The EU AI Act Is Now Affecting U.S. Companies: Does Your Business Need to Comply?

Artificial intelligence regulation in Europe is no longer a future concern for U.S. businesses. As of August 2, 2026, important transparency requirements under the European Union's AI Act are in force, including rules addressing customer interactions with AI, AI-generated and manipulated content, deepfakes, emotion-recognition systems, and certain AI-generated publications on matters of public interest. Digital Strategy

For American companies, the critical issue is that the AI Act is not limited to businesses physically established in Europe. The regulation can apply to providers that place AI systems on the EU market even if they are located in another country, and it can also apply to providers and deployers located outside the EU when the output of an AI system is used in the European Union. Eur-Lex

That means a Chicago software company selling an AI-enabled platform in Europe, a Midwest retailer using an AI chatbot with European customers, or a U.S. marketing business producing AI-generated content for an EU audience may need to look more closely at the Act. The question is no longer simply whether a company is “an AI company.” It is whether the business develops, provides, deploys, or uses artificial intelligence in a way that falls within the EU rules.

The AI Act Can Reach Beyond Europe

The territorial scope of the AI Act is one of the first things U.S. businesses should understand. Under Article 2, the regulation applies to providers placing AI systems or general-purpose AI models on the EU market regardless of whether the provider is established inside or outside the Union. It also reaches providers and deployers located in third countries when the output produced by the AI system is used in the EU. Eur-Lex That creates a broader compliance question than simply asking whether a company has an office in France, Germany, Spain, or another EU member state.

A U.S. technology company could be affected because European customers use its AI product. A business could also be affected because it operates an AI-enabled service whose output is used in Europe. The European Commission's current guidance specifically confirms that providers located outside the EU can fall within the Act when the output of their systems is used in the Union. Digital Strategy At the same time, not every U.S. business that uses an AI tool internally automatically becomes subject to every provision of the AI Act. The obligations depend on the company's role, the particular AI system, how the system is used, and whether there is a sufficient connection to the EU.

That makes the first compliance task one of classification: What AI are we using, what role do we play, and where does its output go?

Providers and Deployers Have Different Responsibilities

The AI Act distinguishes between different participants in the AI ecosystem. A provider is generally the person or organization that develops an AI system—or has it developed—and places it on the market or puts it into service under its own name or trademark. A deployer, by contrast, generally uses an AI system under its authority in a professional context. Eur-Lex That distinction is important because the transparency requirements are divided between the two.

A U.S. software company offering its own AI-powered customer-service platform in Europe may be acting as a provider. A retailer using a third-party generative AI system to create marketing content may instead be a deployer. Some businesses could occupy different roles depending on the product or activity involved.

The European Commission's guidance also makes clear that a legal entity remains the deployer when its employees, contractors, or freelancers operate the AI system on the organization's behalf and under its responsibility. In other words, outsourcing content creation or AI operations does not necessarily remove the company itself from the analysis. Digital Strategy

For businesses that use multiple AI tools across marketing, sales, customer service, human resources, product development, and communications, identifying those roles may require more than a quick inventory of software subscriptions.

Customers May Need to Know When They Are Talking to AI

One of the most visible transparency requirements concerns AI systems that interact directly with people. Article 50 requires providers of systems intended to interact directly with natural persons to design those systems so that users are informed they are interacting with AI, unless that fact would already be obvious to a reasonably well-informed and observant person under the circumstances. Eur-Lex

For businesses, this may affect chatbots, conversational AI, virtual agents, AI avatars, and other automated systems used to communicate directly with customers. Consider a U.S. company operating an online service in Europe. If a customer asks a question through what appears to be a human support interface but is actually communicating with an AI agent, the business needs to consider whether the system provides the required disclosure.

The rule does not necessarily require every AI interaction to begin with an elaborate legal notice. The relevant issue is whether the user is appropriately informed in light of the design and context of the system. The Commission's guidance is intended to help providers determine how that transparency obligation should operate in practice. Digital Strategy For companies already using automated customer service, this is a useful moment to review not only the technology but the customer-facing experience.

