A composite scenario assembled from documented cases: In September 2026, the founder of a 28-person Cambridge B2B software firm searched "EU AI Act for US companies" after signing two enterprise buyers in Dublin and Munich. One page-one social post declared that Europe's AI law applies to anyone with EU customers, employees, or data, "Full stop," while a September 2026 compliance tracker claimed Brussels' Digital Omnibus simplification law was still unpublished (EUR-Lex, Jul 24, 2026; Garrigues, Jul 2026). Both claims were wrong. Under Regulation (EU) 2024/1689 (Article 2) and the enacted Digital Omnibus (Regulation (EU) 2026/1744, published July 24, 2026 and effective July 27, 2026), merely invoicing an EU client or storing EU contact data triggers GDPR rather than the EU AI Act, and Annex III high-risk HR duties were moved 16 months out to December 2, 2027.
For founders and owners asking does the EU AI Act apply to your US business, not automatically, even when you have EU customers or data. Under Article 2(1)(a)-(c) of Regulation (EU) 2024/1689, a US-based company enters scope only if it places an AI system on the EU market or its AI output is intended to be used inside the Union. Check your exact exposure and Regulation (EU) 2026/1744 dates with the ed.cafe 5-Question US-to-EU AI Act Applicability & Output-Path Audit below.
Getting scope right prevents two expensive mistakes: spending tens of thousands of dollars on premature conformity consultants when you are out of scope, or ignoring live Article 50 chatbot and deepfake rules when your outputs actually land in Europe. Under Article 99, statutory fine ceilings reach EUR 35 million or 7% of global annual turnover (threshold rule) for prohibited practices and EUR 15 million or 3% of global annual turnover (threshold rule) for most other duties, with a critical SME protection: for small and midsize firms, the lower of the Euro figure or percentage applies (Art. 99). Paired with our US state vs federal AI law scoreboard, this guide provides general operational information as of October 29, 2026, not EU or US legal advice.
How does the Article 2(1)(c) extraterritorial output trigger actually work?
Under Article 2(1) of Regulation (EU) 2024/1689, a company with zero offices or subsidiaries in the European Union enters EU AI Act scope through only two doors: placing an AI system or general-purpose AI model on the EU market (Article 2(1)(a)), or operating as a third-country provider or deployer "where the output produced by the AI system is used in the Union" (Article 2(1)(c)). Simply holding an EU resident's email address or billing a German corporate account does not trigger the Act (Art. 2).
Think of a physical machine shop in Worcester, Massachusetts. If the shop ships an industrial laser cutter to a factory in Lyon, EU machinery safety rules govern that tool (Article 2(1)(a)). If the Worcester shop keeps the laser cutter bolted to its own floor in Massachusetts and uses an AI scheduling tool strictly internally to plan US shifts before mailing plain steel brackets to Lyon, the AI output stayed in Massachusetts. Now add Recital 22, which explains why Article 2(1)(c) exists: Brussels wanted to block outsourcing loopholes. If a Munich bank or Dublin employer sends applicant resumes or loan files to a third-country vendor in Boston, and the Boston vendor runs an AI scoring model and sends the AI-generated scores or rankings back to Munich to hire or reject people in the EU, Article 2(1)(c) pulls both the EU client and the Boston operator into scope.
Where that physical export analogy breaks is the open web. Any public .com site in Boston can be loaded by a traveler in Madrid. Legal commentary on Article 2(1)(a) and 2(1)(c) distinguishes intended Union market placement or output use from passive, incidental EU access:
- Intended Union use (IN SCOPE): Pricing in EUR, localizing into EU languages, contracting to deliver AI reports, code, chat support, or candidate rankings to EU clients, or screening remote applicants living in EU Member States.
- Incidental / passive access (OUT OF SCOPE): Running an English-only US local business (such as a Massachusetts HVAC shop or clinic priced in USD) whose public chatbot happens to be clicked by a traveler in Paris.
- Internal US AI use on EU personal data (GDPR, NOT EU AI ACT): Using an enterprise LLM in Boston to summarize internal notes for your US rep: if EU personal data enters the prompt, GDPR transfer rules apply, not
Article 2(1)(c), provided the AI output itself never enters the Union.
