Does the EU AI Act apply to US and other non-EU companies?

Yes — like the GDPR, the EU AI Act reaches well beyond companies incorporated in the EU. If your AI product is offered to EU users, or its output is used in the EU, being a Delaware C-corp or a UK Ltd does not take you out of scope. The rules are in Article 2 of Regulation (EU) 2024/1689.

The three hooks that catch non-EU companies

Article 2(1) applies the Act, among others, to:

• Providers placing AI systems on the EU market or putting them into service in the EU, “irrespective of whether those providers are established or located within the Union or in a third country” (Article 2(1)(a)). Selling a SaaS product with an AI feature to EU customers is placing it on the market.
• Deployers established or located in the EU (Article 2(1)(b)) — your EU subsidiary or EU business customers.
• Providers and deployers in third countries, “where the output produced by the AI system is used in the Union” (Article 2(1)(c)). This is the broadest hook: a US company whose chatbot converses with EU visitors, or whose generated content is published to EU audiences, can be in scope even without an EU entity.

What that means for Article 50 specifically

The transparency obligations (Article 50, explained here) apply from 2 August 2026. For a non-EU SaaS company, the practical questions are:

• Do EU users interact with your chatbot or voice agent? If so, the Article 50(1) disclosure duty applies to those interactions — see is my chatbot covered?
• Does your product generate synthetic audio, image, video or text? Article 50(2) requires machine-readable marking of outputs (see C2PA guide).
• Do you or your customers publish AI-generated content to EU audiences? Deep fakes and AI text informing the public on matters of public interest carry deployer-side disclosure duties under Article 50(4) — see do I need to label AI-generated content?

“We'll just geo-block the EU” — is that realistic?

It is the only clean way out of scope, and some teams do it. But be honest about the trade-offs: you lose the EU market, you must actually block (an English-language site that happily takes EU sign-ups and payments is not blocked), and Article 2(1)(c) still matters if EU persons end up using your system's output. For most SaaS products, adding a disclosure line and content marking is dramatically cheaper than exiting a market.

Authorised representatives: an extra step for some providers

Providers of high-risk AI systems and of general-purpose AI models established outside the EU must appoint an EU authorised representative (Articles 22 and 54). Article 50-only exposure — a chatbot, an AI writing feature — does not itself trigger that requirement, which is one reason the transparency tier is the realistic first compliance milestone for most non-EU SaaS teams.

Enforcement against non-EU companies

Market surveillance authorities enforce the Act, with fines for transparency breaches up to €15M or 3% of worldwide turnover (Article 99(4); penalties guide). The GDPR experience is instructive: extraterritorial EU rules were widely ignored by small non-EU companies in 2018 — until enforcement, platform requirements and enterprise procurement made compliance a de-facto market-access condition. Buyers already ask about AI Act posture in security questionnaires today.

A pragmatic checklist for non-EU teams

1. Decide your EU posture: serve the EU (comply) or genuinely block it.
2. If you serve the EU, map your Article 50 exposure with the free 3-minute checker.
3. Ship disclosures for conversational AI and marking for generated content.
4. Document the analysis — including any exemptions you rely on — so you have an answer for enterprise procurement and regulators alike.