EU AI Act Explained for U.S. Businesses
The EU AI Act is the European Union’s risk-based framework for artificial intelligence. Formally the Artificial Intelligence Act, it sets rules for AI systems and general-purpose AI models based on how they are used, the risk they pose, and the organization’s role. The regulation aims to support trustworthy AI while protecting health, safety, and fundamental rights and freedoms.
Its reach extends beyond Europe. A U.S. company can fall within the EU AI Act when, as a provider, it places an AI system or general-purpose AI model on the EU market, or when it acts as a provider or deployer of an AI system whose output is used in the Union. Where an AI system also processes personal data, organizations may need to consider the GDPR alongside the AI Act. GDPR protections are not based on EU citizenship and can apply to the personal data of individuals in the Union under specified circumstances.
The EU AI Act Uses a Risk-Based Framework
The EU AI Act does not regulate every AI application in the same way. Its requirements fall into prohibited practices, high-risk AI systems, systems subject to transparency obligations, and other or minimal-risk uses that do not trigger the same extensive, system-specific requirements.
| Category | What It Generally Covers | Examples | Regulatory Treatment |
|---|---|---|---|
| Prohibited practices. | Uses the EU AI Act does not permit. | Certain manipulative uses, social scoring, and biometric practices. | Prohibited. |
| High-risk AI systems. | AI used in certain product or sensitive-use contexts. | Certain employment, critical infrastructure, education, and law enforcement uses. | Extensive requirements can apply to risk management, documentation, logging, human oversight, and other controls. |
| Transparency-related systems and content. | Certain AI interactions and AI-generated or manipulated content. | Chatbots, deepfakes, and synthetic content. | Applicable transparency duties can require disclosure, marking, or other information. |
| Other or minimal-risk uses. | AI applications outside the categories above. | Many common lower-risk business applications. | They do not face the same system-specific obligations, although other laws can still apply. |
Nevertheless, the actual classification depends on the system’s intended purpose and context; meaning, a “Low-Risk” AI system may pose a High risk for individuals depending on how you use it.
Annex III identifies sensitive-use areas relevant to high-risk classification. Article 6(1), read with Annex I, addresses AI systems used as safety components of certain regulated products or that are themselves covered products.
For more detail, see Insight Assurance’s guidance on high-risk AI systems.
The EU AI Act Can Apply to U.S. Companies
An organization doesn’t have to be headquartered or established in an EU member state for the EU Artificial Intelligence Act to apply.
A provider outside the EU can be covered when it places an AI system or general-purpose AI model on the EU market. A provider or deployer outside the EU can also be subject to the law when the system’s output is used in the Union.
- A provider develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark.
- A deployer uses an AI system under its authority. The Act also assigns responsibilities to other participants in the AI value chain, including importers, distributors, authorized representatives, and certain product manufacturers.
A U.S. technology company offering an AI-enabled hiring system in the EU may act as a provider. A U.S. organization using an AI system under its authority, with that system’s output used in EU operations, may fall within scope as a deployer. Using a third-party generative AI service doesn’t automatically make the customer the provider of the underlying model.
Requirements Depend on the AI System and the Organization’s Role
Prohibited AI Practices
Some uses are prohibited rather than permitted with added controls. Article 5 covers practices including certain manipulative or exploitative uses, social scoring, biometric practices, and particular predictive-policing uses.
Most prohibited-practice provisions began applying on Feb. 2, 2025. Additional Article 5 prohibitions apply on Dec. 2, 2026.
High-Risk AI Systems
High-risk AI systems face more extensive compliance requirements because of their potential effects on health, safety, or fundamental rights. Depending on classification and role, requirements can address:
- Risk management and data governance.
- Technical documentation, logging, and recordkeeping.
- Information for deployers and human oversight.
- Accuracy, robustness, cybersecurity, conformity assessment, and post-market responsibilities, where applicable.
Employment-related systems are one example. Annex III includes uses involving employment and worker management. These requirements focus on how higher-risk uses are governed and evidenced, not simply on how advanced the technology is.
Transparency Obligations
Article 50 creates separate transparency obligations for certain AI systems and AI-generated or manipulated content. Depending on the use, transparency duties can apply to direct interaction with AI systems, deepfakes, and synthetic audio, image, video, or text content.
Article 50 began applying on Aug. 2, 2026. A limited transition period runs until Dec. 2, 2026, for the marking and detection obligation covering certain generative AI systems already on the market before Aug. 2.
General-Purpose AI Models
Chapter V establishes separate obligations for providers of general-purpose AI models. A GPAI model provider may need to maintain technical documentation, give downstream AI developers and providers information about model capabilities and limitations, implement a copyright policy, and publish information about training content.
