EU AI Act for US Companies: When It Applies, Which Role You Hold and First Steps

The EU AI Act applies to US companies in three main situations: when they place an AI system or general-purpose AI model on the EU market, when they use AI through an office or subsidiary in the EU, and when the output of their AI system is used in the EU. Being headquartered in the United States removes none of the obligations.

For an American company, the closest analogy is product-safety law rather than privacy law: duties attach to roles, such as the company that sells a system or the one that uses it, and follow a system onto the EU market wherever its maker sits. What you owe depends on your role, how risky the use is, and when each rule starts.

This guide reads the scope, role and date provisions of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, checked on EUR-Lex on 14 October 2026. It is general information, not legal advice, and EU counsel should confirm your position. To test a specific system, use our EU AI Act checker.

Does the EU AI Act apply to US companies?

Article 2(1) lists who is covered. Three of its limbs do most of the work for a US company:

The remaining limbs cover importers and distributors, product manufacturers that sell an AI system with their product under their own name, the authorized representatives of non-EU providers, and affected persons located in the EU.

Three definitions in Article 3 carry most of the weight. Placing on the market is the first making available of an AI system or model on the EU market. Putting into service is supplying a system for first use directly to a deployer, or for your own use, in the EU. A deployer is any organization using an AI system under its authority, except in a purely personal, non-professional activity.

The third limb is the easiest to overlook. Recital 22 explains it as a guard against circumvention, for example where an operator abroad runs AI on data collected in the EU and sends the output back to an EU client, so the Act covers non-EU providers and deployers “to the extent the output produced by those systems is intended to be used in the Union”. A US headquarters that screens applicants for its Paris office is the kind of case to check with counsel.

Exclusions cover systems used exclusively for military, defense or national security purposes, AI developed and put into service solely for scientific research, pre-market research and testing (real-world testing excepted), and open-source systems that are not high-risk, prohibited or covered by Article 50.

Which role are you? A decision table for US companies

Roles attach to each system, not to the company, so one business can be a provider for its product and a deployer for the tools it buys:

An importer is by definition located or established in the EU, so a US company is never the importer of its own product. A company with no EU customers, users, staff or outputs is outside the Act until that changes.

What each role owes, and when it starts

The dates are identical for US and European companies. As amended by the Omnibus, the ones that matter are:

High-risk systems already on the market before those dates are caught only after a significant design change, except systems intended for public authorities, which must comply by 2 August 2030 (Article 111(2)). For a phase-by-phase view, see our deployer readiness guide.

Duties already in force

AI literacy (Article 4). Providers and deployers must take measures to support the AI literacy of staff and others who operate or use AI systems on their behalf. Since the Omnibus, the article no longer requires guaranteeing any specific level of literacy in any individual. Nothing in it limits the duty to staff based in the EU, so include US teams that run in-scope systems.

Prohibited practices (Article 5). Eight practices have been banned since 2 February 2025, among them manipulative techniques that cause significant harm, social scoring, emotion recognition at work and in education, and untargeted scraping of facial images.

Transparency (Article 50). Providers must tell people they are interacting with an AI system unless that is obvious, and mark synthetic audio, images, video and text in a machine-readable way. Deployers must inform people exposed to emotion recognition or biometric categorization, disclose deepfakes, and disclose AI-generated text published to inform the public on matters of public interest unless it has had human review under someone’s editorial responsibility.

Duties that arrive with high-risk systems

From 2 December 2027, a provider of an Annex III system needs, under Article 16, a quality management system, technical documentation, logs, a conformity assessment, an EU declaration of conformity, CE marking and registration. A deployer must use the system according to its instructions, assign human oversight to competent people, monitor it, keep its logs for at least six months, inform workers before using it at the workplace, and tell people when a high-risk system makes or assists decisions about them (Article 26).

Authorized representatives in the EU

A US provider can sell most AI systems into the EU without a local presence. Two cases change that:

• High-risk AI systems (Article 22). Before making a high-risk system available on the EU market, a provider established outside the EU must appoint, by written mandate, an authorized representative established in the EU.
• General-purpose AI models (Article 54). Before placing a model on the EU market, a non-EU provider must do the same. Providers of models released under a free and open-source license, with weights, architecture and usage information public, are exempt unless the model presents systemic risk.

