Does the EU AI Act apply to my company? For most businesses that operate in the EU, the answer is yes — but usually not in the way people expect. The Act reaches organizations that simply use AI tools bought from someone else, not only the companies that build them.
That catches a lot of businesses off guard. According to Eurostat, 19.95% of EU enterprises used AI technologies in 2025, up from 13.48% the year before. Among large enterprises, the figure was 55.03%.
The rules have also moved. Since 2 August 2026, the European Commission’s AI Office and national authorities have been enforcing the AI Act, and new transparency requirements now apply to chatbots and AI-generated content.
In this article, we’ll walk through five questions that settle whether the Act applies to you, then set out in table form exactly what your company has to do — the baseline every organization owes, and how the obligations change depending on whether your systems are narrow scope, general purpose, or high risk.
Does the EU AI Act Apply to My Company?
The EU AI Act applies to your company if you place an AI system on the EU market, put one into service in the EU, or use one in a professional capacity within the EU. It also applies when your AI system sits outside the EU but its output is used inside it.
The Act does not care whether you call yourself an AI company. It cares about three things: what the system does, what role you play in relation to it, and where the effects land.
Here’s the short version of who is in scope:
- Providers. You develop an AI system or have one developed and place it on the market under your own name or trademark. This includes rebranding someone else’s system as your own.
- Deployers. You use an AI system under your own authority in a professional context. This is the largest group by a wide margin, and the one least aware it has duties.
- Importers and distributors. You bring an AI system into the EU market or make one available on it without being the provider.
- Product manufacturers. You embed an AI system into a product you already place on the market under existing EU product safety law.
One important carve-out: using AI in a purely personal, non-professional capacity falls outside the Act. Your team using an AI assistant to draft client work does not.
What Is an AI System Under the EU AI Act?
Under Article 3 of Regulation (EU) 2024/1689, an AI system is a machine-based system designed to operate with varying levels of autonomy, that may show adaptiveness after deployment, and that infers from its inputs how to generate outputs such as predictions, content, recommendations, or decisions.
The word doing the most work in that definition is infers. A system that follows rules a human wrote — an if-then workflow, a fixed formula, a conventional database query — generally sits outside the definition.
The Commission has published guidelines on the AI system definition precisely because this line is difficult in practice. If your automation genuinely just executes deterministic rules, it is probably not an AI system. If it learns, scores, ranks, classifies, or generates, it probably is.
A few examples that usually fall inside the definition:
- Generative assistants. Tools that draft text, code, or images from a prompt.
- Scoring and ranking models. Systems that rate candidates, applications, or transactions.
- Detection and classification systems. Fraud detection, anomaly detection, and content moderation.
- Recommendation engines. Systems that infer what to show, offer, or prioritize for a given person.
Five Questions That Decide Your Obligations
Working through these in order gives you a clear picture within an afternoon. You do not need a lawyer for the first pass — you need an honest inventory.
1. Are we using anything that infers?
Start with what is actually running, not what is on the approved software list. That includes AI features quietly added to tools you already pay for, and anything staff signed up for on a company card.
2. What role do we hold for each system?
The same company can be a deployer of one system and a provider of another. Rebranding a third-party tool under your own name, or modifying one substantially, can move you from deployer to provider — with materially heavier duties.
3. Is any of it high risk?
High risk is defined by use case, not by how sophisticated the model is. Annex III covers areas including biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and the administration of justice. A simple model used to screen job applicants can be high risk; a complex model used for internal demand forecasting usually is not.
4. Does anything interact with people or generate content?
If you run a customer-facing chatbot, or publish AI-generated or AI-altered images, audio, video, or text, Article 50 transparency obligations apply to you now. These duties are independent of the high-risk classification.
5. Are we ready to show our work?
Almost every obligation in the Act resolves into evidence: an inventory, a risk assessment, logs, instructions for use, a record of human oversight. A structured risk assessment is the usual starting point, and it also feeds the policy work that follows.
When Do the Rules Actually Apply?
The Act is in force and is being applied in phases. The phasing changed in 2026: the AI Omnibus was proposed on 19 November 2025, reached political agreement on 7 May 2026, and entered into force on 27 July 2026, extending the high-risk deadlines to give standards and support tools time to land.
| 1 August 2024 | The AI Act enters into force. No requirements apply yet. |
| 2 February 2025 | Prohibited practices and AI literacy duties start to apply. |
| 2 August 2025 | Rules on GPAI models, governance, notified bodies, and penalties start to apply. |
| 2 August 2026 | The remainder of the Act applies, except high-risk classification rules. Article 50 transparency obligations apply and enforcement begins. |
| December 2026 | New prohibition on AI systems generating non-consensual intimate imagery or CSAM takes effect. |
| 2 December 2027 | Annex III high-risk rules apply — biometrics, critical infrastructure, education, employment, migration, and border control. |
| 2 August 2028 | High-risk rules apply to AI embedded in regulated products such as lifts, toys, and machinery. |
Two practical readings of that table. First, if you thought high-risk obligations landed in August 2026, they did not — you have until December 2027, and that is a runway, not a reprieve. Second, transparency duties and AI literacy duties are live today, and they apply regardless of risk tier.
