What the EU AI Act means for companies outside Europe

For a technology company based outside Europe, the first EU AI Act question is usually geographical. I would begin with the product instead. What is being supplied, where is it being used, and which entity is responsible for the relevant activity? A company’s registered office is part of that analysis, but it does not settle it. Effective readiness starts with a precise account of the system and the route through which it reaches the European market.

Establish the European connection

The European Commission explains that the Act can apply to public and private actors outside the EU that place relevant systems or models on the EU market or put systems into service in the EU. The statutory scope also addresses certain circumstances in which outputs produced outside the EU are used within it. The exact connection matters; the shorthand that every company with a European customer has identical obligations is unhelpful.

I would ask the commercial and product teams to describe the planned route to market before giving a scope conclusion. A direct enterprise licence, an integration into another supplier’s product and an internal deployment can raise different questions. The answer should be recorded with its assumptions, including relevant exclusions and facts that could change the assessment.

Identify the role before assigning the work

An organisation may develop an AI system, integrate a model, distribute a product or use a system supplied by someone else. Those activities need careful legal classification. Being a customer of a model provider does not make the organisation’s own responsibilities disappear. Equally, buying an AI-enabled product does not automatically transfer every obligation of its manufacturer to the purchaser.

The contract should follow the role analysis. I want to know who supplies documentation, communicates limitations, supports incident handling and provides information needed for oversight. If that information is necessary for the customer’s lawful use, a vague promise to cooperate may not be enough. The delivery process, escalation route and relevant change notifications should be worked through while the commercial relationship is being designed.

Classify the actual use

The Commission describes the Act as a risk-based framework. Certain practices are prohibited; certain uses attract high-risk requirements; other provisions address transparency and general-purpose AI. These categories should not become marketing labels. The task is to test the intended use and the relevant legal conditions, including whether a particular exception or qualification applies.

A product name is an unreliable guide. A system’s function in a recruitment process may matter more than whether the vendor calls it an assistant. I would document the intended purpose, affected people, operating environment and decisions influenced by the output. I would also identify restrictions on use. A boundary that exists only in the legal file is fragile if the product and sales materials invite customers to cross it.

Turn readiness into an evidence plan

Once the relevant duties are understood, the team can map them to work it controls. That may involve risk management, appropriate documentation, data governance, human oversight, transparency, logging or monitoring. The precise requirements depend on the role and system. A generic compliance checklist can conceal the most important gaps if it assumes that every product needs the same evidence.

I ask who can explain the system’s limitations and what happens when those limitations matter. Human oversight needs a person with usable information, sufficient authority and a process for intervention. A policy that tells staff to exercise judgment is weak support if the interface makes intervention impossible or the operating model rewards unquestioning acceptance.

Procurement deserves the same attention as development. A company cannot responsibly promise transparency or ongoing monitoring when its supplier contract leaves it unable to obtain necessary information. A readiness plan should distinguish obligations the organisation can meet itself from dependencies that must be resolved with another party.

Keep timing and adjacent law under review

The Act’s application is staged, and implementation guidance and amendments affect the practical timetable. I would verify the current official position for the particular provisions before setting milestones or making a statement to customers. This article deliberately avoids a universal compliance date: a headline date is an inadequate project plan for a framework with different duties and transition arrangements.

AI Act work also sits alongside privacy, consumer, employment, product and sector-specific law where applicable. Passing one assessment cannot establish compliance with all of them. For a Canadian or Gulf-based company, I treat European readiness as a coordinated workstream within the wider governance architecture, with locally licensed counsel involved where required. The useful outcome is a documented, reviewable position that the business can operate and explain.

General information only, not legal advice. Ruchi Bindra is a member of the Alberta Bar (Barrister & Solicitor) and first qualified as an Advocate in India. Advice on the laws of other jurisdictions, including the UAE and the United States, is provided in coordination with locally licensed counsel where required.