The representative must be able to check the required documentation and conformity steps, keep the documentation available to authorities for ten years, answer reasoned requests and cooperate with authorities, who may deal with it instead of you. If it believes you are breaking your obligations, it must end the mandate and tell the authority. Its own duties carry second-tier fines, so expect it to want real access to your documentation.

The impact on US companies that only use AI

Most US companies are not AI vendors. They buy chat assistants, coding tools, HR software with AI features and customer-service bots. For them the Act bites in three ways:

1. Through EU entities. An EU subsidiary or branch that uses AI is a deployer under Article 2(1)(b), with AI literacy, transparency and, for high-risk uses, Article 26 duties.
2. Through output used in the EU. A US team using AI to make or shape decisions about people in the EU, such as candidates, customers or students, can be a deployer under Article 2(1)(c).
3. Through what you change. Pointing a general-purpose assistant at a high-risk task, such as ranking job applicants, or putting your name on a vendor’s high-risk system turns a deployer into a provider under Article 25(1).

Deployers carry the most weight in the Annex III areas, which include employment and worker management, education, and access to essential services such as credit scoring and life and health insurance pricing. US universities and edtech firms with EU students should read our guide to the AI Act in education.

How far the extraterritorial reach goes, compared with GDPR

Americans who went through GDPR will recognize the pattern but not the trigger. GDPR Article 3(2) applies to a controller or processor outside the EU that processes personal data of people who are in the EU, where the processing relates to offering them goods or services, paid or free, or to monitoring their behavior in the EU.

Both laws can apply to the same system, and Article 2(7) of the AI Act says it does not affect the GDPR. A hiring tool used on EU candidates, for example, can bring Article 26 deployer duties under the AI Act and a data protection impact assessment under the GDPR. Where your data and models physically run is a third question, separate from both; our comparison of data sovereignty and data residency covers it for AI procurement.

Fines a US company could face

Article 99 treats US companies exactly as it treats European ones: €35 million or 7% of total worldwide annual turnover for prohibited practices, €15 million or 3% for breaches of operator and transparency duties, and €7.5 million or 1% for misleading information, whichever is higher, or whichever is lower for SMEs. The base is worldwide turnover, not EU revenue. The Act does not define “undertaking”, and under the GDPR the Court of Justice has calculated fine ceilings on the turnover of the whole economic unit, which can include a parent group.

National market surveillance authorities impose most fines under each Member State’s penalty law, while the European Commission fines general-purpose model providers directly under Article 101. Our guide to EU AI Act fines works through examples at four company sizes.

First steps for a US company

1. Map your EU touchpoints. List EU customers, users, subsidiaries and staff, and any decisions about people in the EU that your AI shapes; that tells you which limb of Article 2(1) applies.
2. Inventory your AI systems and models. Record what each one does, who built it, where it runs and who uses its output.
3. Assign a role to each system. Use the decision table above; one company can hold different roles for different systems.
4. Screen for banned practices. Check every system against Article 5 now, including the two bans that start on 2 December 2026.
5. Classify the risk. Decide whether each system falls under Annex III or is part of an Annex I product; our checker gives a first pass with article references.
6. Fix transparency and literacy. Add AI disclosures to chatbots and voice agents used with people in the EU, label deepfakes, and record your literacy measures.
7. Appoint representatives where required. For high-risk systems or general-purpose models, sign the written mandate before the product goes on the EU market.
8. Prepare for supplier questions. EU providers of high-risk systems must agree in writing with their suppliers on the information and access they need (Article 25(4)), so have your documentation ready if you supply models, tools or components.

How VDF AI fits

For a US company with EU operations, the hardest part of the Act to produce on demand is evidence: who used which system, on what data, with which model, and who approved the outcome. VDF AI is a self-hosted platform you can run in your own data center, in a private cloud region you choose, or air-gapped, so those records stay on infrastructure you control on either side of the Atlantic.

Audit logs, role-based access control on every plan and Human Approval nodes in VDF AI Networks support the oversight and record-keeping that the high-risk regime expects, and VDF AI Router registers on-premises models alongside approved cloud models, with an air-gap mode that keeps routing local. Our reference architecture for the AI Act shows how the pieces fit. VDF AI does not decide your role or your risk classification and holds no certifications; those judgments stay with you and your counsel.