Does the EU AI Act apply to Canadian businesses?
October 22, 2026
Yes — if your AI, or what your AI produces, reaches the European Union. The EU AI Act (Regulation (EU) 2024/1689) was written to follow the market and the output, not the flag on your office. A Canadian company with no EU entity, no EU staff and servers in Ontario can still be inside its scope, and Canadian law firms — Torys and BLG among them — are telling clients exactly that. This post sets out the three ways the Act reaches a Canadian business, which duties are already live, and what to do in what order.
Quick answer
Selling AI into the EU makes you a provider there, wherever you are incorporated. (Article 2(1)(a).)
Using AI whose output is used in the EU makes you a deployer in scope, even with no EU presence at all. (Article 2(1)(c).)
Your EU customers will reach you contractually even where the Act doesn't reach you directly — their obligations become clauses and questionnaires in your inbox.
Already live: the prohibited-practices bans and staff AI-literacy duty (since February 2025) and the Article 50 disclosure duties (since 2 August 2026).
Coming 2 December 2027: the full high-risk regime for the uses listed in Annex III — hiring, credit, education, essential services and similar. The Digital Omnibus (Regulation (EU) 2026/1744) moved that date; it did not remove the duties.
The three ways it catches a Canadian business
1. You put an AI system on the EU market
Article 2(1)(a) covers providers "placing on the market or putting into service" AI systems in the Union, "irrespective of whether those providers are established or located within the Union or in a third country." If a Canadian SaaS company sells an AI product to customers in France or Germany, it is a provider under the Act for that product. For high-risk systems, a provider outside the EU must also appoint an authorised representative established in the Union, by written mandate, before making the system available (Article 22).
2. Your AI's output is used in the EU
This is the sharper hook, and the one that catches businesses that don't think of themselves as selling into Europe at all. Article 2(1)(c) covers providers and deployers located in a third country "where the output produced by the AI system is used in the Union." A Canadian agency that uses AI to produce analysis, screening results or content that an EU client then uses in the EU is working inside that sentence. So is a Canadian firm whose EU subsidiary or customer runs decisions off its reports. You do not need an EU contract, an EU office or EU revenue — you need EU use of the output.
3. Your customers' obligations become yours by contract
Even where neither hook reaches you directly, you will meet the Act through your customers. An EU business with deployer duties — human oversight, logging, using systems as instructed — has to be able to show its suppliers support those duties. Expect AI Act clauses in EU customer contracts, security and governance questionnaires that ask about your AI use, and procurement teams asking what standard you work to. This is commercial, not statutory — but for most Canadian SMBs it will arrive first and matter most.
Provider or deployer: which one are you?
Most Canadian businesses that use off-the-shelf AI are deployers: they use systems built by someone else, under their own authority, in their own operations. Providers build the systems or put them on the market under their own name. The duties differ — providers carry the heavier load (conformity assessment, technical documentation, registration for high-risk systems); deployers carry an operational set: use the system as instructed, assign competent human oversight, control the input data you supply, keep the logs the system produces, and tell affected people what the Act requires you to tell them.
One caution: the line moves. Putting your own name or trademark on a high-risk system, or substantially modifying one, can make you a provider of it, with provider duties to match. White-labelling an AI product for the EU market is not a way around the Act; it is a way into the heavier half of it.
For the deployer duties in detail, see our guide to the EU AI Act for businesses that only use AI.
