Does the EU AI Act apply to your business if you sell to Europe?

Many small businesses outside Europe assume the EU AI Act, formally Regulation (EU) 2024/1689, is a problem for European firms only. The text says otherwise. Article 2 lists who it covers, and two lines matter for exporters: providers that place AI systems on the EU market wherever they are based, and providers or deployers located in a third country when the output of their AI system is used in the Union. The European Commission's AI literacy questions and answers, updated on October 20, 2026, repeat the point plainly: the rules reach actors outside the EU when a system is sold in the EU, used there, or affects people located there.

So the useful question is not "am I in Europe?" but "what role do I play, and where does my AI's output land?" This article walks through that question for a small business as of October 2026. It is general information; if a European contract or a high-risk use is on the table, a lawyer who knows the Act is worth an hour of your time.

Provider or deployer: the role decides the duties

A provider builds an AI system or has one built, and offers it under its own name. A deployer uses an AI system in a professional setting. Someone using a chatbot for purely personal, non-professional purposes is outside the deployer duties altogether.

Here is how that sorts out for a few Canadian businesses with European customers:

Most small businesses land in the deployer column. That is good news, because the heaviest obligations in the Act fall on providers of high-risk systems and of general-purpose models.

What a deployer selling into Europe must do now

Four sets of rules already apply as of October 2026.

1. Banned practices. Since February 2, 2025, a short list of uses is prohibited, such as manipulative techniques that cause harm and emotion recognition at work or in schools. Check any tool that scores or profiles people.
2. AI literacy. Article 4 asks providers and deployers to take measures that support the AI skills of staff and others who use AI on their behalf. The Commission says no certificate is needed; an internal record of training and guidance is enough. National market surveillance authorities supervise this duty from August 2, 2026.
3. Transparency. Since August 2, 2026, Article 50 requires that people be told when they are dealing with an AI system unless it is obvious. Deployers must also label deepfakes and flag AI-written text published to inform people about questions of public interest, unless a person reviewed it and someone takes editorial responsibility.
4. Data protection. Article 2 states that EU law on personal data and privacy continues to apply to the data processed alongside the Act.

A worked example: the Montréal store above can meet the transparency duty with a first message such as "You're chatting with an AI assistant. Type 'agent' to reach a person." It can meet the literacy duty with a one-hour session for the three staff who manage the chatbot, plus a page of written guidance, and a dated note recording both.

I run a small business in Canada with customers in the European Union.
Here are the AI tools we use and what each one does: [list them].
For each tool, tell me:
1. Whether we are likely a provider or a deployer under the EU AI Act.
2. Whether its output reaches people in the EU.
3. Which Article 50 transparency duty might apply, if any.
Flag anything that looks like hiring, credit or other high-risk use.
Do not give legal conclusions; list questions I should ask a lawyer.

What changed with the 2026 AI Omnibus delays?

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was signed on July 8, 2026, published in the Official Journal on July 24 and entered into force three days later. It amends the AI Act without changing its general start date of August 2, 2026. The main changes, as the Official Journal text reads:

The marking extension concerns providers of generative tools, not the businesses that use them. If you publish AI images or chatbot answers, your own disclosure duties as a deployer have applied since August 2, 2026; the delay only gives tool makers until December 2 to embed hidden markers in older systems.

The Omnibus also extends several simplifications that small and medium-sized enterprises already had, such as simplified technical documentation and lower caps on fines, to "small mid-cap" companies, which are a step larger. For a small exporter, the practical effect is time: if you use AI to screen European job applicants or assess customers' creditworthiness, you now have until December 2027 before the high-risk rules apply, and that time is best spent asking your vendors what documentation they will provide.