AI-Generated Content Is Also Subject to New Transparency Rules

The rules extend beyond conversational AI. Providers of AI systems that generate synthetic audio, images, video, or text must generally ensure that the output is marked in a machine-readable format and can be detected as artificially generated or manipulated. The technical approach is expected to be effective, interoperable, robust, and reliable to the extent technically feasible. Eur-Lex

The Commission's guidance recognizes exceptions. For example, the machine-readable marking obligation does not apply in the same way when an AI system merely performs standard editing or does not substantially alter the input or its meaning. The guidance also identifies certain outputs that may fall outside the relevant marking obligation, including some machine-to-machine communications and limited technical outputs. Digital Strategy

For U.S. companies, the practical question is whether systems being offered into Europe have been designed with these requirements in mind. A business building a generative-image tool, audio generator, video platform, or text-generation system may face obligations at the product level. This is different from the obligations that can apply to a company merely using one of those tools. That distinction should be reflected in vendor contracts as well. Businesses purchasing AI technology should understand which compliance obligations belong to the technology provider and which remain with the company deploying the system.

Deepfakes and Public-Interest Content Receive Special Attention

The AI Act also places disclosure obligations on certain professional users of AI-generated content. Deployers must disclose when image, audio, or video content constitutes a deepfake. The Act and the Commission guidance also address AI-generated or manipulated text published for the purpose of informing the public on matters of public interest. In that context, disclosure may be required unless the content has undergone human review or editorial control and a person holds editorial responsibility for its publication. Digital Strategy

This creates an important distinction for companies using generative AI in communications. Using AI to help draft an internal email is not the same scenario as publishing AI-generated content intended to inform the public about a matter of public interest. Likewise, ordinary image editing does not necessarily create the same obligations as producing realistic synthetic media that depicts a person or event in a misleadingly authentic way.

U.S. companies publishing content for European audiences should therefore consider not just whether AI was used, but how it was used, what type of content was created, and what the audience is likely to understand about its origin. Marketing, public relations, media, communications, and social-media teams may be particularly affected by these distinctions.

Emotion Recognition and Biometric Categorisation Carry Their Own Disclosure Requirements

Another category covered by Article 50 involves emotion-recognition and biometric-categorisation systems. Deployers using these technologies are required to inform individuals who are exposed to them, subject to the limitations and exceptions contained in the Act. Digital Strategy This could matter in contexts where AI is used to interpret facial expressions, vocal characteristics, or other biometric information for commercial or professional purposes.

Companies should also remember that the AI Act does not operate in isolation. European privacy and data-protection laws can apply alongside AI regulation when personal or biometric data is involved. The AI Act expressly preserves the application of EU privacy and data-protection law. Eur-Lex That means a business evaluating an AI system involving biometric or behavioral data may need to consider several regulatory frameworks rather than treating AI Act compliance as a standalone exercise.

Marketing Teams Need to Pay Attention Too

It would be a mistake to view the new transparency rules as an issue only for software developers. Marketing departments are among the fastest adopters of generative AI. Businesses now routinely use AI to create social-media content, advertising copy, images, product demonstrations, customer communications, voiceovers, video, and digital campaigns. For companies serving European customers, those workflows deserve review.The relevant question is not whether using AI for marketing is prohibited—it generally is not. The issue is whether the company's particular use triggers a disclosure or labelling obligation.

A company using AI to make minor edits to an ordinary product photograph may present a very different case from one publishing a realistic synthetic video of a person who never made the statements attributed to them. Likewise, an employee using AI to improve the wording of human-authored copy differs from automatically generating public-interest reporting without meaningful human editorial review. Businesses therefore need internal rules that distinguish between different uses rather than relying on a blanket policy that simply says employees “may” or “may not” use AI.

Businesses Should Know What Their Vendors Are Doing

Many companies will encounter the EU AI Act through technology they did not develop themselves. A business may license an AI customer-service system, use a third-party marketing platform, embed generative AI into its own product, or hire a contractor using AI tools behind the scenes. That raises a contract and due-diligence issue.

If a vendor is responsible for providing machine-readable markings, is that obligation clearly addressed? If the software is marketed as compliant with the EU AI Act, what does that representation actually cover? Who is responsible for user disclosures? Will the provider notify customers if the technology or regulatory status changes? Does the business have enough information about the system to satisfy its own obligations as a deployer? These questions become more important as businesses integrate AI into customer-facing products rather than merely using it as an internal productivity tool.

