EU AI Act Compliance: Why "We're Not Based in the EU" Won't Keep You Out of Scope
Sub-Intro: A US-based fintech with zero EU offices can still fall under the EU AI Act the moment its credit model scores a single applicant living in Lisbon. The scope test, the risk tiers, and the technical fixes that matter before August 2026 enforcement are below.
When Do EU AI Act Compliance Deadlines Take Effect?
Compliance requirements phased in starting February 2025 and are not tied to one deadline. Transparency and general-applicability obligations became enforceable August 2, 2026. High-risk Annex III obligations, the heaviest compliance workload, were delayed to December 2, 2027 under the AI Omnibus, with Annex I obligations following in August 2028.
Here’s the rollout in order:
Date | What Took Effect |
February 2, 2025 | Ban on “unacceptable risk” practices (social scoring, manipulative AI, certain biometric uses) |
August 2, 2025 | Obligations for general-purpose AI (GPAI) model providers |
August 2, 2026 | General applicability of the Act, plus transparency obligations (disclosure, AI-generated content labeling) |
December 2, 2026 | The ninth prohibited practice takes effect (AI tools generating non-consensual explicit content) Article 50(2) watermarking/machine-readable AI-content marking also becomes mandatory for systems already on the market before August 2026, both added via the Digital Omnibus on AI |
December 2, 2027 | High-risk AI system obligations under Annex III (hiring, credit, biometric categorization, and similar use cases) |
August 2, 2028 | High-risk obligations extend to AI embedded in regulated products under Annex I (medical devices, machinery) |
According to the European Commission’s AI Act page (last updated 27 July 2026), the December 2027 date is the EU’s current published position under the AI Omnibus, not a proposal still under negotiation. Treating the extra time as a reason to wait is risky, since documentation gaps often surface only when an EU customer’s procurement team requests the technical file.
Does the EU AI Act Apply to Your Company Even Outside the EU?
Yes. According to Regulation (EU) 2024/1689, organizations fall within scope if their AI system’s output is used by people located in the EU or if the system is placed on the EU market, regardless of where the company is incorporated or where the model was trained.
Most scope confusion clears up with three questions. Does your product serve users located in the EU, even as one market among many? Does its output feed into a decision about those users, like credit approval, hiring, or service access? Do you supply the system to another company operating in the EU, without touching the end user directly? A “yes” to any one of these generally puts you in scope, and this is where teams running production AI and machine learning engineering work tend to hit the most confusion during an initial audit.
The most common error is conflating “no EU legal entity” with “not covered.” The Act follows the user’s location and the market where the system is placed, not the company’s registration address. A US-based HR tech company screening resumes for EU employees is in scope even if every engineer and server sits in Texas.
Role-Based Obligations: Provider, Deployer, Importer, Distributor
Your obligations depend on your role in the AI supply chain, not just which system you use. A provider builds the system and carries the heaviest documentation duties. A deployer uses it under its own authority. Importers and distributors must verify a provider’s compliance before market availability.
Role | Definition | Primary Obligation |
Provider | Develops the AI system or has it developed under its name | Conformity assessment, technical documentation, risk management system |
Deployer | Uses the AI system under its own authority | Human oversight, monitoring, informing affected individuals |
Importer | Places a non-EU provider’s system on the EU market | Verifying provider compliance before distribution |
Distributor | Makes the system available on the EU market | Checking documentation and conformity marking are present |
Heavily customizing or fine-tuning a vendor’s model is a common way a company shifts from deployer into provider without realizing it, changing the entire obligation set.
How Do You Classify an AI System's Risk Level Under the Act?
The Act sorts every AI system into one of four tiers: unacceptable risk (banned outright), high-risk (heavily regulated), limited risk (transparency obligations only), and minimal risk (no specific obligations). Most of the real compliance workload sits in the high-risk tier.
