Non-EU companies placing AI on the EU market

The situation

The company is established in the United States, the United Kingdom or another third country, holds no EU entity and runs no EU data centre, and sells its system into the Union or has its output used there. Neither an establishment nor a data centre is a scope criterion. Art. 2(1)(a) applies the Regulation to providers placing an AI system or a general-purpose AI model on the Union market irrespective of whether the provider is established in the Union or in a third country, and Art. 2(1)(c) applies it to providers and deployers in a third country where the output produced by the system is used in the Union. Art. 2(3) excludes systems used exclusively for military, defence or national security purposes, Art. 2(8) excludes research, testing and development before placing on the market with the exception of testing in real-world conditions, and Art. 2(12) excludes free and open-source systems unless they are high-risk or fall under Art. 5 or Art. 50. The scope and role determination is recorded under PR-CLS v1.0 as a reasoned technical assessment for discussion with counsel; the classification decision remains with the provider and its counsel.

Art. 22(1) requires a provider established in a third country to appoint, by written mandate, an authorised representative established in the Union before it makes a high-risk AI system available on the Union market. Under Art. 22(3) the mandate empowers the representative to verify that the EU declaration of conformity and the technical documentation under Art. 11 have been drawn up, to keep the provider's contact details, a copy of the declaration, the technical documentation and any certificate at the disposal of the authorities for ten years after placing on the market, to provide on reasoned request the information and documentation needed to demonstrate conformity, including the logs under the provider's control, and to comply with the registration duty under Art. 49. Under Art. 22(4) the representative terminates the mandate and informs the market surveillance authority when it considers that the provider acts contrary to its obligations, so the Annex IV file has to exist in a form the representative can produce on request. The EU sales chain carries its own checks: Art. 23(1) requires an importer to verify, before placing a high-risk system on the market, that the conformity assessment was carried out, the technical documentation drawn up, the CE marking, declaration and instructions for use supplied and the representative appointed; Art. 24(1) requires a distributor to verify the CE marking, the declaration and the instructions; and under Art. 25(1) an importer or distributor that puts its own name on the system, substantially modifies it or changes its intended purpose becomes the provider. A provider of a general-purpose AI model established in a third country appoints its representative under Art. 54.

Work done for a US framework or a state law is partly reusable, and the reuse has to be mapped heading by heading. NIST AI RMF 1.0Published is a published voluntary framework organised in the Govern, Map, Measure and Manage functions, while Annex IV is organised in sections, so a Measure record answers Annex IV section 2(g) only where it names the metric, the test set and the conditions the section asks for. ISO/IEC 42001:2023Published is a published management-system standard whose clauses map onto the Art. 17(1) elements, and an audit against it is not a conformity assessment under Art. 43. The technical documentation a developer prepares under a state law such as Colorado's reenacted Part 17 on automated decision-making technology follows that law's headings rather than the Annex IV sections; the EU AI Act vs Colorado AI Act guide maps the two. The mapping table produced under PR-11-DOC v1.0 marks each existing artifact as reusable, reusable with additions, or missing, and the gap list is what has to be produced fresh. EU enterprise customers ask for that file in procurement before the Annex III application date, and one Annex IV file held by the provider answers the customer, the representative and the authority; a single global build carries the Art. 15 test reports with thresholds justified against the EU context of use and the Art. 50(2) marking for every market. The questions this hub answers:

• Whether the Act applies at all, given no EU entity and no EU data centre
• Which existing US framework evidence counts, and what has to be produced fresh for the Annex IV file
• The authorised representative will be asked for the technical file and must be able to produce it
• EU enterprise customers ask for AI Act evidence in procurement before the application date
• A single global product has to satisfy the EU requirements without a separate EU build

Obligations and dates

Three regulation entries carry the dates for this obligation set, the same entries as for the corresponding EU role, and each row of the table shows the entry that governs it.

Regulation (EU) 2024/1689 sets no numeric threshold for accuracy, robustness or cybersecurity in Art. 15, none for the Art. 50(2) marking beyond the four qualitative criteria of effectiveness, interoperability, robustness and reliability, and none for the Annex XI content under Art. 53. No harmonised standard is cited in the Official Journal as of the anchor date, so no presumption of conformity is available to any provider, inside or outside the Union. The metric categories and the structure of the accuracy declaration come from prEN 18229-2Draft, a JTC 21 draft; the metric-selection rationale a provider already records under NIST AI RMF 1.0Published, a published framework, is reusable as the justification only when it is tied to the EU context of use. The provider sets its own targets against that context and records the justification; the acceptance-criteria step of PR-15-ROB v1.0 and the target-setting step of PR-50-MARK v1.0 hold that record.

