Does the EU AI Act Apply to Your US Software Product?

What you can decide after checking the facts

A better-informed decision starts with what is known, what still needs checking, and who will take the next step. The following are practical objectives to consider for this particular issue:

• Map supply and use in EU.
• Identify provider/deployer roles.
• Classify prohibited or high-risk uses.
• Build a date-specific obligation checklist.

Why the evidence matters

US-TechLaw is an independent technology-law research and consulting platform. This page uses the applicable official rules and product-provider documentation as reference points, rather than relying on broad claims about what every AI system or business must do. Where company-specific contracts or settings would change the conclusion, they are identified as facts to verify instead of assumed. The research is informational and does not replace qualified advice for a particular situation.

How to raise your specific question

Describe the decision or problem in a few sentences, identify the product or system involved, and state what result you need to understand. Do not send privileged documents, complete customer files, credentials, or sensitive operational records in an initial email. The scope, appropriate expertise, and any secure exchange of additional documents should be determined separately before detailed review.

Questions worth preparing:

• Where are users, customers, and outputs located?
• Is the company a provider, importer, distributor, or deployer?

Questions, documents and safeguards to review

Can EU AI rules apply to a company based in the United States?

A software company does not avoid the EU AI Act simply by being incorporated in the United States. The law can reach providers and deployers connected to the EU market and, in some circumstances, the use of AI outputs in the Union. The starting point is not the company's address but the product's supply chain, user location, use case, and intended deployment. Identify whether the business develops an AI system, integrates a general-purpose model, distributes software, or uses a system internally. The obligations may differ materially across these roles. (EU AI Act regulatory framework (European Commission))

Who counts as a provider or deployer?

Map how the product reaches EU users. Is it actively offered to EU customers, deployed by an EU organization, or used to produce outputs for an EU business process? Does a distributor put the product into service or change its intended purpose? Keep contracts and product materials that describe this chain. Avoid an oversimplified rule that any web page accessible from Europe automatically makes every product fully subject to the Act. The scope test depends on the statutory provisions, the actors involved, and the particular form of AI use. (EU AI Act regulatory framework (European Commission))

Is the AI offered or used in the European Union?

Role classification comes before the compliance checklist. A company training a general-purpose model may face a different set of duties from a SaaS provider integrating that model into a specific application. A customer deploying an AI system for employee selection may have responsibilities distinct from the supplier. Describe who sets the intended purpose, who changes the system, whose name appears on the product, and who controls the actual deployment. Contract labels can help document the arrangement but do not replace the legal role definitions. (EU AI Act regulatory framework (European Commission))

What if only the AI output reaches an EU user?

Not all AI systems fall in the same risk category. Assess whether the use case involves prohibited practices, transparency requirements, general-purpose AI duties, or the high-risk categories defined by the legislation. An AI writing assistant used by an editor is different from software that evaluates employment applications or affects an individual's access to essential services. Use the precise statutory annex and definitions rather than a popular online list. If the product performs several functions, classify each significant use rather than assigning a single label to the entire company. (EU AI Act regulatory framework (European Commission))

Does your use case fall into a higher-risk category?

The implementation dates changed following the 2026 amendments. The official EU AI Act Service Desk identifies current milestones for general provisions and prohibitions, general-purpose AI, transparency, and delayed application of major high-risk obligations. It states December 2, 2027 for relevant standalone high-risk systems and August 2, 2028 for specified high-risk systems embedded in regulated products. Those dates do not mean every other obligation is postponed. Date each obligation separately and check relevant transitional provisions before treating a company as subject to a new duty. (EU AI Act implementation timeline (European Commission))

Which obligations already apply?

A compliance file should connect the actual system to documented intended use, data and model providers, user instructions, oversight controls, testing, and post-deployment change processes. Which documents are required depends on the company's statutory role and classification. Avoid publishing a universal “EU-ready certificate” for US technology providers. Where a general-purpose model is supplied by another company, review what information the integrator receives and what remains its own responsibility. If national or sector rules apply alongside the Act, identify the separate source rather than merging them into one unsourced checklist.

Which dates apply to different types of AI systems?

Business communications can create misunderstandings if they claim the product is “EU compliant” without defining the system version and requirements assessed. Describe verified features and limitations instead of implying regulatory approval. The same applies to customers' contractual requests for documentation: determine which records exist, which can be shared, and what promises are supported. A risk register should identify dependencies on model providers, changes to intended use, and releases that require fresh review. Use an official source with a substantive date whenever stating a legal deadline. (EU AI Act implementation timeline (European Commission))

What documents should a US supplier prepare?

Start by drawing a map of product, roles, EU exposure, actual use cases, and effective dates. Then record where the company has evidence and where it relies on a supplier. A focused enquiry should provide the software's function, markets, business customers, model supplier, and whether outputs influence important decisions. From that information, a qualified reviewer can assess the next appropriate legal and operational questions. Neither the presence of an EU user nor the use of a popular AI model alone produces a complete compliance conclusion.

Example: how the decision changes with the facts

Illustrative scenario, not a client case or statement of actual results.

A US startup builds an AI résumé-screening feature used by an EU employer. The startup supplies software; the employer selects the job criteria and uses the results in hiring. The inquiry should identify whether the startup is a provider, whether the employer is a deployer, which high-risk category may apply, and the stage at which relevant provisions take effect. An unrelated writing assistant sold by the same startup may require a different classification. The company should not advertise blanket EU conformity based on its legal address or a single vendor certificate. A product-by-product record is more reliable.

Decision and evidence table

Documents and facts to prepare

For a reliable review, identify the specific system or agreement, the date and version of its relevant terms, the business decision being made, the people affected, and the records available to support the answer. The most helpful starting material for this topic is: US-to-EU AI Act scope flowchart and obligations-by-role/date matrix. A request for information should remain proportionate; sensitive records should be exchanged only through an appropriate authorized process.

Frequently asked questions

Does every US AI app need an EU high-risk assessment?

Check EU exposure, legal role, and use case; not every AI product fits a high-risk category.

Did all AI Act obligations move to 2027?

No. The current official timeline identifies several earlier duties and different later high-risk dates.

Does a model provider’s paperwork cover an app vendor?

Not automatically. Each organization must assess its own role and obligations.

What to check before acting

Before acting, write down the decision your team needs to make: Help us software companies check whether eu ai act rules apply to their product, users, or outputs. List the relevant documents and settings, the facts still missing, and the person who will confirm each point. Review the decision again if the agreement, software features, workflow, or governing requirements change. Seek qualified professional advice when the specific legal question or regulated activity requires it.

Related business and technology guides

• Explore AI Regulation
• Related research and practical support
• Does Colorado’s New AI Decision Law Apply to You?
• How Do You Control What Copilot Studio Agents Can Do?