Guide
Who does the EU AI Act apply to?
Updated June 16, 2026 · By Max Langley, AI Audits EU
The EU AI Act applies to you if you provide or deploy an AI system that is placed on the EU market, put into service in the EU, or whose output is used in the EU, regardless of where your company is based. US and UK companies selling or deploying AI into the EU are squarely in scope.
It reaches outside the EU on purpose
The Act is extraterritorial. It covers providers that place an AI system on the EU market no matter where they are established, deployers located in the EU, and providers or deployers based anywhere in the world when the output their system produces is used in the EU. A model trained and hosted in the United States that scores EU job applicants, or whose results land in front of EU users, can fall under the Act even if the company has no European entity.
Which role are you: provider or deployer?
Your obligations depend on your role. A provider develops an AI system, or has it developed, and puts it on the market or into service under its own name. A deployer uses an AI system under its own authority in a professional setting. The same company can be both. Importers and distributors that bring third-party AI into the EU also carry duties. Providers of high-risk systems carry the heaviest load, but deployers must still use the system as instructed, keep human oversight in place, and monitor how it performs.
Internal use does not let you off
Using AI inside your own organisation makes you a deployer, and if that system is high-risk you take on deployer obligations. Build it yourself and you can hold provider obligations on top. The trigger is the activity and the risk tier, not whether you sell the tool, so an internal hiring or credit-decision model is not automatically out of scope.
Who is exempt
The Act does not cover AI used purely for military, defence, or national security, systems built only for scientific research and development, or purely personal non-professional use. Free and open-source systems get some relief, but not when they are high-risk, are general-purpose AI models that pose systemic risk, or touch the prohibited-practice rules. If you are unsure, the safer assumption is that a system used in a regulated, decision-making context is in scope.
Does the EU AI Act apply to US and UK companies?
Yes, if you place an AI system on the EU market, put it into service in the EU, or your system produces output that is used in the EU. The Act applies regardless of where your company is established, so a US or UK business with no EU office can still be fully in scope.
What is the difference between a provider and a deployer?
A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority in a professional capacity. The heaviest obligations fall on providers of high-risk systems, but deployers have duties too, including human oversight and using the system per its instructions.
Does it apply if my AI is only used internally?
Often yes. Using an AI system in your own operations makes you a deployer, and if the system is high-risk you take on deployer obligations. If you build the system yourself for internal use, you can also hold provider obligations. Internal-only use does not automatically remove you from scope.
Are there exemptions?
Yes. The Act does not cover AI used purely for military, defence, or national-security purposes, scientific research and development, or purely personal non-professional use. Free and open-source systems get limited relief, but not when they are high-risk, are general-purpose AI models with systemic risk, or fall under the prohibited-practice rules.
Sources
- Regulation (EU) 2024/1689 (the AI Act), Article 2 (scope), EUR-Lex, eur-lex.europa.eu.
- European Commission, Regulatory framework on artificial intelligence, digital-strategy.ec.europa.eu.
Not sure if you are in scope?
Tell us what your AI system does and where it is used. We will tell you whether the EU AI Act applies and what a readiness assessment would involve.
This guide is general information, not legal advice. Confirm your obligations with qualified counsel.