Quick Answer
Yes, it can. The EU AI Act applies to a US company with no EU office when it places an AI system or model on the EU market, or when the output of its AI system is used in the EU. A US firm that only uses AI internally, for US people and US decisions, is usually outside it. EU staff and EU customers change that.
- Already applying: prohibited practices since 2 February 2025, general-purpose AI model rules since 2 August 2025, transparency duties from 2 August 2026.
- Coming: high-risk systems in areas such as employment and credit from 2 December 2027; AI inside regulated products from 2 August 2028.
- Most likely trigger: AI that screens or manages EU-based staff, or a chatbot that talks to EU customers.
- First step: an inventory of every AI system, who it touches, and where its output lands.
The scope rule is short and it reaches further than most US teams expect. Article 2(1)(c) covers “providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union.” Location of your servers and your headquarters does not settle it. Location of the output does.
The stakes are written into Article 99: fines of up to EUR 35 million or 7 percent of worldwide annual turnover for prohibited practices, and up to EUR 15 million or 3 percent for most other operator obligations. For SMEs, the lower of the two figures applies.
The hard part for a mid-market company is not reading the law. It is answering a simple question the law assumes you can answer: which AI systems do you run, whose data do they read, and where does their output go? In most companies we assess, that answer is spread across a CRM plug-in, an HR platform, two copilots and a model somebody trained in a notebook.
What Actually Triggers the Act for a US Company?
Article 2 names three routes in. A US company can be caught by any of them, and the role you play (provider or deployer) decides which obligations land on you.
| Your situation | Your likely role | Article 2 route | In scope? |
|---|---|---|---|
| You sell software with AI features to EU customers | Provider | 2(1)(a): placing on the EU market, wherever you are established | Yes |
| You run an AI chatbot on a site EU residents use | Provider or deployer, depending on who built it | 2(1)(c): output used in the Union | Likely yes |
| You screen candidates or manage staff located in the EU with AI | Deployer | 2(1)(b) if your EU entity deploys it; 2(1)(c) if output is used in the EU | Likely yes, and possibly high-risk |
| You use AI internally for US staff and US decisions only | Deployer | None, unless output reaches the EU | Usually no |
| Your engineers test models before release | Not yet an operator | 2(8) excludes research and testing before market placement, except real-world testing | Not for that activity |
A deployer is anyone using an AI system under its own authority outside personal, non-professional use. A provider develops a system or model and places it on the market under its own name. Most mid-market companies are deployers of other vendors’ AI and providers of nothing, until a product team ships an AI feature. Check that assumption every quarter.
Which EU AI Act Dates Apply Right Now?
The timeline changed in July 2026, and a lot of published guidance has not caught up. These dates come from the European Commission’s AI Act page, its Article 50 FAQ, and the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026.
| Date | What applies | Who it hits in a US mid-market firm |
|---|---|---|
| 2 February 2025 | Prohibited AI practices and AI literacy obligations | Anyone in scope; check no system falls in a banned category |
| 2 August 2025 | Obligations for general-purpose AI models and governance rules | Model providers; rarely a mid-market deployer |
| 2 August 2026 | Article 50 transparency obligations | Chatbots, synthetic content, emotion recognition, deepfakes |
| 2 December 2026 | End of the narrow grace period for Article 50(2) content marking, only for systems already on the market before 2 August 2026 | Providers of generative systems launched before August |
| 2 December 2027 | High-risk systems under Article 6(2) and Annex III | Employment, credit and similar uses |
| 2 August 2028 | High-risk systems under Article 6(1) and Annex I | AI as a safety component of regulated products |
Two corrections matter. First, the December 2026 date was never a general Article 50 date. The Commission’s FAQ is explicit that the grace period covers only marking and detection of AI-generated content, and only for systems placed on the market before 2 August 2026; every other transparency duty applied from August. Second, any plan built on high-risk obligations starting in August 2026 is out of date. The Omnibus moved Annex III to 2 December 2027.
What Do the Transparency Rules Ask a Deployer to Do?
