Here is the honest summary. Most US small businesses are not in scope of the EU AI Act, but some are, and the ones that are often do not realise it. You are most likely in scope if you offer an AI-driven product or service to customers in the European Union, or if your AI system's output is used in the EU, particularly in one of the high-risk categories the law defines. If that is you, the August 2, 2026 high-risk deadline matters and the fines are large enough to take seriously. If it is not, you can note the law and move on.
The purpose of this article is to let you determine which group you are in quickly and accurately, without either panicking over a law that does not touch you or ignoring one that does. Both mistakes are common, and both are avoidable with a clear read of how the law actually applies.
The EU AI Act high-risk rules begin applying August 2, 2026, and the law reaches non-EU businesses whose AI affects people in the EU. Most US small businesses are not in scope, but you likely are if you sell an AI-driven product or service into the EU or your AI output is used there in a high-risk category. Fines run up to 35 million euros or 7 percent of global turnover. Determine your scope now, do not assume distance protects you.
What the EU AI Act actually is
The EU AI Act is the European Union's comprehensive AI law, and it takes a risk-based approach. Rather than regulating all AI equally, it sorts AI systems into tiers by how much harm they could do, and applies heavier obligations to the riskier ones. Some uses are prohibited outright. Some are classed as high-risk and carry significant compliance duties. Most ordinary AI uses fall into lower tiers with light or no specific obligations.
This tiering is the key to understanding your exposure. The law is not a blanket set of rules that lands equally on every business using AI. It concentrates its real weight on a defined set of high-risk uses, and if your AI does not fall into those categories, the heavy obligations largely do not apply to you even if the law technically reaches your business. Understanding which tier your AI sits in is most of understanding whether you need to do anything.
It is also worth knowing that parts of the law are already in force. The prohibitions on certain AI practices have applied since February 2025, and the rules for general-purpose AI models since August 2025. The European Commission has already opened initial investigations under the prohibited-practices rules. This is a live, enforced law, not a future proposal, which is part of why the August 2026 high-risk phase deserves attention rather than a wait-and-see shrug.
The timeline and the August 2026 deadline
The EU AI Act phases in over several years, and the August 2, 2026 milestone is the one currently on the horizon. That date brings a major set of obligations for high-risk AI systems into application, which is why law firms began alerting US clients about it in early 2026.
The phasing matters because it means the law's full weight is not landing all at once, and the high-risk rules are the heavy ones. If your AI use touches a high-risk category, August 2026 is the deadline by which the associated obligations apply. If it does not, the deadline is largely informational for you. Knowing your category tells you whether this date is a hard deadline or a calendar note.
It is worth flagging that the exact contours and timing of some high-risk obligations have been subject to ongoing clarification and debate in Brussels, which is normal for a law this large and this new. The safe posture for a small business is to treat August 2, 2026 as the operative deadline for high-risk obligations, determine whether you are in a high-risk category, and act accordingly rather than betting on a delay that may or may not materialise.
How a EU law reaches a US business
The feature that makes this a US problem and not only a European one is extraterritorial reach. The EU AI Act, like the GDPR before it, applies not just to companies established in the EU but to companies outside it whose AI systems are placed on the EU market or whose AI output is used within the EU.
In practice, this means a US small business can be in scope without any European office, European entity, or European employee. If you offer an AI-driven product or service to customers located in the European Union, or if the output your AI system produces is used by people in the EU, the law can apply to you based on that connection alone. The physical location of your company and your servers does not create an exemption, the same way GDPR reached US businesses serving EU customers regardless of where they were based.
This is the part that catches small businesses off guard. A US software company with a handful of European customers, a US service business whose AI tool produces outputs used by someone in the EU, a US e-commerce operation selling into Europe with AI-driven features, any of these can find themselves within the law's reach. The connection that matters is to EU users and the EU market, not to EU soil. If you have that connection and your AI sits in a covered category, distance does not protect you.
What counts as high-risk
Because the heavy obligations attach to high-risk systems, the practical question for most businesses is whether their AI use is high-risk under the law. The high-risk categories center on AI used in areas where a bad outcome seriously affects people's lives and rights.
These include AI used in employment decisions such as hiring and evaluation, in access to essential services like credit and insurance, in education, in critical infrastructure, in certain safety components of products, and in other domains where the law judges the stakes high enough to warrant strict oversight. The pattern echoes the categories you see in US state AI laws, because regulators broadly agree on where AI does the most potential harm: decisions about jobs, money, housing, education, health, and fundamental rights.
The flip side is that a great deal of ordinary business AI is not high-risk. An AI that drafts your marketing copy, answers customer questions about your products, summarises documents internally, or recommends which item to feature in an email is not making the kind of consequential, rights-affecting decision the high-risk tier targets. If your AI use is operational and low-stakes, you are very likely outside the high-risk obligations even if the law technically reaches your EU-facing business. Identifying honestly whether your AI makes consequential decisions about people, versus assisting with ordinary operations, is the core of the scope question.
