People worldwide are rushing to comply with the EU AI Act and are working hard to implement the required controls. But the big question is, must I comply with the EU AI Act? Who does the AI Act apply to? What is the territorial scope of the AI Act?

Technology transcends borders. Its borderless nature challenges traditional jurisdiction and it can be difficult to know which law applies to who, what, and where. AI systems have numerous role players and each one could be located on a different continent. So then, who needs to comply with the EU AI Act? What if they are not even established in the European Union?

We know you’re busy but this is important. You need to know whether you have to comply or not. If not, you can afford to procrastinate. If you must comply, you need to start taking action now.

Must I comply with the EU AI Act?

Before we can answer this question, you have to ask yourself a few questions. If you answer yes to any of the following questions, you have to comply with the EU AI Act.

  1. Do we provide AI systems on the market or put AI systems into service in the European Union?
  2. Are we located within the European Union and a user of AI systems?
  3. Is the output our AI system produces used in the European Union?

If you answered yes, then you fall within the EU AI Act’s catchment area. Take steps to comply by finding out how Michalsons can help you. The risks are significant and there are deadlines to comply. Unfortunately, answering these questions can be harder than it appears and you may need more information.

The EU AI Act does not apply to you if you use an AI system in the course of a personal non-professional activity.

1. Are we a provider of AI systems?

You are a ‘provider‘ of an AI system if you are a natural or legal person, public authority, agency or other body that develops an AI system or that has an AI system developed with a view to placing it on the market or putting it into service under your own name or trademark, whether for payment or free of charge. The Act defines:

  • ‘placing on the market’ as the first making available of an AI system on the European Union market; and
  • ‘putting into service’ as the supply of an AI system for first use directly to the user or for own use on the European Union market for its intended purpose.

For example, OpenAI is a clear-cut instance of an AI provider. By developing ChatGPT and making it available to the public, they are directly involved in both creating and placing the AI system on the market. As an AI provider, OpenAI must comply with the EU AI Act.

2. Are we a user of AI systems?

You are a ‘user’ of an AI system if you are a natural or legal person, public authority, agency or other body using an AI system under your authority. The Act establishes that any entity located in the European Union and a user of AI systems must comply with the requirements set out in the EU AI Act. For example, if your organisation is registered in the EU and uses Microsoft Copilot, you must comply with the Act.

3. Is the output our AI system produces used in the EU?

The Act does not define “output” but refers to it within the definition of AI systems. The Act defines ‘artificial intelligence system’ (AI system) as software that… can… generate outputs such as content, predictions, recommendations, or decisions influencing the environments they interact with.

Imagine a Chinese company that develops an AI system for predicting global stock market trends. This system generates daily forecasts that investors worldwide, including many in the European Union, use extensively. Even though the company itself is not located in and its AI system is not used in the European Union, its AI system’s outputs are used and used to significantly influence financial decisions made within the European Union. In this example, the Chinese company would need to comply with the EU AI Act.

Actions to take