Which AI laws apply to your company?

Which AI laws apply to your company depends not only on where it is registered, but also on where its customers are and where the output of its AI systems is used. A company based outside the EU can fall under EU rules, and a company in the EU can be caught by the rules of the other markets it sells into.

Hypothetical example: a software company with no office in Europe sells a customer-support chatbot to online shops in Portugal and Germany. Because the chatbot is offered on the EU market and its answers reach customers in the EU, the EU AI Act can still apply to it.

Why your address is not enough

AI rules tend to follow the market and the people affected. Three things decide the answer: where you offer an AI system, where you use it, and where its output ends up.

How the EU AI Act sets its scope

Legal requirement (EU AI Act, Art. 2). The AI Act applies to:

• providers that place AI systems on the EU market or put them into service in the EU, wherever the provider is established;
• deployers of AI systems that are established or located in the EU;
• providers and deployers established outside the EU, where the output produced by the AI system is used in the EU.

A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark, including for its own use. A deployer uses an AI system under its authority in a professional capacity (Art. 3). Whether you are a provider or a deployer is the next question after scope.

Being in scope does not mean every obligation applies. Obligations depend on your role and the system’s risk level, and apply on different dates: the prohibitions and AI literacy since 2 February 2025, general application since 2 August 2026, and the high-risk requirements later. The overview of what the EU AI Act requires sets out the timeline, and the Commission keeps a plain-language summary of the AI Act.

GDPR is a separate layer

Legal requirement (GDPR, Art. 3). The GDPR already applies and has its own scope, whether or not the AI Act applies. Under Art. 3 it covers processing of personal data by organisations established in the EU, and by organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there (EDPB guidance). Handling personal data alone does not bring every organisation under the GDPR. Where it applies, a system with no specific AI Act obligations can still require a data protection impact assessment (Art. 35) or safeguards for automated decisions (Art. 22).

Employment, consumer, product liability and sector rules can add more layers; see which other laws apply to your use of AI.

Outside the EU

Other jurisdictions differ: some have broad AI laws, some regulate specific sectors or uses, and others rely on existing data protection and consumer law plus voluntary guidance. Check each market rather than assuming EU rules cover everything.

Three questions to work out which AI laws apply

Recommendation. Answer these for each AI use case, not once for the whole company:

1. Where are the people who use the system or are affected by its output? List the countries of your customers, users and staff. If any of them are in the EU, the AI Act and the GDPR may be relevant.
2. Do you build the AI, sell it under your name, or use it in your work? Building a system, even for internal use only, or selling it under your name points towards the provider role; using one under your authority, towards the deployer role.
3. What data does the system use, and what does it decide? Personal data brings in the GDPR where its territorial scope (Art. 3, above) is met. Decisions about people, such as hiring or access to credit, can bring in the high-risk rules and GDPR Art. 22.

Next step: for each entry in your AI inventory, list the markets where the use case operates: where it is sold, where it is used and where its output reaches people.

Sources and further reading

• Regulation (EU) 2024/1689 (AI Act) — Articles 2 and 3
• Regulation (EU) 2016/679 (GDPR) — Articles 3, 22 and 35
• EDPB Guidelines 3/2018 on the territorial scope of the GDPR
• EU AI Act Service Desk — Article 3
• European Commission — AI Act overview

This article is for general information and is not legal advice.