EU AI Act for US Companies: What Applies, What Doesn't, and When

The EU AI Act applies to US companies that place AI on the EU market or whose AI output is used in the EU. Companies that only use AI tools are deployers, with lighter duties than vendors who build them. That second group is where the typical US business lands, running Microsoft 365 Copilot, ChatGPT Enterprise, or an AI screening tool inside its hiring stack. The heaviest deployer duties now start December 2, 2027. Two others are already live. Sorting out which of your tools fall where is the first job of any AI governance program.

This isn't GDPR for AI.

GDPR follows personal data wherever it travels. The AI Act reads more like product safety law. It regulates the thing being sold, the company selling it, and the company putting it to work, and each of those roles carries a different set of duties.

Getting the roles right matters more than the fine amounts. A US company that treats the Act like GDPR tends to over-scope it, dragging every chatbot and spreadsheet macro into a compliance project. A company that files it under "a European problem for AI vendors" under-scopes it, and misses the HR tool quietly ranking candidates for its Dublin office.

Both mistakes are fixable in a quarter. Regulation (EU) 2024/1689 runs 113 articles and 13 annexes. A US deployer needs about a dozen of them.

Does the EU AI Act apply to a US company?

It does when any of three triggers is met. You place an AI system or model on the EU market, you use AI through an entity located in the EU, or the output of your AI system is used in the EU. No EU office is required.

All three live in Article 2(1). The first two are what you'd expect from any EU law. The third, Article 2(1)(c), is the long arm. It covers providers and deployers located outside the EU "where the output produced by the AI system is used in the Union." Your servers can sit in Virginia. Doesn't matter.

A few ways this plays out:

• A Chicago staffing firm scores applicants for a client's plant outside Munich. The scores land in Germany. In scope.
• A Phoenix manufacturer has no EU customers, no EU staff, and a website that happens to load in Paris. Its internal AI use isn't caught.
• Picture a US parent whose Irish subsidiary uses an AI screening tool. The subsidiary is a deployer located in the Union under Article 2(1)(b). And if headquarters runs the screening centrally and ranks the Irish candidates itself, that output lands in the EU and the parent is caught too.

One more filter sits upstream of all this. The Act only governs an "AI system," and the Commission's guidelines on the AI system definition (February 2025) put basic data processing, classical heuristics, and simple prediction models outside it. Your Excel forecasting macro isn't an AI system. It's out.

Provider or deployer: which one are you?

A provider builds an AI system, or has one built, and puts it on the market or into service under its own name. A deployer uses an AI system under its authority for professional purposes. Your role is set per system, not per company.

Those definitions sit in Article 3(3) and 3(4). The per-system point trips people up. One company can be a deployer for the 400 Copilot licenses it bought and a provider for the customer chatbot it built on a model API and launched under its own brand.

McKinsey's 2025 State of AI survey found 88% of organizations use AI regularly in at least one business function. Almost none of them trained a model. They bought one, switched one on inside software they already paid for, or pointed a team at a chat window. That's deployer territory, and it's where this guide stays.

When the AI Act doesn't reach you

If none of the three triggers hits, you don't need an AI Act project. No EU market, no EU entity, no AI output used in the EU. That's a clean answer, and a lot of US businesses get it.

Take a US regional bank running a fraud model on US card transactions is outside. So is a Texas distributor using Copilot to draft purchase orders for US suppliers. No targeting test, no argument about who your website was aimed at. Just where the output lands.

"We don't sell in Europe" isn't the same as "no output lands in Europe." Remote employees in Lisbon, a sales rep in Amsterdam, and candidates applying from Warsaw all count as places where output gets used. You may still want AI rules for your own reasons, like data leaking into public chat tools. That's what an AI acceptable use policy is for, and it's a different conversation from EU law.

Our GDPR guide for US businesses starts from the same "does this law even touch us" question. The answers overlap less than you'd think. GDPR asks about data subjects, while the AI Act only cares where the output lands.

How does a deployer turn into a provider?

Three ways, under Article 25. You put your name or trademark on a high-risk AI system, you make a substantial modification to one, or you change a general tool's intended purpose so it becomes high-risk. Any of those hands you the provider's obligations.

