Does the EU AI Act apply to your AI app?

The short answer

Using AI and having users in the EU is usually enough to make the question live, but it does not settle it. Scope turns on the role you hold, what the system is for, and whether one of the Article 2 exclusions catches you. The rest of this page walks the actual test rather than assuming the answer.

Article 2(1) defines three categories of entity that fall within scope:

• Article 2(1)(a): Providers placing an AI system on the EU market, regardless of whether they are established in the EU or a third country.
• Article 2(1)(b): Deployers of AI systems who are established in, or located in, the EU.
• Article 2(1)(c): Providers and deployers of AI systems established in a third country, where the output produced by the system is used in the Union.

That third clause is the one that catches most developers off guard. It means a SaaS product built in San Francisco, Lagos, or London that serves even a single EU user is in scope.

Source: Regulation (EU) 2024/1689, Article 2(1). Published in the Official Journal of the European Union on 12 July 2024.

A decision tree

Five questions determine your position under the EU AI Act: whether your product uses AI, whether you have EU users, whether you are the provider or deployer, which risk tier applies, and what obligations follow. Working through them in order takes under a minute and gives you a clear regulatory classification under Regulation (EU) 2024/1689.

Work through these five questions in order. Each one narrows your position under the regulation.

I am based in the US / UK / outside the EU — does it still apply?

Yes. The mechanism is Article 2(1)(c), which states that the regulation applies to:

"providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union"

This is deliberately modelled on GDPR's extraterritorial reach (Article 3(2) of the GDPR). The regulation does not require you to have an office in the EU, a legal entity in the EU, or even a contract with an EU customer. If the output of your AI system is used by someone in the EU, you are in scope.

For non-EU providers of high-risk AI systems, there is an additional requirement: Article 22 requires you to appoint an authorised representative established in the EU before placing the system on the market. This is a legal prerequisite, not optional.

Source: Regulation (EU) 2024/1689, Article 2(1)(c) and Article 22.

I use the OpenAI API — am I a provider or a deployer?

If you integrate a hosted model (OpenAI, Anthropic, Google) into your product and serve it to end users, you are a deployer under Article 3(4). The API provider is the GPAI model provider. You only become a provider yourself if you place the AI system on the market under your own name or make a substantial modification to a high-risk system under Article 25.

This is the single most common question on developer forums, and the answer is more straightforward than most people expect.

You are almost certainly a deployer.

Article 3(4) defines a deployer as "a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity". If you integrate OpenAI's GPT, Anthropic's Claude, Google's Gemini, or any other hosted model into your product, you are using that AI system under your authority, and using it in a product you ship is not personal non-professional use. You are the deployer.

OpenAI (or Anthropic, or Google) is the GPAI model provider under Article 3(63). They have their own obligations under Articles 53–55, which have been in force since 2 August 2025.

When do you become a provider instead? Article 3(3) says you are a provider if you:

• Place an AI system on the market or put it into service under your own name or trademark, or
• Make a substantial modification to a high-risk AI system that is already on the market (Article 25)

So if you fine-tune a model significantly, wrap it in a product, and market it as your own AI system — you may cross the line from deployer to provider. The distinction matters because providers of high-risk systems have heavier obligations (conformity assessment, CE marking, registration in the EU database).

For most SaaS developers calling an API: you are a deployer. Your obligations are lighter but they are real — particularly around transparency (Article 50) and, if you are in a high-risk domain, around human oversight (Article 14) and record-keeping (Article 12).

Source: Regulation (EU) 2024/1689, Articles 3(3), 3(4), 3(63), 25, and 53–55.

I am a solo founder with 3 users — do I really need to worry?

Honest answer: the regulation does not have a size threshold.

Article 2 applies based on where the AI system's output is used, not the size of the company behind it. There is no "small company exemption" and no minimum user count. A solo developer with a SaaS product used by three EU customers is technically in scope.

However. Practical enforcement risk is proportionate. The EU AI Office and national competent authorities have finite resources. They will focus on high-impact, high-risk systems first — not a three-user side project.

Article 62 requires Member States to provide SMEs and startups with priority access to AI regulatory sandboxes and to take the specific interests and needs of SME providers into account when setting fees and compliance costs. Recital 141 explicitly acknowledges that compliance costs should be proportionate.

The practical move is to document the system's intended purpose, roles, deployment context, and any detected indicators early. A tool can support that review but cannot establish that no obligations apply.

Source: Regulation (EU) 2024/1689, Articles 2, 62, and Recital 141. Omnibus status: COM(2025) 37 final.

Automate the decision

The decision tree above is exactly what regula assess implements as an interactive CLI flow. It walks you through the same five questions — AI usage, EU scope, prohibited practices, high-risk domains, and transparency triggers — and tells you your tier, your role, and your obligations.

$ regula assess

EU AI Act — Applicability Check

  Does your product use AI, machine learning, or an AI API?
  (Examples: OpenAI, Anthropic, Google AI, Hugging Face...)
  yes

  Do any users interact with your product from within the EU?
  yes

  Does your product do any of the following?
  a) Score or rank people's social behaviour...
  b) Influence user decisions outside their awareness...
  no

  Does your product do any of the following?
  a) Screen, rank, or filter job candidates...
  b) Make or influence credit decisions...
  no

  Does your product do any of the following?
  a) Interact with users via chat or voice...
  b) Generate text, images, audio, or video...
  yes

  Are you based outside the EU?
  yes

  Result: LIMITED-RISK (Article 50 transparency obligation)

  Your product is in scope, but the obligation is lightweight:
  inform users they are interacting with AI or consuming
  AI-generated content.

  Generally applicable since 2 August 2026.
  Article 50(2) providers with systems already on the market before that date have until 2 December 2026 under Regulation (EU) 2026/1744.

You can also run it non-interactively in CI or scripts:

$ regula assess --answers yes,yes,no,no,yes
$ regula assess --answers yes,yes,no,yes,no --format json

What to do next

Run regula assess to record intended purpose and deployment context, then regula check . to identify code-observable indicators. Use the results as evidence for qualified review; neither command confirms legal classification or the obligations applicable to a real deployment.

Based on where you landed in the decision tree:

• Need a structured starting point? Run regula assess to record context for human review.
• Want to scan your code? Run regula check . to identify risk patterns against 423 detections across 8 languages.
• High-risk? Run regula gap . for an Articles 9–15 gap assessment, then regula plan . for a prioritised remediation list.
• Limited-risk? Run regula disclose . to draft disclosure text to review for your chatbot or AI-generated content.
• Want the full picture? Install and run:

$ pipx install git+https://github.com/kuzivaai/getregula.git@main
$ regula assess          # applicability check
$ regula check .         # code-level risk scan
$ regula report . -f html # full compliance report