EU AI Act Penalties and Enforcement: A Practical Risk Assessment for US-Based Legal Teams

Introduction: Why US Legal Teams Should Care About the EU AI Act

The European Union's Artificial Intelligence Act entered its penalty-enforcement phase in August 2025, but for many US-based legal teams, the regulation still feels like a European compliance problem — something for the Brussels office to handle. That assumption is dangerous. The EU AI Act's jurisdictional model explicitly reaches beyond the Union's borders, and the financial consequences of ignoring that reach are measured in tens of millions of euros and percentages of global turnover.

This article is written for US-based in-house counsel, compliance officers, and legal operations professionals whose companies have customers, users, or business partners in the European Union. It does not provide a general overview of the AI Act's phased rollout — that ground is covered elsewhere on this site. Instead, it focuses on a specific, underappreciated risk: the extraterritorial exposure that US companies face, the three-tier penalty structure that awaits non-compliant organizations, and the practical steps that legal teams should take before the August 2026 compliance deadline.

Extraterritorial Triggers: When the EU AI Act Applies to US Companies

The EU AI Act follows a jurisdictional model familiar to anyone who has worked through GDPR compliance: it applies to entities outside the Union if their activities affect the EU market or individuals within it. But the AI Act's reach is, in some respects, broader than its data-protection predecessor. A company need not have a European office, hire European employees, or maintain a physical presence in the EU to fall under the regulation's scope.

Three specific triggers bring a US-based organization under the Act's jurisdiction:

• Provider placing AI on the EU market. Any entity that develops an AI system — or has one developed under its name or trademark — and places it on the EU market is a "provider" under Article 3, regardless of where that entity is headquartered. A US-based SaaS company that sells an AI-powered product to EU customers is a provider, full stop.
• Output used in the EU. The Act applies to entities where the output produced by an AI system is used in the Union. This is a deliberately broad hook. A US employer that deploys an AI recruitment tool to screen candidates based in the EU — even if the employer has no EU subsidiary — triggers the Act's deployer obligations.
• Importer or distributor in the EU. A US company that does not directly place AI on the EU market but sells through an EU-based importer or distributor also falls within the regulatory chain. The importer and distributor have their own obligations, and the provider remains ultimately responsible for conformity.

The extraterritorial scope is not theoretical. As noted by Holland & Knight, the Act's jurisdictional triggers mirror and in some ways extend beyond GDPR's approach, meaning that any US company that has already navigated GDPR compliance should recognize the pattern — but should not assume the obligations are identical.

Real-World Scenarios: US Companies at Risk

Abstract jurisdictional rules become concrete when mapped to actual business operations. The following scenarios illustrate how common US-based business models trigger EU AI Act obligations — often without the company's legal team having conducted a formal exposure assessment.

• Scenario 1: US SaaS platform with EU users. A San Francisco-based company offers a project management platform that includes an AI-powered feature for automatically prioritizing tasks and predicting project delays. The platform has 15,000 paying users in Germany, France, and the Netherlands. The company is a provider under the AI Act because it places an AI system on the EU market — even though its servers are in Oregon and its entire team is in the United States. If the AI feature qualifies as high-risk (for example, if it is used in employment contexts or access to essential services), the company must complete a conformity assessment, register the system in the EU database, and appoint an authorized representative in the EU before August 2026.
• Scenario 2: US employer screening EU job candidates. A New York-based financial services firm uses an AI recruitment tool to screen applicants for a London office. The tool analyzes CVs and ranks candidates based on predicted cultural fit and tenure likelihood. Even though the firm has no EU headquarters, the AI system's output is used in the EU (the UK is treated as a third country for AI Act purposes, but the scenario applies to EU member states). The firm is a deployer under the Act and must comply with transparency obligations, human oversight requirements, and — if the tool is classified as high-risk under Annex III (employment) — the full high-risk compliance framework.
• Scenario 3: US-hosted AI API embedded in an EU product. A Boston-based AI company provides a sentiment-analysis API that an EU-based customer service platform embeds into its product. The API processes text in multiple EU languages and returns emotional-tone scores. The Boston company is a provider; the EU platform is a deployer. Both have obligations under the Act. The US provider must ensure the API meets conformity requirements before the EU platform can lawfully deploy it — and the provider's authorized representative in the EU must maintain technical documentation for 10 years.

