EU AI Act compliance reaches across the AI supply chain

The EU AI Act applies beyond companies that build AI systems. Under Article 2, its scope includes providers placing AI systems or general-purpose AI models on the EU market, deployers located or established in the EU, importers, distributors, product manufacturers, authorized representatives, and certain organizations outside the Union.

Compliance depends on the role an organization plays for each system. A business may be a provider when it markets an AI product under its own name, a deployer when it uses an AI tool professionally, or both across different systems. Importers, distributors, and manufacturers can also face obligations when AI systems are supplied through the EU market or embedded in regulated products.

Territorial reach is a major issue for non-EU companies. Providers established in countries such as the US, UK, Canada, or Japan may fall within the Act when supplying AI products or services to European customers, and certain third-country providers or deployers may be covered when AI system outputs are used within the European Union.

The EU AI Act entered into force on 1 August 2024, with phased requirements. Prohibited AI practices and AI literacy obligations began applying on 2 February 2025, general-purpose AI model obligations began from 2 August 2025, Annex III high-risk AI obligations are scheduled for 2 December 2027, and certain Annex I product-related high-risk AI requirements are scheduled for 2 August 2028.