Does the EU AI Act Apply to Companies Outside the EU?
Yes. The AI Act applies to providers established outside the EU when they place an AI system on the EU market or put one into service there. It also applies to providers and deployers in third countries when the output produced by the system is used in the EU.
That means a US software company with EU customers is in scope, as is a UK consultancy running an AI screening tool on candidates based in Germany. Non-EU providers of high-risk systems also need an authorized representative established in the EU.
For groups operating across several markets, the practical answer is usually to apply one standard everywhere rather than maintain two regimes. It costs less than it looks, and it removes an entire category of internal argument.
Do Small Businesses Have to Comply With the EU AI Act?
Yes. There is no blanket exemption for small businesses, but the Act does treat them proportionately.
Here’s how that proportionality actually works:
- Fines are capped differently. For SMEs and startups, the fine is the lower of the fixed amount or the percentage of turnover, rather than the higher.
- Documentation is simplified. Simplified technical documentation arrangements apply to SMEs, and the AI Omnibus extended these to small mid-cap companies.
- Sandboxes are open. Member States must run at least one AI regulatory sandbox, and the Omnibus widened access, including at EU level.
- The obligations themselves still stand. Proportionate does not mean optional. A five-person company running a hiring model has the same substantive duty as a five-thousand-person one.
Penalties are set out in Article 99 and are worth knowing before you scope any of this. Breaching the prohibitions carries fines of up to €35 million or 7% of worldwide annual turnover. Breaching provider, deployer, or Article 50 transparency obligations carries up to €15 million or 3%. Supplying incorrect or misleading information to authorities carries up to €7.5 million or 1%.
What Does My Company Actually Have to Do?
Every organization in scope does the same ten things first, whatever its classification turns out to be. What changes afterwards is how far each one has to go.
This is the part most guidance skips. Knowing that the Act applies to you is not the same as knowing what lands on someone’s desk on Monday.
Let’s start with the baseline that applies to every company:
| Action | AI Act reference | Who usually owns it | Typical effort |
| Build a complete AI inventory. Every system that infers, including AI features inside tools you already license. | Art. 3(1) | IT and security, with department heads | 2–5 days |
| Classify each system. Prohibited, high risk, transparency-triggering, general purpose, or none of these. | Art. 5, 6, 50, 51 | Compliance, with technical input | 2–4 days |
| Define your role for each system. Provider, deployer, importer, or distributor. | Art. 2, 3, 25 | Legal and compliance | 1–3 days |
| Check for prohibited practices. Nine practices are banned outright and have been since February 2025. | Art. 5 | Compliance | 1–2 days |
| Establish AI governance. Named accountability, a decision route for new tools, and a place the inventory lives. | Art. 4, 17 | Executive sponsor | 3–5 days |
| Write an AI use and approval policy. Approved tools, data rules, review obligations, disclosure expectations. | Art. 4, 16, 17, 26 | Compliance with HR and IT | 3–8 days |
| Deliver AI literacy training. Proportionate to role and context, with a record that it happened. | Art. 4 | HR and security awareness | 2–5 days plus rollout |
| Set up vendor and value chain governance. Documentation access, change notification, incident cooperation. | Art. 22–25 | Procurement and third-party risk | 3–8 days |
| Run a transparency check. Chatbots, AI-generated content, deepfakes, emotion recognition. | Art. 50 | Marketing, product, and web | 1–3 days |
| Define the incident and monitoring route. Who notices, who decides, who reports, and to whom. | Art. 72, 73 | Security operations | 2–5 days |
Ten actions, and none of them require an AI specialist. They require someone with authority to ask every department what they are running and get an honest answer.
What Changes Depending on Your Classification?
After the baseline, obligations diverge sharply. A narrow-scope AI system carries almost nothing further. A high-risk system carries the full weight of Chapter III.