Which US workflows fall inside vs outside the EU AI Act? Six concrete scenarios
Before checking deadlines, determine whether your US company acts as a Provider (develops an AI system/GPAI model, or puts its own name/trademark on one for EU market placement), a Deployer (uses an AI system under its authority in professional operations whose output is used in the EU), or Out of Scope.
| US Business Workflow | EU AI Act Role | Scope Verdict (Art. 2) | Primary Legal Regime Triggered |
|---|---|---|---|
| 1. US SaaS sells an AI-assisted CRM or support widget to Dutch & German buyers. | Provider (if branded AI feature) or Deployer. | IN SCOPE (Art. 2(1)(a) & (c)). | EU AI Act (Art. 4 literacy + Art. 50 bot disclosure) + GDPR. |
| 2. Boston consulting firm uses Claude internally for US staff notes; mails human-written strategy PDF to Milan. | Neither (internal US draft aid only). | OUT OF SCOPE (human work product; check Art. 50(4) editorial rule). | Contract law + GDPR if Milan personal data was processed. |
| 3. Austin recruiting agency uses an AI scorer in Texas to rank Dublin applicants and sends shortlist to Irish client. | Deployer of Annex III HR AI (Recital 22). | IN SCOPE (Art. 2(1)(c) output used in EU). | EU AI Act Annex III high-risk HR duties (effective Dec 2, 2027) + GDPR. |
| 4. US e-commerce brand ships apparel to France and runs an AI customer-support chatbot on its EU checkout. | Deployer of interactive AI. | IN SCOPE (Art. 2(1)(c)). | Article 50(1) chatbot disclosure (live Aug 2, 2026) + Article 4 literacy. |
5. Local Boston accounting firm (.com, USD only, US clients) gets 12 accidental pageviews from Berlin. | None (no EU market targeting or intended EU output use). | OUT OF SCOPE. | US federal and Massachusetts laws only. |
| 6. US startup uses Slack emotion-scoring AI on video calls with 3 remote employees based in Spain. | Deployer of workplace emotion AI. | PROHIBITED (Art. 2(1)(c) + Art. 5(1)(f)). | Banned since Feb 2, 2025; up to 7% turnover / EUR 35M SME-adjusted cap. |
What changed in the 2026 Digital Omnibus (Reg. 2026/1744)? Phased timeline to 2028
If you read an EU AI Act explainer written in 2024, 2025, or early 2026, half its high-risk dates are now outdated. Following late-2025 simplification proposals driven by delayed European harmonized technical standards, the EU enacted Regulation (EU) 2026/1744 (the Digital Omnibus on AI), published in the Official Journal on July 24, 2026 and entering into force July 27, 2026 (EUR-Lex; Garrigues).
Three major changes hit US firms with EU exposure:
- Annex III High-Risk AI Deferred 16 Months to December 2, 2027: Standalone high-risk obligations covering employment, recruitment, worker management, education, credit scoring, and essential services moved from August 2, 2026 to December 2, 2027 (while Annex I AI embedded in regulated medical devices, machinery, or toys moved from August 2, 2027 to August 2, 2028).
- Article 4 AI Literacy Reframed as an Effort Duty: Instead of a rigid outcome mandate to "ensure a sufficient level" of literacy, amended
Article 4requires covered providers and deployers to "take measures to support the development of AI literacy" among staff operating AI systems (EUR-Lex). Read our companion guide on keeping an Article 4 AI literacy training record for a 40-person team. - Article 50 Transparency Stayed Live on August 2, 2026 (With One Grace Window): Chatbot disclosures (
50(1)) and deployer deepfake/synthetic-content labels (50(4)) were not delayed and took effect August 2, 2026. Only machine-readable marking (50(2)) for generative systems placed on the market before August 2, 2026 received a four-month transition grace period ending December 2, 2026 (CSA Labs). Meanwhile,Article 50(4)preserves a vital deployer carve-out: AI-generated public-interest text does not require an AI label when it undergoes human review and a natural or legal person holds editorial responsibility. See our full EU Article 50 guide to labelling chatbots, deepfakes, and AI text.