Risk Tier | Examples | Obligation Level |
Unacceptable | Social scoring, manipulative AI, real-time public biometric surveillance | Banned outright |
High-risk | Hiring tools, credit scoring, biometric ID, education admissions/grading | Technical file, human oversight, conformity assessment |
Limited/transparency | Chatbots, AI-generated content | Disclosure that AI is involved or content is AI-generated |
Minimal | Spam filters, AI-enabled games | No specific obligations |
In practice, this classification hits resume screening tools, loan underwriting models, biometric identification systems, insurance pricing engines, and workplace monitoring tools most often.
Where Classification Gets Ambiguous
Recommendation engines are the trickiest case. A model ranking products isn’t high-risk, but the same architecture ranking job candidates for a shortlist likely is. What matters isn’t the algorithm, but whether the output affects someone’s access to employment, credit, education, or public services.
What Does Annex IV Technical Documentation Actually Require?
Annex IV lists what a high-risk system’s technical file must contain: a description of the system’s purpose, design specifications, training and testing data details, human oversight measures, and performance metrics covering accuracy, robustness, and cybersecurity. It’s the primary artifact regulators and notified bodies review during conformity assessment.
The file has to stay current as the model changes, which is why one-time documentation efforts tend to fail within two or three release cycles. Structuring it against ISO/IEC 42001, the international standard for AI management systems, gives teams a template that already maps well to what Annex IV expects.
What Are the Rules for General-Purpose AI (GPAI) Models?
GPAI obligations became applicable on August 2, 2025, ahead of every other major deadline, which catches many compliance calendars off guard. Providers of general-purpose models must maintain technical documentation, publish a summary of training content, and comply with EU copyright law. Models carrying systemic risk face added risk assessment and incident-reporting duties. The European AI Office enforces this tier directly rather than delegating it to national regulators.
Does the EU AI Act Apply to Startups and SMEs?
Yes. Scope under Regulation (EU) 2024/1689 doesn’t change based on company size. Startups and SMEs face the same risk-tier obligations as large enterprises, though the Act offers reduced conformity assessment fees, simplified documentation templates, and priority sandbox access to offset the burden. A five-person startup building a high-risk hiring tool carries the same Annex III obligations as a large enterprise, just with lower-cost paths to compliance.
Are Open Source AI Models Exempt from the EU AI Act?
Partially. Open-source AI components are generally exempt from most obligations, but that exemption narrows sharply once the model is used in a high-risk system or classified as a GPAI model with systemic risk. Publishing weights under an open license doesn’t remove your obligations if you’re also deploying that model in a hiring tool or credit engine.
What Happens If You Don't Comply?
EU AI Act Penalties Explained
Penalties scale with the severity of the violation. Per the European Commission’s AI Act guidance (updated July 2026), infringements are tiered by violation type rather than applied as a flat fine.
Violation Type | Maximum Fine |
Prohibited practices or data requirement breaches | €35 million or 7% of global turnover, whichever is higher |
Other compliance failures (documentation, oversight, etc.) | €15 million or 3% of global turnover |
Supplying incorrect information to authorities | €7.5 million or 1% of global turnover |
SMEs, any tier | The lower of the two figures applies the inverse of the rule for large undertakings. In practice, that’s usually the turnover percentage, not the flat amount. |
What Does an EU AI Act Compliance Checklist Look Like for Engineering Teams?
A production-ready compliance posture rests on four technical pillars: data governance documentation, a maintained technical file, human oversight design, and post-market monitoring. Each pillar maps to a specific article in the Act, and each one belongs to engineering, not just legal.
You need a record of where training and validation data came from, how it was labeled, what bias testing was run, and how the dataset changed across versions. High-risk systems need a documented override mechanism so a human can intervene before the output takes effect, plus logs capturing decisions and version metadata for a set retention period. Teams that already run structured security logging, the kind that’s become standard as enterprise cybersecurity keeps getting redefined by AI-driven threats, usually have most of the plumbing in place and just need to extend retention and add decision-specific fields.
Before deployment, most high-risk systems require a conformity assessment and registration in the EU’s public database of high-risk AI systems, a step enterprises often discover last, usually while closing a deal with an EU customer’s procurement team.
Where Do Enterprises Actually Get EU AI Act Compliance Wrong?
