EU AI Act: Does It Apply to Your U.S. Business?

Update History

Sept. 15, 2026: Corrected the high-risk compliance deadline. The Digital Omnibus on AI was formally adopted (Regulation (EU) 2026/1744, in force July 27, 2026) and defers standalone high-risk system obligations from Aug. 2, 2026, to Dec. 2, 2027, and embedded high-risk systems to Aug. 2, 2028. Updated the Implementation Timeline, Executive Summary, Digital Omnibus section, and FAQ accordingly. Note that Article 50 transparency obligations, the disclosure and labeling rules most generative AI tools fall under, took effect on schedule Aug. 2, 2026 and were not delayed.

The European Union's Artificial Intelligence Act represents the first large-scale attempt to regulate AI across an entire economic bloc. For businesses serving European customers or working with EU partners, compliance is now part of doing business.

The Act applies beyond EU borders. If your AI system is used in the EU, the requirements apply.

Understanding the EU AI Act

The Act entered into force on Aug. 1, 2024, with requirements rolling out over several years. It creates a unified framework across all EU member states, replacing what could have been a patchwork of national laws.

At its core is a risk-based model. Systems are categorized based on their potential impact, and requirements scale with that risk.

Risk Categories

Unacceptable Risk

Some uses are banned outright. These include manipulation techniques, social scoring, biometric categorization tied to sensitive attributes, and certain forms of real-time identification.

Those prohibitions took effect in early 2025 and are already enforceable. The Digital Omnibus on AI added two more prohibited categories in this tier: AI systems that generate non-consensual intimate imagery and AI-generated child sexual abuse material. Both carry a grace period for associated technical safeguards running through Dec. 2, 2026.

High-Risk Systems

High-risk systems face the most requirements. This includes AI used in hiring, credit decisions, healthcare, law enforcement, and critical infrastructure. Compliance for standalone high-risk systems (Annex III) is now due Dec. 2, 2027, and for high-risk AI embedded in products already covered by EU product-safety law (Annex I), Aug. 2, 2028, following the Digital Omnibus deferral.

Limited Risk

Most generative AI tools fall into this category. The main requirement is transparency under Article 50, including disclosing when users interact with AI and labeling synthetic content. These obligations took effect on schedule Aug. 2, 2026, and were not part of the Digital Omnibus deferral, though the sub-obligation covering systems already on the market before that date was extended to Dec. 2, 2026.

Minimal Risk

Lower-risk uses, like spam filters or basic automation, have minimal additional obligations beyond existing laws.

Implementation Timeline

Aug. 1, 2024: The Act entered into force.

Feb. 2, 2025: Prohibited uses became illegal.

Aug. 2, 2025: Rules for general-purpose AI models took effect.

Nov. 19, 2025: European Commission proposes the Digital Omnibus on AI, aimed at deferring the high-risk compliance timeline.

May 7, 2026: The European Parliament and Council of the EU reach provisional political agreement on the Digital Omnibus.

June 29, 2026: The Council gives final approval, following the Parliament's June 16 vote.

July 27, 2026: The Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force.

Aug. 2, 2026: Article 50 transparency obligations take effect on schedule for new systems.

Dec. 2, 2026: Article 50 transparency obligations extend to legacy systems already on the market; new prohibited-use categories (non-consensual intimate imagery, AI-generated CSAM) become fully enforceable.

Dec. 2, 2027: Compliance deadline for standalone high-risk systems (Annex III), deferred from the original Aug. 2, 2026 date.

Aug. 2, 2028: Compliance deadline for high-risk AI embedded in already-regulated products (Annex I), deferred from Aug. 2, 2027.

The deferral changes when the heaviest obligations bite, but the underlying work of finding every AI system in your business and classifying it against the Act's risk tiers doesn't get easier by waiting.

General-Purpose AI Models

The Act includes specific requirements for general-purpose models. These systems must be documented, their training data summarized, and downstream use supported with appropriate information.

Models with broader impact face added obligations, including risk assessments and incident reporting. These provisions have applied since August 2025 and were not affected by the Digital Omnibus.

Penalties for Noncompliance

Prohibited use violations: Up to EUR 35 million or 7% of global revenue

High-risk violations: Up to EUR 15 million or 3%

Providing incorrect information: Up to EUR 7.5 million or 1%

For smaller companies, penalties may be reduced but still significant. The new prohibited-use categories the Digital Omnibus added, non-consensual intimate imagery and AI-generated CSAM, fall under the steepest penalty tier alongside the Act's original prohibited practices.