| Milestone Date | EU AI Act Provision (Reg. 2024/1689 + Reg. 2026/1744) | Status on Oct 29, 2026 | Maximum Fine Ceiling (Art. 99 Rule for Firms) |
|---|---|---|---|
| Feb 2, 2025. | Article 5 core bans (social scoring, workplace/school emotion AI 5(1)(f)). | IN FORCE. | Up to EUR 35M or 7% turnover rate (lower for SMEs). |
| Aug 2, 2025. | Articles 51-55 General-Purpose AI (GPAI) model provider rules. | IN FORCE. | Up to EUR 15M or 3% turnover rate (GPAI fine regime). |
| Jul 27, 2026. | Reg. (EU) 2026/1744 Omnibus: softened Article 4 literacy support duty. | IN FORCE. | Weighed in national audits; no standalone Art. 99 tier. |
| Aug 2, 2026. | Article 50 chatbot disclosures (50(1)) & deployer deepfake labels (50(4)). | IN FORCE. | Up to EUR 15M or 3% turnover rate (lower for SMEs). |
| Dec 2, 2026. | Article 50(2) legacy marking grace ends + new Art. 5 nudifier/CSAM bans. | 34 DAYS AWAY. | EUR 15M / 3% (Art. 50); EUR 35M / 7% (Art. 5 rule). |
| Dec 2, 2027. | Annex III high-risk AI (HR/hiring, education, credit, biometrics). | DEFERRED. | Up to EUR 15M or 3% turnover rate (lower for SMEs). |
| Aug 2, 2028. | Annex I embedded high-risk AI (medical devices, machinery, toys). | DEFERRED. | Up to EUR 15M or 3% turnover rate (lower for SMEs). |
Worked compliance & SME penalty math for a 35-person US company
Panic-driven vendor pitches routinely warn 30-person US firms of a "EUR 35 million fine tomorrow." Check Article 99(6) first (Art. 99). For large enterprises, EU regulators apply whichever cap is higher (EUR 15M/35M or the 3%/7% turnover threshold rule for firms). For SMEs (under 250 staff and turnover <= EUR 50 million, or balance sheet <= EUR 43 million), including startups, Article 99(6) flips the rule to whichever amount is LOWER.
Assume a 35-person Boston SaaS firm earns $6.0 million (~EUR 5.5 million) annually, derives 8% of revenue from 14 EU client firms, retains two remote contractors in Ireland, runs a support bot on its EU pricing page, and uses an AI resume ranker in Greenhouse.
- True SME Penalty Ceiling: Under
Article 99(6), a 3% turnover threshold on EUR 5.5 million equals EUR 165,000 (not EUR 15 million), and national authorities weigh firm size and cooperation. - Immediate 2026 Cost (
Article 50+Article 4): Adding a clear chatbot greeting ("You are chatting with an AI assistant") on EU pages takes 30 minutes. Logging a 60-minute staff session via our free 60-minute AI literacy session plan takes 1 hour per worker ($0 software cost). Checking provider C2PA marking before December 2, 2026 takes 2 hours. - 2027 Planning (
Annex IIIHR AI due December 2, 2027): Screening Irish applicants sends HR AI output into the Union, giving the firm 13 months to either route EU applicants through manual human review ($0 cost) or assemble Annex III logs and notices.
Run the 15-minute scope check: The ed.cafe 5-Question US-to-EU AI Act Audit
Open a blank doc with your operations, product, and HR leads and walk every AI tool or product feature through the ed.cafe 5-Question US-to-EU AI Act Applicability & Output-Path Audit below. The ed.cafe 5-Question US-to-EU AI Act Applicability & Output-Path Audit separates GDPR-only workflows from live 2026 and deferred December 2027 obligations in 15 minutes.
THE ED.CAFE 5-QUESTION US-TO-EU AI ACT APPLICABILITY & OUTPUT-PATH AUDIT
Verified: Oct 29, 2026 (Includes Digital Omnibus Reg. (EU) 2026/1744)
Publisher: ed.cafe by No Worker Left Behind (Boston 501(c)(3), EIN 88-3268312)
Operational scope screen for US organizations; not EU or US legal advice.
STEP 1: 5-QUESTION SEQUENTIAL SCOPE CHECK (RUN PER AI WORKFLOW OR FEATURE)
Q1. EU ESTABLISHMENT (`Art. 2(1)(b)`): Does an EU subsidiary, branch, or EU-based
entity of yours deploy this AI system?
-> YES: IN SCOPE as an EU deployer. Go to Q4.
-> NO (US-established only): Go to Q2.
Q2. EU MARKET PLACEMENT (`Art. 2(1)(a)`): Do you sell, license, or make your own
AI system or GPAI model available to buyers in the EU (EUR pricing, EU sales
contracts, EU app stores, or targeted EU marketing)?
