EU AI Act: Outside Europe, and Still in Scope
Episode notes
A sixty-person company in Denver sells software that screens job applications. American customers, American servers. One of those customers has an eleven-person sales office in Dublin, and in March that office started using the tool. Nobody in Denver signed anything with Europe. That was enough.
There is no establishment threshold in the EU AI Act, in the same way there is no size threshold. Article 2 applies to providers placing an AI system on the Union market "irrespective of whether those providers are established or located within the Union or in a third country".
This episode is the map. Three doors lead into scope: you place a system on the Union market, somebody in the Union deploys it, or, the one people miss, you sit in a third country and the output produced by your system is used in the Union. Recital 22 explains why that third door exists, and uses the word circumvention.
Also here: why this is not data protection law wearing a different hat. What applies today, which is Article 5, Article 50 and the general-purpose AI chapter, and what waits until 2 December 2027. The authorised representative in Articles 22 and 54, including the part where yours is required to report you to the regulator. And the Article 25 flip that turns your distributor into the provider.
Then the honest part. A European Parliament briefing in March 2026 counted eight designated single points of contact out of twenty-seven. Not one harmonised standard has been cited in the Official Journal, the classification guidelines are still a draft, and we could not find a single AI Act penalty against any provider, anywhere.
Two hosts, twenty minutes, every article number checked so you can check us.
DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility for its content.
This episode is information, not legal advice. Before you sign a compliance warranty, talk to a qualified lawyer.
CHAPTERS
0:00 These are AI voices, and why we say so first
1:26 Welcome to Project Cognivora
2:02 Three doors into scope, and none of them ask where you are
3:42 The output test, and the line nobody has drawn yet
5:02 Why this is not data protection law
6:02 What already applies to you today
8:10 Article 50, and the transitional that is not in Article 50
9:49 What is coming: 2 December 2027 and 2 August 2028
11:18 The authorised representative, Articles 22 and 54
13:25 Your European partner, and the Article 25 flip
15:07 What enforcement looks like from far away
16:12 Eight of twenty-seven, no standards, no database
17:27 Ninety seconds: five things to do on Monday
18:45 What happened in Denver, and who to send this to
SOURCES
Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Regulation (EU) 2026/1744, the Digital Omnibus on AI: https://eur-lex.europa.eu/eli/reg/2026/1744/oj
Commission guidelines on general-purpose AI models, July 2025: https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers
Project Cognivora: https://www.project-cognivora.com