Often, yes. The EU AI Act reaches companies outside the EU in two ways: when they place an AI system on the EU market or put it into service there, and when the output of their system is used in the EU. Where you are established matters less than where your agent's work lands.
Which non-EU companies are caught?
The Act's territorial scope, in substance, covers:
- Providers anywhere that place AI systems on the EU market or put them into service in the EU. A US platform selling agents to EU banks is in scope.
- Deployers established in the EU, whoever built the system.
- Providers and deployers outside the EU where the output produced by the AI system is used in the EU. This is the clause that catches agents.
- Importers and distributors that bring systems into the EU market.
A non-EU provider of a high-risk system must appoint an authorised representative established in the EU, who holds the documentation and deals with authorities.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Why does the output clause matter so much for agents?
A model's output is a score or a piece of text. An agent's output is an action: an email sent, a payment queued, a claim settled, a record changed. When an agent run from Singapore or Lagos sends a decision to a customer in Spain, or updates the account of a customer in Germany, its output is used in the EU.
That means a company with no EU office, no EU servers and no EU sales team can still be a deployer in scope, simply because its agents act on EU customers. The classification then follows the normal rules. An agent answering EU customers' questions carries Article 50 transparency duties. An agent scoring EU residents for credit is high-risk. The way the Act treats action rather than output is the subject of the EU AI Act and agents that act.
What may the agent do, and what stays with a person?
The Act does not change what an agent may do because its operator is abroad. The same tiers apply:
| Agent activity touching the EU | Duty for a non-EU company | Stays with a person |
|---|---|---|
| Chat support for EU customers | Tell them it is an AI system | Complaints and exceptions |
| Pre-assessing EU residents for credit | High-risk deployer duties | The credit decision and challenges |
| Selling an agent platform to EU firms | Provider duties; EU representative for high-risk | Release decisions and incident handling |
| Back-office work with no EU effect | Likely out of scope | As your own policy sets |
The practical steps for this situation are set out in the EU AI Act for non-EU companies deploying AI agents.
An illustrative example
Take a UK-based consumer lender that also lends to customers in Ireland. It runs one underwriting agent across both books, hosted outside the EU. The firm assumed the Act did not apply after the UK left the EU.
For the Irish book, the agent's output is used in the EU, and the use is creditworthiness assessment of natural persons. So that capability is high-risk, and the firm has deployer duties for Irish applicants: human oversight by competent staff, keeping the logs under its control, informing applicants, and a fundamental rights impact assessment under Article 27. The UK book is outside the Act, though it sits under UK rules. The lender chose to apply the same controls to both books, because running two standards for one agent was harder than meeting the stricter one.
Which controls should a non-EU company put in place?
- Map where outputs land. For each agent, list which countries its actions reach. This, not your address, decides scope.
- Classify each capability that touches the EU under the Act's tiers.
- Confirm your role for each: provider, deployer, or both. If you are a provider of a high-risk system, appoint an EU authorised representative.
- Keep an inventory of agents and their EU exposure. An AI agent register for the EU AI Act is the simplest form.
- Apply oversight at the moment of action for high-risk capabilities, wherever the agent runs.
The overall test is in whether the EU AI Act applies to AI agents, the Act itself is summarised in what the EU AI Act is, and the cross-regulation view is in AI agent regulation, mapped to controls.
Questions people ask
Does hosting the agent outside the EU avoid the Act?
No. Hosting location does not decide scope. If the agent's output is used in the EU, or you supply it into the EU market, the Act can apply wherever the servers are.
What does the EU authorised representative do?
It is an EU-established person mandated by a non-EU provider of a high-risk system. It keeps documentation available, cooperates with authorities and acts as the contact point inside the EU.
Are we in scope if only a few EU customers use our agent?
There is no minimum volume in the scope rules. If the agent's output is used in the EU, assess it. A small exposure may still be high-risk if the use is listed in Annex III.