Does the EU AI Act apply outside the EU?

When does the AI Act apply to a company outside the EU?

The EU AI Act (Regulation (EU) 2024/1689) is the regulation that sets risk-based rules for placing AI systems on the EU market and using them in the EU. Article 2 lists who it applies to. For a company outside the EU, three points decide it:

• Article 2(1)(a): providers that place AI systems or general-purpose AI models on the EU market, or put them into service there, are covered whether they are established in the EU or in a third country.
• Article 2(1)(c): providers and deployers established outside the EU are covered where the output produced by the AI system is used in the Union.
• Article 2(1)(e): product manufacturers that place an AI system on the market together with their product, under their own name or trademark, are covered.

In short, what matters is not where the company sits but where the system or its output ends up. The scenarios below make this concrete. The table is a first pass; the outcome depends on your contracts and context.

Scenario	Likely role	Likelihood of scope	First step
You sell an AI-enabled SaaS product to EU customers	Provider	High	Determine the system’s risk level and transparency duties
Your model runs in Türkiye, but its output goes to a partner in the EU	Provider or deployer	Medium to high	Document how the output is used in the EU
You use AI only for internal processes outside the EU	Deployer (non-EU)	Low	Focus on local data protection law and good practice
You build software nearshore for an EU company	Usually your client is the provider; you support as developer	Depends on the contract	Write role allocation and documentation duties into the contract
You export a machine or device with an AI component to the EU	Product manufacturer or provider	High	Check whether the product falls under EU harmonisation legislation

Provider, deployer, importer, distributor: which are you?

Most obligations depend on your role.

• Provider: a person or organisation that develops an AI system or model, or has it developed, and places it on the market under its own name. The heaviest obligations, especially for high-risk systems, sit here.
• Deployer: an organisation using an AI system under its authority in a professional activity. A bank using a credit scoring product it bought is an example.
• Importer: an EU-based person or organisation that places a non-EU provider’s system on the EU market.
• Distributor: a party in the supply chain, other than the provider or importer, that makes the system available on the market.

A non-EU provider placing a high-risk system on the EU market must also appoint an authorised representative in the EU. Roles are set per system; the same company can be a provider for one product and a deployer of another tool.

What are the risk levels, and which uses are high-risk?

The Act works in four tiers. Practices with unacceptable risk, such as manipulative techniques or social scoring, are prohibited. High-risk systems face strict requirements. Limited-risk systems carry transparency duties. Other uses carry no additional obligations under the Act.

High-risk systems are identified in two ways:

• Annex III use cases. Areas such as biometrics, education, employment, access to essential services and law enforcement. Systems that evaluate the creditworthiness of natural persons (excluding fraud detection) are on the list, so credit risk scoring projects with an EU link should assess scope from the outset. Systems used for student admission or assessment are in Annex III as well.
• Annex I products. AI systems that are a safety component of a product covered by EU harmonisation legislation, such as machinery, toys, lifts or medical devices. A visual quality inspection system on a production line may fall outside this if it is not a safety component; if it takes over a machine’s safety function, the picture changes. That distinction needs technical and legal review together.

For high-risk systems, providers are expected to run risk management, data governance, technical documentation, record-keeping, human oversight and conformity assessment.

What do AI literacy and transparency require?

Article 4, AI literacy. Providers and deployers must take measures to support AI literacy among staff and others working with their AI systems. According to the European Commission’s Q&A, the duty has applied since 2 February 2025, and supervision by national market surveillance authorities started on 2 August 2026. After the AI Omnibus amendment the duty stays with providers and deployers, but there is no requirement to guarantee a specific literacy level or to measure employees’ knowledge. Measures should fit people’s technical knowledge, experience and the context of use.

Article 50, transparency. Where a system interacts directly with people, they must be told they are dealing with AI unless that is obvious. Outputs of systems that generate synthetic audio, images, video or text must be marked in a machine-readable format. Deployers publishing deepfakes must disclose them. According to the Commission, the transparency rules came into effect in August 2026. According to the Council, the grace period for marking AI-generated content ends on 2 December 2026.

Which obligation starts when?

The Act entered into force on 1 August 2024 and applies in stages. The AI Omnibus amendment, proposed by the European Commission, entered into force on 27 July 2026 and postponed the high-risk timeline. As of 26 October 2026, Commission sources give this timeline:

Date	What applies
2 February 2025	Prohibited practices and AI literacy (Article 4)
2 August 2025	Obligations for general-purpose AI models and governance rules
2 August 2026	General application, transparency rules (Article 50), AI Office enforcement powers over general-purpose models
December 2026	The new prohibition added by the AI Omnibus
2 December 2027	Annex III high-risk use cases
2 August 2028	High-risk systems embedded in Annex I products

The timeline has changed before. Check the Commission’s AI Act page and the AI Act Service Desk before you plan.

Where should you start?

1. Inventory the AI systems your company uses and sells.
2. For each, record your role and whether the system or its output reaches the EU.
3. Flag systems that may be high-risk under Annex III or Annex I.
4. Plan an AI literacy programme suited to how each team uses AI.
5. Add transparency notices to systems that talk to users or generate content.
6. Review the results together with your legal counsel.

Do not run this apart from data protection. The same inventory underpins your GDPR records and, for operations in Türkiye, your KVKK (Türkiye’s data protection law) personal data inventory and transfer assessment. The AI Act looks at the system’s risk, data protection law looks at the personal data processed; managing both from one system list avoids duplicate work. The umbrella term for this is AI governance.

The topic matters most to technology and software companies selling into the EU, finance and insurance firms using models in credit and underwriting decisions, manufacturers exporting machinery and equipment to the EU, and education providers using AI in assessment.

Corrplus does not give legal advice. We are the technical team that builds the requirements your legal counsel sets into your systems. In discovery we map the AI inventory and data flows; in design we set down logging, human oversight and transparency controls in writing. More on our security, compliance and data ethics, AI consulting and, for literacy programmes, corporate AI training pages.