EU AI Act compliance for U.S. companies: scope, roles and the 2026 timeline
A U.S. company does not need an office in Europe to fall under the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). Selling an AI-enabled product to European customers, or producing outputs that are used in the EU, can be enough. The timeline has just moved: the Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026, postponed the obligations for high-risk systems.
A postponement is not a pause. Several obligations already apply. This guide explains when U.S. businesses are in scope, which role they play and what to prioritise, with the points where Romain Waiss-Moreau assists foreign companies entering the European market.
When does the AI Act apply to a non-EU company?
The AI Act applies regardless of where the company is established when:
- it places an AI system or a general-purpose AI model on the EU market or puts it into service in the EU;
- the output produced by its AI system is used in the EU, even if the system runs on U.S. servers;
- it acts as a deployer located in the EU, for instance through a European subsidiary using AI internally.
Providers of high-risk systems and of general-purpose AI models established outside the EU must appoint an authorised representative in the Union before placing their products on the market.
Which role does your company play?
| Role | Simplified definition | Typical U.S. example |
|---|---|---|
| Provider | Develops an AI system or model and places it on the market under its name | A SaaS vendor offering an AI hiring tool to EU clients |
| Deployer | Uses an AI system under its authority for professional purposes | The French subsidiary using that tool for its own recruitment |
| Importer | Places on the EU market a system from a non-EU provider | The European distributor of a U.S. AI product |
| Distributor | Makes a system available without being provider or importer | A reseller or marketplace |
Companies that substantially modify a third-party system, or market it under their own brand, can become providers and inherit the corresponding obligations.
What is the timeline after the Digital Omnibus?
| Date | Obligations that apply |
|---|---|
| 2 February 2025 | Prohibited practices |
| 2 August 2025 | Obligations for providers of general-purpose AI models |
| 2 August 2026 | Article 50 transparency obligations (chatbots, deepfakes, AI-generated content) |
| 2 December 2026 | End of the grace period for content marking by generative systems already on the market |
| 2 December 2027 | High-risk systems listed in Annex III (employment, credit, education, etc.) |
| 2 August 2028 | High-risk AI embedded in regulated products (Annex I) |
The Omnibus also added new prohibited practices, including AI systems generating non-consensual intimate imagery or child sexual abuse material. The substance of the high-risk requirements, including risk management, data governance, documentation, logging and human oversight, is unchanged.
What are the penalties?
Fines can reach €35 million or 7% of worldwide annual turnover for prohibited practices, €15 million or 3% for most other breaches, and €7.5 million or 1% for supplying incorrect information to authorities. Lower caps apply to SMEs. Beyond fines, AI Act compliance is becoming a standard question in European procurement and in investor due diligence.
How should a U.S. company prepare?
- Map every AI system and model you offer or use in connection with the EU.
- Qualify your role and the risk tier of each use case.
- Address current obligations first: prohibited practices and transparency.
- Appoint an EU authorised representative where required.
- Update contracts with EU customers and AI suppliers: documentation, allocation of responsibilities, GDPR compliance.
- Plan high-risk compliance for December 2027 or August 2028.
Romain Waiss-Moreau aligns AI Act compliance with GDPR obligations and commercial contracts, so that a single documentation set serves all three.
What must a high-risk AI provider do?
| Requirement | Provider | Deployer |
|---|---|---|
| Risk management system | Throughout the lifecycle | No |
| Data governance for training data | Yes | Relevance of input data it controls |
| Technical documentation and logging | Yes | Keep generated logs |
| Instructions for use | Provide | Follow |
| Human oversight | Design for it | Ensure it in practice |
| Conformity assessment and CE marking | Yes | No |
| Information to affected persons | Depending on the case | Inform, for example employees in HR uses |
Case study: a U.S. HR tech vendor with EU customers
A U.S. company sells an AI tool that ranks job applicants to customers in France and Germany. Recruitment uses are high-risk under Annex III. As provider, it must appoint an authorised representative in the EU, build a risk management and quality management system, prepare technical documentation, enable logging and human oversight, and complete a conformity assessment before 2 December 2027. Its EU customers, as deployers, will ask for documentation, contractual commitments and support for their own obligations, often in procurement questionnaires well before the deadline. The firm helps such vendors prioritise the commercial documents customers request first, while the full compliance programme is built.
What does Article 50 transparency require?
Since 2 August 2026, people must be told when they interact with an AI system, unless it is obvious. AI-generated or manipulated content, including deepfakes, must be disclosed, and providers of generative systems must mark outputs in a machine-readable way, with a grace period until 2 December 2026 for systems already on the market. Customer service chatbots and AI-generated marketing visuals are directly concerned.
AI Act compliance: key points
- Assuming U.S. hosting keeps you out of scope: use of outputs in the EU is enough.
- Reading the delay as a reprieve on everything: prohibitions and transparency rules already apply.
- Ignoring the EU subsidiary's role: as a deployer, it has its own obligations, especially for HR uses.
Frequently asked questions
Does using a third-party model like a large language model make us a provider?
Not by itself. You are typically a deployer, or the provider of an AI system built on that model. If you place a system on the EU market under your name, provider obligations attach to the system, while the model's own obligations remain with its developer.
Is internal use of AI tools by our European staff covered?
Yes, as deployment. Most productivity uses are minimal risk, but HR decisions, monitoring of employees or customer-facing chatbots trigger specific obligations.
Who enforces the AI Act?
National market surveillance authorities in each Member State, with the European AI Office directly supervising general-purpose AI models.
Is there relief for startups and SMEs?
Yes. Fines for SMEs and startups are capped at the lower of the two applicable amounts, and the 2026 Digital Omnibus simplified certain documentation duties for SMEs and small mid-caps. The substantive requirements still apply.
More articles
Initial consultation at no charge.
You set out your project. By the end, you will know whether one of the four services fits, or whether we should direct you elsewhere. EN or FR, Paris or New York, confidential.