Route three catches operators. Article 25(1)(c) says that whoever modifies the intended purpose of an AI system, "including a general-purpose AI system," so that it becomes high-risk is now its provider.

Picture a normal week. An HR manager builds a custom GPT that reads resumes for the Warsaw office and ranks the top 10. Nobody calls it a product. It's a Tuesday afternoon project. Harmless, right? Not quite. A general assistant just became a CV screening system, which is high-risk under Annex III, and the company that built it now carries provider duties. Those include a conformity assessment (the documented check that the system meets the Act's requirements), technical documentation, a quality management system, and for a non-EU provider, an authorized representative in the EU under Article 22.

White-labeling works the same way. A software firm that resells a vendor's high-risk scoring engine under its own logo becomes the provider unless its contract with the original provider says otherwise.

Would anyone in your company know if this had already happened? Ask around.

What are the four risk tiers?

The Act sorts AI into prohibited practices (banned since February 2, 2025), high-risk systems like hiring and credit tools (duties from December 2, 2027), transparency-risk systems like chatbots and deepfakes (from August 2, 2026), and minimal-risk AI, which carries no specific duties.

US employers get surprised by the first row. Article 5(1)(f) bans AI that infers the emotions of people in the workplace, with narrow medical and safety exceptions. Some call-center analytics and employee engagement products read mood from voice or facial expressions. Pointed at agents in an EU contact center, that's not a high-risk system with paperwork attached. It's banned outright. Check yours. The Commission's guidelines on prohibited practices walk through examples.

Annex III has a filter, too. A listed use can escape the high-risk tier if the AI only performs a narrow procedural task and doesn't materially influence the decision. In practice that can cover a tool that sorts incoming applications into folders by job title or flags missing documents, and the exemption ends the moment the tool starts scoring, ranking, or recommending which people move forward. Profiling people is the exception to the exception. Always high-risk.

Is the August 2026 deadline still real?

Half of it. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved high-risk duties for Annex III systems to December 2, 2027, and for AI inside regulated products to August 2, 2028. Transparency rules still started in August 2026.

Published in the Official Journal on July 24, 2026, the Omnibus took effect three days later. Plenty of pages ranking for this topic still tell you August 2026 is the high-risk deadline. Not anymore.

Deferred isn't cancelled. December 2027 is about 14 months out, and the work a deployer needs from its vendors, meaning instructions for use, access to logs, and a straight answer on whether the product will pass its conformity assessment in time, moves at vendor speed, which is to say slowly and usually after the renewal is signed. Start now.

AI literacy got rewritten too. The original Article 4 told providers and deployers to "ensure, to their best extent" a sufficient level of AI literacy among staff. The new text says they "take measures to support the development of AI literacy." IAPP's analysis argues the softer wording may complicate compliance rather than simplify it, because the benchmark now comes from Commission and member state guidance that isn't written yet.

Don't read the softer wording as permission to skip training. For high-risk systems, Article 26(2) still requires the people overseeing them to have "the necessary competence, training and authority." The literacy duty got vaguer. The oversight duty didn't move an inch.

Two smaller changes round it out. One is a new prohibition on AI that generates non-consensual intimate imagery or child sexual abuse material. The other extends some SME relief to small mid-cap companies. Gibson Dunn's summary covers the full list.

What a deployer actually owes

Less than you'd fear. A few duties already apply to every deployer in scope, and a longer list kicks in for high-risk systems in December 2027.

Already live:

1. Take measures to support AI literacy among the people who use and oversee AI for you (Article 4). The Commission's AI literacy Q&A says you don't need to test individual employees. A record of what training exists and who took it goes a long way.
2. Don't run a prohibited practice (Article 5). The workplace emotion recognition ban is the one to check first.
3. Disclose when you deploy a deepfake, and when you publish AI-generated text to inform the public on matters of public interest, unless a human reviewed it and someone holds editorial responsibility (Article 50(4)). Tell people when you use emotion recognition or biometric categorization on them, where either is still legal.

