The EU AI Act Is Extraterritorial — Just Like GDPR
US companies that assumed the EU AI Act was “a European problem” learned the same lesson GDPR taught a decade earlier: EU digital regulation follows the market, not the company's address. Article 2 of the AI Act sets out a deliberately broad scope. If your AI touches the EU market or EU users, you are very likely in scope no matter where you are headquartered, where your servers sit, or where your engineers work.
The Three Triggers That Pull You In
A US company falls under the Act through any of three routes:
- Placing on the EU market. If you sell, license, or otherwise make an AI system or GPAI model available in the EU under your name or trademark, you are a provider in scope.
- Output used in the EU. This is the catch-all. If the output your AI system produces is used by someone in the EU — a recommendation, a score, a generated document, a decision — the Act applies to you as a provider or deployer located outside the EU, even if everything else about you is American.
- Affecting EU persons through the supply chain. Importers and distributors in the EU have their own duties, which creates contractual pressure up the chain onto US providers to supply compliant systems and documentation.
Are You a Provider or a Deployer?
Your obligations depend on your role. A provider develops an AI system or GPAI model (or has it developed) and places it on the EU market under its own name — this is most US AI vendors and SaaS companies. A deployer uses an AI system under its authority in a professional setting — for example, a US company using an AI hiring tool that screens EU-based applicants. Providers carry the heavier load (documentation, conformity assessment, CE marking); deployers carry oversight, logging, and intended-purpose duties. Use our high-risk definition guide to see which category and risk tier you sit in.
The EU Authorised Representative Requirement
This is the obligation most US companies miss. If you are a non-EU provider of a high-risk AI system or a GPAI model, you must — by written mandate, before going to market — appoint an authorised representative established in the EU. This representative acts as your compliance point of contact: keeping documentation available to authorities, cooperating with regulators, and registering the system. It is a formal legal appointment, not a casual arrangement, and operating in the EU without one where required is itself a breach.
A Compliance Roadmap for US Companies
1. Inventory and classify. List every AI system you offer into, or whose output reaches, the EU, and map each to the four risk tiers. Our free classifier does this quickly.
2. Screen for prohibited uses. Article 5 bans are already enforceable; a US company can be fined for a prohibited deployment reaching the EU. Clear these first.
3. Build documentation for high-risk systems. Stand up the risk management system and Annex IV technical file, then run the conformity assessment.
4. Appoint your EU representative if you are a high-risk or GPAI provider.
5. Leverage NIST. If you already follow the NIST AI Risk Management Framework, much of your risk-management evidence maps onto the AI Act's requirements — reuse it rather than starting over. Our AI governance guide shows how the frameworks line up.
GeraCompliance helps US companies meet the EU AI Act without an EU legal team: a free risk classifier, ready-to-use templates, and a fixed-scope sprint that delivers documentation in days.