If your AI outputs are used in the EU, check Article 2 scope.
Article 2(1)(c) can apply the EU AI Act to providers and deployers outside the EU when an AI system’s output is used in the Union. Scope depends on role, use, and the Act’s exclusions. Regula reports code indicators locally for human review; it does not determine whether the Act applies. Read Article 2 in the primary legislation.
Why this matters for UAE companies
Four facts about EU AI Act extraterritoriality that GCC general counsel are double-checking right now.
Extraterritorial by design
Article 2(1)(c) of Regulation (EU) 2024/1689 covers providers and deployers established outside the EU where the output produced by the AI system is used in the Union, subject to the Act's definitions, exclusions and other conditions. Non-EU incorporation alone does not exclude that route.
Source: Regulation (EU) 2024/1689 Article 2(1)(c)
Provider status carries duties
A DIFC or ADGM company may be a provider where it develops an AI system or model, or has one developed, and places it on the market or puts it into service under its own name or trademark. Article 3 definitions and the actual distribution arrangement matter; a reseller relationship alone does not settle the role.
Source: Regulation (EU) 2024/1689 Article 3(3) and Article 16
Article 99 penalty framework
Article 99 sets penalty ceilings by infringement type and includes turnover-based limits. The applicable amount depends on the legal conditions and enforcement decision.
High-risk deadline: 2 December 2027 (Omnibus)
Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July 2026. It sets 2 December 2027 for Annex III high-risk provisions and 2 August 2028 for Annex I product-embedded provisions. Article 50 obligations generally have applied since 2 August 2026; providers of systems covered by Article 50(2) that were already on the market before that date have until 2 December 2026 under the amendment's transition rule.
Source: Council press release, 7 May 2026; Regulation (EU) 2024/1689 Article 113
Examples that may require closer scope and classification review
Sector labels alone do not make a system high-risk. Intended purpose and every condition in Article 6 and Annex I or III require separate review.
DIFC, ADGM, and the federal layer: who regulates AI in the UAE today?
No federal UAE AI Act was identified in the official legal sources reviewed for this audit. AI governance also involves data-protection, financial, health, and free-zone rules. The regulator summary below is orientation, not a complete statement of UAE law.
The practical takeaway: UAE rules and EU AI Act scope are separate questions. If Article 2 brings a system or actor into EU scope, applicable EU duties may sit alongside local rules. Regula reports local code indicators but cannot decide either legal question.
What it looks like
Real session against a one-file Python script that calls OpenAI to score a CV — the canonical Annex III Category 4 case.
$ pipx install git+https://github.com/kuzivaai/getregula.git@main Successfully installed regula-ai-1.9.0 $ cat demo.py import openai def classify_resume(resume_text): client = openai.OpenAI() reply = client.chat.completions.create( model='gpt-4', messages=[{'role':'user','content':f'Score this resume: {resume_text}'}]) return reply.choices[0].message.content $ regula quickstart Regula Quickstart Created: ./regula-policy.yaml First scan complete (0.0s) Files scanned: 1 BLOCK findings: 0 WARN findings: 0 INFO findings: 1 $ regula classify --file demo.py Decision: insufficient_information Jurisdiction: eu Rule resolution: unresolved Facts needed to resolve the next decision: 2 - is_ai_system: Does the subject meet the governing law's definition of an AI system? - jurisdiction_in_scope: Does this jurisdiction's territorial and operator scope apply? Detector observation (not a legal classification): HIGH-RISK: Employment and workers management - Articles 9, 10, 11, 12, 13, 14, 15 $ # Reports code-observable indicators; runtime varies by repository.
How you verify Regula independently
Use the underlying artefacts to check reproducibility, security boundaries, evaluation limits, and what remains unvalidated.
- ✓ Trust Pack — every claim is paired with the exact shell command anyone can run to verify it. docs/TRUST.md
- ✓ Published methodology: the precision and recall measurements are under review and are not quoted here as current figures. The method, the corpora and their limits are published so the numbers can be reproduced and challenged. benchmark methodology
- ✓ SHA-256 tamper-evident audit log — verify the chain yourself with
regula audit verify. - ✓ Zero runtime dependencies — Regula's core only uses Python's standard library. The Software Bill of Materials is empty by design.
- ✓ Local-first core scanning — no account or API key is required for the core scan path. Optional network-enabled features have separate boundaries.
- ✓ Open source under Apache 2.0 / EUPL 1.2 — read every line at github.com/kuzivaai/getregula.
Last reviewed: 26 August 2026 · Coverage level: dated tracker and EU-oriented scope guidance, not UAE decision logic · Report a correction