Scope differs in structure, not only in wording. The AI Act has a horizontal, risk based scope set by Article 2, with defined actors, defined system and model categories, and defined exclusions. The UK has no horizontal AI scope; scope is set by the existing law that governs each activity and by the remit of each sector regulator. The United States has no federal horizontal AI scope; scope is set by federal sector law and by state law, which varies by state. A comparison of scope must therefore compare the legal mechanism that sets scope in each jurisdiction, not only the words used to describe AI. This guide compares the mechanisms and the actor and subject matter scope at a high level. It does not compare detailed duties, definitions or enforcement, which are dealt with in the companion comparison guide.
What does this comparison cover, and what does it not cover?
This comparison covers scope only: who is covered, what is covered, and on what territorial or activity basis, in the EU, the UK and the US at a high level as checked on 29 October 2026. It does not cover the detailed duties that follow from scope, such as the high risk requirements, the transparency duties, the documentation duties or the conformity procedures, which are compared separately. It does not cover penalties, enforcement practice, or the detailed definitions of AI system, high risk system, consequential decision or automated decision, except where a definition is needed to explain scope. It does not cover the EEA position in detail, which is dealt with in its own guide, and it does not cover jurisdictions beyond the UK and the US, except for the international standards material in the companion guide. Stating what a comparison does not cover is part of the comparison, because a reader who assumes that a scope comparison is a full comparison will draw conclusions about duties and enforcement that the comparison does not support. Each section of this guide states its jurisdiction, its source type and its checking route, so that the reader can follow the comparison back to the law of each jurisdiction.
How is EU scope set?
EU scope is set by Regulation (EU) 2024/1689, a directly applicable Regulation, with Article 2 setting the personal and territorial scope, Article 3 defining the actors and the system and model categories, Article 5 setting prohibited practices, Article 6 setting high risk classification, and Chapter V setting the general purpose model regime. The scope is horizontal, in the sense that it applies across sectors, subject to sector integration for Annex I products and to sector law that applies alongside it. The scope is risk based, in the sense that the duties that follow depend on the risk category, on the actor role and on the system or model category. The scope is defined in the Regulation itself, with guidance from the Commission and the AI Office, and with enforcement by market surveillance authorities, national competent authorities and the AI Office for general purpose models. A reader can therefore work from a single legal text, the consolidated Regulation, to answer the scope question for the Union, subject to the guidance and to the sector law that applies alongside it. That single text basis is the distinctive feature of EU scope, and it is what makes a scope comparison with the UK and US difficult, because neither has a single text to compare.
For the broader regulatory framework, see non-EU and international overview.
How is UK scope set?
UK scope is set by existing law, applied by existing regulators, with no horizontal AI statute to define it. The scope question for a UK activity is therefore: which law governs the activity, which regulator oversees it, and what guidance has that regulator published for AI within its remit. Data protection scope is set by UK GDPR and the Data Protection Act 2018, with the ICO as regulator. Financial services scope is set by financial services law, with the FCA and PRA as regulators. Medical device scope is set by medical device law, with the MHRA as regulator. Online safety scope is set by the Online Safety Act 2023, with Ofcom as regulator. Competition and consumer scope is set by competition and consumer law, with the CMA as regulator. Equality scope is set by the Equality Act 2010, with the EHRC as regulator. A single AI system can therefore be in scope for several UK frameworks at once, with different definitions, different duties and different regulators, and can be out of scope for others. The UK scope record must therefore be a multi framework record, with each framework cited separately, rather than a single UK AI scope statement. Government policy, including the five principles and the Blueprint, guides the regulators but does not set a horizontal scope in law.
How is US scope set?
US scope is set by federal sector law and by state law, with no federal horizontal AI statute to define it. Federal scope is set by the statute that governs each agency remit, such as consumer protection, medical devices, securities, consumer finance and employment, with the agency guidance and enforcement for AI within that remit. State scope is set by each state legislature, with laws that vary in subject matter, definitions, duties and effective dates, and with local laws, such as New York City automated employment decision tools law, adding a further layer. Voluntary frameworks, such as NIST AI RMF 1.0, do not set legal scope, although they can be referenced in state law, in contracts and in sector guidance with legal effect in defined circumstances. A single AI system can therefore be in scope for a federal sector duty, for a state duty in one state, and out of scope in another state, with different definitions and duties in each. The US scope record must therefore be a multi jurisdiction record, with federal, state and local layers kept distinct, and with each state checked on its official sources. A US scope statement that treats the United States as a single jurisdiction will be wrong for most systems.
What actor scope differences matter most?
Actor scope differences matter most where the same company plays different roles in different jurisdictions. In the EU, the Act defines provider, deployer, importer, distributor, authorised representative, product manufacturer and operator, with duties that follow the role. In the UK, the actor labels are those of the underlying law: data controller and processor for data protection, authorised firm for financial services, manufacturer for devices, regulated service provider for online safety, and so on. In the US, the actor labels are those of the sector and state law: developer and deployer under Colorado law, employer under employment law, manufacturer under device law, and so on. A company that is a provider in the EU may be a controller in the UK and a developer in a US state, with different duties under each label, and a company that is a deployer in the EU may be a processor, a firm or an employer elsewhere. The record should therefore use the actor label of each jurisdiction for that jurisdiction, and should not translate a label from one jurisdiction into another without checking the definition. A mapping table that lists the EU role, the UK role and the US role for each system, with the definition cited for each, is a useful record, provided that the table is treated as a mapping aid, not as a statement that the roles are equivalent.
Continue with risk approach and enforcement comparison.
What does this scope comparison not decide?
This scope comparison does not decide whether any named company or system is in scope in any jurisdiction, does not reproduce any statute or guidance, and does not compare duties or enforcement. Scope decisions need the activity, the actor, the system, the location and the official law of each jurisdiction, checked on the date of the decision. A company operating across the EU, UK and US should obtain local legal advice in each jurisdiction, with the scope record for that jurisdiction in hand. This comparison gives the mechanisms and the questions, not the scope answers for a named activity.
Frequently asked questions
Is UK scope the same as EU scope?
No. EU scope is set by a single horizontal Regulation with defined actors and categories. UK scope is set by existing law applied by sector regulators, with no horizontal AI statute. A system can be in scope for several UK frameworks at once, with different definitions and duties, and the UK record must be kept framework by framework.
Is US scope the same as EU scope?
No. US scope is set by federal sector law and by state law, which varies by state, with no federal horizontal AI statute. A system can be in scope in one state and out of scope in another, and federal and state analyses must be kept distinct from the EU analysis, with definitions cited separately for each jurisdiction.
What does this guide not compare?
It does not compare detailed duties, documentation, conformity procedures, penalties or enforcement practice, which are dealt with in the companion comparison guide. It does not cover the EEA position in detail, or jurisdictions beyond the UK and US. A scope comparison should not be read as a full comparison of the frameworks.
How should a cross border scope record be kept?
As separate sections for each jurisdiction, with the law, the actor label and definition, the subject matter scope, the territorial basis, the guidance checked and the date, for each system. A mapping table can help, but it should not present roles from different jurisdictions as equivalent without checking the definitions.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