EU AI Act for Non-EU Companies — Complete Compliance Guide

The EU Artificial Intelligence Act (EU AI Act), entering phased enforcement through 2026-2027, is the world’s first comprehensive AI regulation. For non-EU companies developing or deploying AI systems that affect EU individuals, this law applies alongside GDPR — creating a dual compliance framework with significant penalties.

Does the AI Act Apply to Non-EU Companies?

Yes. Like GDPR, the AI Act has extraterritorial scope. It applies to providers and deployers of AI systems established outside the EU if the output of the system is used in the EU. This means: if you train an AI model outside the EU and the model’s output is used by EU users, the AI Act applies to you.

Phased Implementation Timeline

• February 2025: Prohibited AI practices banned (social scoring, real-time biometric surveillance in public, manipulative AI)
• August 2026: High-risk AI system rules apply (key deadline for most businesses) — including conformity assessment, risk management, transparency, and human oversight
• August 2027: GPAI (general-purpose AI) model rules apply
• 2025 Digital Omnibus proposal: Pending formal adoption, may postpone high-risk deadline by 12-18 months

AI Act and GDPR — How They Overlap

The AI Act and GDPR intersect critically:

• Personal data in training data: If your AI model was trained on EU personal data, GDPR applies to the training process
• Automated decision-making: GDPR Article 22 regulates solely automated decisions with legal/significant effects; the AI Act adds risk management and transparency requirements
• Data protection impact assessment (DPIA): Required under GDPR for high-risk processing; the AI Act adds fundamental rights impact assessment
• Biometric data: Both regulations impose strict rules on biometric data processing

Practical Compliance

1. Classify your AI system — determine if it’s prohibited, high-risk, limited risk, or minimal risk under the AI Act
2. Appoint an EU Representative if you don’t have one — both GDPR (Article 27) and the AI Act (Article 43) require it
3. Conduct impact assessments — plan DPIAs for GDPR and fundamental rights impact assessments for the AI Act
4. Document training data — maintain records of data sources, preprocessing, and governance measures

Get your EU Rep from EUR 490/year →