EU AI Act: buying AI from outside the EU doesn't transfer compliance risk to the vendor

An analysis by law firm Holland & Knight, published in April 2026, details the EU AI Act's extraterritorial scope: a provider established outside the Union is covered whenever it places an AI system or model on the EU market, or, even with servers located elsewhere, whenever the system's output is used in the Union — for example a resume-screening tool used by a non-EU employer to evaluate EU candidates, or a credit-scoring system processing EU residents' data.

The least-discussed part of this extraterritoriality concerns the buyer, not just the vendor: any business that imports or distributes an AI system embedded in a product sold on the EU market must comply with the AI Act, whether or not it developed that system. A French aerospace integrator, an energy operator, or a luxury house embedding an AI component bought from a non-EU vendor inherits a share of the compliance burden, regardless of its technical control over the underlying system.

Non-EU providers must also appoint an EU-based authorized representative — in practice the only easily verifiable signal an EU buyer has, before purchase, of how seriously a vendor treats its compliance obligations.

Penalties under Article 99 remain substantial: up to €15 million or 3% of global annual turnover for non-compliance, up to €7.5 million or 1% for providing false or misleading information to authorities — with market surveillance authorities additionally empowered to order non-compliant systems withdrawn from the market.