The European Union (EU) has adopted what is widely described as the world’s first comprehensive law regulating artificial intelligence (AI): the EU AI Act. Many companies outside Europe assume it does not apply to them. That assumption can be costly.
Like the General Data Protection Regulation (GDPR) before it, the EU AI Act reaches beyond Europe’s borders. This article explains when the law applies to non-European companies, which deadlines matter after the 2026 amendments, and how organizations can prepare. It is a general overview, not legal advice.
When the EU AI Act Applies to Companies Outside Europe
The Act applies based on where AI systems are used, not only where companies are based. It covers providers that place AI systems or general-purpose AI models on the EU market, wherever they are established. It also applies to providers and deployers outside the EU when the output of their AI system is used in the EU. In practice, this can include:
- A software company selling an AI-powered product to European customers
- A service provider whose AI tool screens job applicants for an employer in Europe
- An outsourcing firm delivering AI-generated analysis or content used by EU clients
- A developer of a general-purpose AI model made available to users in the EU
Penalties are significant. The most serious violations can lead to fines of up to 35 million euros or 7% of global annual turnover, whichever is higher. Lower fine levels apply to other violations, with some adjustments for smaller companies.
Key EU AI Act Deadlines After the 2026 Amendments
The Act entered into force in August 2024 and is being phased in. Bans on certain prohibited practices and AI literacy obligations have applied since February 2025, and obligations for general-purpose AI models since August 2025. The prohibited practices include certain forms of manipulative AI and social scoring (Cooley).
In July 2026, the Digital Omnibus on AI entered into force, postponing key deadlines. Obligations for stand-alone high-risk systems, such as AI used in hiring, credit scoring, and education, now apply from 2 December 2027 instead of 2 August 2026. Rules for high-risk AI embedded in regulated products, such as medical devices, now apply from 2 August 2028 (Future of Privacy Forum).
Not everything was delayed. Transparency obligations, including telling people when they are interacting with an AI system and labeling deepfakes, have applied since 2 August 2026 (Cooley). Companies offering chatbots or generative AI features to EU users should already be meeting these requirements.
How Non-European Companies Can Prepare
The postponement gives companies more time, not an exemption. Practical steps include:
- Inventory AI systems: list where AI is used in products, services, and internal processes, and whether outputs reach EU users
- Classify risk levels: identify systems that may fall into high-risk categories such as employment or credit decisions
- Review transparency practices: make sure users know when they are interacting with AI and that synthetic content is labeled
- Document data and models: keep records of training data sources, testing, and human oversight measures
- Clarify contracts: define compliance responsibilities with EU clients, partners, and AI vendors
Early alignment can also simplify compliance elsewhere, since several jurisdictions are developing AI rules built on similar risk-based principles. Legal counsel can help interpret how specific obligations apply to each product or service.
Companies that supply AI components to EU-based providers should also prepare. Their customers will need documentation and assurances to meet their own obligations, which makes compliance readiness a commercial advantage.
Preparing Early for the EU AI Act
The EU AI Act applies far beyond Europe, reaching companies whose AI systems or outputs are used in the EU. With transparency rules already in effect and high-risk obligations arriving in December 2027, now is the time to inventory AI systems, classify risks, and build documentation into development processes. Organizations serving European clients benefit from working with an experienced software development team that designs AI systems with compliance and traceability built in.