Executive briefing: EU AI Act
Does the EU AI Act Apply to UK and US Companies? Extraterritorial Scope Explained
Yes, in many cases. The EU AI Act applies to UK and US companies that place AI systems on the EU market, or whose AI output is used in the EU, wherever they are based. This extraterritorial scope, set by Article 2, follows the market, much as GDPR does. AI that never reaches the EU is generally outside it.
Correct as of 28 September 2026. Regulation and guidance change. If you are reading this later, check for updates before relying on it.
Read the full briefingIn brief
- The Act follows the market, not the head office. Being outside the EU does not take you outside the Act.
- Two tests catch most UK and US companies: you place AI on the EU market, or the output of your AI is used in the EU.
- Your role decides your duties: provider, deployer, importer or distributor. Most companies are deployers of AI they bought.
- Non-EU providers of high-risk AI must appoint an authorised representative in the EU before selling there.
- Banned practices, AI literacy and Article 50 transparency already apply. Most high-risk duties apply from 2 December 2027.
Why the board should care
Fines are set on global turnover
Up to EUR 35 million or 7% of worldwide annual turnover for banned practices, and up to EUR 15 million or 3% for many other breaches, whichever is higher (Article 99).
EU customers will ask first
EU buyers carry their own duties as deployers. Expect AI questions in tenders, supplier questionnaires and contract renewals before any regulator calls.
Brexit is not an exemption
The UK left the EU, but its companies still sell to, employ and serve people there. The Act applies to that activity.
Full briefing
Read the full briefing
Free for executives. Confirm your work email once and every AIPEX executive briefing opens for 12 months.
- The full written briefing
- Who it applies to, and who it does not
Next step
Find out where your AI exposure sits
The AI Readiness Assessment (£999 + VAT) scores your business across 30 areas, including governance and risk, with a prioritised roadmap and a 60-minute debrief. Prefer to talk first? A free 30-minute scoping call with a senior partner.
FAQ
Frequently asked questions
Does the EU AI Act apply to UK companies?
Yes, where a UK company places an AI system on the EU market, uses AI whose output is used in the EU, or has an EU subsidiary or office using AI. Brexit changed UK law, not the reach of EU law over activity in the EU. AI that never reaches the EU is generally outside it.
Does the EU AI Act apply to US companies?
Yes, on the same test. A US company that places an AI system on the EU market, or whose AI output is used in the EU, is in scope wherever it is headquartered. US federal or state rules on the same system are separate obligations and do not replace the EU duties.
What is the extraterritorial scope of the EU AI Act?
Article 2(1) of Regulation (EU) 2024/1689 applies the Act to providers placing AI on the EU market wherever they are established, and to providers and deployers outside the EU where the output of their AI system is used in the EU. It follows the market and the effect, not the head office, much as GDPR does.
Who does the EU AI Act apply to?
Providers, deployers, importers and distributors of AI systems, product manufacturers who place AI on the market with their products, and authorised representatives of non-EU providers. Most businesses are deployers: they use AI, often bought from a vendor, in the course of their work.
Do non-EU companies need an EU representative under the AI Act?
Providers established outside the EU must appoint an authorised representative in the EU, by written mandate, before making a high-risk AI system available there (Article 22). Providers of general-purpose AI models outside the EU have a similar duty (Article 54). Deployers do not need one.
Does the EU AI Act apply if we only use AI and do not sell it?
It can. A company outside the EU that uses AI whose output is used in the EU, such as screening EU job applicants or scoring EU customers, is a deployer in scope for that system. Deployers of high-risk AI carry duties including human oversight, monitoring and keeping logs.
Does the UK have its own AI Act?
Not at the date of review. The UK government set out a sector-led approach through existing regulators in its February 2024 response on AI regulation, and has no cross-sector AI statute equivalent to the EU AI Act. UK companies with EU customers or staff still need to meet the EU rules.
What are the fines for non-EU companies under the EU AI Act?
The same as for EU companies: up to EUR 35 million or 7% of worldwide annual turnover for banned practices, up to EUR 15 million or 3% for many other breaches, and up to EUR 7.5 million or 1% for misleading information. The higher figure applies, except for SMEs, where the lower one does.
Correct as of 28 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 28 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.
This briefing is general information about the scope of the EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (EU) 2026/1744, correct at the date last reviewed. Governance guidance, not legal advice. AIPEX is not a certification body. For decisions about specific AI systems, take advice from a qualified lawyer.