Does the EU AI Act apply to US companies with EU users?
Yes, for most US companies with EU users — and the test has nothing to do with where you are incorporated, where your servers are, or whether you have a European entity.
The AI Act's scope provision, Article 2(1), reaches three groups. Two of them are about geography, and the third is the one that catches American businesses:
- Art. 2(1)(a)
- providers placing an AI system on the Union market or putting it into service in the Union, irrespective of whether they are established in the Union or in a third country.
- Art. 2(1)(b)
- deployers of AI systems established or located in the Union.
- Art. 2(1)(c)
- providers and deployers established or located outside the Union, where the output produced by the AI system is used in the Union.
Clause (c) is the operative one. The duties attach to where the output is used; registering the company elsewhere does not move them. A Delaware C-corp with a support chatbot that answers questions from customers in Dublin is producing output used in the Union.
Where US companies actually land#
| Your situation | In scope? | Why |
|---|---|---|
| US SaaS, no EU entity, AI chatbot on a site EU customers use | Yes | The chatbot's output is used in the Union (Art. 2(1)(c)). Art. 50(1) disclosure applies at first interaction. |
| US company selling an AI product to EU businesses | Yes | Placing an AI system on the Union market makes you a provider under Art. 2(1)(a), wherever you are established — the fullest set of duties. |
| US publisher, AI-assisted articles with EU readers | Yes | AI-generated text published to inform the public on matters of public interest falls under Art. 50(4); EU readership brings the deployer into scope. The editorial-responsibility carve-out changes the analysis — see below. |
| US group with an EU subsidiary running AI | Yes | The subsidiary is a deployer established in the Union (Art. 2(1)(b)). |
| US company, US-only customers, no EU traffic you serve | Generally no | No output used in the Union. But read the next section before relying on this. |
| US company, EU visitors browse but the AI feature is geo-blocked for them | Depends | If the AI system genuinely produces no output used in the Union, the (c) hook is not met. That is a decision someone has to make in the product itself. |
"We don't target the EU" is a weaker defence than it sounds#
Three things routinely surprise US teams here.
There is no targeting test in clause (c). GDPR's Article 3(2) asks whether you offer goods or services to or monitor people in the Union — language that supports a "we don't market there" argument. Article 2(1)(c) of the AI Act asks whether the output is used in the Union. If EU visitors reach your site and your chatbot answers them, the output is used there. Whether you sought them out is not the question the clause asks.
Availability tends to become use. A site that accepts EU traffic, prices in euros, ships to the EU, or runs a chat widget with no geographic gate is producing output used in the Union whatever the go-to-market deck says.
There is no general small-business exemption. SMEs and start-ups get lighter supporting measures and a lower fine ceiling — for the operator obligations the cap is the lower of €15 million or 3% of worldwide annual turnover rather than the higher — not a pass on transparency itself. A twelve-person company with EU users is in scope in the same way a large one is.
Geo-blocking is the one genuine scope answer, and it is an engineering decision with revenue consequences, not a policy sentence. If you take it, take it properly: the AI feature must not serve EU visitors, not merely be unadvertised to them.
What being in scope actually requires#
For most US website owners, in-scope means four duties, of which two are usually live:
- Art. 50(1) — chatbot disclosure. Any AI system interacting with people must make that clear no later than the first interaction, in a clear and distinguishable manner. This is a configuration problem far more often than an engineering one.
- Art. 50(2) — machine-readable marking of AI-generated audio, image, video and text. A provider-side duty on the generative system, but it fails quietly in your pipeline: CDNs and image optimisers strip provenance metadata routinely.
- Art. 50(3) — emotion recognition and biometric categorisation notice, where you run such a system.
- Art. 50(4) — visible labels for deepfakes and for AI-generated text published to inform the public on matters of public interest, unless a human reviewed it and a natural or legal person holds editorial responsibility.
The dates: 2 August 2026 for all of it, with enforcement powers active from the same day and no separate grace period. One narrow carve-out runs to 2 December 2026 — machine-readable marking under 50(2), for generative systems already on the market before 2 August 2026. That is the whole of the deferral; see what 2 December does and does not cover. The Digital Omnibus (Regulation (EU) 2026/1744) pushed the high-risk regime out to 2027–2028 and left Article 50 where it was, which is the single most common misreading in US coverage.
