Being outside the EU does not put you outside the EU AI Act. Like the GDPR before it, the law reaches by market, not by address. The key rule in Article 2 is simple: if the output of your AI system is used in the EU, you can be covered, whether you are in Casablanca, Dubai, or anywhere else. The test is not where your company sits; it is whether your AI touches people or markets inside the EU. So before you decide this is a European problem, it is worth checking whether it is quietly yours.
There is a very common reaction to everything we have written in this series, especially from readers in Morocco, the Gulf, and the wider region: "This is a European law. My company is not in Europe, so none of it applies to me." It feels reasonable. It is also, in a lot of cases, wrong. And getting it wrong is expensive, because the penalties we keep mentioning do not check your address first.
The rule that catches everyone
The heart of this is Article 2 of the AI Act, the part that defines who the law applies to. It does three things that matter for anyone outside the EU. First, it covers providers who place an AI system on the EU market, and it says so "irrespective of whether those providers are established or located within the Union or in a third country." In plain terms: if you sell or offer your AI into the EU, where you are based does not save you. Second, and this is the big one, it covers providers and deployers located outside the EU "where the output produced by the AI system is used in the Union." Third, it reaches importers, distributors, and product makers who bring AI into the EU market.
That second rule is the one that surprises people. It means the trigger is not your location, and not even where your servers are. It is where the result of your AI is used. If a company in the EU relies on your AI's output, the law can follow that output back to you. Lawyers call this the market-location principle: what matters is whether your AI affects people or markets inside the EU. If it does, the Act may apply, no matter which country you operate from.
This is exactly how the GDPR works, and it is why so many non-EU companies ended up complying with a European data law. The AI Act borrows the same logic. A business in the region that already adjusted its data practices for the GDPR because it served EU customers should expect the same pattern here: serve the EU market, inherit the EU rules. If anything, this makes the mental model easy. If the GDPR reached you, the AI Act very likely will too.
Provider or deployer, which are you?
The Act does not treat everyone the same, so your first job is knowing which role you are in, because it decides what you owe. A provider is whoever develops an AI system, or has one developed, and puts it on the market or into service under their own name. If you build an AI product, or rebrand one as yours and offer it out, you are a provider, and providers carry the heaviest obligations. A deployer is whoever uses an AI system in a professional capacity, a company running an AI tool as part of its work. Deployers carry lighter but real duties. You can even be both at once: a company that builds an internal AI tool and also uses it is wearing both hats.
This matters outside the EU because both roles can be caught by the output rule. A provider in the region whose system is offered into the EU is in scope. A deployer in the region whose AI output is used in the EU can be in scope too. The practical point is that "I just use a tool, I did not build it" is not automatically a way out.
Who is in, who is out
Abstract rules are hard to feel, so here are concrete cases, adapted from how legal specialists describe the scope. They are illustrations, not rulings on any real company.
| The situation | In scope? |
|---|---|
| A Moroccan startup sells an AI recruitment tool to employers in the EU | Yes. The output is used in the EU, and recruitment AI is high-risk, so the full high-risk obligations apply, even though it is built and hosted outside the EU. |
| A Gulf company offers an AI service that EU businesses sign up for and use | Yes. Making the service available to EU customers brings it into scope. |
| A device maker sells AI-powered smart products to consumers in the EU | Yes. Placing the product on the EU market pulls it in. |
| A local company uses a French AI chatbot, but only to serve its own customers at home, not in the EU | Not directly. If the output is not used in the EU and you are not targeting the EU market, the Act typically does not apply to you as the user. |
| A company imports an EU-made AI tool and resells it only in its home market, outside the EU | No. Nothing is placed on, or used in, the EU market. |
The pattern is consistent. Follow the output. If it ends up being used inside the EU, you are likely in scope. If it stays entirely outside and you are not selling into the EU, you are likely not. The grey zone is in the middle, which is exactly why this needs a real check rather than a gut call.
What to actually do
You do not need a legal department to take the first sensible steps. Start by asking one question honestly: does the output of any AI we build or use reach the EU? Think about your customers, not just your offices, a single EU client can be enough. Next, work out your role for each system: are you the provider who offers it, or the deployer who uses it? Then, if you are in scope, the rest of this series applies to you, and the immediate move is to check your risk tier, exactly as we covered in earlier episodes. If you buy AI from vendors, ask them directly whether they meet EU AI Act requirements, and look at how your contracts handle it. And because this is the point where scope turns into real legal exposure, this is a genuinely good moment to get advice from someone qualified rather than guessing.
The uncomfortable headline is that "we are not in Europe" is not the shield many assume. The reassuring part is that the test is knowable: follow your AI's output, find your role, and you will know where you stand. For a region racing to adopt AI, that clarity is worth having early, before an EU client, not a regulator, is the one who asks you the question.
Frequently asked questions
I am not in the EU. Does the EU AI Act really apply to me?
It can. The Act applies by market, not by address. Under Article 2, if you place an AI system on the EU market, or if the output of your AI system is used in the EU, you can be covered even if your company and servers are entirely outside the EU. The real test is whether your AI touches people or markets inside the EU, not where you are based.
What does "output used in the Union" actually mean?
It means the result your AI produces ends up being used inside the EU. For example, if an EU company relies on predictions, scores, text, or decisions generated by your AI, that output is being used in the EU, and the law can follow it back to you. If the output is used only outside the EU and you are not targeting the EU market, the Act typically does not apply to you.
Does it matter whether I built the AI or just use it?
It changes your obligations, not whether you are in scope. Providers (who build or place AI on the market) carry the heaviest duties; deployers (who use AI professionally) carry lighter ones. But both roles can be caught by the output rule, so simply being a user is not automatically a way out.
Is this the same as how the GDPR works?
Very much so. The GDPR reaches non-EU companies that serve EU customers, and the AI Act uses the same market-location logic. If your business already had to comply with the GDPR because of EU customers, you should expect the AI Act to reach you in a similar way.
What should I do first to find out if I am covered?
Ask one honest question: does the output of any AI we build or use reach the EU, through any customer or market? If the answer is yes or maybe, identify your role (provider or deployer), check your risk tier, and get advice from a qualified professional. This article is an explainer, not legal advice, and scope questions are exactly where a specialist is worth it.
Follow the series, get compliant one rule at a time
We are working through AI regulation one rule a week, in plain language, with the region in mind. Explore the full series and practical AI guides on AISetApp.
Explore more on AISetApp- EU AI Act (Regulation 2024/1689), Article 2, on the scope and territorial application of the Regulation
- Afriwise / ENS, "Extraterritorial Application of the EU AI Act: What Non-EU Companies Should Know," on the "output used in the Union" rule and worked examples
- William Fry and White & Case analyses of the AI Act's extraterritorial reach and the market-location principle, 2024
Reviewed October 2026. This is an explainer, not legal advice. The law is evolving and scope depends on your specifics; verify with a qualified professional before acting.
Researched and drafted with AI assistance, reviewed and edited by Yasser El Hardouz, who takes editorial responsibility for this article.