The AI Act applies to providers placing AI systems or general purpose models on the Union market irrespective of where they are established, to deployers located in the Union, and to providers and deployers in third countries where the output produced by the AI system is used in the Union, under Article 2(1). Non-EU providers of high risk systems must appoint an authorised representative established in the Union under Article 22, and non-EU providers of general purpose models have a parallel duty under Article 54. The UK has no AI Act equivalent and regulates AI through existing sector regulators and data protection law. The United States has no federal AI statute and regulates AI through sector law and state law, which varies by state. The EEA position for Norway, Iceland and Liechtenstein depends on incorporation of the Act into the EEA Agreement, which must be checked as developing and unverified on the date of reading. No comparison in this cluster is legal advice for a foreign jurisdiction.
What is the territorial reach of the AI Act?
Article 2(1) sets out the personal and territorial scope of the Regulation. It applies to providers placing on the market or putting into service AI systems or placing on the market general purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country. It applies to deployers of AI systems that have their place of establishment or are located within the Union. It applies to providers and deployers that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union. It also applies to importers and distributors, to product manufacturers placing an AI system on the market with their product under their own name or trademark, to authorised representatives of providers not established in the Union, and to affected persons located in the Union. The reach is therefore based on market access and on output use in the Union, not on the nationality or headquarters of the provider. A company with no Union office, no Union entity and no Union employees can still be in scope where it places a system on the Union market or where its output is used in the Union. That company should not assume that distance from the Union removes it from scope.
How do the UK, US and EEA positions differ at a high level?
The UK, the United States and the EEA EFTA states illustrate three different relationships to the AI Act. The UK is a third country for AI Act purposes. It has no standalone AI Act and no dedicated AI regulator, and it regulates AI through existing law applied by existing sector regulators, with cross cutting principles set out in government policy. A UK company is therefore subject to UK law for its UK activities and to the AI Act for its Union market and output use activities, with two different legal frameworks to meet. The United States is also a third country, with no federal AI statute, with voluntary federal frameworks such as the NIST AI Risk Management Framework, and with state laws that vary by state and that change frequently. A US company must therefore check federal sector law, the state law of each state where it operates, and the AI Act for Union activities, as three separate exercises. The EEA EFTA states, Norway, Iceland and Liechtenstein, are not Member States, and an EU regulation binds them only once it is incorporated into the EEA Agreement by a Joint Committee Decision and implemented in national law where required. The AI Act is marked as EEA relevant, but incorporation and implementation must be checked as a developing position, and a reader should not assume that the Act applies in an EEA EFTA state on the same dates as in the Union.
What should a non-EU provider do first?
A non-EU provider should start by mapping its Union footprint: whether it places systems or models on the Union market, whether its output is used in the Union, whether it has Union deployers, importers or distributors, and whether it has an authorised representative. It should then map its role for each system, its classification screening, its Article 5 and Article 50 screens, and its authorised representative arrangements under Articles 22 and 54. It should identify the Member State authorities and the AI Office contacts that are relevant to its systems, and it should plan for language, documentation and cooperation arrangements that work across time zones and legal systems. It should check whether its contracts with Union customers allocate information, documentation and cooperation duties in a way that supports its AI Act duties, because a contract that is silent on those matters will leave the provider without the material it needs when an authority asks. It should keep a record of the Union footprint, with dates and evidence, so that a change in the footprint, such as a new Union customer or a new output use, triggers a fresh scope assessment. Scope is not a one time decision. It changes as the business changes.
How should comparisons be read?
Comparisons in this cluster compare scope, risk approach and enforcement at a high level, and they state what they do not compare. They do not compare the detailed duties of each jurisdiction, they do not reproduce foreign statutes, and they do not present a foreign framework as equivalent to the AI Act where it is not. A comparison that states that two frameworks both use risk language does not mean that they impose the same duties, the same documentation or the same penalties. A comparison that states that a jurisdiction has no AI statute does not mean that AI is unregulated there, because sector law, data protection law, consumer law, employment law and liability law can all apply to AI uses. Readers should use the comparisons to orient themselves, to identify the questions to ask in each jurisdiction, and to decide where to seek local advice. They should not use a comparison to conclude that compliance in one jurisdiction satisfies compliance in another, or that a system that is lawful in one jurisdiction is lawful in another. Each jurisdiction must be checked on its own law, as checked on the date of the decision.
What sources are used for foreign law in this cluster?
Foreign law in this cluster is described only from official sources where a verified official source is available, and is otherwise labelled as a current position to be checked, with the checking route stated. For the UK, the official sources are government policy documents and regulator guidance, including the Department for Science, Innovation and Technology policy and the Information Commissioner guidance, which should be checked on GOV.UK and on the regulator sites. For the United States, the official sources are federal agency material, including NIST, and state legislature and state regulator material for the state concerned. For the EEA, the official sources are the EEA Agreement, Joint Committee Decisions and EFTA material, together with national government statements. Where this cluster relies on secondary reporting to describe a fast moving position, such as state law changes or a government blueprint, it says so and instructs the reader to confirm the position on the official source before relying on it. No foreign rule is asserted in this cluster without that checking instruction, and no foreign rule is presented as legal advice. A reader who needs a decision for a foreign jurisdiction should obtain local legal advice on the current law of that jurisdiction.
Continue with territorial reach in Article 2.
What does this overview not decide?
This overview does not decide whether any named non-EU company is in scope, does not decide whether any foreign law applies to a specific activity, and does not compare the detailed duties of the jurisdictions in full. It does not state the current EEA incorporation position, does not state the current law of any US state, and does not state the current UK regulatory position beyond the high level description that must be rechecked. International AI regulation changes quickly, through legislation, guidance, enforcement and court decisions, and a position stated in this overview can become out of date. A non-EU provider or a company operating across jurisdictions should confirm the scope, the authorised representative, the foreign law and the comparison position with a competent authority or legal adviser in each jurisdiction concerned, on the date the decision is made.
Frequently asked questions
Does the AI Act apply to a company with no EU office?
It can do. Article 2(1) applies to providers placing systems or models on the Union market irrespective of establishment, and to providers and deployers in third countries where the output is used in the Union. A company with no Union office can still be in scope, and a non-EU provider of a high risk system must appoint an authorised representative under Article 22.
Does the UK have an AI Act?
No, as described in the UK guides in this cluster. The UK regulates AI through existing law applied by existing sector regulators, with government policy principles. That position must be rechecked on GOV.UK and regulator sites, because UK policy and legislation develop. A UK company with Union activities must meet both UK law and the AI Act for those activities.
Does the US have a federal AI Act?
No. The United States has no federal AI statute. Federal regulation is sector based and voluntary frameworks, such as the NIST AI Risk Management Framework, sit alongside state laws that vary by state. Each state must be checked on its official legislature and regulator sources, and the position changes frequently.
Does the AI Act apply in Norway, Iceland and Liechtenstein?
Not automatically on Union dates. Those states are EEA EFTA states, and an EU regulation binds them only once incorporated into the EEA Agreement by a Joint Committee Decision and implemented in national law where required. The incorporation position for the AI Act must be checked as developing and unverified on the date of reading, with EFTA and national government sources.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