Does the EU AI Act apply if you're not based in the EU?
The question I hear most often from teams outside Europe isn't “how do we comply with Article 50.” It's “does this even apply to us,” usually followed by some version of “we're a US company, we don't have an EU entity, surely this doesn't touch us.” The direct answer is that it doesn't work that way, and the Act was written specifically so it wouldn't.
Scope is decided by who's on the other end of the interaction, not by where your company is incorporated. If your chatbot, voice agent, or AI feature is reachable by someone in the EU and talks to them, the disclosure duty follows that interaction regardless of where your servers sit or where your business is registered. This is the same logic GDPR already established for data protection, and at this point few US companies still believe GDPR doesn't apply to them just because they're not headquartered in Europe. Article 50 inherits that same territorial reach, applied to a different obligation.
Where this actually gets concrete is in how your product is reachable, not how your company is structured:
- A public chatbot on your website, open to anyone who lands on the page, with no geographic restriction — this is covered. EU visitors will reach it whether or not you ever intended an EU audience, and intent isn't the test.
- A product that actively geo-blocks the EU, so no EU user can ever reach it — the obligation has much less to attach to, since there's no EU interaction happening. “Actively block” is doing real work in that sentence though: it has to be a deliberate technical decision, not an assumption that your audience happens to be domestic.
- A B2B product sold only to non-EU companies, where one of your customers has EU end users of their own — this is where provider and deployer obligations can split across two different companies, and it's genuinely worth checking which one of you is holding which duty for your specific setup.
I'll be straightforward about the limit here: those three scenarios cover the common cases, not every case, and the specific facts of your product matter enough that a real answer should come from someone who's actually looked at your setup, not a blog post. What I can say with confidence is which direction the assumption should run: start from “this probably applies to us” and let your specific facts argue you out of it, not the other way around.
The part that tends to surprise non-EU companies most isn't the scope question, it's what's at stake once scope is established: penalties are calculated on global annual turnover, not EU revenue. Under Article 99(4)(g), that's up to €15 million or 3% of worldwide turnover, whichever is higher — a number set by your whole business, even if the EU is a small fraction of it. For SMEs and start-ups, the AI Act applies the lower of the two amounts (Art. 99(6)).
This is also why Disclarion's SDK doesn't ask where your company is incorporated, because the obligation was never about that in the first place. dc.track(reply, session_id=session.id) runs the same way whether your entity is in Delaware, London, or Berlin — it logs the interaction that actually happened, for the user who actually had it, which is the only thing Article 50 was ever checking in the first place.
For the obligation itself, start with what Article 50 actually requires. For which kinds of systems it covers — chatbots, emotion recognition, biometric categorization — see AI disclosure requirements in the EU.
More from the blog
Your internal AI tools owe the same disclosure duty the customer-facing one does
An HR bot or IT helpdesk assistant used only by your own staff still interacts with natural persons. Article 50 doesn't carve out an exception for "internal-only."
Why I built Disclarion as an SDK, not a dashboard
The easier product to build is a dashboard you configure after the fact. I built Disclarion to sit inside the AI call itself instead, and it's worth explaining why.
Deepfakes get a stricter rule than an AI-written blog post
Article 50(4)'s deepfake duty isn't the same obligation as ordinary AI content labeling — it applies to image, audio, and video specifically, and the built-in exemptions work differently too.
Your chatbot isn't the only thing that owes a disclosure under Article 50.
Article 50's disclosure duty doesn't stop at chatbots — emotion recognition and biometric categorization systems carry the same obligation, and they're the two system types teams miss most often.
You named it "AI Assistant." That's not the same thing as disclosing it.
A bot's name feels like disclosure. Article 50 cares whether a reasonable user actually understood they were talking to an AI — not whether a label existed somewhere on the page.
Your editor touched it. Article 50's label exemption still might not apply.
Article 50(4) waives the visible AI-content label when a human takes substantive editorial responsibility for a piece — but a quick skim doesn't qualify, and the exemption doesn't touch the audit-trail duty underneath it.
You labeled the article. That's not the same thing as marking it.
Article 50(2)'s machine-readable marking and Article 50(4)'s visible label are two different duties. Images already meet the first one by accident. Article text usually doesn't meet it at all.
Your AI answers the phone now. There's no modal for that.
Article 50's disclosure duty doesn't go away because there's no screen. What actually discloses an AI voice agent on a phone call, when a modal isn't an option.
An AI audit trail doesn't need to know what your users actually said.
Teams hear "audit trail" and picture a database of every conversation. Article 50's version is narrower: it has to prove disclosure and labeling happened, not repeat what was said.
Article 50 skips disclosure when it's "obvious from context." That word is doing more work than it looks like.
Disclosure isn't required when AI use is obvious from context, but Article 50 never defines obvious, and most of the cases teams assume qualify, don't.
Your chatbot needs to disclose it's an AI. Once, not every message.
Disclosing a chatbot is AI sounds simple until you build it: repeat it every message and people tune it out, show it once and later visitors never see it.
You have logs. That's not the same thing as an audit trail.
Under Article 50, an audit trail has to be insert-only, complete, and producible on demand, not a data-engineering project when a regulator actually asks.
Your AI-generated content needs a label. Here's what that actually means.
A disclaimer someone remembers to add isn't a labeling system. Under Article 50, AI-generated content needs to be identifiable as such, reliably, not as a manual step someone can forget.
EU AI Act Article 50, explained: who it affects and what it requires
Article 50 of the EU AI Act has been enforceable since August 2, 2026: who it applies to, its three obligations, and the penalties for getting it wrong.