Providers of general-purpose AI models with systemic risk face additional obligations involving model evaluation, risk assessment and mitigation, serious-incident reporting, and cybersecurity.
GPAI provider obligations began applying on Aug. 2, 2025. Providers of models already placed on the market before that date have until Aug. 2, 2027, to comply. The European AI Office oversees important aspects of general-purpose AI governance and enforcement.
EU AI Act Requirements Are Phasing in Through 2028
The regulation entered into force in 2024, but its obligations do not share one universal compliance date. Amendments adopted in 2026 revised the application dates for particular high-risk requirements while leaving many other parts of the AI Act already applicable.
| Date | Key Milestone |
|---|---|
| Feb. 2, 2025 | Initial prohibited practices and AI literacy provisions began applying. |
| Aug. 2, 2025 | Governance provisions and obligations for providers of general-purpose AI models began applying. |
| Aug. 2, 2026 | The AI Act became generally applicable, including Article 50 transparency obligations. |
| Dec. 2, 2026 | Additional prohibited practices introduced through the 2026 amendments apply, along with the limited Article 50 transition milestone for certain existing systems. |
| Dec. 2, 2027 | Requirements for AI systems classified as high risk through Article 6(2) and Annex III apply. |
| Aug. 2, 2028 | Requirements for high-risk systems classified through Article 6(1) and Annex I apply. |
The European Commission continues to publish implementation information through the European AI Office and AI Act Service Desk. Organizations should follow the dates that apply to their systems rather than treating the EU AI Act as having a single deadline.
See Insight Assurance’s EU AI Act timeline for more detail.
Noncompliance Can Carry Significant Penalties
Article 99 establishes several maximum administrative-fine bands. Violations involving prohibited AI practices can reach €35 million or 7% of worldwide annual turnover. Violations of other obligations can reach €15 million or 3%. Supplying certain incorrect, incomplete, or misleading information to notified bodies or national competent authorities can carry penalties of up to €7.5 million or 1%.
For undertakings, the applicable maximum is generally the higher of the fixed amount or percentage threshold. For small-to-medium-sized enterprises (SMEs), including startups, the applicable cap is the lower of the two. Article 101 separately allows the European Commission to fine providers of general-purpose AI models up to €15 million or 3% of worldwide annual turnover, whichever is higher, for specified violations.
For systems affecting health, safety, or fundamental rights, the same documentation used to support compliance also establishes who owns the risk, how the system is governed, and what evidence supports those decisions.
What U.S. Companies Should Review Now
U.S. companies should be able to answer four questions:
- Scope: Which AI systems, models, or AI-enabled processes could bring the organization within the EU AI Act?
- Role: Is the organization acting as a provider, deployer, importer, distributor, authorized representative, product manufacturer, or another regulated participant?
- Classification and requirements: How is each relevant system or model classified, and which obligations and application dates follow?
- Evidence: What documentation supports the organization’s classification, AI governance decisions, and applicable controls?
Evidence may include AI inventories, role and classification rationale, technical documentation, risk records, transparency documentation, and records showing how controls operate.
ISO/IEC 42001 can provide structure for AI governance and evidence practices because it establishes requirements for an AI management system. ISO/IEC 42001 certification doesn’t independently establish EU AI Act compliance.
Learn more about ISO/IEC 42001 certification.
EU AI Act FAQs
Does the EU AI Act Apply to U.S. Companies?
Yes, in specific circumstances. Outside-EU providers can be covered when they place an AI system or GPAI model on the EU market, and providers or deployers can be covered when system output is used in the Union.
What Are the EU AI Act Risk Categories?
Prohibited practices, high-risk systems, transparency-related systems and content, and other or minimal-risk uses. General-purpose AI models have separate requirements and are not another risk tier.
What Counts as a High-Risk AI System?
High-risk classification is tied to specified products and sensitive-use contexts. Annex III covers areas such as employment and law enforcement, while Article 6(1) and Annex I address certain regulated products.
What Are the Penalties for EU AI Act Noncompliance?
Article 99 penalties can reach €35 million or 7% of worldwide annual turnover for prohibited-practice violations, with lower bands for other violations. Article 101 separately addresses violations by GPAI model providers.
When Do the High-Risk AI Requirements Apply?
Requirements for Annex III systems apply Dec. 2, 2027. Requirements for systems classified under Article 6(1) and Annex I apply on Aug. 2, 2028. Other AI Act provisions are already applicable.
Evaluate Your EU AI Act Readiness
Insight Assurance can independently assess the documentation, evidence, and controls supporting an organization’s stated EU AI Act classification and readiness conclusions. The organization retains legal classification decisions, compliance program design, and control operations.