What applies now, and what arrives later
| Date | What applies | Who it touches |
|---|---|---|
| 2 Feb 2025 | Prohibited practices banned (Article 5); staff AI-literacy duty (Article 4) | Everyone in scope |
| 2 Aug 2025 | General-purpose AI model obligations | Model providers |
| 2 Aug 2026 | Article 50 disclosure duties: chatbots, AI content marking, deepfakes, emotion recognition notices | Providers and deployers |
| 2 Dec 2026 | New Article 5 bans on AI-generated non-consensual intimate imagery and CSAM; marking grace period ends for generative systems on the market before Aug 2026 | Providers and deployers |
| 2 Dec 2027 | Full high-risk regime for Annex III uses (hiring, credit, education, essential services, biometrics, law enforcement and similar) | Providers and deployers of high-risk systems |
| 2 Aug 2028 | High-risk regime for AI embedded in regulated products (Annex I) | Product manufacturers and providers |
The August 2026 date deserves emphasis because it is the one most often misread. The Digital Omnibus deferred the high-risk regime; it expressly did not defer Article 50. If your website chatbot talks to EU visitors, or your AI-written content is published for an EU audience, the disclosure duties are not a 2027 problem. They are in force. Our post on AI disclosure requirements walks through the four duties one by one.
What a Canadian business should actually do
In order:
Map your EU touchpoints. Which products, customers, subsidiaries or audiences involve the EU — including where your output ends up, not just who pays you. That map decides which of the three hooks applies.
Classify your role, system by system. Provider or deployer, for each AI system that touches the EU. The duties follow the role, and the same company can hold both roles for different systems.
Fix disclosure now. Chatbot notices, AI-content labelling and the other Article 50 duties are live. This is days of work, not months.
Inventory your AI and assign owners. Every later duty — oversight, logs, incident handling — presupposes you know what is in use and who is responsible for it. This is the foundation work, and it is the same work Canadian rules increasingly expect (see Canada's AI rules after AIDA).
Use the runway to December 2027 for high-risk uses. If any of your EU-facing AI screens job applicants, scores credit, proctors exams or does similar Annex III work, the deferral is preparation time: instructions-for-use discipline, human oversight that is real rather than nominal, log retention, and records that show it.
Penalties, in proportion
The Act's ceilings are high: up to €35 million or 7% of worldwide annual turnover for prohibited-practice breaches, and up to €15 million or 3% for most other obligation breaches, including the deployer and transparency duties. For SMEs and start-ups, the cap is the lower of the fixed amount and the percentage. Member States set actual fines, and proportionate enforcement against a small foreign business that fixes a gap looks different from the headline — but a Canadian business that cannot show it ever considered the question starts the conversation in a poor position.
Frequently asked questions
We have no EU office and no EU entity. Are we really in scope?
You can be. Article 2(1)(c) is written for exactly your situation: a business established in a third country whose AI output is used in the Union. The question is not where you are; it is where the output lands.
Our AI vendor is a large US platform. Doesn't compliance sit with them?
Partly — providers carry their own duties. But deployer duties (how the system is used, oversight, disclosure to the people in front of you) sit with the business doing the deploying, and EU customers will ask you about your use, not your vendor's headquarters. A vendor contract that says nothing about AI Act cooperation is a gap to close, not a shield.
We sell services, not software. Does the Act care?
Yes, where the services are produced with AI and used in the EU. Screening, scoring, drafting and analysis delivered to EU clients are outputs used in the Union. The Act follows the output, not the invoice category.
Is Canada bringing in its own version we should wait for instead?
Canada's proposed AI law, AIDA, died in January 2025 and is not coming back as drafted; the rules that bind Canadian businesses today are a different, patchwork set. Waiting for an Ottawa version of the EU Act is not a plan for EU exposure that exists now.
What if we simply stay out of the EU market?
That is a legitimate strategy — if it is real. It means no EU customers, no EU-facing services, and output that does not get used in the Union, including by your non-EU customers' EU operations. Most businesses that say it discover an EU touchpoint in the mapping exercise. Better to map first and decide on facts.
Start with the practices, not the paperwork
The duties that reach a Canadian business — disclose AI use, keep a human responsible for important decisions, protect the confidential information you feed these tools — are working practices before they are legal filings. They are the practices the Ethicality AI Use Standard (EAUS) checks, and documenting them does double duty: it is most of the evidence an EU customer's questionnaire asks for. Check the pricing, run the free self-assessment, or get certified if you want those practices independently assessed.