-> YES: IN SCOPE as a Provider (note: non-EU High-Risk/GPAI providers must
appoint an EU Authorized Representative under Art. 22 / Art. 54). Go to Q4.
-> NO: Go to Q3.
Q3. OUTPUT USED IN THE UNION (`Art. 2(1)(c)` & `Recital 22`): Does your US team
run an AI tool whose OUTPUT (chatbot replies, candidate scores, credit tiers,
synthetic media, or unedited AI deliverables) is intended to be used inside
an EU Member State by EU customers, EU clients, or EU-based staff/applicants?
-> NO (purely internal US use, passive accidental EU web traffic, or human-
authored final work): OUT OF EU AI ACT SCOPE. (Still check GDPR if EU
personal data entered the prompt!) STOP HERE.
-> YES: IN SCOPE under Art. 2(1)(c). Go to Q4.
Q4. PROHIBITED OR LIVE 2026 TRANSPARENCY CHECK (`Art. 5`, `Art. 4`, `Art. 50`):
- Does it score workplace/school emotions (`Art. 5(1)(f)`), manipulate
subliminally, social-score, scrape facial DBs, or generate non-consensual
intimate imagery (`Dec 2, 2026`)? -> STOP IMMEDIATELY (Banned; 7% / EUR 35M).
- Do EU users interact directly with an AI bot (`Art. 50(1)`) or receive
deepfakes (`Art. 50(4)`)? -> LIVE SINCE AUG 2, 2026: Add clear AI disclosure
now; verify legacy provider machine-marking before DEC 2, 2026.
- Do staff operate in-scope AI? -> LIVE NOW (`Art. 4` amended): Log role-based
measures supporting staff AI literacy. Go to Q5.
Q5. DEFERRED HIGH-RISK CHECK (`Annex III` & `Annex I` under `Reg. 2026/1744`):
- Does output screen/manage EU job applicants or workers, score EU credit/
insurance, grade EU students, or run remote biometrics (`Annex III`)?
-> DEADLINE DEFERRED TO DEC 2, 2027: Either exclude EU residents from
automated scoring OR prepare human oversight, logs & worker notices.
- Is AI a safety component inside regulated EU hardware/medical devices
(`Annex I`)? -> DEADLINE DEFERRED TO AUG 2, 2028.
STEP 2: ONE-LINE OUTPUT-PATH LOG (COPY INTO SPREADSHEET)
| Workflow / Tool | Role (Provider / Deployer / None) | Does Output Land in EU? | Live 2026 Duty (Art. 4 / 50) | Dec 2, 2027 Duty (Annex III) | Owner |If Question 4 flags staff AI literacy for your EU-facing workflows, pair your training log with our scoreable tasks across the five DOL AI literacy skill areas. Massachusetts residents can also take the Google AI Professional Certificate at no cost via the Mass AI Hub, and No Worker Left Behind is forming Circle #1 at ed.cafe/start/, a free 30-chair cohort closing December 1, 2026 (pre-launch as of October 2026; zero cohorts completed yet).
Where this stops being true
- GDPR and national EU Member State laws stay separate: Passing Question 3 as "Out of Scope" for the EU AI Act never exempts a US firm from GDPR (
Regulation (EU) 2016/679) if staff paste EU resident personal data into an LLM, nor from EU works-council consultation rules or national civil liability laws. - Substantial modification upgrades you to a Provider (
Article 25): If your US company rebrands a third-party AI tool under your own trademark, changes its intended purpose into a high-risk domain, or substantially modifies a high-risk system,Article 25shifts full Provider duties onto your firm (including appointing a written EU Authorized Representative underArticle 22before high-risk enforcement hits). - Excluded domains (
Article 2(3)-(8)): Pure scientific R&D prior to market placement, open-source non-GPAI/non-high-risk releases (subject to exceptions), and national-security/military systems follow statutory exclusions inArticle 2. - Not legal advice: Cross-border jurisdiction and
Article 2(1)(c)output tracing depend on contract flow and upcoming European AI Office guidelines; consult qualified EU regulatory counsel before launching high-risk EU workflows.
Questions people ask
Who does the EU AI Act apply to?
