Does the EU AI Act apply to US companies
Yes, where a trigger in Art. 2(1) of Regulation (EU) 2024/1689 is met: the company places an AI system or model on the Union market under Art. 2(1)(a), its output is used in the Union under Art. 2(1)(c), or its product carries an AI system under its own name under Art. 2(1)(g). The Art. 3 role fixes the set: Art. 9 to Art. 17 for a high-risk provider from the Annex III application date Deferred, Art. 50 for generative features, Art. 53 for a model. This page gives the set per role, the sequence, the evidence and the consequence of inaction.
Where this starts
The question arrives from a US company with no EU subsidiary and no EU data centre, and the answer turns on neither fact. Art. 2(1)(a) applies the Regulation to a provider that places an AI system or a general-purpose AI model on the Union market or puts an AI system into service in the Union, irrespective of whether that provider is established or located within the Union or in a third country. Art. 2(1)(c) applies it to a provider or deployer located in a third country where the output produced by the system is used in the Union. Art. 2(1)(g) applies it to a product manufacturer that places an AI system on the market or puts it into service together with its product and under its own name or trademark. The definitions behind those triggers are in Art. 3: a provider under Art. 3(3) develops the system or model, or has it developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge; placing on the market under Art. 3(9) is the first making available on the Union market; and making available under Art. 3(10) is the supply for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge. A free tier, a self-serve API or a reseller contract that supplies the system for use in the Union meets Art. 3(10) on its face, and the exclusions in Art. 2(3) for exclusively military, defence or national security use, in Art. 2(8) for research, testing and development before placing on the market, and in Art. 2(12) for free and open-source systems that are not high-risk and fall outside Art. 5 and Art. 50 are the only routes out. The scope check is step 11 of PR-CLS v1.0, the risk classifier runs the same triggers on the published logic, and the result is a technical assessment for discussion with counsel; the classification decision remains with the provider and its counsel.
The obligation set is fixed per role, and one US company holds different roles for different products. A US provider of a high-risk system under Art. 6 owes the Chapter III Section 2 set, risk management under Art. 9 through the quality management system under Art. 17, the provider duties collected in Art. 16 including the conformity assessment under Art. 43 and the registration under Art. 49, and, before it makes the system available on the Union market, the appointment by written mandate of an authorised representative established in the Union under Art. 22(1); the representative keeps the technical documentation under Art. 11 at the disposal of the authorities under Art. 22(3)(b). A US provider of a system that interacts with natural persons or generates synthetic content owes Art. 50(1) disclosure and Art. 50(2) marking from the Art. 50 application date In force, whether or not the system is high-risk. A US provider of a general-purpose AI model owes Art. 53 from the GPAI application date In force, appoints its own representative under Art. 54(1) before placing the model on the Union market, and loses the Art. 53(2) and Art. 54(6) open-source exception where the model is classified with systemic risk under Art. 51; Art. 55 then applies as well. A US deployer whose system output is used in the Union owes the deployer duties under Art. 26 through Art. 2(1)(c), and each EU customer of a US provider is a deployer under Art. 2(1)(b) that receives the Art. 13 instructions for use from the provider.
The EU side of the sales chain carries verification duties that stop when the US provider's file is missing. An importer under Art. 3(6) is by definition a person in the Union that places on the market a system bearing the name or trademark of a person established in a third country, and Art. 23(1) requires it to verify, before placing a high-risk system on the market, that the conformity assessment under Art. 43 was carried out, that the technical documentation under Art. 11 was drawn up, that the CE marking, the EU declaration of conformity and the instructions for use are present, and that the representative under Art. 22(1) was appointed; under Art. 23(2) an importer with sufficient reason to consider that the system is not in conformity does not place it on the market. A distributor under Art. 24(1) verifies the CE marking, the declaration and the instructions. Under Art. 25(1) an importer, distributor or deployer that puts its own name on a high-risk system, substantially modifies it or changes its intended purpose becomes the provider, and under Art. 25(3) the product manufacturer of an Annex I Section A product is the provider of a high-risk safety component placed under its name. Work already done under a US framework or a state law is reusable only where a mapping shows which Annex IV heading it answers: a published voluntary framework such as NIST AI RMF 1.0Published is organised by function and Annex IV by section, and the technical documentation a developer prepares under Colorado's reenacted Part 17 on automated decision-making technology follows that law's headings rather than Annex IV, as the EU AI Act vs Colorado AI Act guide maps. No harmonised standard is cited in the Official Journal as of the anchor date, so no presumption of conformity is available to a provider inside or outside the Union, and each Art. 15 threshold is the provider's own, justified against the EU context of use and recorded in the threshold-declaration step of PR-15-ROB v1.0. The hub for providers outside the Union carries the full obligation set with its dates and the evidence list the representative, the importer and the authority ask for.
The sequence
The work runs scope first, then role, then classification, then the representative, then the register, the mapping, the tests and the file.
Check each system against the Art. 2(1) triggers: Union market supply, own-name product, output used in the Union.
Record Territorial scope record, one row per system and model
[Regulation (EU) 2024/1689, Art. 2(1)(a), (c) and (g); PR-CLS step 11]
Test each Art. 3 role definition against the company and against each EU party in the sales chain.
Record Role determination record, one row per system and Art. 3 role
[Regulation (EU) 2024/1689, Art. 3(3), (4), (6) and (7); PR-CLS steps 8 and 9]
Check whether an EU importer, distributor or product manufacturer takes the provider role under Art. 25.