The Commission has also published a voluntary Code of Practice on Transparency of AI-Generated Content to help providers and deployers demonstrate compliance with certain Article 50 marking and labelling obligations. Organizations that do not rely on the Code remain responsible for demonstrating compliance through other adequate means. Digital Strategy That makes vendor claims such as “AI Act compliant” worth examining carefully. Compliance may depend on the system, the use case, and the role each party plays.

The August 2 Deadline Is Already Here

The transparency obligations under Article 50 began applying on August 2, 2026. There is no general future compliance date for companies that simply have not addressed them yet. Digital Strategy

There is a limited transition for certain AI systems that were already placed on the market before August 2, 2026, with respect to the machine-readable marking and detection requirements for AI-generated content. Under the Commission's current guidance, those systems have until December 2, 2026 to meet that particular obligation. Content generated and already made available before August 2 does not generally need to be labelled retroactively. Digital Strategy That transition should not be mistaken for a general grace period for the AI Act's transparency requirements. Businesses currently offering or using covered systems should evaluate compliance now.

The Penalties Make This More Than a Best-Practices Issue

The AI Act includes significant enforcement authority.

According to the European Commission's Article 50 guidance, violations of applicable AI Act obligations can result in fines reaching €15 million or 3% of total worldwide annual turnover from the preceding financial year, depending on the infringement. The rules also require proportionality when penalties are applied to small and medium-sized enterprises and small mid-cap companies. Digital Strategy

National market-surveillance authorities will handle much of the enforcement of Article 50, while the EU AI Office has authority in certain areas involving systems connected to general-purpose AI models and certain major online platforms or search engines. Digital Strategy For U.S. businesses, the larger lesson is familiar from other European regulatory regimes: a company does not necessarily avoid EU compliance obligations merely because its headquarters are in the United States.

If the product, service, system, customer base, or AI output has the required connection to Europe, the analysis may follow the activity across the Atlantic.

What U.S. Businesses Should Review Now

Companies doing business in Europe should begin with an inventory of how AI is actually being used rather than starting with a lengthy policy document. That inventory should identify AI built into products, customer-service tools, generative-content platforms, marketing systems, employee applications, biometric technologies, and third-party services.

From there, the company should determine whether it is acting as a provider, deployer, importer, distributor, or another regulated participant for each significant system and whether the AI Act applies to the activity. Businesses should pay particular attention to customer-facing AI systems, AI-generated or manipulated audio, images, video and text, deepfake content, public-interest communications, and any emotion-recognition or biometric-categorisation technology.

Contracts with AI vendors should also be reviewed. The business should know which party is responsible for disclosures, technical markings, compliance documentation, system updates, and cooperation if a regulator requests information.

Internal procedures may need updating as well. Marketing and communications teams should understand when AI-generated content may require disclosure. Customer-service teams should know when users must be informed they are interacting with AI. Product and technology teams should know when machine-readable marking must be built into the system rather than added manually after content has already been generated.

The objective is not to label everything created with AI indiscriminately. It is to identify the specific uses that fall within the rules and make sure responsibility for compliance has been assigned before the technology reaches European users.

The Bottom Line

The EU AI Act is beginning to change the legal environment for businesses that use artificial intelligence internationally. For U.S. companies, the most important point is that compliance does not necessarily depend on having a European headquarters, employees, or physical office. A U.S. business may need to evaluate the Act because it provides an AI system to the European market, uses AI output in the EU, communicates with European consumers through AI, or publishes covered AI-generated content for European audiences. Eur-Lex

The new transparency rules also show why companies need to look beyond the broad question of whether they “use AI.” Different technologies and different uses can create very different obligations. A customer-service chatbot, generative-content platform, synthetic marketing video, biometric system, and internal drafting assistant should not automatically be treated the same way.

For businesses expanding internationally, AI compliance is becoming another part of market-entry planning alongside privacy, contracts, intellectual property, consumer protection, and other regulatory requirements. Understanding how the technology is being used—and where its output is going—is the necessary starting point.

This article is provided for informational purposes only and does not constitute legal advice.

Using AI in products, customer interactions, marketing, or services that reach the European market? TEIL Firms can help you assess whether the EU AI Act applies, identify the transparency obligations relevant to your business, and review the contracts and compliance measures surrounding your AI use. Click the button below to get legal support with your EU AI compliance strategy.