The EU AI Act for US companies: does it apply to you, and what to do in the next 90 days
The EU AI Act (Reg. (EU) 2024/1689) doesn't stop at the EU border. If your AI system's output reaches someone in the EU, it can apply to you — regardless of where you're incorporated. Here's how to check, and what to do about it before your next board or procurement review.
"We're a US company" isn't a reason it doesn't apply.
Article 2 of the AI Act reaches providers and deployers outside the EU whenever they place an AI system on the EU market, or the system's output is used within the EU. Location of incorporation is not the test — location of effect is.
Signs you're covered
- You sell into the EU, even through a reseller or a regional subsidiary.
- EU-based customers, users or employees see or are affected by the system's output.
- Your product page, pricing or support targets EU markets.
- You supply an AI system or a general-purpose AI model that an EU company integrates into its own product.
Signs you're not — yet
- Your product and its output are US-only, with no EU customers, users or data subjects in sight.
- You have no plans to expand into the EU market in the near term.
- Revisit this the moment either of those changes — reach is assessed on effect, not intent.
What's live now, and what's coming.
The AI Act phases in over several years — and the schedule for the heaviest obligations recently moved.
Six questions to find out where you stand.
Answer honestly — the goal is an accurate map, not a comfortable one.
- 01Do any customers, users or employees affected by your system's output sit in the EU?
- 02Is your product marketed or sold into the EU, even indirectly through a partner or reseller?
- 03Does your system make or materially shape a decision about an EU-based person — credit, employment, insurance, access to essential services?
- 04Could any feature resemble an Art. 5 prohibited practice — social scoring, manipulative techniques, certain biometric categorisation?
- 05Do you build on a third-party general-purpose AI model whose GPAI obligations have applied since 2 Aug 2025?
- 06Will any of the above become true within your current 12-month roadmap?
Answered yes to any of the first five? You're likely in scope today. All no, but yes to the sixth? Build the compliance work into the roadmap now, not after launch.
The EU AI Act doesn't replace your US obligations — it adds to them.
Several US state rules are already in force or land before the AI Act's high-risk deadlines. Build to the strictest one that applies to you.
| Rule | Status | What it covers |
|---|---|---|
| California CCPA — ADMT rules | Effective 1 Jan 2026; compliance for existing uses required by 1 Jan 2027 | Automated decision-making technology used on California residents |
| California SB 53 | 1 Jan 2026 | Frontier AI model developers |
| Illinois HB 3773 | 1 Jan 2026 | AI use in employment decisions |
| NYC Local Law 144 | In force; enforcement tightening | Automated employment decision tools |
| Colorado SB 26-189 | 1 Jan 2027 | High-risk AI systems and consumer protection |
| New York RAISE Act | 1 Jan 2027 | Frontier AI model safety and transparency |
A December 2025 executive order pushed for federal preemption of state AI rules. That push is contested and unresolved — don't assume it removes any state-level obligation above, and it has no bearing on the EU AI Act at all.
A sequence that doesn't require a rebuild later.
Same underlying work — inventory, classify, disclose, monitor — whichever rulebook you're closest to.
Inventory & classify
- List every AI system in production or in build, and where its output lands.
- Flag any that reach EU users, customers or employees.
- Classify each against Art. 5 prohibitions and the high-risk Annexes.
- Name an owner for AI-literacy training under Art. 4.
Close the near-term gaps
- Deliver Art. 4 AI-literacy training to staff who build or operate the systems — already required.
- Draft Art. 50 transparency disclosures ahead of the 2 Aug 2026 deadline.
- Align in parallel with whichever US state deadline lands first for you.
Document & monitor
- Finalise a policy pack and a sign-off process for new AI features.
- Prepare procurement-ready answers for EU customers who ask.
- Set a quarterly check against the Digital Omnibus timeline — the high-risk dates can move again.
We build to EU standards by default — so this isn't a special project.
Every system we ship already accounts for the AI Act, GDPR and the US rules that apply to mid-market teams. Three ways in:
AI Opportunity Sprint
Use-case shortlist, data & system map, and risk classification against the EU AI Act and relevant US state rules — in 1–2 weeks, fixed fee.
AI Governance Starter
Inventory of AI already in use, Art. 4 literacy training, an Art. 50 transparency check, and a policy pack your legal team can file.
AgentOps
Ongoing monitoring, evaluation, compliance logs and human-on-the-loop escalation once you're live — priced monthly, no lock-in.
Know whereyou stand.
Send us your current AI inventory — we'll tell you honestly what applies and what doesn't.