The EU Artificial Intelligence Act (AI Act) is not limited to companies located within the European Union. Under the destination principle, the regulation also applies to companies established outside the EU if their AI systems or outputs affect the EU market or users. This broad extraterritorial scope is designed to ensure fair competition and consumer protection, regardless of where a company is based.

Who Is Subject to the AI Act?

According to Articles 2(1), 22(1), and 54(1) and Recitals 21, 22, and 82, the AI Act applies to:

• Providers established outside the EU that place AI systems or general-purpose AI (GPAI) models on the EU market;

• Providers and deployers located in non-EU countries whose AI systems produce outputs that are used in the EU, even if the system itself is not physically present in the EU.

The regulation ensures a level playing field and prevents companies from evading legal responsibilities by outsourcing development or deployment outside the EU.

Requirement to Appoint a Legal Representative

Under Article 54(1) and Recital 82, non-EU providers must appoint a legal representative based in the EU. This representative:

• Acts as a point of contact for authorities;

• Maintains access to technical documentation;

• Is responsible for ensuring regulatory compliance;

• Must be formally authorized before the AI system is placed on the EU market.

Without such a representative, placing AI systems in the EU market is not legally permissible.

What Should Non-EU Companies Do?

If your company is based outside the EU but your AI system reaches EU users or markets, you should:

• Classify your AI system by risk level (e.g., prohibited, high-risk, or GPAI);

• Prepare technical documentation in accordance with Annex IV;

• Conduct conformity assessments, if required;

• Implement transparency, oversight, and accountability mechanisms;

• Appoint a legal representative within the EU.

Penalties for Non-Compliance

Violations of the AI Act can result in fines of up to €35 million or 7% of global annual turnover, depending on the nature and severity of the breach.