What the EU AI Act asks of US companies
Aranv’s short answer: the EU AI Act for US companies applies when you place an AI system or general-purpose model on the EU market, or when output from your AI system is used in the EU. Your duties then depend on the system’s risk tier and on whether you are its provider or its deployer.
Start with Article 2, which sets the scope. The official Article 2 text on the Commission’s AI Act Service Desk is short and worth reading in full before you decide the Act does not concern you.
According to the European Commission, the Act has been in force since 1 August 2024. Bans and the AI literacy duty have applied since 2 February 2025, rules for general-purpose models since 2 August 2025, and most other provisions since 2 August 2026. Amendments that took effect on 27 July 2026 moved high-risk rules for Annex III uses to 2 December 2027, and for AI built into regulated products to 2 August 2028.
Working out whether the AI Act reaches your business
Four questions for a US company
- 01 Does it reach the EU? Selling AI there, or output used there, brings you into scope.
- 02 Provider or deployer? Building and selling carries more duties than using.
- 03 Which risk tier? Banned, high-risk, transparency or minimal sets the workload.
- 04 Which dates apply? Some rules apply now; high-risk rules follow in December 2027 and August 2028.
Dates follow the European Commission’s pages, checked November 2026.
Four points US firms should know about the AI Act
The regulation is long, but four ideas cover most first decisions.
Reach beyond Europe
Providers anywhere that put AI on the EU market are covered, and so are providers and deployers abroad whose system output is used in the Union.
Role sets the duties
A provider develops or brands the system and carries most obligations. A deployer uses it under its own authority and has a shorter list.
Risk tiers, not one rule
A few practices are banned, some uses are high-risk, chatbots and generated media carry transparency duties, and most tools face no specific rules.
Chatbots and generated media
People must be told they are dealing with an AI, and generated media needs machine-readable marking, with extra time to 2 December 2026 for systems already on the market.
When EU rules reach a US business
Three situations come up most. You sell a product with AI features to EU customers, usually as its provider. You run AI in the US whose results go to people in the EU. Or your EU office uses AI tools as a deployer.
What we do
- EU sales of AI products
- AI output delivered into the EU
- EU staff using AI tools
- General-purpose models offered in the EU
- EU representative for high-risk systems
High-risk uses and the later dates
Annex III lists sensitive areas such as hiring, education, credit scoring, some insurance pricing and public benefits. Providers of these systems document, test and monitor them. Deployers follow the instructions for use, assign trained overseers and keep the logs.
What we do
- Risk management across the lifecycle
- Data governance for training sets
- Technical documentation and logging
- Human oversight by trained staff
- Conformity assessment before sale
How we approach a project
High-risk systems carry the heaviest duties, described below. Fines for banned practices reach EUR 35 million or 7 percent of worldwide annual turnover, whichever is higher; for SMEs the lower figure applies.
For most US small and midsize firms the practical work is an AI inventory, a role and tier for each system, chatbot disclosures and staff training. Our AI governance consulting helps build that inventory, the NIST AI RMF guide offers a risk method that sits well beside the Act, and the Colorado AI Act guide covers a US state law on similar themes. None of this is legal advice; it is a general summary, and EU counsel should confirm where your company stands.
How we work
- Scope before obligations
- Your role decides the duties
- Dates checked against official text
Our Process
-
List your AI systems
Record every AI tool you build, sell or use, including features inside other software.
-
Assign role and risk tier
For each system, decide whether you are provider or deployer and whether any use is banned or high-risk.
-
Close the near-term gaps
Add chatbot disclosures and content marking, train staff who use AI and ask vendors for their AI Act documentation.
-
Plan for the high-risk dates
Where a use is high-risk, schedule documentation, oversight and logging work well ahead of the deadline.
How Aranv helps US teams prepare
An inventory you can maintain
We help you list each AI system, its vendor, users and output destinations in a register your team keeps current.
Role and tier worked out early
For each system we note your likely role and flag uses that may be high-risk, ready for counsel to confirm.
Disclosures designed in
When we build chatbots and content tools, AI disclosure and machine-readable marking are part of the first design, not a late patch.
Records that serve several rules
Test results, oversight steps and logs are kept in one format that can feed EU, Colorado and NIST reviews alike.
Ready to act on this guide?
Ask our team in a 30-minute conversation.
Or see how we build it: Explore all services
EU AI Act questions from US businesses
-
Does the EU AI Act apply to a US company with no EU office?
It can. The Act reaches providers anywhere that place AI systems or general-purpose models on the EU market, and providers and deployers abroad whose system output is used in the Union. AI used only for US customers is usually outside it.
-
What are the main EU AI Act obligations for a deployer?
For most tools the duties are light: support AI literacy among staff and disclose deepfakes you publish. For high-risk systems, deployers also follow the instructions for use, assign trained overseers, monitor the system and keep its logs.
-
Has the EU delayed the AI Act’s high-risk rules?
Yes. Amendments in force since 27 July 2026 moved the rules for Annex III high-risk uses to 2 December 2027, and those for AI inside products covered by EU product law to 2 August 2028. The bans and most other parts already apply.
-
Do we need an EU representative under the AI Act?
Only in some cases. A provider based outside the EU appoints an authorised representative in the Union before offering a high-risk AI system or a general-purpose model there, with exceptions for some open-source models.
-
Is a customer service chatbot high-risk under the AI Act?
Usually not. A support chatbot falls under the transparency rules, so people must be told it is an AI. The answer changes if the same system assesses credit, prices life or health insurance, screens job applicants or decides public benefits.
Let’s talk about your next step
Contact Aranv to discuss your workflow, current tools, and goals. Meet with our team or send an inquiry.
Book a meeting with our team
Choose an available date and time for a 30-minute conversation about your project.
Tell us about your project
Share a few details so we can discuss a useful next step.
Prefer email? sales@aranv.com