The EU AI Act became generally applicable on August 2, 2026, bringing important transparency and compliance requirements into effect across Europe.
For U.S. companies, the central issue is not simply whether they developed an AI model. A business may also have obligations when it incorporates a third-party AI system into a product or service offered in Europe, or when the output of its AI system is used in the European Union.
Why third-party AI creates compliance risk
Using technology developed by another company does not automatically transfer every compliance responsibility to the developer.
Instead, a company’s obligations depend on how it uses and presents the AI system. A business may be treated as a deployer when it uses an AI system in its operations, or as an importer or distributor when it introduces another provider’s system into the European market.
A company may assume the more extensive obligations of a provider if it offers the system under its own name or trademark, substantially modifies it, changes its intended purpose or alters it in a way that causes the system to become high-risk.
This means a company integrating an outside model into its own branded product cannot assume the original developer is solely responsible for compliance.
Why this matters to U.S. companies
The AI Act can affect U.S. businesses that sell AI-powered products in Europe, provide AI-integrated services to European users or produce AI-generated output that is used in the EU.
The law may be relevant to companies using AI in customer service platforms, marketing tools, hiring systems, educational products, financial services, software features and content-generation applications. The specific obligations will depend on the company’s role, the system’s intended use and its risk classification.
Transparency requirements are already in effect
As of August 2, 2026, certain AI transparency obligations apply to both providers and deployers.
Depending on the system, users may need to be informed when they are interacting with AI. AI-generated or manipulated content may also require machine-readable markings or visible disclosures. Additional notice requirements can apply to deepfakes, emotion-recognition systems, biometric-categorization tools and certain AI-generated content addressing matters of public interest.
Companies should review how AI appears within their products and communications, including whether users understand when they are interacting with an automated system or viewing synthetic content.
What companies should focus on now
Businesses should begin by identifying every AI model, tool and AI-enabled feature used within their products and operations. They should then determine whether those systems are offered in Europe, used by European customers or producing outputs that are used in the EU.
Each system should be evaluated to determine whether the company is acting as a provider, deployer, importer or distributor. That classification will help establish which obligations apply and whether the company’s use of the technology has moved beyond the role originally contemplated by the vendor.
Companies should also obtain sufficient documentation from AI providers. This may include information about the model’s intended use, technical limitations, risk classification, copyright policies and available compliance support.
Vendor agreements should address access to compliance information, material changes to the model, incident reporting, regulatory cooperation, intellectual property claims and responsibility for violations. Companies that fine-tune, rebrand or significantly modify a third-party system should also assess whether those actions change their legal status under the Act.
Not every requirement took effect at once
Although the AI Act now applies broadly, some high-risk requirements remain subject to later deadlines.
Rules for certain stand-alone high-risk systems are scheduled to apply beginning December 2, 2027. Requirements for high-risk AI embedded in regulated products are scheduled to apply beginning August 2, 2028.
Companies should therefore evaluate each system according to its use, risk level and applicable deadline rather than relying on one general compliance date.
The practical takeaway
Third-party AI does not mean third-party responsibility. A U.S. company that integrates, modifies, brands or commercializes an AI system in Europe must understand its own role and support that role with appropriate documentation, disclosures and contractual protections.
The immediate priority is not to master every provision of the AI Act. It is to know which AI systems the company uses, how they reach Europe and where the company’s own obligations begin.