The Digital Omnibus on AI: Now Law, Not a Proposal

The Digital Omnibus on AI is no longer a proposal. The European Commission published it Nov. 19, 2025, as part of a broader package simplifying the AI Act, GDPR, and related digital rules. After a first round of trilogue negotiations broke down on April 28, 2026, the European Parliament, Council of the EU, and Commission reached a provisional political agreement on May 7, 2026. The Parliament approved it 423-57 on June 16, 2026, and the Council gave final approval June 29, 2026. It was published in the Official Journal on July 24, 2026, as Regulation (EU) 2026/1744, and entered into force on July 27, 2026, just six days before the original high-risk deadline.

The headline change is the deferral described above: standalone high-risk systems now have until Dec. 2, 2027, and embedded high-risk systems until Aug. 2, 2028. But the deferral is not a blanket delay. Article 50 transparency duties, the disclosure and labeling requirements most generative AI deployments fall under, took effect on schedule Aug. 2, 2026, and general-purpose AI model obligations that have applied since August 2025 are untouched. The Omnibus also added new prohibited-use categories rather than removing any existing requirement.

One practical detail worth knowing: systems already placed on the market before the new deadlines may be able to avoid full high-risk obligations until they're substantially modified. What counts as a "substantial modification" that resets that clock is worth mapping against your own AI deployments now, before you assume a system is grandfathered in.

Practical Steps

Start by identifying where AI is already in use across your business.

Map those uses to risk categories so you understand what requirements apply, and which deadline governs each one now that high-risk timelines have shifted.

Put governance in place that defines what data can be used and how AI tools are accessed.

Document systems, usage, and controls so you have a defensible position.

Treat the extended high-risk deadline as extra runway, not a reason to slow down. The hardest part of AI Act compliance, finding every AI system in the business and correctly classifying it, doesn't get easier with more time, and roughly 18 months is less than it sounds once product and engineering are involved.

Monitor guidance from EU regulators and adjust as requirements evolve.

U.S. vs EU Approach

The EU uses a unified, risk-based framework across member states. The U.S. approach is still fragmented across state laws.

Meeting EU requirements often puts a business in a stronger position for U.S. compliance, but it doesn't remove the need to monitor state-level rules.

For more detail, see our State AI Laws Guide and Federal AI Policy breakdown.

Frequently Asked Questions (FAQs)

Does the EU AI Act apply to U.S. companies?

Yes. If your AI systems are used in the EU or affect EU users, the Act can apply regardless of where your business is based.

When do companies need to comply?

It depends on the requirement. Transparency obligations for most generative AI tools took effect on schedule Aug. 2, 2026. The deadline for standalone high-risk systems was deferred by the Digital Omnibus on AI from Aug. 2, 2026, to Dec. 2, 2027. High-risk systems embedded in already-regulated products have until Aug. 2, 2028. Prohibited uses have been banned since February 2025, and two new prohibited categories added by the Digital Omnibus become fully enforceable Dec. 2, 2026.

Are most AI tools high-risk?

No. Most tools fall into the limited-risk category. Risk depends on how the system is used.

What's the biggest challenge for businesses?

Visibility. Many companies don't fully know where AI is being used or what data is being shared.

Can tools like ChatGPT or Microsoft Copilot fall under the EU AI Act?

Yes. The classification depends on how the tool is used. A standard chatbot may fall into a limited-risk category, but connecting it to sensitive data, internal systems, or decision-making processes can increase its risk classification under the Act.

What makes an AI system "high-risk" in practice?

An AI system becomes high-risk when it is used to influence decisions that affect people's rights, financial outcomes, employment, healthcare, or access to services. The same tool may be low risk in one use case and high risk in another depending on how it is deployed.

Does the EU AI Act apply if only part of our business touches the EU?

Yes. The Act can apply to a specific product, service, or workflow rather than your entire business. If any part of your AI system interacts with EU users or data, that portion of your environment may need to comply.

Are penalties actually being enforced yet?

Enforcement is active for the requirements already in effect. Prohibited uses have been banned since February 2025, and Article 50 transparency obligations became enforceable Aug. 2, 2026. High-risk obligations, originally due to become fully enforceable in August 2026, were deferred by the Digital Omnibus on AI to Dec. 2, 2027 for standalone systems and Aug. 2, 2028 for embedded systems. Expect enforcement activity tied to high-risk requirements to build toward those later dates instead.

How does the EU AI Act relate to cybersecurity programs?

The Act overlaps with cybersecurity in areas like logging, access control, data governance, and monitoring. Many of the required controls mirror practices already used in security frameworks such as SIEM monitoring, identity management, and risk management programs.

What is the most common mistake businesses make with AI compliance?

Most businesses assume AI adoption is a future decision. In reality, AI is already in use across employee workflows and SaaS platforms. The biggest gap is not lack of tools, but lack of visibility and governance. With the high-risk deadline now extended to Dec. 2, 2027, a second common mistake is treating the extra time as a reason to pause preparation rather than a longer runway to do it properly.