The penalties, in real numbers
The reason the EU AI Act cannot be ignored where it applies is the size of the penalties. The law follows the GDPR model of fines scaled to be painful for even very large companies, which means they are potentially existential for a small one.
For the most serious violations, breaching the prohibitions on banned AI practices, fines reach up to 35 million euros or 7 percent of total worldwide annual turnover, whichever is higher. For breaches of the high-risk system requirements, fines reach up to 15 million euros or 3 percent of worldwide annual turnover. For supplying incorrect or misleading information to authorities, up to 7.5 million euros or 1 percent of turnover. Enforcement is handled by national market surveillance authorities for most violations and by the European Commission and its AI Office for general-purpose AI model obligations.
The turnover-percentage structure is the part to absorb. These are not flat fines a business can treat as a cost of doing business. They scale with revenue, and the headline ceilings are designed to deter the largest companies on earth. For a small business genuinely in scope and in serious breach, the exposure is far larger than the value of whatever the AI was doing. That asymmetry, modest benefit against severe potential penalty, is exactly why determining your scope accurately is worth the effort rather than guessing.
Are you actually in scope?
Put the two questions together and you can place yourself quickly. Question one: do you have a relevant EU connection, meaning do you offer an AI-driven product or service to customers in the EU, or is your AI system's output used by people in the EU? Question two: does your AI use fall into a high-risk category, meaning does it make or materially shape consequential decisions about people in areas like employment, credit, insurance, education, or fundamental rights?
If the answer to both is yes, you are likely in scope for the high-risk obligations and the August 2, 2026 deadline matters to you. If you have the EU connection but your AI is ordinary and low-stakes, the law reaches you but the heavy obligations largely do not, though you should still confirm you are not running afoul of the prohibited practices that have applied since 2025. If you have no EU connection at all, the law does not apply to you, and you can note it and move on without action.
Most US small businesses land in the second or third group, EU connection with low-stakes AI, or no EU connection. The group that needs to act is the first: a real EU customer or user base plus AI that makes consequential decisions about people. If that describes you, the next section is the one that matters. If it does not, you have just saved yourself a compliance project you did not need.
What a small business should do now
If you might be in scope, four steps, in order. First, map your EU exposure honestly. Do you have EU customers? Is your AI's output used in the EU? Be precise, because this single question determines whether the law touches you at all, and it is easy to either overlook a handful of European users or overstate a connection that does not really exist.
Second, classify your AI use by risk tier. Determine whether what your AI actually does falls into a high-risk category or sits in the ordinary, low-stakes tier. This is the question that decides whether you face heavy obligations or light ones, and it is worth doing carefully and writing down your reasoning.
Third, if you are in the in-scope-and-high-risk group, get specialist legal advice before the August 2026 deadline. The high-risk obligations are detailed, they are not something to improvise from a blog post, and the penalties make professional guidance clearly worth the cost. This is the rare compliance question where a small business genuinely should bring in an expert rather than self-serve.
Fourth, regardless of the EU AI Act specifically, keep basic AI governance in place, because the same documentation and oversight that the EU AI Act expects also serves the US state laws, the hiring-tool risks, and plain good practice. An inventory of your AI systems, a record of what each does and what data it uses, and human oversight of consequential decisions is a no-regret foundation that pays off across every AI regulation rather than just this one.
The closing point is one of proportion. The EU AI Act is a serious law with real reach and real teeth, and a US small business genuinely serving EU customers with high-risk AI should treat the August 2026 deadline as the real deadline it is. But for the majority of US small businesses, whose AI assists with ordinary operations and whose customers are domestic, the correct response is a quick, honest scope check followed by moving on. The mistake to avoid is at either extreme: the panic that wastes money on compliance you do not need, and the dismissal that ignores a law that quietly does apply to you. A clear-eyed read of the two scope questions is all it takes to land in the right place.
Sources
- Holland & Knight — US Companies Face EU AI Act's Possible August 2026 Compliance Deadline
- European Commission — AI Act, Shaping Europe's digital future
- EU Artificial Intelligence Act — Article 99: Penalties
- Legal Nodes — EU AI Act 2026 Updates: Compliance Requirements and Business Risks
- DLA Piper — Enforcement and fines in the European Union, AI Laws of the World
- Decode the Future — EU AI Act 2026: Penalties, Risk Tiers and New Deadlines
- Spektr — EU AI Act: Timeline, Enforcement and Fines and How To Prepare
- Adherent — EU AI Act Compliance Requirements for Companies: What to Prepare for 2026