Does the EU AI Act apply to a US company that licenses data?

Short answer: who does the Act reach?

Generally the Act's obligations attach to providers and deployers of AI systems, not to a company that simply licenses its business records to a developer. A US company supplying records is a data source, not a provider. It can still be asked by buyers for information that helps them meet their own duties. Application dates have changed since adoption, so check the consolidated text.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

What does the regulation say about who is covered?

The official text of Regulation (EU) 2024/1689 lays down harmonized rules on artificial intelligence. Its duties are organized around roles: providers who place AI systems or general-purpose models on the EU market, deployers who use AI systems, and others in the chain such as importers and distributors. Providers can be established outside the EU. That is the extraterritorial reach people mean.

A company licensing operational records is not placing a system on the market and is not deploying one. It holds inputs. The roles table below shows the usual mapping.

Whether any particular arrangement changes that picture is a legal question for the parties' counsel.

Which provisions do buyers mention anyway?

Two parts of the Act show up in buyer questionnaires, because they shape what developers must document.

• Training-content transparency. Providers of general-purpose AI models face documentation duties that include a summary of the content used for training (Article 53). A buyer may ask suppliers to describe the dataset in terms that help produce that summary.
• Data governance. For high-risk systems, Article 10 sets expectations for the quality and governance of training, validation and testing data. A buyer may ask where records came from, whether rights were cleared and how personal data was handled.

Neither article places a direct obligation on a US supplier, but both explain why clean provenance is commercially valuable. This is the same reason SourceX documents rights review, inventory and delivery steps.

What about dates and later amendments?

The Act has been amended since it was adopted, and the dates on which obligations start have moved. The EUR-Lex summary states, for example, that high-risk requirements apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, as summarized alongside the official text. Rather than rely on a date from an article or a vendor blog, use the consolidated text on EUR-Lex and confirm current timing with counsel.

Does GDPR change the picture for a US supplier?

Possibly, if the records contain personal data about people in the EU. The AI Act is separate from the GDPR. If a dataset includes EU residents' data, GDPR questions about lawful basis and transfers can arise for the supplier even when the AI Act does not apply to it. For definitions and how US and EU terms differ, see PII vs personal information vs personal data. A simple way to reduce exposure is to scope the license to US operations and de-identify before delivery.

What should a partner tell a founder?

A longer founder-friendly framing is in how to explain company data licensing to a US founder. The related questions of ownership and contractual limits appear in confidentiality clause use restrictions, and whether licensing counts as a sale under California law is covered in is licensing company records a sale under the CCPA.

Is this a reason to skip a company?

Only in narrow cases. A company whose data mostly concerns people in the EU, or one planning to build and offer its own AI system into the EU, has more to analyze. A US operating business with English-language, US-based records licensing de-identified material typically does not. Always run the broader legal view in is it legal for a company to license its business records for AI training.

Questions worth asking the owner

• Are the records mainly about US operations and US-based staff and customers?
• Does the company sell or plan to sell its own AI features into Europe?
• Does the company hold material about EU residents, such as European customer support logs?
• Can someone point to where the data originated and who owns it?

Next step

If the answers are comfortable, register as a partner and make the introduction. You can also screen the basics with the company fit checker. Partners earn 25% of the eligible platform fees SourceX actually collects, capped at $100,000 cumulative per referred company, and only after the buyer pays and SourceX receives its fee. Rewards are not guaranteed.