The EU AI Act: Who Is Covered?

This update is part of our EU AI Act Essentials Series. Click here to view additional updates.

The AI Act affects companies that develop, use and/or commercialize AI systems and general purpose AI models (GPAIMs) in the EU. Here’s a look at who the law affects – and how.

An Overview: Key Things Your Company Should Know

• The first thing your company should do is determine whether and how the AI Act applies to you.
  • The compliance obligations vary depending on a company’s role and the level of risk the law assigns to its products or services.
  • Companies with AI systems or GPAIMs the law deems high-risk face more stringent compliance obligations – low risk AI systems or GPAIMs trigger few to no compliance obligations.
• The Act affects companies that place AI systems on the market in the EU, make them available in the EU market or offer AI system-based services in the EU – even if they are based outside the EU, unless an exemption applies. It also covers AI systems if the system outputs are used in the EU.
• Most obligations apply to providers, followed by deployers. Importers and distributors mainly face regulatory compliance verification and documentation obligations.

How the AI Act Affects Companies Based on Their Roles

The Act details impose obligations on a company based on its role.

• Providers develop (or have another person or company develop) an AI system or GPAIM. A provider places the system or GPAIM on the market or puts the system into service under its name or trademark, whether for payment or free.
  • Deployers, distributors and importers are considered providers if they do any of the following:
    • Put their name or trademark on a high-risk AI system already put into service or placed on the market.
    • Substantially modify a high-risk system already on the market or put into service.
    • Modify the intended purpose of an AI system in a way that makes it high-risk according to the Act.
• Deployers use an AI system under their authority as part of their professional or commercial activity.
• Importers are located or established in the EU. They place an AI system on the EU market under the name or trademark of a person or legal entity outside the EU.
• Distributors include people or companies other than the provider or importer that make an AI system available in the EU.
• Product manufacturers are subject to the Act when they integrate AI systems into their products. The law does not define product manufacturers. It relies instead on definitions from other product regulations. For high-risk AI systems that make up safety components of products subject to legislation in Annex II of the Act, the manufacturer is considered the provider if:
  • The high-risk AI system is placed on the market under the manufacturer’s name or trademark and/or
  • The high-risk AI system is put into service under the manufacturer’s name or trademark after the product has been placed on the market.

The AI Act also anticipates the scenario in which a party is so heavily involved in the technical development and/or placing on the market of a high-risk AI system that this party may be deemed the provider of that system (for instance by commercializing the system under its own brand or introducing substantial modifications to the system such that it remains high-risk).

What Does It Mean to Make Available, Place on the Market or Place into Service?

Companies should understand what the law means when it refers to “placing on the market,” “making available on the market” or “putting into service.” The AI Act defines these terms this way:

• “Placing on the market”: The first time an AI system or GPAIM is made available in the EU.
• “Making available on the market”: Supplying an AI system or GPAIM for distribution or use in the EU as part of a commercial activity, whether for payment or free.
• “Putting into service”: Supplying an AI system for first use to a deployer or for use in the EU for its intended purpose.

The AI Act also applies when output is used in the EU – even if the provider is outside the EU. The regulation provides practical examples but does not define more specifically what this means in the context of the Act.

Companies should stay tuned for guidance from the new European AI Office and relevant national market supervisory authorities.

When Does the Act Affect People and Companies Outside the EU?

Role:	The AI Act applies if:	The AI Act does not apply if:
Provider	The provider places an AI system on the market and/or The provider puts an AI system into service on the market and/or The provider places a GPAIM on the market and/or The provider’s AI system output is used in the EU.	None of the scenarios in the first column apply.
Deployer	The deployer uses an AI system to generate outputs that are used in the EU.	Generated outputs are not used in the EU.
Product manufacturer	The manufacturer places an AI system on the market in a product bearing its name or trademark and/or The manufacturer puts an AI system into service in a product bearing its name or trademark.	None of the scenarios in the first column apply.
Distributor	The distributor makes an AI system available on the EU market.	The distributor does not make the AI system available on the EU market.

 

Want to know more? Reach out to one of the authors or other members of Orrick’s AI team.