- The EU AI Act can apply to U.S. organizations even when they are not established in the EU.
- Applicability depends on factors including where an AI system or model is placed or used, where its output is used, and the organization's role.
- An organization may be a provider, deployer, importer, distributor, product manufacturer, authorized representative, or occupy more than one role under the Act.
- Determining whether the Act applies is only the first step. An organization's role and the AI systems or models involved help determine which requirements follow.
Despite its name, the EU AI Act doesn't stop at Europe's borders.
That distinction matters. A U.S. company may fall within the Act's scope by placing an AI system or general-purpose AI (GPAI) model on the EU market, putting an AI system into service in the EU, or using AI outside Europe while its output is used within the EU.
For CISOs, that makes visibility critical. Where is AI being used across the organization? Where are its outputs going? And what is the organization's role, as defined by the Act?
Understanding your organization's exposure starts with following the AI, not just where your organization is headquartered. Here's how to determine when the EU AI Act applies to U.S. organizations and how your organization's role affects its compliance obligations.
Who does the EU AI Act apply to?
The EU AI Act applies to organizations across the AI value chain, not only to companies that develop AI. Depending on how an organization develops, provides, distributes, imports, or uses its AI systems or models, it may fall into one or more roles defined by the Act:
For CISOs who remember the lead-up to and the global impact of the General Data Protection Regulation (GDPR), the idea of an EU regulation reaching organizations beyond Europe should feel familiar. GDPR changed how organizations worldwide approached data privacy because its territorial scope extended beyond companies physically established in the EU. The EU AI Act similarly has extraterritorial reach, although the conditions that bring an organization within scope are specific to the AI Act.
For example, a U.S. organization does not automatically fall outside the Act because it lacks an EU headquarters or because its AI systems operate elsewhere. At the same time, the Act includes exclusions for certain military, defense, national-security, research and development, and personal uses.
When does the EU AI Act apply to U.S. companies?
A U.S. company does not need an office, employees, or even an AI system physically located in Europe for the EU AI Act to apply. The Act includes several circumstances that can bring organizations established outside the EU within its scope.
One of the clearest is when a U.S. company places an AI system or general-purpose AI model on the EU market. For example, a U.S. software company that develops an AI-powered product and makes it available to customers in the EU may be subject to the Act as a provider, even if it develops and operates that technology from the United States.
The Act can also apply when a provider outside the EU puts an AI system into service within the EU. Applicability isn't limited to selling AI as a standalone product; how and where an organization deploys an AI system for use can also matter.
Similarly, when providers’ and deployers’ AI system output is used in the EU, the Act applies, even if they’re outside the EU. Consider a U.S. company using an AI system in the United States to evaluate job applicants for positions at its European operations. The AI may run entirely in the U.S., but if its output is used to make decisions in the EU, the company may still fall within the Act's scope.
U.S. product manufacturers also need to consider AI incorporated into products they sell under their own name or trademark in Europe. When an applicable AI system is used with a product covered by EU product-safety legislation, the manufacturer may assume provider responsibilities under the Act.
These scenarios also show why CISOs need visibility beyond where AI is hosted. An inventory that identifies an AI system but not how it is used, where its outputs are consumed, or how it reaches the European market may not provide enough information to assess regulatory exposure. For U.S. organizations, determining applicability requires looking across organizational and geographic boundaries at the AI system, its use, and its outputs.
What is your organization's role under the EU AI Act?
Once you've determined that the EU AI Act may apply, the next question is what role your organization plays for each AI system or model. Because the Act assigns different responsibilities to different operators, understanding those roles helps identify where regulatory responsibility exists across the organization.
An organization can occupy more than one role. For example, a company that develops an AI system and then uses it itself may act as both provider and deployer. Because roles can differ among AI systems, organizations should determine them on a system-by-system basis rather than assigning one label to the entire company.
At a high level, the major organizational roles include:
|
Role |
What it means |
U.S./global example |
High-level compliance significance |
|
Provider |
Develops an AI system or GPAI model, or has one developed, and places it on the market or puts an AI system into service under its own name or trademark. |
A U.S. software company develops an AI application and offers it to customers in the EU. |
Providers generally carry many of the Act's obligations for the systems or models they provide. |
|
Deployer |
Uses an AI system under its authority, other than for personal, non-professional activity. |
A U.S. multinational uses an AI hiring system within its European operations. |
Deployers have their own obligations related to how applicable AI systems are used and overseen. |
|
Importer |
Located or established in the EU and places an AI system bearing the name or trademark of a third-country organization on the EU market. |
An EU business brings an AI system from a U.S. provider onto the EU market. |
Importers must verify that applicable provider requirements have been met before placing systems on the market. |
|
Distributor |
Makes an AI system available within the EU supply chain but is neither its provider nor importer. |
An EU distributor makes a U.S. provider's AI system available to customers. |
Distributors have obligations related to verifying compliance before making applicable systems available. |
|
Product manufacturer |
Places a product on the EU market or puts it into service under its own name or trademark together with an AI system. |
A U.S. manufacturer sells an applicable AI-enabled product in the EU under its brand. |
In certain circumstances, the manufacturer can assume provider responsibilities for the AI system. |
|
Authorized representative
|
Established in the EU and has a written mandate to act on behalf of a provider established outside the EU. |
A U.S. AI provider appoints an EU-based representative where required by the Act. |
The representative performs specified regulatory tasks on the provider's behalf. |
The table above intentionally keeps those responsibilities high-level. The next article in this series will examine the EU AI Act's risk categories and compliance requirements in detail.
Does the EU AI Act apply to every AI system?
Even when an organization falls within the EU AI Act's territorial scope, that does not mean every AI system it develops or uses is subject to the same requirements.
The Act takes a risk-based approach, with requirements varying according to factors such as an AI system's intended purpose and the organization's role. Certain AI practices are prohibited altogether, while high-risk systems face more extensive requirements. Other AI systems may face specific transparency obligations, while many lower-risk uses have few or no mandatory requirements under the Act.
The Act also treats general-purpose AI models differently from individual AI systems. Providers of these models have their own set of obligations, with additional requirements applying to general-purpose AI models that present systemic risk. This distinction matters as organizations assess both the AI systems they build or use and the underlying models that may power them.
Certain uses are also excluded, including AI used exclusively for military, defense, or national-security purposes, specific types of scientific research and development activities, and personal, non-professional use.
However, determining that the EU AI Act applies is only the beginning. Organizations must then classify relevant AI systems and models to determine which requirements apply.
What should U.S. organizations do next?
For U.S. organizations, assessing EU AI Act applicability starts with understanding the AI operating across the business. CISOs don't need a full compliance analysis at this stage, but they do need enough visibility to identify where further review is necessary.
Four initial steps can help establish that foundation:
- Inventory relevant AI systems and models. Identify the AI your organization develops, provides, or uses rather than limiting the inventory to internally developed systems.
- Identify where the AI and its outputs are used. Determine where systems are offered or deployed and where their outputs ultimately inform actions or decisions.
- Determine your organization's role. Establish whether the organization acts as a provider, deployer, importer, distributor, product manufacturer, or another covered operator for each relevant system or model.
- Flag AI that requires further review. Identify systems and models that need additional risk classification and compliance analysis under the Act.
These steps help establish if and how the EU AI Act may apply. From there, Part 2 of this series will examine how relevant AI is classified and which compliance requirements follow.
