EU AI Act timelines shift for US companies

Regulation (EU) 2024/1689 can apply to US companies that place AI systems or models on the EU market, use AI through an entity located in the EU, or produce AI output that is used in the EU. The law distinguishes providers, which build or market systems under their own name, from deployers, which use AI for professional purposes. Most US businesses using tools such as Microsoft 365 Copilot, ChatGPT Enterprise, or AI screening software fall into the deployer category.

Risk tiers determine the obligations. Prohibited practices have been banned since February 2, 2025, including workplace emotion recognition with narrow exceptions. Transparency duties for uses such as chatbots, deepfakes, and some AI-generated public-interest text began on August 2, 2026. High-risk deployer duties for Annex III systems moved to December 2, 2027, while AI inside regulated products moves to August 2, 2028.

Deployers must support AI literacy, avoid banned uses, and disclose certain AI uses. For high-risk systems, they must follow provider instructions, assign competent human oversight, monitor risks, retain logs for at least 6 months, notify affected workers, and explain AI-assisted decisions when required. Potential fines reach €35M or 7% of worldwide annual turnover for prohibited practices, €15M or 3% for most other breaches, and €7.5M or 1% for incorrect information supplied to authorities.