Full detail on each duty: EU AI Act Article 50, explained.
Who enforces it against a US company#
National market-surveillance authorities in the member states, not a single EU-level regulator. Practically, that means the authority in a country where your output is used.
Article 50 is unusually cheap to enforce, which changes the risk calculus for a company with no EU footprint. Nobody needs to serve you with anything to find a problem: they open your site, start a chat, and read. Many of these matters start as competitor complaints for exactly that reason. The evidentiary burden then runs the other way — showing what your site displayed on a past date is your problem, not theirs, and it is the part US teams are least prepared for. See how to prove your disclosure was live on a specific date.
Fines for the operator obligations reach €15 million or 3% of worldwide annual turnover, whichever is higher — worldwide turnover, not EU-derived revenue. Penalties and enforcement in detail.
The US rules do not substitute, and may arrive first#
If you are building an AI disclosure programme for the EU, you are most of the way to the US state requirements — but they are separate obligations with their own definitions:
- California SB 942, the AI Transparency Act, became operative the same day as Article 50 and reaches covered providers with latent and manifest disclosures on AI-generated content. California SB 942, explained.
- Utah's AI Policy Act requires disclosure when a user asks whether they are dealing with AI — the direct-question test, as state law. Utah AI Policy Act.
Neither one satisfies Article 50, and Article 50 does not satisfy either of them. The overlap is real enough that one implementation usually serves all three, provided you build to the strictest placement rule — which is the EU's "at the latest at the time of the first interaction."
Where to start#
- Determine whether EU visitors currently reach your AI features. Analytics answers this in a minute, and it is the only scope question that matters.
- Check the disclosure the way a visitor sees it, on desktop and mobile: the audit procedure.
- Fix the wording where it is weak rather than absent — the near-miss phrasings are the most common finding by a wide margin. Fifteen examples.
- Start keeping dated, external records of what your site showed.
The free homepage scan runs the visitor's-eye check from outside your network and returns findings with the captures attached — no signup, and it works the same whether your company is in Ohio or Ostend.
Common questions
Does the EU AI Act apply to a US company with no EU entity?
Usually yes, if EU users reach your AI features. Article 2(1)(c) covers providers and deployers established outside the Union where the output produced by the AI system is used in the Union. It asks where your system's output lands. Where you are incorporated, where your servers sit, and whether you have a European subsidiary do not decide it.
Is there a targeting test like GDPR's?
No, and this is the trap. GDPR Article 3(2) asks whether you offer goods or services to, or monitor, people in the Union — language that supports a "we don't market there" argument. Article 2(1)(c) of the AI Act asks whether the output is used in the Union. If EU visitors reach your site and your chatbot answers them, the output is used there, whether or not you sought them out.
Would geo-blocking EU visitors put us out of scope?
It is the one genuine scope answer, and it is an engineering decision with revenue consequences rather than a policy sentence. If the AI system genuinely produces no output used in the Union, the Article 2(1)(c) hook is not met. Take it properly if you take it: the AI feature must not serve EU visitors, not merely be unadvertised to them.
Is there an exemption for small US companies?
No general one. SMEs and start-ups get lighter supporting measures and a different fine ceiling — for the operator obligations the cap is the lower of €15 million or 3% of worldwide annual turnover rather than the higher — but not a pass on transparency. A twelve-person company with EU users is in scope the same way a large one is.
Does complying with California SB 942 cover the EU AI Act?
No, and the reverse is not true either. They are separate obligations with their own scope and definitions, though the overlap is real enough that one implementation usually serves both — provided you build to the strictest placement rule, which is the EU's requirement to disclose at the latest at the time of the first interaction.
Sources and further reading
- Article 2 — Scope (EU AI Act)
- Article 50 — Transparency obligations
- Commission guidelines on transparency obligations, 20 July 2026
Last updated September 2026. Informational only, not legal advice: this page describes what the text of the EU AI Act says and what an external check can observe, not whether any particular site complies. Corrections welcome at hello@disclosureproof.com.