The EU AI Act for US Companies: Scope, Roles and What to Do Now
A US headquarters does not put you outside the EU AI Act. If your AI systems or their outputs reach the EU market, the regulation can reach you. Here is how to work out your exposure and what to build now.
By Enterprise AI Architects · · 8 min read
The EU AI Act (Regulation (EU) 2024/1689) is the European Union’s horizontal law on artificial intelligence. It entered into force on 1 August 2024 and applies in phases. For US companies, the key fact is that it is extraterritorial: it can apply to organizations outside the EU when they place AI systems on the EU market or when their systems’ outputs are used in the EU. It sorts AI uses by risk, assigns obligations mainly by role (provider or deployer), and adds a separate regime for general-purpose AI models.
This guide is written for US technology, risk and legal leaders deciding how seriously to take the regulation and what to build. It is not legal advice, and parts of the timeline are the subject of active legislative proposals, which we flag where relevant. Work with EU counsel on your specific exposure.
Why the EU AI Act reaches US companies
Article 2 sets out who is covered. The provisions that matter most for US organizations:
- Providers placing AI on the EU market, whether or not they are established in the EU. If you sell an AI-enabled product or service to EU customers, you are likely in scope.
- Deployers established or located in the EU. If you have an EU subsidiary that uses AI systems, that subsidiary is a deployer.
- Providers and deployers in third countries where the output of the AI system is used in the EU. This is the broadest hook. A US-hosted system that scores EU applicants or generates content consumed by EU users can fall within scope.
- Importers and distributors of AI systems within the EU supply chain.
Non-EU providers of high-risk AI systems and of general-purpose AI models must appoint an authorized representative established in the EU before making them available on the EU market.
The Act also excludes some activity, including AI used exclusively for military, defense or national security purposes, and AI developed and used solely for scientific research and development. Purely personal, non-professional use by individuals is outside deployer obligations.
The risk categories
The EU AI Act does not regulate “AI” as a single thing. It regulates uses, grouped by risk.
| Category | What it covers | Core consequence |
|---|---|---|
| Prohibited practices (Article 5) | Uses the EU considers unacceptable, such as manipulative techniques that cause significant harm, exploiting vulnerabilities of specific groups, social scoring, certain predictive policing based solely on profiling, untargeted scraping to build facial recognition databases, emotion recognition in workplaces and schools (with narrow exceptions), and certain uses of real-time remote biometric identification | Banned |
| High-risk (Article 6, Annexes I and III) | AI that is a safety component of regulated products (Annex I), and AI used in listed areas (Annex III) such as biometrics, critical infrastructure, education, employment and worker management, access to essential private and public services (including creditworthiness and certain life and health insurance pricing), law enforcement, migration, and administration of justice | Extensive provider obligations and specific deployer duties |
| Transparency risk (Article 50) | AI systems that interact with people, generate synthetic content, or perform emotion recognition or biometric categorization, and deepfakes | Disclosure and labeling duties |
| Minimal risk | Most other AI, such as spam filters, recommendation for internal productivity, code assistants | No specific obligations beyond AI literacy; voluntary codes encouraged |
Note that an Annex III use is not automatically high-risk in every case. The Act includes a derogation where a system does not pose a significant risk of harm, for example when it performs a narrow procedural task. Providers relying on that derogation must document the assessment. Systems that profile natural persons are always treated as high-risk within Annex III areas.
Provider versus deployer: find your role first
Almost every EU AI Act obligation attaches to a role. Get this wrong and you will either over-build or miss real duties.
Provider obligations for high-risk systems
Providers of high-risk AI systems carry the heaviest load, including:
- A risk management system operated across the life cycle.
- Data and data governance requirements for training, validation and testing data.
- Technical documentation sufficient to show conformity.
- Record-keeping: automatic logging of events over the system’s lifetime.
- Transparency and instructions for use for deployers.
- Human oversight designed into the system.
- Accuracy, robustness and cybersecurity appropriate to the intended purpose.
- A quality management system, conformity assessment, CE marking, EU database registration, and post-market monitoring with serious incident reporting.
Deployer obligations for high-risk systems
Deployers of high-risk systems must, among other things, use the system according to the provider’s instructions, assign human oversight to competent people, ensure input data under their control is relevant, monitor operation and report risks, keep automatically generated logs under their control (for at least six months, unless other law provides otherwise), and inform workers before deploying high-risk AI in the workplace. Public bodies and certain private deployers, including those assessing creditworthiness or pricing life and health insurance, must carry out a fundamental rights impact assessment before first use.
When a deployer becomes a provider
Under Article 25, a deployer or other party is treated as a provider of a high-risk system if it puts its name or trademark on the system, makes a substantial modification, or changes the intended purpose of a system in a way that makes it high-risk. This matters for enterprises that customize vendor AI. Fine-tuning a vendor model and deploying it for employment screening under your own brand can move you into the provider role.
