Does the EU AI Act Apply to US Companies?

The EU AI Act is designed to protect the EU market and people affected by AI there. Article 2 therefore covers providers outside the EU that place AI systems or general-purpose AI models on the EU market. It also covers overseas providers and deployers where the system's output is used in the EU.

This is called extraterritorial reach. It is similar in principle to GDPR, although the exact scope tests and duties are different.

• A SaaS company makes an AI assistant available to customers in France and Germany.
• A US employer uses AI-generated scoring for candidates applying to an EU role.
• A support chatbot interacts directly with visitors in the EU.
• A US analytics provider sends AI-generated recommendations to an EU customer for use in its operations.

Determine whether the company is an AI provider, an AI deployer, or both. Providers and deployers have different responsibilities.

Common duties include staff AI literacy under Article 4 and role-specific transparency under Article 50. Providers carry the direct AI-interaction notice duty, while deployers have separate disclosure duties for specified systems and content. Uses in employment, credit, essential services, education, or healthcare may fall into high-risk categories with additional controls.

State laws in California, Texas, Colorado, and elsewhere may apply alongside the EU AI Act. Map the system once, then compare the transparency, risk, and record-keeping duties across both markets.