Article 2 applies the EU AI Act to providers placing AI systems or general-purpose AI models on the Union market or putting them into service in the Union, to deployers established or located in the Union, to providers and deployers in third countries where the output produced by the system is used in the Union, and to importers, distributors, product manufacturers, authorised representatives and affected persons in the situations the article lists. Location outside the Union does not by itself take an activity outside scope, and an exclusion must match the exact wording of Article 2.
What does Article 2 actually cover?
Article 2 lists the persons and activities to which Regulation (EU) 2024/1689 applies, rather than describing a single market or a single type of company. It covers AI systems and general-purpose AI models in the situations it names, and it reaches several points in the value chain at once. A reader should therefore start from the activity, not from the company label. Placing a system on the market, putting it into service, importing it, distributing it, using it under an organisation's authority, and manufacturing a product that contains it can each engage the Act in a different way. The same organisation can fall inside Article 2 for one activity and outside it for another, so scope is assessed activity by activity and system by system.
How does territorial reach work for providers outside the EU?
A provider established or located in a third country is within scope when it places an AI system or a general-purpose AI model on the Union market or puts an AI system into service in the Union. The test looks at the market act, not at where the provider is incorporated or where its servers sit. A separate limb covers providers and deployers established or located in a third country where the output produced by the AI system is used in the Union. That output limb is fact sensitive. A record should state where the system is made available, where it is used, and where its output is used, because each fact can change the answer. Do not assume that a non-EU establishment or a non-EU hosting location settles the question.
For the broader regulatory framework, see EU AI Act fundamentals.
Who else does Article 2 name?
Article 2 also names deployers that have their place of establishment or are located within the Union, importers and distributors of AI systems, product manufacturers that place an AI system on the market or put it into service together with their product and under their own name or trademark, authorised representatives of providers established outside the Union, and affected persons located in the Union. The breadth matters for procurement. A buyer that only uses a system can still be a deployer with its own duties, and a manufacturer that embeds a supplied system under its own brand can be drawn into the provider side of the analysis. Each role must be checked against the Article 3 definitions before duties are assigned.
Which activities fall outside scope?
Article 2 excludes several situations, and each exclusion is narrow. AI systems developed or used exclusively for military, defence or national security purposes are outside scope, as are certain systems used by public authorities of a third country or by international organisations in the context of law enforcement and judicial cooperation under specified agreements. AI systems and models specifically developed and put into service for the sole purpose of scientific research and development are excluded, and research, testing and development activity prior to placing on the market or putting into service is also treated separately. Use in the course of a purely personal non-professional activity is outside scope. None of these exclusions should be read more widely than its wording.
How do other laws sit alongside the Act?
Article 2 preserves the application of other Union law. The Act does not displace data protection law, consumer protection law, product safety law, employment law or sectoral rules that may also govern the same system. Where another law imposes a stricter or more specific duty, that duty still needs to be met. The interplay is practical as well as legal. A data protection assessment, a product conformity file and an AI Act classification record may cover overlapping facts but answer different questions. Keep the records separate and cross-referenced, so that a conclusion under one regime is not mistaken for a conclusion under another. Confirm with a competent authority or legal adviser where two regimes point in different directions.
Continue with what the EU AI Act is.
What does this guide not decide?
This guide explains how Article 2 frames scope. It does not decide whether a particular provider, deployer, importer or distributor is within scope, whether a particular exclusion applies, or whether output is used in the Union in a specific case. Those questions turn on contracts, distribution facts, user geography and the precise configuration of the system, and they can change when a system is re-released, rebranded or used in a new place. A scope record should name the facts relied on, the Article 2 limb considered, the date the assessment was made, and the trigger for revisiting it, and borderline cases should be confirmed with a competent authority or legal adviser.
Frequently asked questions
Does being based outside the EU keep a provider outside the AI Act?
No, not by itself. Article 2 reaches providers that place systems or models on the Union market or put systems into service in the Union, wherever they are established, and it also reaches third-country providers and deployers where the output produced by the system is used in the Union.
Does buying an AI system mean the buyer has no AI Act role?
No. A buyer that uses an AI system under its own authority can be a deployer, and the Act attaches duties to that role separately from the provider. Procurement alone does not settle the role.
Does an exclusion for research cover a system that is later sold?
The research exclusion is tied to systems specifically developed and put into service for the sole purpose of scientific research and development, and to activity before placing on the market or putting into service. Once a system is placed on the market or put into service for another purpose, the analysis must be redone on the new facts.
Does the AI Act replace GDPR or product safety law?
No. Article 2 preserves other Union law. Data protection, consumer, employment and product rules can apply to the same system alongside the AI Act, and each regime must be checked on its own terms.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