployer, importer, distributor — with importer duties at Article 23 and distributor duties at Article 24.

The Article 25 role-shift

A deployer, distributor, or importer becomes a provider under Article 25 the moment it puts its own name or trademark on a high-risk system, substantially modifies it, or changes its intended purpose. A US company that fine-tunes a base model into a new high-risk purpose, or rebrands a high-risk EU tool, can inherit the full provider stack without realising it.

High-risk duties and penalties

For a stand-alone Annex III high-risk system, the provider stack applies in full: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness (Articles 9–15), conformity assessment, the Article 49 registration, and provider obligations under Article 16. Penalties are the Article 99 tiers — identical figures, calculated on worldwide turnover, not EU or US revenue: up to €35 million or 7% for Article 5 breaches (Article 99(3)); up to €15 million or 3% for most other obligations including high-risk provider duties (Article 99(4)); up to €7.5 million or 1% for supplying incorrect or misleading information (Article 99(5)). For SMEs, Article 99(6) caps the fine at the lower of the fixed amount or the percentage; small mid-caps get the same cap for Article 99(4) and (5) fines under Article 99(6a), added by the Digital Omnibus. Separately, GPAI model providers are fined by the Commission under Article 101 (up to €15 million or 3%), not under Article 99.

---

Worked example: a San Francisco SaaS firm selling AI hiring software into the EU

BrightHire Inc is a roughly 140-employee San Francisco SaaS company with around $22 million in annual revenue. It sells an AI candidate-screening and ranking tool, and several customers are employers in Germany and the Netherlands.

Why BrightHire is in scope now

As a provider placing the system on the EU market, BrightHire is in scope under Article 2(1)(a) today — no EU office is required, and the lack of a European entity is irrelevant. Its tool is high-risk under Annex III point 4(a) (recruitment and selection of natural persons), which triggers the full provider stack under Articles 9–15. Even where BrightHire has no direct EU contract, Article 2(1)(c) can catch it where the tool's output is used to assess candidates in the Union.

The prohibited-practice gate comes first

Before any high-risk work, BrightHire must clear the hard gate at Article 5(1)(f): emotion recognition in the workplace context is a prohibited practice. If the screening flow infers emotion from video interviews — reading "confidence" or "enthusiasm" from facial expression or tone — that feature must be removed for the EU market regardless of high-risk status. A prohibited practice cannot be cured by documentation; it is simply banned.

BrightHire's pre-market checklist

• Appoint an Article 22 authorised representative established in the Union before placing the system on the EU market.
• Build the Article 11 / Annex IV technical documentation and the Article 47 / Annex V EU declaration of conformity.
• Run the conformity assessment and register the system under Article 49.
• Note the exposure: a high-risk provider breach sits in the Article 99(4) tier. As an SME, BrightHire benefits from the Article 99(6) cap at the lower of the fixed amount or the percentage, so 3% of roughly $22 million revenue is the operative ceiling, not the €15 million figure.
• Keep US obligations — federal guidance and applicable state AI laws — running in parallel; the EU file does not discharge them, and vice versa.

---

What US companies should do now

Map your EU exposure, not your US status

Do not start from "are we covered under US law?" Start from "do we touch the EU market?" If you place AI on the EU market or your output is used in the Union, the EU timeline binds you through Article 2 — independent of anything the US does or does not legislate.

A five-step starting checklist

1. Map your AI systems against Article 2 to confirm where you place systems on the EU market or your output reaches the Union.
2. Classify each system: clear the Article 5 prohibited-practice gate first, then assess Article 6 / Annex III for high-risk status.
3. Assign roles — provider, deployer, importer, distributor — and run the Article 25 conversion check on anything you rebrand, fine-tune, or repurpose.
4. For high-risk systems, appoint an Article 22 authorised representative in the Union before market placement.
5. Build the compliance file: risk management, Annex IV documentation, conformity assessment, and the Annex V declaration of conformity — and keep your US obligations running in parallel.

Two developments to monitor

Track two moving pieces for legal review: EU implementing guidance — the Commission's draft Article 6 classification guidelines (May 2026) and harmonised standards, none yet cited in the Official Journal — and the evolving US landscape — federal action and the growing patchwork of state AI laws — which may add US obligations but will not displace the EU AI Act's extraterritorial reach.

---

How Confir helps US companies

Confir derives your provider, deployer, importer, or distributor role and classifies your systems under Articles 5 and 6 with Annex III logic from plain-language intake. The engine is deterministic and rule-based — no model inference, no hallucination — so the same intake always yields the same audit-defensible finding with a human-readable explanation of which rule fired.

Confir generates the Article 11 / Annex IV technical documentation pack and the Article 47 / Annex V declaration of conformity, and supports the Article 27 Fundamental Rights Impact Assessment where it applies. The aim is to give a US company an EU-market compliance file that stands on its own, separate from whatever US federal or state obligations apply. The GPAI workflow (Articles 51–55) is partial and on the roadmap, not presented as complete. Confir is EU-hosted, at confir.eu.

---

Related guides

• EU AI Act extraterritorial reach for non-EU companies
• EU AI Act in Switzerland: extraterritorial reach
• EU AI Act in the UK: post-Brexit reach
• EU AI Act scope explained (Article 2)
• EU AI Act deadlines and application dates