Does the EU AI Act Apply Outside Europe?

The EU AI Act applies according to where the output of an AI system is used, not where the company sits. A business with no European office can fall inside it if what its system produces reaches people or decisions in the European Union.

Carlos Andrés Ramírez · 2026-10-14

The EU AI Act applies according to where the output of an AI system is used, not where the company sits. A business with no European office can fall inside it if what its system produces reaches people or decisions in the European Union.

Start with how the question usually arrives. An operations director in Bogotá, Lima or Mexico City reads that Europe passed an AI law, sees that the company has no headquarters or offices there, and files it away. That would be a sound conclusion if the law worked like a local tax. It does not.

The short answer is that Regulation (EU) 2024/1689 has extraterritorial reach. Article 2 applies it to providers placing AI systems on the European market, and also to providers and deployers located outside the Union when the output their systems produce is used in it. The test is where the output ends up, and the location of whoever runs the system takes second place. For a Latin American company with customers, subsidiaries or suppliers in Europe, that changes the starting point: the default is to look, not to rule it out.

The test

When does the AI Act apply to a company that does not operate in Europe?

You do not need a law firm on day one to decide this. You need an honest inventory of which AI systems the company uses and where their output goes. Three questions structure that inventory, and operations already holds the answers.

1. Does the system's output reach people in the European Union?

Think of a customer service assistant answering from Lima to users in Spain, or a model scoring credit applications from residents of Germany. If the answer or the decision is used in Europe, the system is on the radar even when the servers and the team are elsewhere.

2. What is the company's role: provider or deployer?

Whoever develops the system or sells it under their own name is a provider, and carries most of the obligations. Whoever buys it and uses it in their operation is a deployer, with narrower duties such as using it as instructed and monitoring how it behaves. Many companies are both without having thought about it: they buy a model and build it into a product they sell.

3. What is the system used for?

The Regulation scales obligations to the risk of the use. Selecting staff, assessing creditworthiness or deciding access to essential services is treated as high risk and demands more. An internal meeting summarizer demands far less. Two companies with the same model can carry very different loads because of what they do with it.

The mechanism

Exposure rarely comes from the headquarters, it comes from the chain of customers and suppliers

What matters here is how exposure creeps in without anyone deciding it. Imagine a recruitment services firm based in Colombia that uses a model to rank applications and has won a European subsidiary of a multinational group as a client. Nobody at the firm decided to enter the European market. But the model's output, the ranked list of candidates, feeds a hiring decision in the Union. That is exactly the kind of case the text of the Regulation is meant to cover, and it falls in a use it treats as high risk.

The same logic runs the other way. A company may only be a deployer of a model built by an outside provider, and assume the obligation sits with that provider. If the output is used in Europe, part of the responsibility stays with whoever uses it. Buying the system abroad does not move the obligation abroad.

The AI Act does not ask where your office is. It asks where what your system produces ends up.

BECOME

The decision

A full compliance program is only needed where the exposure is real

Answering yes does not mean building a compliance program for the whole company. It means knowing which specific systems are exposed and sizing the effort to match. A low-risk system whose output reaches Europe asks for little beyond transparency and sensible use. A high-risk one asks for documentation, human oversight and logging, and that is a project with an owner and a timeline.

The sensible order of work is this: first a short inventory of AI systems and where their output goes, then a classification by use, and only then the decision on how much to invest. Doing it the other way around, buying a generic program before knowing what exists, spends money on what is not needed and leaves uncovered what is. The entry-into-application dates are staggered, and the exact calendar is worth confirming with legal counsel against the text of the Regulation, because it varies by type of obligation.

Ask each function for a list of the AI systems it uses and who receives their output. Mark those that touch people or companies in the European Union and, among them, those involved in hiring, credit or access to services. That short list is what to take to legal counsel.

Let's review which AI systems in your operation have exposure in Europe