Who Does the EU AI Act Apply To? (Scope & Extraterritorial Reach)
The EU AI Act reaches far beyond EU-based AI developers. Article 2 defines its scope by the roles operators play and by where an AI system's output is used — which pulls in many non-EU companies. This page covers the operators in scope, the extraterritorial reach, and the key exclusions.
Who Does the EU AI Act Apply To? (Scope & Extraterritorial Reach)
The EU AI Act reaches far beyond EU-based AI developers. Article 2 defines its scope by the roles operators play and by where an AI system's output is used — which pulls in many non-EU companies. This page covers the operators in scope, the extraterritorial reach, and the key exclusions.
Son Güncellenme: 4 Temmuz 2026
Which Operators Are In Scope
The Act applies to a defined set of operators across the AI value chain:
- Providers placing AI systems or general-purpose AI models on the EU market or putting them into service, wherever they are established
- Deployers of AI systems that are established or located within the EU
- Importers and distributors of AI systems making them available on the EU market
- Product manufacturers placing an AI system on the market together with their product under their own name or trademark
- Authorised representatives of providers not established in the EU, and affected persons located in the EU
Extraterritorial Reach
You do not need an EU establishment to be caught. The Act follows the AI system's placement on the market and, critically, where its output is used:
- Providers placing an AI system on the EU market or putting it into service in the EU are covered regardless of where they are established
- The Act applies to providers and deployers located in a third country where the output produced by the AI system is used in the EU
- This means a non-EU company whose AI produces results relied on inside the EU can be in scope even with no EU office
- Non-EU providers of high-risk systems must appoint an EU-established authorised representative (Article 22)
Cloud-hosted and web-accessible AI tools reachable by EU users can fall in scope — the trigger is EU use of the output, not the location of the servers.
Key Exclusions
Article 2 also carves out several areas from the Act's scope:
- National security, military and defence — AI systems placed on the market or used exclusively for these purposes
- Scientific research and development — AI systems and models developed and put into service solely for scientific research, and pre-market R&D, testing and development activity
- Personal, non-professional use — natural persons using AI systems in the course of a purely personal, non-professional activity
- Free and open-source AI — largely excluded, except where the system is prohibited, high-risk, subject to the Article 50 transparency duties, or is a general-purpose AI model with systemic risk
- Public authorities in third countries and international organisations acting under international cooperation agreements for law enforcement or judicial cooperation, subject to safeguards
How AIAgentree helps
Whichever in-scope role you hold, the Act expects logging and human-oversight evidence — AIAgentree helps any operator produce it:
- Role-agnostic evidence: tamper-evident decision records and human-oversight workflows produce the logging and oversight trail the Act expects, whether you are a provider or a deployer
- Built for non-EU operators too: REST, MCP, A2A and OpenTelemetry integrations plus Python and TypeScript SDKs let any in-scope operator capture decisions without re-architecting
- EU data residency in Germany keeps that evidence inside the EU, which matters when your output is used in the EU even though your company is not
Frequently Asked Questions
Does the EU AI Act apply to companies outside the EU?
Yes. It applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers located in third countries when the output produced by their AI system is used in the EU. A non-EU company can be in scope with no EU office.
What kinds of operators does the Act cover?
Providers, deployers, importers, distributors, product manufacturers placing AI with their product, and the authorised representatives of non-EU providers. Affected persons located in the EU are also recognised. Each role carries its own set of obligations.
Is open-source AI exempt from the EU AI Act?
Free and open-source AI systems are largely excluded, but not unconditionally. The carve-out does not apply where the system is prohibited, classified as high-risk, subject to Article 50 transparency obligations, or is a general-purpose AI model with systemic risk.
Is AI used only for research covered?
AI systems and models developed and put into service solely for scientific research and development are excluded, as is research, testing and development activity before a system is placed on the market. Once such a system is placed on the market or put into service for real use, the exclusion no longer applies.
Does hosting our AI outside the EU keep us out of scope?
Not necessarily. The scope test looks at whether the output of the AI system is used in the EU and whether the system is placed on the EU market, not at where the servers sit. Cloud-hosted and web-accessible tools reachable by EU users can be caught.
Continue exploring the EU AI Act guide
EU AI Act Compliance Guide
The complete guide to EU AI Act compliance for AI agents — start here.
Article 12 — Record-Keeping & Logging
What every high-risk AI system must log, and how to capture it.
Article 14 — Human Oversight
Designing effective human-in-the-loop controls for AI decisions.
Annex III — High-Risk AI Systems
Which AI use cases the Act classifies as high-risk.
EU AI Act Compliance Checklist
A step-by-step checklist to reach and document compliance.
Compliance Cost Calculator
Estimate your EU AI Act compliance effort and cost.
Deadlines & Timeline
Key enforcement dates, including the August 2, 2026 deadline.
Fines & Penalties
Penalty tiers up to €35M or 7% of global annual turnover.
Transparency Obligations (Art. 13 & 50)
Disclosure duties for AI systems and their outputs.
Risk Management & Conformity Assessment
Build a risk management system and assess conformity.
GPAI Obligations
Rules for providers of general-purpose AI models.
EU AI Act for US Companies
Extraterritorial scope and what US providers must do.
Omnibus Update
The latest changes to the EU AI Act timeline and rules.
Penalty Calculator
Estimate your maximum fine under the Article 99 tiers.
Article 11 + Annex IV
What technical documentation the EU AI Act requires.
Article 26: Deployer Obligations
What deployers of high-risk AI must do, including log retention.
Article 17: Quality Management
The QMS providers of high-risk AI must document.
Article 10: Data Governance
Data quality, bias mitigation, and governance duties.
Article 4: AI Literacy
The staff AI-literacy duty in force since February 2025.
Deployer vs Provider
Who bears which obligation — and when a deployer becomes a provider.
FRIA (Article 27)
Who must run a Fundamental Rights Impact Assessment, and how.
Post-Market Monitoring
Articles 72–73: ongoing monitoring and incident reporting.
ISO 42001 vs EU AI Act
How the voluntary standard and the binding law fit together.
NIST AI RMF vs EU AI Act
A practical crosswalk between the framework and the law.
EU AI Act for Healthcare
High-risk medical AI, MDR/IVDR interplay, and clinician oversight.
EU AI Act for Financial Services
Credit scoring, insurance pricing, and existing financial regulation.
EU AI Act for HR & Employment
Hiring AI as high-risk, plus NYC LL144 and EEOC overlap.