What an assessor or authority will ask for

A market surveillance authority acting under Art. 74, an importer verifying under Art. 23, or the authorised representative preparing for a reasoned request asks a provider outside the Union for the following, in this order.

1. Scope and role determination memo under Article 2 and Article 3, presented as a reasoned technical assessment for discussion with counsel
2. Mapping table from NIST AI RMF, ISO/IEC 42001 or state-law artifacts to the Annex IV headings, with reusable evidence marked and gaps listed
3. Annex IV technical file held by the provider and available to the authorised representative
4. Accuracy, robustness and cybersecurity test reports in the form an EU assessor expects, with thresholds justified
5. Article 50 marking evidence for generative features sold into the Union
6. Importer and distributor verification records under Articles 23 and 24

The list maps onto the artifact families specified with synthetic samples on the deliverables page: the assessment memo for the scope and role determination from PR-CLS, the traceability matrix for the mapping from NIST AI RMF, ISO/IEC 42001 or state-law artifacts to the Annex IV headings with reusable evidence marked, the evidence pack for the Annex IV file assembled under Art. 11 and held for the representative, the test report from PR-15-ROB and PR-50-MARK for accuracy, robustness, cybersecurity and marking, the protocol run record behind each test, and the register or checklist for the importer and distributor verification records under Art. 23 and Art. 24.

Scenarios

Each scenario page tagged for providers outside the Union states the sequence of events, the evidence list and the consequence of inaction with its article reference.

• Does the EU AI Act apply to US companies
• Do we need an EU authorised representative under the EU AI Act
• EU AI Act vs NIST AI RMF: reusing RMF work as EU evidence
• Who needs to comply with the EU AI Act

Guides

Each guide tagged for providers outside the Union holds a real command, configuration or synthetic example and a threshold or pitfall with its source.

• EU AI Act vs Colorado AI Act
• EU AI Act technical documentation guide: the simplified form for SMEs

Services

Five services test the evidence of a provider outside the Union; the scope limits are stated on what we cannot do, and the compliance decision remains with the provider, its notified body where one is required, and its counsel.

• Classification and readiness assessmentnow2026-07-27In force
• Technical documentation and evidence-pack preparationtoward the Annex III date2027-12-02Deferred
• Robustness and adversarial testingnow, toward the Annex III date2027-12-02Deferred
• Article 50 transparency and marking/watermark testingnow, past legacy grace2026-08-02In force
• Pre-conformity mock assessmenttoward the Annex III date2027-12-02Deferred

Protocols

Each protocol is versioned and published in full on the methodology index with the derivation from the standards it cites and the limits of what it shows.

• PR-CLS v1.0Classification and role determination protocol
• PR-11-DOC v1.0Annex IV documentation assembly and consistency protocol
• PR-15-ROB v1.0Robustness and adversarial testing protocol
• PR-50-MARK v1.0Article 50 marking and detection protocol
• PR-43-MOCK v1.0Pre-conformity mock assessment protocol

Tools and templates

The classifier, the obligation tracker and the traceability matrix run in the browser, nothing is sent to a server, and their rules are published on the tool logic page; the Annex IV outline and the other templates are on the templates page.

• Risk and role classifier
• Obligation tracker
• Traceability matrix template

Questions

+−What is the extraterritorial reach of the AI Act?

Art. 2(1)(a) applies Regulation (EU) 2024/1689 to providers placing an AI system or a general-purpose AI model on the Union market, whether established in the Union or in a third country. Art. 2(1)(c) applies it to third-country providers and deployers where the output produced by the system is used in the Union. Art. 2(3) excludes exclusively military, defence and national security use, and Art. 2(8) excludes research, testing and development before placing on the market, except testing in real-world conditions.

+−How does the EU AI Act affect US companies?

A US company that places an AI system on the Union market carries the provider duties: Art. 9 to Art. 17 for a high-risk system, Art. 50 for generative features, Art. 53 for a general-purpose AI model. Art. 22 requires an authorised representative in the Union before a high-risk system is made available, and Art. 54 requires one for a general-purpose AI model. Evidence built for NIST AI RMF or a state law is reusable where a mapping shows which Annex IV heading it answers.

+−Is the EU AI Act extraterritorial?

Regulation (EU) 2024/1689 reaches providers outside the Union through Art. 2. Art. 2(1)(a) names providers irrespective of establishment in the Union or a third country, and Art. 2(1)(c) names third-country providers and deployers whose output is used in the Union. The authorised representative under Art. 22 is the addressee for the authorities, a market surveillance authority can require corrective action, withdrawal or recall under Art. 79, and Member States impose penalties under Art. 99. The provider's action is the Art. 22 mandate and an Annex IV file the representative holds.

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com