Does the EU AI Act apply to your company? The scope test in Article 2

Article 2 of Regulation (EU) 2024/1689, the EU AI Act, decides whether the Regulation reaches your company at all. It catches non-EU businesses in two main ways: placing an AI system or general-purpose AI model on the Union market, and having a system's output used in the Union. This guide walks through the Article paragraph by paragraph and gives you a sequence of questions to run against your own facts.

Who paragraph 1 catches

Article 2(1) lists seven categories of actors. If you fit any of them, the Regulation applies, subject to the exclusions later in the Article.

Limb	Who	The location test
(a)	Providers placing AI systems on the market or putting them into service, or placing general-purpose AI models on the market, in the Union	Irrespective of whether the provider is in the Union or a third country
(b)	Deployers of AI systems	Place of establishment or location within the Union
(c)	Providers and deployers of AI systems	Established or located in a third country, where the output produced by the system is used in the Union
(d)	Importers and distributors of AI systems	None stated in the limb
(e)	Product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark	None stated in the limb
(f)	Authorised representatives of providers not established in the Union	None stated in the limb
(g)	Affected persons	Located in the Union

Two points matter for a non-EU reader. First, limb (a) says the provider's location is irrelevant. What counts is where the placing on the market or putting into service happens. A provider in a third country that places a system on the Union market is inside scope. Second, limb (g) brings affected persons located in the Union into the Regulation's scope, which signals that the law protects people in the Union regardless of where the operator sits.

The extraterritorial limb: output used in the Union

Limb (c) is the one that surprises companies with no EU sales, no EU office, and no EU customers on paper. It reads:

providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union

The trigger is the use of the output in the Union, not the location of the system, the servers, or the operator. A hypothetical: a company established outside the EU runs an AI screening tool on its own infrastructure, and the results are used by a team in a Member State. On the text of limb (c), that use of the output in the Union brings the third-country provider or deployer into scope. Whether a given fact pattern meets the limb is a legal question for counsel. The point for you is that "we have no EU establishment" is not, on its own, an answer under Article 2.

Note what limb (c) covers and what it does not. It applies to AI systems. The general-purpose AI model language appears in limb (a), tied to placing the model on the market in the Union.

Paragraph 2: a reduced regime for some product-embedded systems

Article 2(2) narrows the Regulation for one class of high-risk systems. For AI systems classified as high-risk under Article 6(1) and related to products covered by the Union harmonisation legislation listed in Section B of Annex I, only Article 6(1), Articles 102 to 109 and Article 112 apply. Article 57 applies only in so far as the high-risk requirements have been integrated into that harmonisation legislation. If your product sits under Section B of Annex I, most of the Act's high-risk chapter does not apply directly to it.

The exclusions: paragraphs 3 to 12

The rest of Article 2 removes activities and actors from scope, or preserves other law. Read each exclusion in its own terms, because several carry conditions.

Paragraph	What it says
3	The Regulation does not apply to areas outside the scope of Union law and does not affect Member State competences for national security. It does not apply to AI systems placed on the market, put into service, or used exclusively for military, defence or national security purposes, regardless of the type of entity involved. A third subparagraph covers systems not placed on the Union market where the output is used in the Union exclusively for those purposes.
4	Third-country public authorities and international organisations are out of scope where they use AI systems in the framework of international cooperation or agreements for law enforcement and judicial cooperation with the Union or Member States, provided adequate safeguards for fundamental rights and freedoms exist.
5	The Regulation does not affect the intermediary liability provisions in Chapter II of Regulation (EU) 2022/2065.
6	It does not apply to AI systems or models, including their output, specifically developed and put into service for the sole purpose of scientific research and development.
7	Union law on personal data, privacy and confidentiality of communications continues to apply. The Regulation does not affect Regulation (EU) 2016/679 or (EU) 2018/1725, or Directive 2002/58/EC or (EU) 2016/680, without prejudice to Article 10(5) and Article 59.
8	Research, testing and development activity prior to placing on the market or putting into service is excluded, but testing in real world conditions is not covered by that exclusion.
9	The Regulation is without prejudice to other Union rules on consumer protection and product safety.
10	Deployer obligations do not apply to natural persons using AI systems in a purely personal non-professional activity.
11	The Union and Member States may keep or introduce rules more favourable to workers on employer use of AI, and may encourage or allow more favourable collective agreements.
12	AI systems released under free and open-source licenses are excluded, unless placed on the market or put into service as high-risk systems or as systems falling under Article 5 or Article 50.

Watch the qualifiers. Paragraph 3 requires an exclusive military, defence or national security purpose. Paragraph 6 requires that the system was developed and put into service for the sole purpose of scientific research and development. Paragraph 8 excludes pre-market development but carves real-world testing back into scope. Paragraph 12 falls away for high-risk systems and for systems under Articles 5 and 50, so an open-source license is not a blanket exemption.

A decision sequence you can run

Run these questions in order against Article 2's text. This is a reading aid, not legal advice.

1. Do you place AI systems on the market, put them into service, or place general-purpose AI models on the market, in the Union? If yes, limb (a) applies wherever you are located.
2. Are you a deployer established or located in the Union? If yes, limb (b) applies.
3. Are you a third-country provider or deployer of an AI system whose output is used in the Union? If yes, limb (c) applies.
4. Are you an importer, distributor, product manufacturer under limb (e), or an authorised representative? If yes, you are in scope under the relevant limb.
5. If any answer above is yes, test each exclusion in paragraphs 3 to 12, including its qualifiers. Exclusive military, defence or national security purpose? Sole purpose of scientific R&D? Pre-market development that is not real-world testing? Purely personal non-professional use? Open source, and not high-risk or caught by Article 5 or 50?
6. If you clear step 5, check paragraph 2. If your high-risk system relates to a product under Section B of Annex I, only the listed Articles apply.

What to take into the exam

You need to be able to identify which limb of Article 2(1) catches a given actor, to explain why a third-country company can be in scope through output used in the Union, and to spot when an exclusion fails because a qualifier is not met. The qualifiers do the work: "exclusively," "sole purpose," "purely personal non-professional," and the real-world testing carve-back in paragraph 8. Learn the seven limbs and the 12 paragraphs as a sequence you can run from memory, because scope is the first question in any AI Act analysis, and everything else in the Regulation depends on getting it right.