Record Art. 25 trigger record
[Regulation (EU) 2024/1689, Art. 25(1) and 25(3); PR-CLS step 10]
Classify each system as high-risk or not and each model as general-purpose or not.
Record High-risk classification record and GPAI determination record
[Regulation (EU) 2024/1689, Art. 6(1), 6(2) and Annex III; Art. 3(63); PR-CLS steps 12 to 16 and 19 to 20]
Verify the written mandate of the authorised representative and what it produces on a simulated request.
Record Mandate verification record and retrieval exercise record
[Regulation (EU) 2024/1689, Art. 22(1) and (3), Art. 54(1) and (3); PR-CLS steps 4 and 31 to 33]
Compile the obligation register: each article per role with the regulation entry that dates it.
Record Obligation register per role with a regulation entry id per date
[PR-CLS steps 39 to 41]
Map each artifact built for a US framework or state law to an Annex IV heading and list the gaps.
Record Annex IV gap and consistency report (PR-11-DOC output)
[Regulation (EU) 2024/1689, Art. 11(1) and Annex IV; PR-11-DOC]
Run the Art. 15 tests and the Art. 50(2) marking tests on the build sold into the Union.
Record Accuracy, robustness and cybersecurity test reports (PR-15-ROB output) and marking presence and survivability test report (PR-50-MARK output)
[Regulation (EU) 2024/1689, Art. 15(1) and 15(3), Art. 50(2); PR-15-ROB and PR-50-MARK]
Place the assembled file with the representative and match its version to the provider's copy.
Record Representative's file copy with a version match to the provider's technical documentation
[Regulation (EU) 2024/1689, Art. 22(3)(b) and Art. 54(3)(b); PR-CLS step 34]
Evidence this situation ends with
| Artifact | Answers | Produced by |
|---|---|---|
| Role determination record (PR-CLS output) | Art. 2(1)(a), (c) and (g) and Art. 3(3) to 3(7): the trigger met and the role held per system, with the Art. 25 check | PR-CLS v1.0 |
| Obligation register (PR-CLS output) | Art. 16, Art. 50, Art. 53 and Art. 26 per role: each applicable article with the regulation entry that dates it | PR-CLS v1.0 |
| Mandate verification record (PR-CLS output) | Art. 22(1) and (3) or Art. 54(1) and (3): representative established in the Union, mandate dated before placing on the market, tasks listed | PR-CLS v1.0 |
| Annex IV technical documentation set (Annex IV sections 1 to 9) | Art. 11(1): the file the representative keeps under Art. 22(3)(b) and the importer verifies under Art. 23(1)(b) | the provider |
| Annex IV gap and consistency report (PR-11-DOC output) | Art. 11(1) and Annex IV: each existing framework or state-law artifact marked reusable, reusable with additions, or missing | PR-11-DOC v1.0 |
| Risk management file (Art. 9(1)) | Art. 9(1) and 9(5): the risks identified, the measures adopted and the residual risk judgement, described in Annex IV section 5 | the provider |
| Marking presence and survivability test report (PR-50-MARK output) | Art. 50(2): the mark present and readable after the transformation set on the build supplied to the Union | PR-50-MARK v1.0 |
| Annex XI technical documentation (Annex XI Section 1 and, for systemic risk, Section 2) | Art. 53(1)(a): the model documentation the representative keeps under Art. 54(3)(b) | the provider |
Each artifact follows a specification with a synthetic sample on the deliverables page: the role determination record and the mandate verification record follow the assessment memo specification, the obligation register follows the register or checklist specification, the gap and consistency report follows the traceability matrix specification, and the test reports follow the test report specification.
If nothing is done
A high-risk system supplied to the Union without a representative and without the Annex IV file meets the market surveillance procedure of Art. 79 at the first EU party that handles it: the importer under Art. 23(1)(d) cannot verify the Art. 22(1) appointment and under Art. 23(2) does not place the system on the market, and a market surveillance authority that finds the Chapter III requirements unmet requires corrective action, withdrawal or recall under Art. 79(2) and takes provisional measures to prohibit or restrict the system where the operator does not act, under Art. 79(5). The reasoned request for documentation goes to the representative under Art. 22(3)(c), and under Art. 22(4) a representative that considers the provider to act contrary to its obligations terminates the mandate and informs the authority. A finding against the provider obligations under Art. 16, the representative duties under Art. 22 or the transparency duties under Art. 50 falls in the penalty tier of Art. 99(4), with the amount set by the national authority under the Art. 99(7) criteria; for a general-purpose AI model the Commission requests information under Art. 91 and fines the provider under Art. 101 from the enforcement date In force. The provider's action is the Art. 22(1) or Art. 54(1) mandate, the Annex IV or Annex XI file placed with the representative, and the corrective action under Art. 20 taken on its own initiative once it has reason to consider that the system does not meet the requirements.
Services, guides and tools for this situation
The classification and readiness assessment runs the scope, role and classification steps under PR-CLS v1.0 and produces the obligation register per role, within the limits stated on what we cannot do; the Art. 22 and Art. 54 mandate verification and the retrieval exercise are part of the same protocol.
- ICP hubs
Questions
Which obligations does the EU AI Act place on US companies?
The role under Art. 3 of Regulation (EU) 2024/1689 fixes the set. A US provider of a high-risk system owes Art. 9 to Art. 17, the Art. 16 provider duties and an authorised representative in the Union under Art. 22(1). A US provider of a system that interacts with persons or generates content owes Art. 50. A US provider of a general-purpose AI model owes Art. 53 and a representative under Art. 54(1). A US deployer whose output is used in the Union owes Art. 26 through Art. 2(1)(c).
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.