The EU AI Act can apply to a U.S. company even if it has no office in Europe. If your organization builds AI systems sold in the EU, or uses AI whose outputs affect people in the EU, you are likely in scope. Several obligations are already enforceable. The high-risk requirements were recently pushed back, but they have not been removed. At Steadfast Partners, we help growing organizations turn this moving regulatory target into a governance roadmap they can act on.
Does the EU AI Act Apply to U.S. Companies?
Often, yes. The Act reaches beyond Europe’s borders in the same way GDPR does. It covers:
- Providers that place AI systems or general-purpose AI models on the EU market, wherever they are based
- Deployers that use AI systems within the EU
- Providers and deployers outside the EU whose AI outputs are used within the EU
A SaaS company with European customers, a U.S. employer screening EU-based candidates with an AI tool, and a healthtech firm serving EU patients could all fall under the Act.
Which EU AI Act Obligations Are Already in Effect?
The Act entered into force in August 2024 and is phasing in over several years. Key milestones already in effect include:
- February 2025: Bans on prohibited AI practices and AI literacy requirements for staff who work with AI
- August 2025: Obligations for providers of general-purpose AI models
- August 2026: Article 50 transparency obligations, such as telling people when they are interacting with an AI system
Penalties are significant. Fines for prohibited practices can reach €35 million or 7 percent of global annual turnover, whichever is higher.
What Did the Digital Omnibus Change?
In July 2026, the EU’s Digital Omnibus on AI took effect and amended the Act’s timeline. The biggest change is more time for high-risk AI systems:
- Stand-alone high-risk systems (Annex III), such as AI used in hiring, credit decisions, education, and access to essential services, now have until December 2, 2027
- High-risk AI embedded in regulated products (Annex I), such as medical devices and machinery, now have until August 2, 2028
The Omnibus also added new prohibited practices that apply from December 2026. The delay gives organizations time to prepare, but the work itself has not shrunk. Companies that treat the extension as a reason to wait will face a compressed timeline in 2027.
How Should U.S. Organizations Prepare?
The most effective preparation starts with visibility and structure:
- Build an AI inventory. Document every AI system you develop, buy, or embed, including tools employees adopted on their own.
- Classify each system by risk. Determine whether it is prohibited, high-risk, subject to transparency rules, or minimal risk.
- Clarify your role. Obligations differ for providers and deployers, and many companies are both.
- Establish governance. Assign ownership, set approval workflows, and document risk assessments.
- Align with a recognized standard. An ISO 42001 AI management system gives you a structured, auditable foundation that maps well to EU AI Act expectations.
Who Should Own EU AI Act Readiness?
AI governance works best when one leader connects legal, security, product, and executive priorities. For many mid-sized organizations, a vCISO with AI governance expertise provides that leadership without a full-time executive hire. Pairing that leadership with a formal AI security and risk management program helps ensure your controls hold up to regulatory and customer scrutiny.
Start Preparing for the EU AI Act Today
The EU AI Act is now part of the operating environment for any AI-driven company with European exposure. Organizations that build governance now will be ready for 2027 and positioned to answer customer due diligence questions today. Steadfast Partners brings former CISOs, auditors, and AI security strategists who can assess your exposure and build a practical roadmap. Call 737-210-5503 to talk with our team about where your AI program stands and what comes next.