Does the EU AI Act apply to companies outside the EU?

Yes, often. Article 2 of the EU AI Act covers providers placing AI on the EU market wherever they are based, and non-EU providers and deployers whose AI system's output is used in the EU. Being headquartered elsewhere is not an exemption, though several specific carve-outs exist.

Who Article 2 covers

According to the text of Article 2(1), the Act applies to:

• Providers placing AI systems or general-purpose AI models on the EU market, or putting them into service there, whether they are in the EU or a third country.
• Deployers established in the EU.
• Providers and deployers in third countries where the output produced by the AI system is used in the EU.
• Importers and distributors of AI systems.
• Product manufacturers that ship an AI system with their product under their own name.
• Authorised representatives of providers not established in the EU.
• Affected persons located in the EU.

The practical test is not where your servers or staff sit. It is whether your system reaches the EU market or its output is used there.

The output hook

The "output is used in the EU" limb is the one that surprises people. A US company running a screening model on applicants might think the Act is irrelevant. If the output of that system is used in the EU, for example to decide about a person there, the Act can reach it. Whether a given case meets the test is a legal question, so ask counsel with the facts in hand.

Authorised representatives

Article 2 names authorised representatives of providers not established in the EU as a covered group. The rules on when one must be appointed sit in a separate article that we did not review, so check that text if you are a non-EU provider of a high-risk system.

What is excluded

Article 2 lists several exclusions:

• AI used exclusively for military, defence or national security purposes.
• Systems built solely for scientific research, and pre-market research and development. Real-world testing is not excluded.
• Deployers who are natural persons using AI in a purely personal, non-professional activity.
• Free and open-source systems, unless they are placed on the market as high-risk systems or fall under Article 5 (prohibited practices) or Article 50 (transparency).
• Certain third-country public authorities cooperating on law enforcement.

A scoping routine

1. List every AI system you build, buy or embed.
2. For each, note whether it is sold to, offered in, or its output used in the EU.
3. Mark your role: provider, deployer, importer or distributor.
4. Check each against the exclusions.
5. Record the reasoning so a regulator or customer can see it.

Doing this once, with dates, is cheaper than reconstructing it during a customer audit.

Quick check

Sources

• AI Act Article 2, scope (an unofficial reader; confirm wording against the Official Journal)

Last reviewed: 19 October 2026.