Short answer: probably yes. If your AI system produces outputs used by EU users, EU employees, or EU-based customers — the EU AI Act applies to you, regardless of where your company is headquartered.
No EU office required. No European employees required. The trigger is your AI's connection to the EU — not your company's location.
Article 2 of the EU AI Act defines three categories of non-EU entities covered by the regulation. If any of these apply to your business, you have compliance obligations starting August 2, 2026.
Any US software company whose AI product is accessible to EU companies or individuals — directly or through resellers — is a "provider placing a system on the EU market" under Article 2(1)(a).
A US company that never sells directly to EU customers but whose AI makes decisions affecting EU residents — a hiring algorithm screening EU applicants, a credit model processing EU borrowers — is covered. The trigger is effect, not intent.
If your company deploys AI systems from a place of establishment within the EU — even just an EU office or remote EU employees using your AI tools — you fall under deployer obligations.
US companies processing EU residents' personal data through AI systems — for profiling, scoring, or automated decision-making — are likely covered, especially in conjunction with GDPR obligations.
If you build AI-powered SaaS and your clients include EU companies, those clients' obligations flow back to you as provider. Increasingly, EU enterprise clients require AI Act conformity as a contract condition before signing.
The EU AI Act follows the exact same extraterritorial design as GDPR. US companies that ignored GDPR paid the price. The AI Act penalties are higher.
The EU AI Act is structurally identical to GDPR in one critical way: it applies based on where your AI's outputs are used, not where your company is located. The difference is that AI Act penalties exceed GDPR's — up to 7% of global turnover versus GDPR's 4%.
The EU AI Act uses a risk-based approach. The higher the risk, the heavier the compliance burden. Most US companies in scope fall into high-risk or limited-risk categories.
Outright banned as of February 2025. No compliance path — these systems cannot be deployed in the EU.
Heaviest obligations: technical documentation, conformity assessment, Article 71 registration, human oversight, post-market monitoring.
Must inform users they are interacting with an AI system. AI-generated content must be labeled. Applies from August 2026.
No mandatory requirements. The vast majority of AI applications fall here. Voluntary codes of conduct encouraged.
With the deadline approaching, US companies need a structured compliance approach — not a rushed, last-minute scramble.
Determine whether the EU AI Act applies to your specific business model. Many US companies are in scope without knowing it.
Map every AI system your company uses or develops. Include third-party tools you deploy — you are liable for what you use.
Classify each system under the EU AI Act risk framework. High-risk classification triggers the full compliance burden.
Produce Annex IV technical documentation for high-risk systems. This is where most companies stall — Lexara removes the bottleneck.
Non-EU providers of high-risk systems must appoint an EU Authorized Representative before placing systems on the EU market.
Register high-risk systems in the EU database under Article 71. Deadline: August 2, 2026. Start now — it takes 8-12 weeks.
Article 4 has been in force since February 2, 2025. National authorities begin enforcement on August 2, 2026. Non-compliance is an aggravating factor that increases penalties for any other EU AI Act violation. Lexara Advisory delivers tailored AI literacy programs for US companies. Read the full guide →
Article 4 requires providers and deployers of AI systems to ensure their staff have sufficient AI literacy — the knowledge and skills to understand how AI systems work, their capabilities and limitations, and the risks they pose. This is not optional training. It is a legal obligation with documented compliance requirements.
A scope assessment takes days, not months. Starting today gives you time to comply. Starting in June gives you an emergency.
Lexara Advisory LLC is an AI governance consulting firm, not a law firm.
This page provides general information — not legal advice.
🤖 AI — not a human or lawyer