Does the EU AI Act apply to my company? The complete guide to jurisdiction.
A comprehensive breakdown of Article 2. Learn how the "Brussels Effect" targets foreign entities, the difference between placing on the market versus putting into service, and which strict exemptions actually apply.
When the European Union drafts digital regulation, they do not restrict themselves to their physical borders. Much like the GDPR fundamentally altered global data privacy, the EU AI Act is designed to be the global gold standard for artificial intelligence regulation. Assuming your company is exempt simply because your headquarters is in San Francisco, London, or Singapore is a €35 million mistake.
The Extraterritorial Reach (Article 2)
The jurisdiction of the AI Act is entirely impact-based. Under Article 2, the regulation applies to your organization if you fall into any of the following three categories:
1. Placing on the Market
This applies if you make an AI system available on the EU market, whether for payment or free of charge. If a user in Paris can download your app, access your SaaS, or integrate your API, you have placed it on the market.
2. Putting into Service
This covers AI systems that are supplied for first use directly to the deployer or for your own use in the Union. Even if you built a custom, internal HR tool strictly for your Berlin office, it is "put into service" in the EU and regulated.
3. The "Output" Clause (The Widest Net)
Article 2(1)(c) is the most critical clause for foreign entities. If the AI system is physically located in a non-EU country, and the developer is a non-EU entity, but the output produced by the system is used in the EU, the AI Act applies. For example, if a US healthcare company uses an AI server in Texas to analyze medical scans sent by a Spanish hospital, and sends the diagnosis back to Spain, that US company must comply with the EU AI Act.
Explicit Exemptions
The AI Act does carve out very specific, narrow exemptions. If your system falls entirely within one of these buckets, you are exempt from the regulation's requirements.
-
✓Scientific Research & Development
AI systems developed and put into service solely for the purpose of scientific research and development. Once the system moves from the lab to commercialization or real-world deployment, this exemption vanishes instantly.
-
✓Military & National Security
Systems placed on the market exclusively for military, defense, or national security purposes. Note: "Dual-use" systems (used by both the military and civilian police) do not qualify for this exemption.
-
✓Free and Open Source Software (FOSS)
Open-source AI components are generally exempt unless they are classified as High-Risk, are Prohibited, or qualify as General Purpose AI models with systemic risk. Furthermore, if a company takes a FOSS model and monetizes it, they become liable.
-
✓Personal, Non-Professional Use
Natural persons using AI systems for purely personal, non-professional activities (e.g., using ChatGPT to write a personal email or generating art for a hobby).
Are SMEs and Startups Exempt?
No. There is no blanket exemption for Small and Medium-sized Enterprises (SMEs) or startups. If your 2-person startup builds a High-Risk system (e.g., an AI resume screener), you are subject to the exact same rigorous safety requirements as a Fortune 500 company.
However, the Act includes "Proportionality measures" to ease the burden:
- Regulatory fees for conformity assessments will be scaled down for SMEs.
- SMEs get priority access to "AI Regulatory Sandboxes" established by national authorities to test their systems before market launch.
- Fines for SMEs are capped at lower percentages of global turnover compared to massive tech conglomerates.
Determine Your Jurisdiction Status
Our algorithmic engine maps your system's deployment context against Article 2 to determine if you are legally bound by the EU AI Act.
Run Diagnostic Scan →