Running an AI agent from outside the EU does not take a company outside the EU AI Act. The Act reaches providers that place systems on the EU market, and providers and deployers outside the EU whose system's output is used in the EU. A non-EU firm serving EU customers through an agent is usually in scope.
What does the Act say about territorial scope?
The Act applies, in substance, to:
- providers placing AI systems on the market or putting them into service in the EU, whether they are established in the EU or in a third country;
- deployers of AI systems that are established or located in the EU;
- providers and deployers established or located in a third country, where the output produced by the AI system is used in the EU.
The third limb is the one that catches non-EU deployers. It does not matter where the agent runs, where the model is hosted or where the company is incorporated. What matters is where the output is used. Our short answer to whether the EU AI Act applies to companies outside the EU puts it in one line: if the output lands in the EU, assume you are in scope.
Non-EU providers of high-risk systems must also appoint an authorised representative established in the EU, by written mandate, before making the system available there. For background on the Act's structure, see what the EU AI Act is.
Which non-EU companies are caught?
Common cases:
- A non-EU lender or fintech with EU customers. Its onboarding or credit agent produces decisions and messages used by people in the EU.
- A non-EU software company selling an agent platform to EU businesses. It is a provider placing a system on the EU market.
- A non-EU group whose EU subsidiary uses agents run centrally. The subsidiary is a deployer located in the EU; the group may be the provider.
- A non-EU business process outsourcer whose agents do work for EU clients. The output is used in the EU by the client.
The less clear cases involve incidental output. An agent that answers an occasional query from someone travelling in the EU is a different matter from one deliberately serving an EU customer base. The Act does not give a threshold, so judge by whether you target or serve the EU market.
What makes agents a particular problem for scope?
A model-based service has an obvious output: a score or a piece of text sent to a known user. An agent produces many outputs across many steps, some internal and some external, and may act in systems located anywhere.
Three agent-specific points:
- Outputs include actions. An agent run from outside the EU that sends a message to an EU customer, updates their account or initiates a payment has produced output used in the EU.
- Capabilities may cross the line separately. A global service agent might be in scope only for its EU-facing capabilities. Mapping scope by capability, not by agent, avoids over- or under-applying the Act.
- Shared agents spread duties. A single agent serving customers in several regions inherits the strictest applicable rules for the interactions in scope. Splitting by region is sometimes cleaner than meeting every rule everywhere.
What must a non-EU company do?
The duties are the same as for an EU firm in the same role. A deployer must meet the deployer duties; a provider must meet the provider duties. What changes is logistics: representation, record access and the authority you answer to.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Know which agents are in scope | Register mapping each capability to the markets where its output is used | Register with an EU-scope column |
| Prohibited practices | Capability review against banned practices for EU-facing agents | Review record |
| AI literacy | Training for staff supervising EU-facing agents, wherever they sit | Training records |
| Disclosure to people | AI disclosure in EU channels | Disclosure text and captures |
| High-risk deployer duties | Oversight, monitoring, logs and notices for in-scope high-risk agents | Assignments, reports, retained logs, notices |
| Authorised representative (providers of high-risk systems) | Written mandate to an EU-based representative | Mandate document |
| Records available to EU authorities | Logs and documentation retrievable on request | Export tests; access procedure |
Fairness duties travel with scope too. Agents serving EU customers must be tested for discriminatory outcomes against the people they actually serve; see EU AI Act fairness and non-discrimination for AI agents.
What will a supervisor or auditor ask?
- Which of your agents produce output used in the EU, and how did you decide?
- Who is your authorised representative, if you are a provider of a high-risk system?
- Can you produce logs and documentation for an EU case on request?
- Who oversees EU-facing agents, and are they trained?
- How do you stop EU-facing agents taking on high-risk uses?
What does the Act not settle for non-EU firms?
It does not resolve conflicts with your home country's law; you must meet both. It does not decide data transfer questions, which are for GDPR. It does not give a minimum volume of EU use below which scope ends. And it does not change your role: being outside the EU does not turn a deployer into a provider or the reverse. Smaller firms will find the proportionate reading in EU AI Act for SMEs deploying AI agents, and the full map of duties in AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does hosting the agent outside the EU avoid the Act?
No. Scope turns on where the system is placed on the market or where its output is used, not on hosting location. Hosting affects data transfer rules under GDPR, which is a separate question.
Does a non-EU deployer need an EU representative?
The authorised representative duty applies to non-EU providers of high-risk systems. Non-EU deployers do not have the same duty under the Act, but they still need to be reachable and to produce records when asked.
Can we keep one agent register for all markets?
Yes, and it is usually better. Add columns for where each capability's output is used and which regime applies, so one inventory serves the EU Act and other regimes at once.