EU AI Act for US Businesses: Who's Actually in Scope

The question US companies keep asking

"We're a US company. We don't have an EU office. Does the EU AI Act actually apply to us?" It's the right question, and the honest answer is: maybe, and the test isn't where you're headquartered. US businesses learned this the hard way with the GDPR, which reached them through the behaviour of their EU-facing services rather than their address. The AI Act is built on the same logic — its scope provision, Article 2, is deliberately extraterritorial.

What trips people up is that there isn't one test; there are several, and they catch different things. A US SaaS company selling an AI feature into Europe is in scope for an obvious reason. But a US company with a German subsidiary, or a US company whose AI merely produces output that ends up being used in the EU, can be in scope for reasons that have nothing to do with marketing to Europe. Knowing which trigger applies to you is the whole game, because it determines what you owe and when.

So rather than the vague "it follows the user" framing you'll find on most pages, this guide walks the actual Article 2 tests, names the role you'd occupy, and maps that to the obligations and deadlines that currently apply. Then it does the thing those pages skip: separates the theoretical reach of the law from where a typical US website's exposure realistically sits in 2026.

The three Article 2 triggers

Article 2(1) is where extraterritorial scope lives. Three of its limbs are the ones a US company needs to read, and each catches a different fact pattern.

Limb (a) covers providers — you built or rebranded the AI system and you're placing it on the EU market or putting it into service there. The regulation is explicit that your location doesn't matter: scope attaches "irrespective of whether those providers are established or located within the Union or in a third country." A US company selling an AI product to EU customers is the textbook case.

Limb (b) covers deployers — the organisations that use an AI system in a professional capacity — where the deployer is established or located in the EU. The test turns on location, not nationality, so a US group's German subsidiary deploying an internal AI tool is in scope even if the tool never leaves the group.

Limb (c) is the one to slow down on, because it's the widest and the least intuitive — so it gets its own section.

The "output used in the EU" test — and the gap nobody has closed

Limb (c) extends the Act to providers and deployers located in a third country "where the output produced by the AI system is used in the Union." Read that carefully: there's no requirement that you target the EU, that you monitor anyone, or that personal data is involved. If the output of your AI system is used in the Union, the hook can attach. That's a materially wider reach than the GDPR's targeting/monitoring tests, and it's the provision US companies most often don't see coming.

The classic example in the Act's own recitals is offshored processing: an EU operator contracts a third-country operator to run an AI-driven activity, and the results flow back into the EU, without the system itself ever being placed on the EU market. The third-country operator can be reached through limb (c).

The practical upshot: limb (c) is why "we don't sell to Europe" is not, by itself, a safe-harbour answer. It narrows how far you can rely on your own intentions, and widens the set of US companies that should at least run the analysis rather than assume they're out.

Provider, deployer, importer: which role are you?

Scope gets you in the door; your role decides what you owe. The Act assigns obligations by function, and a single company can wear more than one hat. Four roles matter for US businesses.

• Provider. You develop an AI system (or a general-purpose AI model), or have one developed and place it on the EU market or put it into service under your own name or trademark. Providers carry the heaviest duties. A third-country provider of a high-risk system must appoint an EU authorised representative (Article 22) before placing it on the market — a written mandate, revocable if the provider acts against the Regulation.
• Deployer. You use an AI system in the course of your professional activity. Deployers have lighter but real duties (for example, the human-facing transparency steps under Article 50 often fall here). A US company is a deployer when it runs someone else's AI on its own site or operations.
• Importer (Article 23). An EU-established party that places a third-country provider's system on the market. Importers must verify conformity assessment, technical documentation, CE marking, the EU declaration of conformity, and that an authorised representative exists.
• Distributor (Article 24). Makes a system available in the EU supply chain; must check CE marking, the declaration of conformity, and that provider and importer met their duties.

The practical trap for US companies is role confusion. If you build an AI feature and ship it to EU customers, you're a provider, with the full provider obligation set (and, for high-risk, an authorised representative). If you merely switch on a vendor's AI on your own site, you're a deployer, with a much lighter load — usually just transparency. Most US websites are deployers; most of the scary high-risk obligations are the provider's. Misreading which one you are is how teams either over-build or dangerously under-build.

In scope ≠ high-risk: what you owe depends on the tier

The Act is risk-based: the obligations scale with what the AI does, not merely with being in scope. Four tiers, simplified:

For the overwhelming majority of US websites, the AI they run — a support chatbot, an AI assistant, content tools — sits in the limited / transparency tier. That matters enormously, because it means your AI Act duty is narrow and achievable: chiefly the Article 50 disclosure. The high-risk machinery that dominates the headlines simply doesn't apply unless your AI does something on the Annex III list. We cover the transparency obligations in depth in our guide to EU AI Act compliance.

The timeline the AI Omnibus changed

This is where most 2026 compliance pages are already out of date. The AI Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026) — part of the Commission's digital-simplification package — pushed several deadlines back. Using the old dates on a compliance page is exactly the kind of error that makes a page worse than useless, so here's the current state.

Two takeaways. First, the high-risk regime is now a 2027–2028 problem, not a 2026 one — which buys genuine time for companies that build high-risk systems. Second, and crucially for most US websites, the transparency obligations were not delayed: Article 50 has been live and enforceable since 2 August 2026. The part most likely to apply to you is the part that's already in force. The prohibitions and general-purpose AI obligations also continue on their existing schedule; the Omnibus didn't touch their substance.

Penalties scale with severity: up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for other breaches, including transparency failures, under Article 99.

The realistic risk for a US website (and the CIPA twist)

Here's where a US-focused analysis has to go further than the EU-centric guidance you'll find on CookieYes or Termly. The theoretical reach of Article 2 is broad, but the practical, near-term exposure for a typical US company is narrower and more specific than the headline fines suggest — and it collides with a US law those pages don't mention.

Start with enforcement reality. As of late 2026, no AI Act enforcement action had been brought against a third-country operator. The Act's inspection powers reach premises "in the Union"; against a company with no EU presence, the practical lever is market access — orders to withdraw or restrict a product (Article 83), not an inspector at your US door. That doesn't make you safe, but it does mean the immediate risk for most US sites is the obligation that's easy to breach and easy to prove: the Article 50 chatbot disclosure.

And that obligation leads straight into a US problem. If your site runs a chatbot or AI assistant that EU users interact with, Article 50 says you must disclose it's AI. But a disclosure is not consent — and in the US, routing what a visitor types into that chatbot to a third party can be the exact fact pattern behind the wave of CIPA wiretapping lawsuits, which carry $5,000 per violation. So the same chatbot can owe an EU disclosure duty and a US consent duty at once, and satisfying one does nothing for the other.

So the honest risk map for a US website is: the high-risk regime almost certainly doesn't apply to you and is delayed anyway; the Article 50 transparency duty very possibly does apply and is live now; and the more immediate financial exposure may actually be the US wiretapping claim sitting underneath the same AI feature. Get the disclosure and the consent gate right together, and you've covered the part of the AI Act that realistically touches you — plus the US risk the EU-only guides leave out.

What to actually do

A proportionate plan for a US company, in order of likely relevance:

The quickest first step is to see what's actually running — scan the site, find the AI and tracking that loads, and build the scope and consent picture from what's really there rather than what you assume.