Under Article 2 of Regulation (EU) 2024/1689, the EU AI Act applies to providers placing AI systems or general-purpose AI models on the EU market, deployers established inside the European Union, and non-EU providers or deployers whenever the output produced by their AI system is used inside the Union. Purely personal, non-professional AI use is exempt.
Does the EU AI Act apply to a US company with no EU office?
Only if the US company places an AI system on the EU market (Article 2(1)(a)) or if the output of its AI system is intended to be used inside the European Union (Article 2(1)(c)). Merely having EU customers, storing EU emails, or using ChatGPT internally in the US triggers GDPR rules if personal data is involved, not the EU AI Act.
Was the EU AI Act delayed until December 2027?
Only the high-risk chapters were delayed. Under Regulation (EU) 2026/1744 (the Digital Omnibus on AI, published July 24, 2026 and effective July 27, 2026), Annex III high-risk rules for HR and education moved to December 2, 2027, and Annex I product rules moved to August 2, 2028. Article 5 bans, Article 4 literacy, GPAI rules, and Article 50 chatbot disclosures are already live.
Is the EU AI Act mandatory and what are the fines for small businesses?
Yes, the EU AI Act is a binding regulation across all 27 EU Member States. Fine ceilings reach EUR 35 million or 7% of global annual turnover threshold for banned AI and EUR 15 million or 3% turnover rate for most other breaches. However, under Article 99(6), SMEs and startups are capped at whichever figure (Euro amount or turnover percentage) is lower.
Does the USA have a federal AI Act like the European Union?
No. As of October 29, 2026, the United States has no comprehensive federal statute comparable to the EU AI Act. Instead, US businesses face federal FTC deception and civil-rights enforcement alongside state statutes in Illinois (HB 3773), Texas (TRAIGA), California (FEHA ADS and SB 947), Colorado (SB 26-189), and general state laws in Massachusetts.
Do US websites need EU AI Act chatbot labels for casual visitors from Europe?
Not if your US website exclusively targets domestic customers (for example, priced only in USD for local US buyers) and receives only passive, incidental traffic from Europe. If your site actively markets or sells to EU buyers in EUR or EU languages, add a clear Article 50(1) notice stating users are chatting with an AI system.
Key terms
- Annex III high-risk AI: Standalone AI systems used in sensitive areas such as hiring, worker management, education, credit scoring, and biometrics; deferred to December 2, 2027 under
Reg. (EU) 2026/1744. - Article 2(1)(c) output test: Extraterritorial rule bringing non-EU providers and deployers under the EU AI Act when output produced by their AI system is used in the Union.
- Deployer vs Provider: Distinction between an organization building or branding an AI system for market (
Provider) and one using an AI system in professional operations (Deployer). - Digital Omnibus on AI (
Reg. (EU) 2026/1744): EU amending regulation effective July 27, 2026 that softened Article 4 literacy language and deferred Annex III and Annex I high-risk deadlines. - Editorial-responsibility carve-out (
Art. 50(4)): Exemption removing mandatory AI labels on public-interest AI text when a human reviews it and an editor assumes legal responsibility. - SME lower-cap rule (
Art. 99(6)): Statutory safeguard capping EU AI Act fines on SMEs and startups at the lower of the fixed Euro ceiling or global turnover percentage.
Sources
- European Union, Regulation (EU) 2024/1689 (EU AI Act), Article 2 (Scope) & Recital 22: Article 2 Text
- European Union, Regulation (EU) 2024/1689, Article 99 (Penalties & SME Cap): Article 99 Text
- Official Journal of the European Union, Regulation (EU) 2026/1744 (Digital Omnibus on AI) (Published Jul 24, 2026; Effective Jul 27, 2026): EUR-Lex CELEX:32026R1744
- Garrigues Digital, "AI Digital Omnibus Regulation Has Been Published: Redefining Deadlines and Obligations" (Jul 2026): Garrigues
- Cloud Security Alliance (CSA Labs), "Research Note: EU AI Act Article 50 Watermarking & Dec 2, 2026 Grace Period" (2026): CSA Labs
- Jones Day, "European Commission Publishes Final Code of Practice on Marking and Labelling AI-Generated Content" (Jun 2026): Jones Day
- DLA Piper, "EU AI Act Update: European Commission AI Literacy Questions and Answers" (May 2025): DLA Piper
- European Union, Regulation (EU) 2016/679 (General Data Protection Regulation / GDPR): EUR-Lex GDPR