General-purpose AI model obligations
The Act creates a separate regime for general-purpose AI (GPAI) models, the foundation models behind products such as ChatGPT, Claude and Gemini. GPAI obligations fall on the model provider, not on every company that calls a model API.
All GPAI model providers must maintain technical documentation, provide information and documentation to downstream providers who integrate the model, put in place a policy to comply with EU copyright law, and publish a sufficiently detailed summary of the content used for training. Open-source models released under qualifying licenses are exempt from some of these duties unless they present systemic risk.
GPAI models with systemic risk carry additional duties: model evaluation including adversarial testing, assessment and mitigation of systemic risks, serious incident tracking and reporting, and adequate cybersecurity. A model is presumed to have systemic risk when its cumulative training compute exceeds 10^25 floating point operations, and the Commission can also designate models.
A General-Purpose AI Code of Practice was published in 2025 as a voluntary way for model providers to demonstrate compliance.
For most enterprises, the practical implication is in the value chain. If you build on a GPAI model, you rely on the model provider’s documentation to meet your own obligations. Your vendor due diligence should request it. If you fine-tune or substantially modify a GPAI model and place it on the market, analyze whether you have become a GPAI provider yourself.
The phased timeline, stated carefully
The regulation applies in stages. Under the text as adopted:
- 1 August 2024: entry into force.
- 2 February 2025: prohibited practices and AI literacy obligations apply.
- 2 August 2025: GPAI model obligations, governance provisions and penalties apply.
- 2 August 2026: most remaining provisions apply, including Article 50 transparency duties (the Omnibus gave some synthetic-content marking duties extra time, to 2 December 2026).
- 2 August 2027: GPAI models placed on the market before August 2025 must comply.
- 2 December 2027: high-risk obligations for standalone systems listed in Annex III, such as hiring, credit scoring and education (originally 2 August 2026).
- 2 August 2028: high-risk obligations for AI built into products covered by Annex I harmonization legislation (originally 2 August 2027).
The high-risk dates moved. The European Commission proposed a “Digital Omnibus” package in November 2025; Parliament and Council adopted it in mid-2026 and it was published in the Official Journal in July 2026. It postponed the high-risk obligations to the dates above and added new prohibitions, including AI that generates non-consensual intimate imagery, from 2 December 2026. Confirm details against the consolidated text with counsel before committing to a compliance date, and use the extra time to build the documentation, logging and oversight that high-risk status will require.
What US companies should do now
The durable work is the same regardless of how the timeline settles. A sound plan:
- Inventory AI systems and map EU touchpoints. For each system record whether it is sold into the EU, used by EU staff or subsidiaries, or produces outputs used in the EU.
- Classify each system against the prohibited list, Annex III areas, and Article 50 transparency triggers. Record the reasoning, including any reliance on the high-risk derogation.
- Determine your role per system: provider, deployer, importer, distributor, or none. Watch for Article 25 role shifts when you customize vendor AI.
- Stop anything prohibited. These obligations already apply.
- Deliver AI literacy training proportionate to the roles of people who operate or use AI.
- Implement transparency controls: chatbot disclosure, machine-readable marking of synthetic content where you are the provider, and deepfake labeling where you deploy.
- Build high-risk capabilities into the platform: event logging, model and data versioning, human oversight workflows, evaluation evidence, and post-market monitoring. These are architecture decisions, not documents.
- Update vendor contracts to obtain the documentation, instructions for use and incident notification you need.
- Align with a management framework. ISO/IEC 42001 and the NIST AI RMF both provide structure that maps well onto EU AI Act duties. See our ISO 42001 readiness guide and NIST AI RMF implementation guide.
Architecture patterns that reduce EU AI Act effort
- Centralized model access through a gateway that logs every call with model version, prompt template version, and user context. This gives you record-keeping and monitoring evidence by default. See LLM gateway architecture.
- Region-aware routing and data residency so EU-scoped workloads can be isolated if needed.
- Policy-as-code release gates that block deployment of a system classified high-risk until required evidence is attached.
- Human-in-the-loop components designed as reusable services, so oversight is consistent and auditable rather than reinvented in each application.
Common mistakes
- Assuming no EU entity means no exposure. The output-used-in-the-EU test is broad.
- Treating every AI use as high-risk. This wastes effort and slows teams. Most enterprise AI is minimal or transparency risk.
- Ignoring role shifts. Customizing and rebranding vendor AI can make you a provider.
- Waiting for dates to settle. The core capabilities take time to build and are useful under any timeline.
How we help
We help US companies classify their AI portfolio against the EU AI Act, determine roles, and build the logging, oversight and evidence capabilities into their AI architecture. Our AI governance and risk practice leads this work alongside your counsel. Contact us to discuss your exposure.