The most common failure isn’t ignorance of the law. It’s treating compliance as a one-time legal review instead of an ongoing engineering discipline tied to how the model actually behaves in production. The scale of this exposure is growing quickly: according to the Stanford HAI 2026 AI Index Report (published April 2026), organizational AI adoption reached 88% globally, meaning most enterprises now run more production AI systems than their compliance teams have formally risk-assessed.
A model documented as “limited risk” at launch can drift into higher-risk territory as its outputs start influencing decisions differently than originally recorded. This happens often with scoring models that started as internal tools and later began feeding customer-facing approval decisions without anyone updating the technical file. The same monitoring patterns used for detecting and diagnosing machine learning model drift in production are what catch this shift before it becomes a compliance problem.
Agentic workflows spun up by individual teams, like an agent auto-approving vendor invoices or triaging support tickets without human oversight, often never make it into the official AI system inventory. If that agent’s decisions affect EU users, it’s in scope even if no one registered it. This is precisely the blind spot that opens as agentic AI reshapes enterprise cyber risk in ways the original threat model never accounted for.
How Do You Build EU AI Act Compliance Into an AI Development Pipeline?
Compliance holds up better when it’s built into the same CI/CD and MLOps pipeline that ships the model, not a separate document trail updated quarterly. Version-controlling the technical file alongside the model code, and logging model version, dataset version, and risk tier at every deployment, turns compliance into a byproduct of normal release engineering. Teams already using the NIST AI Risk Management Framework for internal governance tend to adapt faster, since its map, measure, manage structure overlaps significantly with what Annex IV.
Many enterprises already run a readiness exercise before modernizing legacy infrastructure for AI adoption. Extending that same AI readiness assessment to flag EU AI Act scope and risk tier turns two audits into one.
What Is a Realistic Path to the 2026 and 2027 Deadlines?
Enterprises with in-scope systems generally need eight to twelve weeks to move from “we think we might be affected” to a documented, audit-ready posture for transparency obligations, and considerably longer for full high-risk conformity work given the December 2027 runway.
- Inventory every AI system in production, including third-party APIs and internal agentic tools.
- Classify each system by risk tier using the criteria above.
- Gap-assess existing documentation against the Annex IV technical file requirements.
- Close logging and human oversight gaps in the pipeline.
- Run the required conformity assessment for high-risk systems ahead of December 2027.
- Register qualifying systems and set up ongoing post-market monitoring.
Enterprises already running GRC programs covering GDPR or ISO 27001 move through this sequence faster, since the audit-readiness habits already exist. The OECD’s AI Policy Observatory is also worth tracking, since several non-EU jurisdictions are aligning national frameworks with the same risk-tier logic.
(Recommended visual asset: a single timeline graphic plotting the six dates above against this six-step sequence, so engineering and legal stakeholders can see at a glance what’s due now versus by 2027.)
FAQs
What does "placing an AI system on the EU market" mean?
It means making the system available for use or supply within the EU, via direct sales, a subsidiary, a reseller, or EU-based user access online. No physical presence or registered entity is required.
Do we need an EU-based authorised representative?
Non-EU providers of high-risk AI systems generally must appoint an EU-based authorised representative under Article 22, who holds signed mandate documentation and can be held directly liable for compliance failures.
How does the AI Act overlap with GDPR compliance?
The two complement each other. GDPR governs how personal data is collected and processed; the AI Act governs how AI systems built on that data are designed and monitored. GDPR structures like impact assessments inform documentation but don’t replace Annex IV.
Can EU regulators fine a company with no EU presence?
Enforcement usually routes through existing mechanisms: market surveillance authorities can restrict a non-compliant system’s EU market access, and your appointed representative can be held directly liable, making that role more than a formality.
Is there a grace period after a deadline passes?
No. Once a deadline like December 2, 2027 for Annex III systems passes, obligations become enforceable immediately, leaving no buffer for a sudden regulator or customer request for the technical file.
How does the AI Act interact with sector-specific rules?
For products already regulated under frameworks like the Medical Device Regulation, the AI Act adds requirements on top rather than replacing them. Existing conformity procedures typically absorb the added criteria, one reason Annex I waits until August 2, 2028.
