What the EU AI Act Means for US Companies

If your company sells software, runs a website or offers a service that people in Europe use, you have probably asked whether the EU AI Act applies to you. For many US businesses the answer is yes, at least in part, even if you have no office, staff or servers in the EU.

This guide explains when a US company falls under the law, how its risk tiers work, which deadlines apply as of October 2026 (including the delay agreed in 2026), and the practical steps to take now. This is not legal advice; confirm your obligations with EU counsel.

The EU AI Act in brief

The Artificial Intelligence Act, Regulation (EU) 2024/1689, is the first comprehensive AI law from a major economy. It entered into force on August 1, 2024 and applies in stages. Like the GDPR, it is a regulation, so it applies directly in all 27 EU member states.

The law takes a risk-based approach. The more an AI system can harm people’s health, safety or fundamental rights, the stricter the rules. Most everyday business AI falls in the lowest tiers, but some common uses, such as AI in hiring or credit scoring, are classed as high-risk.

In 2026 the EU amended the Act through the “Digital Omnibus on AI”, published in the Official Journal on July 24, 2026 and in force from July 27, 2026. Its biggest change for most companies is a delay to the high-risk deadlines.

When a US company is covered

The AI Act has extraterritorial reach. Under Article 2, it applies to:

• Providers (companies that develop an AI system or general-purpose AI model and put it on the market under their own name) that place AI systems on the EU market or put them into service in the EU, wherever the provider is located.
• Deployers (organizations using an AI system in their work) that are established or located in the EU.
• Providers and deployers outside the EU where the output produced by the AI system is used in the EU.
• Importers, distributors and product manufacturers that bring AI into the EU market.

In practice, a US company is likely in scope if it:

• Sells a SaaS product with AI features to EU customers
• Offers a chatbot or AI tool that people in the EU use
• Uses AI to make decisions about EU-based job applicants, employees or customers
• Builds a general-purpose AI model that is made available in the EU

A US company that only uses AI internally on US data for US customers is generally outside the Act. Non-EU providers of high-risk AI systems and of general-purpose AI models must appoint an authorized representative in the EU.

The 4 risk tiers

General-purpose AI (GPAI) models, such as large language models, have their own track. Providers must keep technical documentation, publish a summary of training content, share information with downstream developers and have a copyright policy. Models with systemic risk face extra duties such as evaluations, incident reporting and cybersecurity.

Key takeaway: Most US companies are deployers or providers of limited- or minimal-risk AI. The heavy obligations hit a narrower set of high-risk uses, especially hiring, credit, insurance and education, so map your use cases before assuming the worst.

Key dates after the 2026 Digital Omnibus

The Act phases in over several years, and the 2026 amendment moved some dates.

The Omnibus also softened the AI literacy rule. Companies must now take measures to support AI literacy among staff who operate AI systems, rather than ensure a “sufficient level” for each person. Document your training anyway; it is the easiest evidence of good faith.

Penalties

Fines are set as a fixed amount or a percentage of worldwide annual turnover, whichever is higher (for SMEs and startups, whichever is lower):

• Up to EUR 35 million or 7% of turnover for prohibited practices
• Up to EUR 15 million or 3% for most other violations, including high-risk and transparency obligations
• Up to EUR 7.5 million or 1% for supplying incorrect or misleading information to authorities

National market surveillance authorities enforce most rules. The European Commission’s AI Office supervises general-purpose AI models.

How the EU AI Act compares with US rules

There is no federal US equivalent. US companies instead face a patchwork of state laws targeting specific uses, such as chatbots, hiring and deepfakes, which we track in our guide to state AI laws. The main differences:

• Scope: The EU Act covers AI across sectors with one framework; US laws are mostly use-specific.
• Pre-market duties: High-risk systems in the EU need conformity assessment and documentation before launch. Most US laws focus on notice, disclosure and anti-discrimination.
• Overlap: Many controls are shared, such as bias testing, impact assessments, human review and transparency. One governance program can serve both. Our explainer on AI bias covers the testing side.

The EU AI Act also sits alongside the GDPR. If your AI processes personal data of people in the EU, GDPR obligations such as lawful basis, transparency and rules on automated decisions continue to apply.

What US companies should do now: a 7-step plan

1. Inventory your AI. List every AI system you build, sell or use, including features inside third-party software. Our AI governance checklist shows how.
2. Map EU touchpoints. For each system, note whether it is offered to EU users, used on EU people’s data or produces output used in the EU.
3. Classify your role and risk tier. Are you a provider, deployer, importer or distributor? Is the use banned, high-risk, limited-risk or minimal-risk? Hiring tools deserve special attention; see how HR teams use AI.
4. Stop anything prohibited. Bans have applied since February 2025.
5. Meet transparency duties now. Label chatbots as AI, mark AI-generated content in machine-readable form where you provide generative tools, and disclose deepfakes.
6. Plan for high-risk obligations. If you have Annex III systems, use the time before December 2, 2027 to build risk management, data governance, documentation, logging and human oversight, and to appoint an EU authorized representative if you are a non-EU provider.
7. Update contracts and training. Ask AI vendors how they comply, add AI Act clauses to EU customer and supplier contracts, and roll out AI literacy training backed by an AI acceptable use policy.

Conclusion

The EU AI Act reaches well beyond Europe’s borders. If your AI touches EU users or EU decisions, some of it applies to you today, especially the bans, AI literacy and transparency rules. The high-risk deadlines now sit in December 2027 and August 2028, which gives US companies time, but not a reason to wait. Start with an inventory and risk classification, fix the quick wins now, and build one governance program that can satisfy both EU and US rules.

Sources

• EUR-Lex: Regulation (EU) 2024/1689, the Artificial Intelligence Act — scope (Article 2), risk tiers, obligations and penalties
• European Commission: AI Act regulatory framework — risk-based approach and application timeline
• EUR-Lex: Digital Omnibus on AI, Official Journal L 2026/1744 (July 24, 2026) — delayed high-risk deadlines, softened AI literacy duty and new prohibitions
• European Commission: AI Office — supervision of general-purpose AI models