Article 50 splits the work. Providers must design systems so people know they are interacting with AI, unless that is obvious, and must mark synthetic audio, image, video and text in a machine-readable, detectable way. Deployers carry two duties of their own: inform people exposed to emotion recognition or biometric categorisation, and disclose deepfakes and AI-generated text published on matters of public interest, unless that text went through human review and someone holds editorial responsibility.
For a typical mid-market company, that means three practical checks. Does any customer-facing assistant tell EU users it is an AI? Does any marketing or communications team publish AI-generated images or video without disclosure? Does any HR, call-centre or security tool infer emotions from voice or video? Each answer needs an owner and a record.
This is where the Colorado and California rules feel familiar. Our Colorado AI Act guide covers a US law with the same shape: notice before automated decisions, explanation after adverse ones, and records kept for years. A company that builds the evidence once can answer both.
What Gets in the Way of a Clean Answer?
- No inventory of AI systems. You cannot decide scope for systems you cannot list. Shadow tools wired into SaaS platforms with personal API keys are the usual gap.
- No record of where output lands. Article 2(1)(c) turns on whether output is used in the EU. If your logs do not record the user’s region or the entity that consumed a result, you are guessing.
- Roles assumed, not documented. A vendor’s model fine-tuned and rebranded by your product team can make you a provider. Write down the role for each system and the reason.
- HR data in a silo. Employment uses are the most common Annex III exposure for a US firm with EU staff, and HR platforms are often the least governed data in the estate.
- Evidence assembled at audit time. Screenshots gathered under deadline do not show a control running over time. Records written by the systems themselves do.
Every item on that list is a data engineering problem before it is a legal one. On a governed lakehouse, the inventory is a Delta table with an owner, a role, a risk class and a status for every model and agent. Unity Catalog captures lineage automatically down to the column level for queries run on Databricks, so you can show which tables an HR model reads. The audit log system table records who accessed what; it is in Public Preview with a 365-day default retention, so copy what you need into a retained table. Our AI governance framework sets out the full control set behind that inventory.
Should You Build the Evidence, Buy a Tool, or Wait?
Build it on your lakehouse when your AI systems already read data from a platform you govern, or will within a couple of quarters. The deciding signal: you have EU staff or EU customers touched by at least one AI system, and your answers to scope questions depend on data you already hold. Lineage, access logs and an inventory table give you evidence that runs every day rather than once a year.
Buy a GRC or AI governance platform when most of your AI is vendor software you do not control, and the work is mainly policy, vendor attestations and assessments. The deciding signal: your exposure sits in contracts and questionnaires more than in your own pipelines. Feed that platform from the lakehouse instead of keeping a second inventory by hand.
Wait, but inventory first, when no AI system you run touches EU people or EU output. The deciding signal: your inventory, once built, shows US-only use. Re-check when you open an EU entity, hire EU staff, or ship an AI feature to EU customers, because any of those flips the answer.
If the build path fits, our AI governance and compliance work starts with that inventory and a scope decision per system, then wires the lineage and logging that back it up. This article is general information, not legal advice; EU counsel makes the call on whether and how the Act applies to you.
Frequently Asked Questions (FAQs)
Does the EU AI Act apply to companies outside the EU?
Yes. Article 2 covers providers placing AI on the EU market wherever they are established, and providers and deployers in third countries where the output of their AI system is used in the Union.
When do the EU AI Act high-risk rules apply?
After the Digital Omnibus, high-risk systems listed in Annex III, such as employment and credit uses, apply from 2 December 2027. High-risk AI in products covered by Annex I applies from 2 August 2028.
Did Article 50 move to December 2026?
No. Article 50 transparency obligations apply from 2 August 2026. Only the Article 50(2) content-marking duty has a grace period to 2 December 2026, and only for systems on the market before August.
What are the fines under the EU AI Act?
Up to EUR 35 million or 7 percent of worldwide turnover for prohibited practices, and up to EUR 15 million or 3 percent for most other obligations. SMEs face whichever figure is lower.
Is an AI tool used only by US employees covered?
Usually not, if its output is used only in the US. The answer changes if the same tool processes EU staff or EU customers, or if its results are used by an EU entity.