From December 2, 2027, for high-risk systems, under Article 26:

• Use the system according to the provider's instructions for use.
• Human oversight goes to named people with the competence, training, and authority to overrule it.
• Where you control the input data, it has to be relevant and sufficiently representative for the intended purpose.
• Watch how it behaves. If it presents a risk, suspend it and tell the provider and the national regulator (the market surveillance authority). Serious incidents get reported.
• Keep the logs the system generates automatically for at least 6 months.
• Before a high-risk system goes live in the workplace, tell workers' representatives and the affected workers (Article 26(7)).
• Tell people when a high-risk system helps make decisions about them. Under Article 86, they can also ask for an explanation of the system's role in the decision.

Credit and insurance deployers carry one more item. Article 27 requires a fundamental rights impact assessment before first use of creditworthiness or life and health insurance pricing systems, which is a written analysis of who the system affects and how things could go wrong for them.

No conformity assessment, no CE marking (the EU conformity label on a product), no EU representative. Those belong to providers, which is why the Article 25 question matters so much.

How big are the fines, and who enforces them?

Up to €35M or 7% of worldwide annual turnover for prohibited practices, €15M or 3% for most other breaches, and €7.5M or 1% for supplying incorrect information to authorities. For large companies the higher figure applies. For SMEs, the lower.

You'll find the SME rule in Article 99(6). National market surveillance authorities in each member state enforce the Act against providers and deployers. The EU's AI Office handles general-purpose AI models.

As of late September 2026, we found no published AI Act fine against any company from an EU regulator. None. A "€47 million in first fines" story has been making the rounds on AI compliance blogs, complete with an HR tech company, a lender, and a retail chain, and when you chase it back through the links it lands on no regulator, no decision, and no named company.

So where does the pressure show up first? Expect it in procurement. EU customers carry their own deployer duties, and the easiest way to meet some of them is to push questions down to their vendors about which AI touches their data and their people. Your first AI Act enforcement will likely arrive as a vendor questionnaire, not a regulator's letter.

How does it compare with US AI rules?

There's still no comprehensive federal AI law in the US. The state picture got lighter this year. Much lighter. Colorado's first AI law, SB 24-205, was blocked in federal court and then repealed and replaced by SB 26-189, signed May 14, 2026, and effective January 1, 2027. The replacement dropped impact assessments and the anti-discrimination duty of care in favor of notices and explanations.

Which leaves the EU AI Act as the strictest AI rule a US company is likely to face. By a wide margin.

Voluntary as it is, the NIST AI Risk Management Framework is the closest thing the US has to a common standard. Its four functions map well onto an AI Act program. Our guide to AI governance frameworks compares the options. Build to the EU bar with NIST as the operating structure, and Colorado's notice rules become a small add-on rather than a separate project.

AI governance also sits beside your other obligations, not inside them. If you already run SOC 2, ISO 27001, or NIST work through a compliance program, the AI inventory belongs next to it, with its own owner. Not the same owner.

What should a US company do this quarter?

Five moves, in order. None waits for December 2027.

1. Inventory every AI system in use. Include the ones nobody approved. Shadow AI (AI tools employees adopt without IT's knowledge) is where the Annex III surprises hide, along with AI features vendors switched on inside software you already own. Copilot is the obvious one, and Copilot governance is its own checklist.
2. Mark every EU touchpoint against that list, meaning EU users, EU employees, EU job candidates, and EU customers who receive the output.
3. Classify each system by tier, then run the Article 25 check. Custom GPTs, rebranded tools, and fine-tuned models are the usual suspects.
4. Push your vendors. Ask your HR, credit, and insurance-tech vendors for their AI Act conformity roadmap, their instructions for use, and how you'll get 6 months of logs. Put the answers in the contract. A third-party risk management program is where those answers get tracked.
5. Write down what you've already done for AI literacy. If the answer is nothing, a written AI acceptable use policy and a 45-minute training session with an attendance record get you a defensible starting point.

Step 1 decides everything after it. Companies that skip it end up classifying the tools they remember, and the Warsaw resume ranker is never one of those.