Question · Territorial scope

Does EU AI Act Article 50 Apply to US Companies?

Last updated: 8 November 2026

Yes, the transparency rules in Article 50 apply to US companies in many cases: Article 2 covers US providers placing AI systems on the EU market and US providers and deployers whose AI output is used in the EU. Whether EU visitors alone suffice is unsettled. The free Article50.io scan shows the most severe finding on one public page.

Once Article 2 brings a US company in, Article 50's chatbot, AI-content and deepfake rules apply as they do to EU firms. Below: three ways a US company can be in scope, whether you need an EU authorised representative, and what isn't settled yet. Scan for free

Scan for free

Three ways a US company can be in scope

A US company can come under Article 50 through three routes in Article 2 of the AI Act. Like the GDPR, scope follows where the output is used, not where you're incorporated: no EU office, staff or servers needed.

Placing AI on the EU market — Art. 2(1)(a).

Providers placing AI systems on the EU market are covered wherever they are established (Art. 2, AI Act Service Desk).

Output used in the EU — Art. 2(1)(c).

Non-EU providers and deployers are covered where the AI system's output is used in the EU (Art. 2, AI Act Service Desk).

An EU establishment — Art. 2(1)(b).

Deployers in the EU are covered, so a US group's EU subsidiary running the same chatbot is in scope in its own right.

US scenarios at a glance

Which route applies depends on what a US company does and where its AI output is used; these six scenarios show the likely outcome, not legal advice.

Scenario	Likely route	Article 50 duty it usually triggers	Status
US SaaS sells a chatbot product to EU customers	2(1)(a) provider placing on the EU market	50(1): design the system so people know they're talking to an AI	Clear from the text
US company runs a chatbot on a site aimed at EU customers (e.g. EU languages, pricing or shipping)	2(1)(c) deployer, output used in the EU	50(1) design duty sits with the chatbot's provider; 50(3) if emotion recognition or biometric categorisation; 50(4) deepfake / public-interest text duties if relevant	Strong argument it applies
US gen-AI image, video or text tool offered to users in the EU	2(1)(a) or 2(1)(c) provider	50(2): machine-readable marking of output	Clear if offered on the EU market; otherwise turns on 2(1)(c)
US company publishes AI-generated deepfakes aimed at EU audiences	2(1)(c) deployer	50(4): disclose that the content is artificially generated or manipulated	Strong argument it applies
US site with incidental EU traffic, nothing aimed at the EU	2(1)(c)?	Unclear	Unsettled (see below)
EU subsidiary of a US group runs the chatbot	2(1)(b) deployer in the EU	Same as any EU deployer	Clear

What the "output used in the EU" test means

Article 2(1)(c) reaches furthest. Recital 22 says that, to prevent circumvention, the Act should apply to providers and deployers established in a third country to the extent the output of their AI systems is intended to be used in the EU.

For a website, the output is the chatbot's replies and the AI-generated images or text. If that output is aimed at people in the EU, there's a strong argument that Article 50 applies.

The same 50(1), 50(2) and 50(4) obligations (Service Desk text) apply to an in-scope US business as to an EU one.

Do US companies need an EU authorised representative?

Not for Article 50 alone. Article 22(1) requires providers established in third countries to appoint an authorised representative in the EU "prior to making their high-risk AI systems available on the Union market".

What's clear, and what isn't

Some of the AI Act's reach outside the EU is clear from its text, and one key question is not.

Clear from the text of the Act

✔Both providers and deployers outside the EU can be covered when their AI system's output is used in the EU
✔Purely personal, non-professional use by individuals is excluded (Art. 2(10))
✔No EU authorised representative is required for Article 50 duties alone (Art. 22 is for high-risk AI)

Not yet settled

The Act doesn't say whether output counts as "used in the EU" merely because a website is accessible from the EU, or only when it's directed at EU users. Article 2(1)(c) says "used"; Recital 22 says "intended to be used". No court has ruled on how this applies to general-purpose websites. Article 50 has applied since 2 August 2026; only 50(2) marking for systems already on the market runs to 2 December 2026.

A US site with incidental EU traffic and no EU-facing activity is in a genuine grey zone. A US site actively serving EU customers is much less likely to be.

Fines for US companies

An Article 50 breach can draw a fine of up to €15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher (Art. 99(4)(g)). For SMEs, including start-ups, the cap is whichever of the two is lower (Art. 99(6)). Small mid-caps (SMCs) also get the lower of the two for fines under Article 99(4) and (5) (Art. 99(6a), AI Act Service Desk: Article 99). Member States set the penalty rules and enforce them. More: penalties explained.

The practical view

If EU users are a meaningful part of your audience, treat Article 50 as applying. For a website deployer, the fix is often a line of disclosure text. If you're in the grey zone and the stakes are high, this is a question for a qualified lawyer.

For which obligations are yours as a provider or deployer, see transparency obligations under Article 50.

Sources

Frequently Asked Questions

Does the EU AI Act Article 50 apply to US companies?

Often, yes. Article 2(1)(a) covers US providers placing AI systems on the EU market, and Article 2(1)(c) covers US providers and deployers whose AI output is used in the EU. If either applies, the same Article 50 transparency duties apply as for an EU company. Being US-based doesn't take you out of scope.

Does having EU visitors automatically bring my US website into scope?

That's still open. Article 2(1)(c) asks whether the AI system's output is used in the EU, and Recital 22 refers to output intended to be used there. No court or authority has settled how that applies to a site anyone can visit, so a confident yes or no isn't possible.

Do US companies need an EU authorised representative for Article 50?

Not for Article 50 alone. Article 22 requires non-EU providers to appoint an EU authorised representative only for high-risk AI systems. A chatbot or AI-content tool that isn't high-risk has Article 50 transparency duties but no Article 22 duty. If your system is also high-risk, Article 22 applies separately.

What fines can a US company face under Article 50?

Up to €15 million or 3% of total worldwide annual turnover, whichever is higher, under Article 99(4)(g). For SMEs and start-ups, and for small mid-caps, the cap is whichever is lower (Art. 99(6) and 99(6a)). Member States set the penalty rules and enforce them.

Are personal, non-commercial users covered?

No. Under Article 2(10), the AI Act does not apply to the obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity. A US company using AI in its business is not covered by this exclusion.

Is this legal advice?

No. Article50.io provides an automated technical assessment of your website's public-facing content against Article 50's transparency requirements, not legal advice. For a determination of your specific legal obligations or compliance strategy, consult a qualified lawyer. This page explains the AI Act's general scope, not how it applies to your facts.

Check your site automatically

Article50.io is an automated scanner for the Article 50 transparency rules of the EU AI Act. It scans one public page for possible Article 50 transparency gaps and reads text inside chat-like frames among the first 25 frames on the page.

The free scan shows your single most severe finding, with no signup and public pages only; each scan is capped at 45 seconds. The full €499 report lists everything the scan found and what it couldn't check, with remediation guidance and disclosure wording you can paste in. No scan can guarantee compliance. Scan for free · See a sample report