The EU AI Act Is Coming for US Companies Too — Here's What to Do Now
If your AI systems touch EU users, employees, or markets, the EU AI Act likely applies to you regardless of where your company is headquartered.
A common misconception we hear from US-based clients is that the EU AI Act is a European regulatory problem. It isn't. The Act applies extraterritorially to any organization whose AI systems are placed on the EU market or whose outputs are used within the EU — which covers most multinational companies with EU customers, employees, or operations, regardless of headquarters location.
What the risk-tier system actually means for you
The Act classifies AI systems into risk tiers — unacceptable, high, limited, and minimal — with obligations scaling accordingly. Systems used in employment decisions, credit scoring, and certain biometric or critical-infrastructure use cases are likely to land in the high-risk tier, which brings requirements for risk management systems, data governance, technical documentation, human oversight, and conformity assessment before deployment.
The practical challenge for most organizations isn't disagreeing with the requirements — it's that they don't yet have an accurate inventory of which AI systems they're running, what tier each one falls into, or who owns the compliance obligation for each. You can't classify what you haven't inventoried.
A realistic starting point
We typically recommend starting with an AI system inventory and risk-tier classification exercise, aligned to the NIST AI Risk Management Framework's Map function, since it gives you a defensible methodology whether the eventual audience is EU regulators, US state-level AI legislation, or your own board. From there, prioritize documentation and human-oversight controls for anything landing in the high-risk tier, and build an ongoing AI governance process — not a one-time compliance project — since new AI use cases will keep appearing faster than any static assessment can track.