This blog post is part of our series on the European Union’s Artificial Intelligence (AI) Act.
As we explained in our July 2024 blog post, the EU’s AI Act establishes an extensive regulatory framework for AI and will be fully effective starting 2 August 2026, with some requirements (such as AI literacy education and banned AI practices) taking effect from 2 February 2025.
The AI Act has an extraterritorial reach and applies to companies outside the EU as well. It’s important to assess whether your company falls under the AI Act and what obligations you might need to meet. This blog post explains the triggers that could place your company within its scope.
Key takeaways
- The AI Act is applicable along the entire value chain and covers a very wide scope of stakeholders, meaning that most organizations using AI in some capacity will fall within its scope.
- Your organization’s role under the AI Act (i.e., whether you’re a provider, deployer, etc.) determines your obligations, which means that you will need to understand your organization’s classification pursuant to the AI Act.
- The AI Act has an extraterritorial effect, meaning that even organizations not located in the EU may fall within its scope.
Pay attention if developing, selling, importing, manufacturing, distributing or deploying AI
The AI Act is applicable along the entire AI value chain, imposing compliance obligations onto a broad range of stakeholders – namely, providers, deployers, importers, distributors and product manufacturers – at least when there is a link with the EU.
Like other EU digital strategy laws – such as the Digital Services Act, Digital Markets Act, Digital Governance Act, Data Act and Cyber Resilience Act – or the General Data Protection Regulation, the AI Act has an extraterritorial effect and will apply to:
- Providers placing AI systems or general-purpose AI models on the market in the EU or putting into service AI systems or placing on the market general-purpose AI models in the EU, irrespective of whether those providers are located within or outside the EU.
- Deployers of AI systems that have their place of establishment in or that are located within the EU.
- Providers and deployers of AI systems that have their place of establishment or that are located in a third country in situations where the output produced by the AI system is used in the EU.
- Importers and distributors of AI systems into or within the EU.
- Product manufacturers which place an AI system on the market or put into service an AI system within the EU together with their product and under their own name or trademark.
The table below provides extended definitions and examples for each stakeholder along the value chain.
Exceptions
The AI Act includes a few exceptions that exempt certain organizations from having to adhere to its regulations:
- AI systems where and in so far as they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities.
- Public authorities in a third country or international organizations meeting the requirements of one of the aforementioned determinations of the AI Act, where those authorities or organizations use AI systems in the framework of international cooperation or agreements for law enforcement and judicial cooperation with the EU or with one or more member states, provided that such a third country or international organization provides adequate safeguards with respect to the protection of fundamental rights and freedoms of individuals.
- AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development.
- Organizations carrying out research, testing, and development activities regarding AI systems or AI models prior to being placed on the market or put into service.
- Natural persons using AI systems in the course of a purely personal, nonprofessional activity.
- AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems, prohibited AI system or an AI system which would be subject to transparency obligations.
What does this mean for your organization?
For organizations, comprehending the extent of the AI Act is essential to identify your responsibilities and establish a suitable AI governance and compliance framework. An organization will need to:
- Identify the AI system(s) and general-purpose AI model(s) you develop, have requested to be developed and/or use.
- Determine the category you fall into (e.g., provider, deployer, importer, distributor), as each has specific obligations and responsibilities.
- If you are not located in the EU, assess whether and to which extent your AI system or general-purpose AI model has an EU nexus which may trigger the extraterritorial effect of the AI Act.
Finally, and as we will discuss in a subsequent blog post in this series, it is crucial to understand where your AI system lies on the risk spectrum (e.g., Article 5 for prohibited AI, Article 6 for high-risk AI, etc.), as this will establish specific obligations related to the risks under the AI Act.
[View source.]