Does the AI Act apply to companies outside the EU?

The Act applies to providers that put AI systems on the EU market, wherever they are based; to deployers established or located in the EU; and to providers and deployers outside the EU when the output of the system is used in the EU.

That third limb is the one that surprises people. It means the Act can follow the AI's output into the EU even when the company behind it sits well outside it.

A company outside the EU that sells an AI product into the EU, or whose AI produces output that is then used in the EU, can be in scope even with no EU office and no EU staff. The output reaching the EU is enough to engage the rules.

A common example is a non-EU provider whose tool is used by EU businesses, or a system that scores or screens EU residents from abroad. The EU connection, not the company's address, is what matters.

Purely internal use outside the EU, with no EU market and no output used in the EU, generally sits outside the Act. A business operating entirely in another region, serving non-EU customers, is not pulled in simply because the Act exists.

Other laws in those countries may still apply, of course. The point here is only the reach of the EU AI Act specifically.

If you are established in the EU and use AI, you are a deployer in scope, full stop. Where your vendors happen to sit, inside or outside the EU, does not change your own duties.

It can, though, change theirs, and what you can expect from them. A non-EU provider selling into the EU carries provider duties too, which is worth keeping in mind when you choose one.