The EU AI Act fines North American companies too.

How the Act reaches you

Article 2 sets the territorial scope, and it's deliberately wide. The Act covers providers who place AI systems on the EU market or put them into service there — 'placing on the market' includes making a system available to EU users, which your SaaS product does the moment an EU customer signs up. It also covers providers and deployers outside the EU where the output of their system is used inside the EU — think an American hiring tool screening EU applicants. General-purpose AI model providers are caught if their model is placed on the EU market, regardless of where they're established. There is no 'we're a Delaware C-corp' exemption. If your product touches EU users, you're in scope.

What applies first: transparency (Article 50)

For most North American SaaS companies, the first live obligation is Article 50, in force since August 2, 2026. If you offer chatbots or AI assistants, you must tell users they're interacting with AI. If your product generates content, certain outputs need machine-readable marking so they can be detected as AI-generated — systems already on the market before August 2026 have until December 2, 2026 to comply. Deployers must label deepfakes and AI-generated text published on matters of public interest without genuine human review. These sound modest; the fines are not — transparency violations fall in the €15M or 3% of global turnover tier.

What applies next: literacy, GPAI, and high-risk

Article 4 — AI literacy — has applied since February 2025: anyone deploying AI must ensure staff using it have 'sufficient' AI literacy. It's the easiest obligation for a regulator to check and the cheapest to fix (more on that in NOTE-03). If you build on or offer foundation models, general-purpose AI duties have applied since August 2025: technical documentation, training-data summaries, and for the most capable models, evaluations and incident reporting. High-risk system obligations — risk management, data governance, human oversight, conformity assessment — are phasing in through 2027 and 2028 after the Digital Omnibus deferral. That delay is not a reprieve: it applies to high-risk systems, not to the transparency and literacy duties already in force. And if your product touches hiring, lending, insurance, or education, start the high-risk work now — 2027 arrives faster than procurement cycles.

The enforcement picture

The EU AI Office's enforcement powers have been active since August 2026, and member-state authorities are standing up now. Early enforcement will follow the path of least resistance: clear, checkable duties like AI literacy and transparency disclosures. Fines scale with intent and cooperation, but the ceilings are real — €35M or 7% for prohibited practices, €15M or 3% for most other violations including transparency, €7.5M or 1% for supplying false information to authorities.

What to do this quarter

1. 1)Determine your role for each product: provider, deployer, or both — obligations differ sharply.
2. 2)Audit every user-facing AI interaction against Article 50 and fix disclosures and marking now.
3. 3)Document AI literacy for staff (see NOTE-03).
4. 4)If any feature makes consequential decisions about people, begin high-risk classification and gap analysis immediately — don't wait for 2027.