These scenarios share a common feature: in each case, the US company's legal team may not have flagged the AI Act exposure because the company lacks a traditional EU establishment. The Act does not require one.

The Three-Tier Penalty Structure: What Non-Compliance Costs

Article 99 of the EU AI Act establishes a three-tier administrative fine structure that applies to all operators — including US-based providers and deployers. The critical detail that many American legal teams miss is that fines are calculated on total worldwide annual turnover, not EU revenue alone. A US company with €2 billion in global revenue but only €50 million in EU revenue faces fines based on the €2 billion figure.

The penalty framework includes several important nuances:

• For small and medium enterprises (SMEs), each fine is capped at the lower of the percentage or the fixed amount — meaning a small startup cannot be fined 7% of a tiny turnover if that exceeds €35 million, but the percentage cap still applies if it yields a lower figure.
• Member states determine the actual penalty rules and must notify the European Commission of their national frameworks. As of mid-2026, not all member states have finalized their penalty regimes, which creates some early enforcement uncertainty.
• Aggravating and mitigating factors — including the nature and gravity of the infringement, the number of affected persons, the degree of cooperation with authorities, and whether the violation was intentional or negligent — influence the final fine amount.

Enforcement Infrastructure: Who Will Police the Rules

The EU AI Act creates a multi-layered enforcement architecture. Understanding who has authority over which violations is essential for US legal teams assessing their exposure.

• The AI Office. Established within the European Commission, the AI Office has exclusive competence over general-purpose AI (GPAI) models and systems built on GPAI models where the model and system share the same provider. Under the Digital Omnibus, the AI Office also gained exclusive authority over AI systems deployed by very large online platforms (VLOPs) and very large online search engines (VLOSEs) under the Digital Services Act. For most US companies, the AI Office is the primary enforcement body if their AI system is based on a GPAI model like GPT-4o, Claude, or Gemini.
• National market surveillance authorities. Each EU member state was required to designate at least one notifying authority and one market surveillance authority by August 2, 2025. These national bodies are responsible for enforcing the Act against providers and deployers within their jurisdiction — including non-EU providers whose authorized representative is located in that member state. National authorities have the power to withdraw noncompliant AI systems from the EU market entirely, creating immediate commercial disruption risk for US companies.
• Designation status. As of mid-2026, the designation of national competent authorities has been slower than expected. This does not mean enforcement is inactive — it means that early enforcement may be inconsistent across member states, with some countries moving faster than others. US companies should not assume that slow designation equates to a grace period.

The enforcement framework also includes a structured escalation process. National authorities can issue warnings, impose corrective measures, and ultimately withdraw products from the market. For US companies, the most immediate enforcement risk is likely to come from a competitor complaint, a customer data protection authority referral, or a whistleblower report — not from proactive EU-wide sweeps.

Key Compliance Actions for US Companies Before August 2026

The August 2, 2026 deadline is not a target — it is the date on which the remaining core obligations of the AI Act take effect, including the Article 50 transparency rules and the full compliance framework for high-risk AI systems placed on the market before that date. For US companies that have not started preparing, the following actions should be prioritized.

