Does the EU AI Act apply to agencies outside the EU?

Short answer: yes, far more often than agencies expect. The EU AI Act is written to reach conduct that touches the EU market, not just companies headquartered inside it. If your AI-generated ads, images, or video are seen by people in the EU, the transparency obligations in Article 50 can apply to you even if your studio is in New York, London, Toronto, or Singapore.

This trips up a lot of teams because it runs opposite to how they think about "EU law." So here is the actual test, the common scenarios, and what a non-EU agency should have in place.

The rule follows the audience, not the office

The AI Act's reach is extraterritorial by design. The parts that matter for creative work hinge on where the output is placed in front of people, not where it was produced. Article 50 - the transparency and disclosure obligation for AI-generated content - is about the content reaching an audience. When that audience is in the EU, the obligation is in play.

The date to care about is August 2, 2026, when the Article 50 transparency obligations become applicable. After that, "we're a US shop" is not a defense if the campaign runs in the EU.

When a non-EU agency is in scope

You are very likely in scope if any of these are true:

You produce AI-generated or AI-manipulated creative that runs on EU social feeds, EU broadcast, EU streaming, or EU web placements.
You deliver AI content to a brand that publishes it to EU audiences - even if the brand does the publishing.
You run a platform or service that lets EU users generate or distribute AI content.

You are probably not in scope for Article 50 if the work is purely internal, never leaves your own market, and never reaches EU users. But "never reaches the EU" is a strong claim for anything running on the open internet, and it is the agency's job to be sure, not to assume.

But wait - isn't the obligation on the brand?

This is the part worth being precise about. The primary disclosure duty tends to land on the deployer - the organization putting the content in front of an audience, which is usually the brand or media owner. We went deep on how that liability actually distributes in the guide to AI creative liability, and on the brand's side of it in commissioning AI content without inheriting the risk.

For a non-EU agency, the practical exposure is less often a direct regulator fine and more often this: the brand carries the obligation, the brand's contract pushes the provenance requirement onto you, and if you can't produce machine-readable marking and a record of how the work was made, you lose the account or eat an indemnity claim. The regulation sets the floor; the commercial contract is where a non-EU agency actually feels it.

What a non-EU agency should put in place

You don't need an EU entity to be ready. You need the work to carry provenance. Concretely:

Mark every AI-touched asset with machine-readable provenance. The recognized route is C2PA Content Credentials - an embedded, verifiable record of what generated the asset. It's the technique Recital 133 of the AI Act names, the layer Article 50(2) puts on the model providers, and the one your clients and the platforms now expect from you - and it travels with the file regardless of where you are.
Keep a fingerprint that survives stripping. Platforms routinely strip metadata on upload. A perceptual fingerprint (a content-derived hash of the media itself) lets the original signed record be matched back even after re-encoding. See watermarking vs metadata vs fingerprinting for why you want more than one layer.
Produce a record you can hand over. A signed compliance certificate covering each delivered asset - models used, approvals, timestamps, content hashes - is what satisfies a brand's audit request and a regulator's "can you show this was handled?"

That is exactly what Archibal is built to generate automatically: C2PA marking, a fingerprint, and a verifiable certificate on every delivery, so a non-EU agency can hand over provable AI creative without standing up its own compliance infrastructure.

Frequently asked questions

Does the EU AI Act apply to US companies? For AI-generated content, the relevant question is whether the content reaches EU audiences. A US company whose AI creative runs in the EU market can be subject to Article 50's transparency obligations from August 2, 2026, regardless of where it is incorporated.

We only deliver to the brand - the brand publishes. Are we off the hook? Legally the deployer (the publisher) usually carries the primary duty. Commercially, the brand will almost always push the provenance requirement back to you in the contract, so you still need to produce machine-readable marking and a record of the work.

Does a "made with AI" caption satisfy Article 50? A caption is the human-readable disclosure the deployer duty in Article 50(4) asks for - one layer, not the whole picture. The machine-readable marking (embedded, verifiable provenance a platform or regulator can check) is a separate technique: Recital 133 names C2PA, and Article 50(2) puts it on the model providers. A caption alone does not provide it, and your clients will want both.

What if the platform strips the C2PA data we added? Stripping is expected, which is why marking is layered. A perceptual fingerprint survives re-encoding and metadata loss, so a stripped asset can still be matched back to its original signed record.

How do we check whether our existing library is marked? Run files through a labeling checker that reads whether a C2PA manifest is present, or model your exposure by territory and channel with the jurisdiction risk calculator.

The bottom line

"We're not an EU company" is not the shield agencies think it is. The EU AI Act reaches AI creative by where it lands, not where it was made. The non-EU agencies that stay out of trouble - and keep winning EU-facing accounts - are the ones treating machine-readable provenance as a standard part of delivery well before August 2, 2026.

Producing EU-facing work from outside the EU? See how Archibal works for creators and agencies.