EU AI Act can apply to US startups without European offices

US startups can fall under the EU’s AI Act even when their entire business operates outside Europe. The law covers companies offering AI products or services in the EU, as well as systems whose outputs are used there. A European office, workforce or server infrastructure is not necessary for the rules to apply.

Compliance obligations depend on risk. Systems used for hiring, credit scoring, facial recognition and certain insurance pricing face stricter requirements, potentially including technical documentation, activity logs, risk management and disclosures. Some lower-risk applications must identify AI interactions or generated content, while minimal-risk tools such as spam filters generally remain unregulated. Prohibited practices include social scoring and most workplace emotion detection.

Enforcement involves national regulators, the European AI Office and the European Data Protection Supervisor. Prohibited practices can draw fines of up to €35 million or 7% of global yearly revenue, whichever is more. For startups and other small and mid-sized businesses, penalties are capped at the lower applicable monetary or revenue-based amount. Founders should assess their exposure to EU users, seek legal advice and incorporate relevant requirements into product development and sales planning, while monitoring evolving regulatory guidance.