• Appoint an EU authorized representative. Non-EU providers must appoint, by written mandate, an authorized representative established in the Union before placing a high-risk AI system on the market. This is not optional. The representative must maintain the provider's written mandate, the EU declaration of conformity, and the technical documentation for 10 years after the system has been placed on the market. The representative can be held jointly liable for non-compliance.
• Complete conformity assessments. For most Annex III high-risk categories (including employment, education, credit scoring, and access to essential services), providers can self-certify conformity. For biometric identification systems, third-party assessment by a notified body is required. The conformity assessment must be completed before the system is placed on the market — not after.
• Register high-risk systems in the EU database. Before placing a high-risk AI system on the market, the provider must register the system in the EU-wide database maintained by the European Commission. This registration is a precondition for lawful deployment.
• Maintain technical documentation. Providers must prepare and maintain technical documentation that demonstrates conformity with the Act's requirements — including a description of the system's design, development methodology, training data, performance metrics, and risk management procedures. This documentation must be kept for 10 years and made available to national authorities upon request.
• Implement transparency and AI literacy measures. Article 50 transparency obligations — including disclosure that content is AI-generated — take effect on August 2, 2026, and are not delayed by the Digital Omnibus. The watermarking obligation for existing systems has a 4-month grace period to December 2, 2026, but the broader transparency framework is live. Additionally, providers and deployers must "take measures to support the development of" AI literacy among their staff — a softened but still binding obligation under the Omnibus amendments.

The US Regulatory Patchwork: How It Compares

US companies accustomed to the fragmented American approach to AI regulation may underestimate the EU AI Act's comprehensiveness. The United States currently has no federal AI law equivalent to the EU's risk-based framework. Instead, AI governance in the US is a patchwork of state-level initiatives, executive orders, and agency enforcement actions.

The practical implication is clear: a US company that achieves compliance with Colorado's AI law or the FTC's enforcement guidance has not thereby achieved compliance with the EU AI Act. The two regulatory systems operate on fundamentally different premises — the EU's model is prophylactic and pre-market; the US model is largely reactive and post-market. Companies serving both markets must prepare for two distinct compliance regimes.

For a deeper look at how law firms specifically should structure their compliance programs under the EU AI Act, see The EU AI Act and Your Law Firm: A Practical Compliance Guide for Legal Practitioners.

Practical Checklist and Risk-Calibration Guidance

The following checklist is designed for US legal teams to assess their company's exposure and prioritize compliance actions. It is not exhaustive, but it covers the highest-risk gaps that organizations commonly overlook.

• Inventory all AI systems. Identify every AI system your company develops, deploys, or embeds — including third-party APIs, internal tools, and customer-facing features. Map each system to the EU AI Act's risk categories (prohibited, high-risk, limited-risk, minimal-risk).
• Determine extraterritorial exposure. For each AI system, assess whether it is placed on the EU market, whether its output is used in the EU, or whether an EU-based importer or distributor is involved. Document the analysis.
• Appoint an EU authorized representative. If your company is a provider of high-risk AI systems placed on the EU market, appoint an authorized representative by written mandate before August 2, 2026. Ensure the representative has the capacity to maintain records for 10 years.
• Complete conformity assessments. For high-risk systems, determine whether self-certification or third-party assessment applies. Complete the assessment and prepare the EU declaration of conformity before placing the system on the market.
• Register in the EU database. Register each high-risk AI system in the EU Commission's database before market placement. This is a precondition for lawful deployment.
• Prepare technical documentation. Ensure technical documentation meets the Act's requirements for design, development, training data, performance, and risk management. Maintain it for 10 years.
• Implement transparency measures. Ensure that AI-generated content is clearly disclosed where required by Article 50. The watermarking obligation for existing systems has a grace period to December 2, 2026, but the broader transparency framework takes effect August 2, 2026.
• Build AI literacy programs. Develop training for staff who develop, deploy, or use AI systems in their professional capacity. The Omnibus softened the obligation from "ensure" to "support the development of" AI literacy, but it remains a binding requirement.

The EU AI Act is not a future regulatory possibility — it is a current enforcement reality with a rapidly approaching compliance deadline. US legal teams that treat it as a European problem rather than a company-wide risk exposure are making a bet that the extraterritorial reach of Article 99 will not find them. The penalty structure, the enforcement infrastructure, and the authorized representative requirements suggest that is a bet worth examining carefully before August 2, 2026.