Article 2(1)(c) applies the Regulation to providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union. The test turns on the use of the output in the Union, not on the location of development, hosting or training, and not on the nationality of the provider. What counts as output, what counts as use, and what counts as use in the Union must be examined on the facts of each system, with the commercial, technical and user evidence together. A provider that cannot show how its output is used, or that assumes that output use outside the Union means no Union use, has not applied the test.
What does Article 2(1)(c) say?
Article 2(1)(c) states that the Regulation applies to providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union. The paragraph has three elements: the actor is in a third country, the actor is a provider or a deployer of an AI system, and the output produced by the system is used in the Union. The paragraph does not require the provider or deployer to have an establishment, an office, employees or customers in the Union. It does not require a direct contract with a Union customer. It does not require the system itself to be placed on the Union market, although a system can be in scope under both Article 2(1)(a) and Article 2(1)(c) at the same time. The paragraph is the output based limb of territorial reach, modelled in its approach on the extraterritorial provisions in other Union law, and it is intended to catch the situation where a third country system produces effects in the Union through its output, even where the system itself is operated outside the Union. The paragraph should be read with Article 2(1)(a) and (b), and with the definitions of provider, deployer, output and use in Article 3 and in the guidance.
What counts as output?
Output in the AI Act context means the predictions, content, recommendations, decisions and other results produced by an AI system, as defined in Article 3 for AI systems in general terms. Output can be a text, an image, an audio file, a video, a score, a ranking, a classification, a recommendation, a decision, a control signal or another result, depending on the system. Output can be produced directly to a user, or indirectly through a downstream system that uses the output as an input. Output can be produced in real time, or in batch, and can be stored, forwarded or transformed before it is used. The record should describe the output in concrete terms for each system: what the output is, in what form, to whom it is delivered, through what channel, and for what purpose. A record that describes the system only in terms of its model, its training data or its hosting location does not describe the output. A record that describes the output only as data does not show how the data is used. The output description should be linked to the use description, so that a reviewer can follow the chain from system to output to use.
For the broader regulatory framework, see non-EU and international overview.
What counts as use in the Union?
Use in the Union means use by a person in the Union, or use that affects a person, a decision or a process in the Union, on the facts of the case. Use can be by a Union deployer that operates the system, by a Union customer that receives the output, by a Union affected person who is the subject of a decision based on the output, or by a downstream system in the Union that processes the output further. Use can be direct, where the output is delivered to a Union user, or indirect, where the output is delivered to a non Union intermediary and is then used in the Union. The test is fact sensitive, and the facts that matter include the location of the user, the location of the affected person, the location of the decision, the location of the process that the output feeds, and the contractual and technical arrangements that govern the delivery of the output. A provider that delivers output to a global platform, to a cloud service with Union users, or to a customer that resells the output in the Union, should examine the downstream use, not only the first delivery. A provider that has no visibility of downstream use should record the limits of its visibility and the measures it takes to obtain it, such as contract terms, logging and customer reporting, rather than assuming that no Union use occurs.
What examples illustrate the test?
The following examples are illustrative and hypothetical, and they do not decide any real case. A third country provider that operates a recruitment screening tool, hosted outside the Union, that screens applications from Union candidates for a Union employer, produces output that is used in the Union, because the screening decision affects Union candidates and the Union employer uses the output in its recruitment process. A third country provider that operates a credit scoring system, hosted outside the Union, that scores Union consumers for a Union lender, produces output used in the Union for the same reason. A third country provider that generates marketing text for a global campaign, where the text is published to Union consumers, produces output used in the Union where the publication and the consumer use are in the Union. A third country provider that provides a research tool used only by researchers outside the Union, with no Union users, no Union affected persons and no Union decisions, may not meet the test on those facts, subject to the other scope paragraphs. Each example turns on the use facts, and a change in the use facts, such as a new Union customer or a new Union publication, can change the answer. The examples should be used to structure the enquiry, not as a substitute for it.
What evidence should a third country provider keep?
A third country provider should keep a scope file for the output test, with the system description, the output description, the customer and user locations, the affected person locations, the decision and process locations, the delivery channels, the contract terms on geographic use, the technical measures on geographic access, and the monitoring of actual use. The file should record the date of each assessment, the evidence relied on, and the conclusion, with borderline cases marked for confirmation. The file should be updated when a new customer, a new market, a new integration or a new use is added, and at a planned interval. The provider should also record the measures it takes to prevent or detect Union use where it claims that no Union use occurs, such as geo blocking, contract exclusions, customer declarations and use monitoring, and should test whether those measures work in practice. A claim of no Union use that is based only on a contract term, without technical or monitoring support, should be treated as weak evidence. A claim of Union use that is based on a single customer record should be tested against the full customer and user records.
Continue with territorial reach in Article 2.
What does this guide not decide?
This guide does not decide whether any named system, output or use meets Article 2(1)(c), and it does not reproduce the guidance on the output test that the Commission may publish. The output, use and location facts must be examined for each system, with the consolidated Article 2 text and any Commission guidance checked on the date of the decision. A third country provider or deployer with a borderline output use question should confirm the position with a competent authority or legal adviser, with the scope file in hand. The output test is a scope test that must be applied on the specific facts, not a general statement about global systems.
Frequently asked questions
Does hosting outside the EU avoid the output test?
No. Article 2(1)(c) turns on output use in the Union, not on hosting location. A system hosted outside the Union whose output is used in the Union can be in scope. Hosting facts should be recorded, but they do not decide scope alone.
What if output goes to a non-EU intermediary first?
The downstream use must be examined. Output delivered to a non Union intermediary and then used in the Union can meet the test, where the Union use facts are established. The provider should examine the downstream chain, the contract terms and the actual use, and should record the limits of its visibility where it cannot see downstream use.
Does a contract term excluding EU use decide the test?
Not by itself. A contract exclusion must be effective in practice, with technical and monitoring measures that support it, and the actual use must be examined. A term that is not enforced, or that is contradicted by sales, user or publication records, will not be treated as effective scope control.
Should the output test be reassessed over time?
Yes. Scope changes as customers, markets, integrations and uses change. The scope file should be updated when a new customer, market or use is added, and at a planned interval, with the date and evidence recorded. A scope conclusion from one period may not hold for a later period.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