The EU AI Act: Who and What Is Covered?

This update is part of our EU AI Act Series. Learn more about the EU AI Act here.

The EU AI Act imposes obligations on providers, importers, distributors and deployers of AI systems and General-Purpose AI Models (GPAI models).

Note: The European Commission has published guidance on key concepts and provisions under the AI Act in its Guidelines on Prohibited AI Practices.

1. In-Scope Technology

The AI Act primarily governs two types of AI-related technology:

• AI System: Any machine-based system (i.e., software) that is designed to operate with varying levels of autonomy to infer how to generate outputs (such as predictions, content, recommendations or decisions) that can influence physical or virtual environments, and that may continue to adapt after deployment.
• GPAI Model: An AI model that displays significant generality, is capable of competently performing a wide range of distinct tasks and can be integrated into a variety of downstream systems or applications.

The obligations imposed on AI systems vary based on whether the system or its use qualifies as Prohibited AI, High-Risk AI or otherwise involves AI interacting directly with individuals or exposing individuals to specified forms of AI-generated content (Individual-User-Facing AI). The law also creates exempted categories or lightens compliance obligations in relation to certain AI systems and GPAI Models.

2. In-Scope Organizations

See below for key definitions for understanding applicability thresholds:

The Act imposes obligations on organizations based on their role in relation to the covered technology. Most obligations apply to providers and deployers, while importers and distributors are primarily subject to regulatory compliance verification and documentation obligations.

Definitions

• Provider: A natural or legal person, public authority, agency or other body that develops an AI system or a GPAI model or that has an AI system or a GPAI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge..
• Deployer: A natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity.
• Importer: A natural or legal person located or established in the Union that places on the market an AI system that bears the name or trademark of a natural or legal person established in a third country.
• Distributor: A natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market.

Downstream modifier as provider

Any distributor, importer, deployer or other third-party shall be considered to be a provider of a High-Risk AI System for the purposes of this Regulation and shall be subject to the obligations of the provider under Article 16, in any of the following circumstances:

(a) they put their name or trademark on a High-Risk AI System already placed on the market or put into service, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated;

(b) they make a substantial modification to a High-Risk AI System that has already been placed on the market or has already been put into service in such a way that it remains a High-Risk AI System pursuant to Article 6;

(c) they modify the intended purpose of an AI system, including a GPAI system, which has not been classified as high-risk and has already been placed on the market or put into service in such a way that the AI system concerned becomes a High-Risk AI System in accordance with Article 6.

‘Substantial modification’ means a change to an AI system after its placing on the market or putting into service which:

• was not foreseen or planned in the provider’s initial conformity assessment and affects the compliance of the AI system with the requirements set out in Chapter III, Section 2 (‘Requirements for high-risk AI systems’);
• results in a modification to the intended purpose for which the AI system has been assessed.

Similarly, the European Commission has indicated in its Guidelines of 18 July 2025 on the scope of the obligations for providers of GPAI that a downstream modifier of a GPAI model may be deemed the model’s provider if its modification of the model leads to significant change in the model’s generality, capabilities or systemic risk.

In practice, parties that plan to modify AI systems or AI models purchased or licensed from third parties should assess whether those modifications may bring them within the scope of the AI Act.

3. Territorial Application

The AI Act applies where there is a sufficient territorial link with the EU:

• Providers that place on the market or put into service their AI systems or models in the EU or where the output is used in the EU, even if the provider or deployers is not based in the EU;
• Deployers established or located within the EU or where the output is used in the EU;
• Importers and distributors located or established in the EU;
• Product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark;
• When the affected person is located in the EU.

Note: When they are established outside the EU, providers of High-Risk AI Systems (Article 22 of the AI Act) and of GPAI models (Article 54 of the AI Act) must assign an authorized EU representative.

4. Exemptions

Article 2 of the AI Act provides five exemptions:

• Areas outside EU law, including military, defense and national security competences;
• Third-country public authorities & international organizations in law-enforcement/judicial cooperation;
• Scientific research & development;
• Personal non-professional use;
• AI systems released under free and open-source licenses.

Want to know more? Reach out to a member of our team.

Key Definitions for Understanding Applicability

• “Placing on the market”: The first time an AI system or GPAIM is made available in the EU.
• “Making available on the market”: Supplying an AI system or GPAIM for distribution or use in the EU as part of a commercial activity, whether for payment or free.
• “Putting into service”: Supplying an AI system for first use to a deployer or for use in the EU for its intended purpose.

These terms are key concepts in EU product safety law and the European Commission’s Blue Guide on the implementation of the product rules 2022 provides additional valuable context to their interpretation, as does the AI Act-specific guidance published by the European Commission.