Does the AI Act apply to a tool from outside the EU?
A non-EU provider does not, by itself, exempt you from the AI Act. Check where you use the system, your role and which rules apply to the particular use.
Why does origin not settle your duties?
Article 2 covers deployers established or located in the Union. A business in an EU member state can be a deployer of someone else’s tool regardless of the provider’s country. There is no general exemption merely because the tool is American or from another third country.
That does not give every AI use identical duties. Check scope, exclusions, intended purpose, role and applicable dates. Article 26 concerns deployers of high-risk systems, not every writing tool.
When is the non-EU provider also in scope?
Article 2 covers providers placing AI systems on the Union market or putting them into service in the Union, or placing general-purpose models on that market, regardless of where they are established.
It also covers providers and deployers in a third country where the system’s output is used in the Union. Check the actual use and the provision’s conditions. That is not a claim that every output accessible on the internet automatically falls within scope.
For example, a recruitment tool offered to EU employers may need a high-risk classification check. Classification follows intended purpose and the legal conditions, not just an “HR” label or hosting location.
What remains your responsibility?
Provider and deployer duties are separate. A provider’s failure does not cancel your applicable duties. For high-risk use, check instructions, human oversight, monitoring, logs and the Article 26 rules on risks and incidents.
Record the data you send, who receives it and what you have in writing from the provider. A European address or a foreign brand does not prove compliance. Personal data and possible transfers outside the EU need separate assessment; the AI Act does not resolve them for you.
What should you check before use?
A practical review can start with three steps:
- Describe the system, provider and where output is used. Distinguish the model from the tool integrating it.
- Record intended purpose, your role and the basis for assessing risk. Check dates and exclusions before treating a particular duty as applicable.
- Obtain instructions and contractual answers on data, changes and incidents. Discuss necessary notifications with a lawyer for the particular use rather than assume one clause fits every tool.
This organises questions and evidence. The list itself does not establish legal applicability, supplier compliance or the safety of a particular use.
Questions
If we use ChatGPT, does its non-EU origin exclude the AI Act?
No. Check your role and use as an organisation in the EU. The product name does not settle which duties apply; it does not replace reviewing the terms and the particular system.
Does every non-EU provider need a representative here?
Do not treat this as a universal rule for every AI product. Article 22 requires a Union representative for third-country providers before making high-risk systems available on the EU market. Other model categories and exceptions need separate checking.
Does free access change the answer?
Price alone does not determine role or duties. A free subscription is not necessarily a system released under a free and open-source licence. Such systems have specific rules and exceptions to check separately.
Sources
Related reading
Next step
Connect the tool’s origin to its particular use.
EU AI Act Readiness records tools, their origin and applicable duties for your role with sources and dates. Unresolved contractual and legal questions are identified for review.
or write to contact@ergostrat.com