EU AI Act for Non-EU Companies: What You Must Do Before December 2027

Updated 7 Oct 2026: Digital Omnibus on AI (Regulation (EU) 2026/1744).

The EU AI Act applies to eu ai act non eu companies just as firmly as it applies to Dutch or German businesses. If you ship an AI-powered product to a user in Amsterdam, Paris, or Warsaw, you are inside the scope of this regulation. Location of incorporation does not create an exemption.

This matters for US SaaS platforms, UK software vendors, Swiss HR tech providers, and anyone else whose output reaches people on European soil. The rules are not limited to companies with a legal entity in the EU. They follow the AI system to wherever its effects land.

# What Article 2 Actually Says

Article 2 of the EU AI Act sets the territorial scope. The regulation applies to:

• Providers who place an AI system on the EU market or put it into service in the EU, regardless of where the provider is established.
• Deployers of AI systems who are located in the EU.
• Providers and deployers located outside the EU when the output of the AI system is used inside the EU.

That last bullet is the critical one. A US company whose AI model produces decisions affecting EU residents is a provider under the Act. A Swiss platform whose outputs are consumed by EU-based HR departments falls in scope. The physical location of your servers is irrelevant. What matters is where the effect lands.

There are limited carve-outs: AI systems used exclusively for military or national security purposes by non-EU countries, and research activities not yet placed on the market. Standard commercial SaaS products do not qualify for these exemptions.

# The Risk Class Determines Your Obligations

Not every obligation kicks in on day one. The AI Act is structured around four risk categories: unacceptable risk (banned outright), high risk, limited transparency risk, and minimal risk.

If your product falls into the high-risk category defined in Annex III, the compliance burden is substantial. High-risk use cases include AI used in recruitment and CV screening, creditworthiness assessment, biometric identification, education and vocational training, and critical infrastructure management.

For high-risk systems, non-EU providers must meet requirements that include:

• Conformity assessments before placing the system on the EU market
• Technical documentation proving the system meets accuracy, robustness, and cybersecurity standards
• Registration in the EU database for high-risk AI systems
• Post-market monitoring and incident reporting obligations

Limited-risk systems, such as chatbots, carry lighter obligations: primarily transparency requirements under Article 50, which require users to be informed they are interacting with an AI.

# Article 22: The Authorized Representative Requirement

This is where many non-EU companies get caught off guard. Article 22 requires that any provider established outside the EU who places a high-risk AI system on the EU market must appoint an authorized representative located in the EU before that system reaches European customers.

The authorized representative is not a formality. They carry real legal weight. Specifically:

• They must be designated in writing by the non-EU provider.
• They act as the single point of contact for EU market surveillance authorities.
• They verify that the conformity assessment has been completed and that the required technical documentation exists.
• They can be held jointly liable for non-compliant systems.

This is analogous to the GDPR's Article 27 representative requirement, which many US companies already handle through a European law firm or compliance service. The AI Act representative is a separate appointment and covers different obligations.

If you have a US-based SaaS platform used by 5,000 EU employees for performance appraisals or recruitment shortlisting, that system very likely qualifies as high-risk under Annex III. Without an authorized representative in place, you cannot legally place that system on the EU market once the high-risk provisions apply (from 2 December 2027 for Annex III systems).

# Key Dates Non-EU Companies Must Track

The AI Act entered into force on 1 August 2024. Obligations phase in over several years, on a timeline the Digital Omnibus on AI (in force since 27 July 2026) partly changed:

• 2 February 2025: Prohibited AI practices (Article 5) became enforceable. If any feature of your product involves social scoring of natural persons or real-time biometric surveillance in public spaces, this has already applied. AI literacy requirements under Article 4 have applied to providers and deployers since the same date.
• 2 August 2025: Obligations for General-Purpose AI (GPAI) model providers took effect.
• 2 August 2026: The Act applies in general, including the Article 50 transparency duties, and national market surveillance authorities supervise it.
• 2 December 2027: High-risk AI system obligations under Annex III apply, moved from 2 August 2026 by the Omnibus. This is the deadline for conformity assessments and authorized representatives for Annex III systems.
• 2 August 2028: High-risk obligations for AI in regulated products (Annex I) apply.

The December 2027 deadline feels distant. It is not. Conformity assessments, technical documentation, and governance processes take months to prepare properly. Companies that wait until 2027 to start risk missing the window.

# What US SaaS Platforms Need to Do Now

If your product is used by EU customers, here is the practical sequence:

Step 1: Classify your system. Map every AI feature against the Annex III categories. This is not a legal opinion exercise; it is a product and compliance team exercise that should take two to four weeks.

Step 2: Check for prohibited features. Article 5 bans are already active. Subliminal manipulation, social scoring, and certain biometric categorisation features are illegal now. From 2 December 2026, the Omnibus adds two more bans: AI that generates or manipulates realistic images, video or audio of an identifiable person's intimate parts or sexual activity without their explicit consent, and AI that generates child sexual abuse material.

Step 3: Appoint an authorized representative if required. If you have any Annex III use cases, you need a named entity in an EU member state. This should be a contracted service with clear accountability, not a loose arrangement with a local partner.

Step 4: Prepare technical documentation. Article 11 specifies what this documentation must contain, including system architecture, training data, performance metrics, and intended purpose. Start drafting now; it is not a short document.

Step 5: Build your conformity assessment process. Most Annex III systems can self-assess using internal procedures. Some categories, particularly biometric systems and certain critical infrastructure applications, require third-party notified bodies.

Step 6: Register in the EU AI database. Once operational, the EU database for high-risk AI will require providers to submit key information about their systems. This is a public-facing registry. Regulators and users will be able to look your product up.

# Penalties Are Designed to Reach You

The fines under the AI Act are structured as percentages of global annual turnover. For violations involving prohibited practices, the maximum is €35 million or 7% of global annual turnover, whichever is higher. For high-risk system non-compliance, it is €15 million or 3%. For incorrect or misleading information provided to authorities, €7.5 million or 1%.

These figures apply to global turnover. The cap is whichever figure is higher, except that SMEs (and, for the €15 million and €7.5 million tiers, small mid-cap enterprises) get the lower one. For a US company with $200 million in worldwide revenue outside those categories, 3% is about $6 million, so its exposure for high-risk non-compliance runs up to the €15 million cap, even if its EU revenue is modest. The enforcement mechanisms are built to ensure that extra-territorial application has real teeth. EU market surveillance authorities can coordinate with each other and can effectively block non-compliant products from the EU market.

# The Interaction With GDPR

Many non-EU companies already have GDPR compliance programmes in place. The AI Act works alongside GDPR, not instead of it. AI systems that process personal data must comply with both frameworks simultaneously. Where AI systems are used in high-risk contexts and involve personal data, a Data Protection Impact Assessment (DPIA) under GDPR and a Fundamental Rights Impact Assessment (FRIA) under the AI Act will often need to run in parallel.

The European Commission's guidance on AI and data protection confirms that the two frameworks are complementary and that supervisory authorities are expected to coordinate enforcement.

If you already have an Article 27 GDPR representative in the EU, that person or entity cannot automatically serve as your Article 22 AI Act representative. These are separate legal appointments covering separate obligations.

# One Action to Take This Week

Pull a list of every AI feature in your product that touches EU users. Mark each one against the Annex III category list. If anything appears on that list, schedule an authorized representative review before the end of the quarter. That single step keeps you on the right side of the 2 December 2027 deadline for Annex III systems.

Not sure where your product sits on the risk spectrum? Run your AI system through the free 2-minute compliance check at comply.khairos.ai and get a clear starting point.