Here’s how the three situations compare, article by article:
| Obligation | AI system, narrow scope (Art. 3(1)) | GPAI model provider (Ch. V) | High-risk system (Annex I or III) |
| Inventory and classification | Required | Required | Required |
| Role definition (Art. 2, 25) | Required | Required | Required |
| Prohibited practice check (Art. 5) | Required | Required | Required |
| AI literacy (Art. 4) | Required | Required | Required |
| Transparency to people (Art. 50) | Where it interacts or generates content | Where it generates content | Required where applicable |
| Risk management system (Art. 9) | Not required | Not required | Required |
| Data governance and bias (Art. 10) | Not required | Training data summary instead | Required |
| Technical documentation (Art. 11, Annex IV) | Not required | Model documentation under Art. 53 | Required |
| Logging and record keeping (Art. 12, 19, 26) | Not required | Not required | Required, six months minimum |
| Human oversight by design (Art. 14) | Not required | Not required | Required |
| Accuracy, robustness, cybersecurity (Art. 15) | Not required | Systemic-risk models under Art. 55 | Required |
| Quality management system (Art. 17) | Not required | Not required | Required for providers |
| Conformity assessment and CE marking (Art. 43, 48) | Not required | Not required | Required for providers |
| EU database registration (Art. 49) | Not required | Not required | Required for providers |
| Post-market monitoring (Art. 72) | Not required | Not required | Required for providers |
| Serious incident reporting (Art. 73) | Not required | Not required | Required |
| Copyright and training data policy (Art. 53) | Not required | Required | Not applicable |
| Applies from | In application now | 2 August 2025 | 2 December 2027 (Annex III), 2 August 2028 (Annex I) |
Read that table once and the shape of the problem becomes clear. Most organizations sit entirely in the first column, owe the baseline and nothing more, and have been quietly budgeting for the third.
How Much Does EU AI Act Compliance Cost?
The honest answer is that the baseline is small and the high-risk work is not. Three things drive the number: how many AI systems you actually run, whether any of them are high risk, and how much management system you already have.
Here’s what typically moves the cost:
- Number of systems in the inventory. Discovery scales with the estate, and shadow AI adds systems nobody budgeted for.
- Classification outcome. A single Annex III system changes the project from a policy exercise into an engineering and documentation program.
- Existing certification. An organization with a working ISO 27001 management system reuses a substantial share of the effort.
- Role. Provider obligations cost several times what deployer obligations cost, for the same system.
- Internal capacity. Most of the baseline is work your own team can do, given a structure to follow.
If you want a figure rather than a range, the fastest route is a scoping conversation against your actual inventory. We would rather quote against what you run than against a hypothetical.
Frequently Asked Questions
Does the EU AI Act apply to my company?
The EU AI Act applies to your company if you place an AI system on the EU market, put one into service in the EU, or use one in a professional capacity within the EU. It also applies when your system sits outside the EU but its output is used inside it. Most organizations in scope are deployers, meaning they use AI tools built by someone else rather than building their own.
Is the EU AI Act in force yet?
Yes. The AI Act entered into force on 1 August 2024 and applies in phases. Prohibited practices and AI literacy duties have applied since 2 February 2025, general-purpose AI rules since 2 August 2025, and the remainder of the Act since 2 August 2026, when the AI Office and national authorities began enforcement.
Do small businesses have to comply with the EU AI Act?
Yes. There is no blanket exemption for small businesses. SMEs and startups benefit from lower fine caps, simplified technical documentation, and access to regulatory sandboxes, but the substantive obligations still apply. A small company running a high-risk AI use case has the same duty as a large one.
Does the EU AI Act apply to companies outside the EU?
Yes. The Act applies to providers established outside the EU that place AI systems on the EU market or put them into service there, and to providers and deployers in third countries when the output of the system is used in the EU. Non-EU providers of high-risk systems must also appoint an authorized representative established in the EU.
When do the high-risk AI rules start to apply?
Rules for Annex III high-risk systems apply from 2 December 2027, and rules for AI embedded in regulated products such as lifts, toys, and machinery apply from 2 August 2028. These dates were extended by the AI Omnibus, which entered into force on 27 July 2026.
What does my company actually have to do to comply with the EU AI Act?
Every organization in scope starts with the same ten actions: build a complete AI inventory, classify each system, define your role for each one, check for prohibited practices, establish AI governance, write an AI use and approval policy, deliver AI literacy training, set up vendor governance, run a transparency check, and define an incident and monitoring route. Obligations then diverge sharply depending on whether a system is narrow scope, a general-purpose AI model, or high risk.
Strengthen Your AI Governance With CyberGlobal
Working out whether the AI Act applies to you is the easy part. Building the inventory, the risk assessment, and the evidence trail that proves it, while the business keeps shipping, is where most teams stall.
But with the right partner by your side, this becomes a project with a scope and an end date rather than an open-ended worry.
At CyberGlobal, we’ve built our GRC and compliance practice around exactly this kind of work: mapping what you run, finding the gaps honestly, and helping your team close them. Our compliance audit and risk assessment services give you a defensible starting point rather than a generic checklist.
We’ll also tell you plainly when something does not apply to you. Scope you do not need is the most expensive thing in compliance.
But behind our advanced technology, there are real people — local teams who know your market and stay with the project after the first report lands.
Reach out to CyberGlobal and let us be your ally against today and tomorrow’s cybersecurity challenges.