Builds on AR-000200 (The EU AI Act Explained), which introduced the Regulation’s structure and risk tiers — none of that content is re-derived here. Article 2 is a prerequisite to everything else: it determines whether the Regulation reaches a given actor before any classification, obligation, or enforcement provision becomes relevant.
Executive summary
What this means
Who this applies to
Para 1(a)
Providers
Placing AI systems or general-purpose AI models on the EU market, or putting AI systems into service in the EU. Applies regardless of where the provider is established.
Para 1(b)
Deployers
Established or located within the Union. The location test is at the deployer level, not the end-user level.
Para 1(c)
Third-country providers & deployers
Established or located outside the Union, but whose AI system’s output is used in the Union. The output-use test is the extraterritorial hook.
Para 1(d)
Importers & distributors
Importers and distributors of AI systems. Article 23 and 24 obligations (covered in AR-000300) attach to these actors.
Para 1(e)
Product manufacturers
Placing or putting into service an AI system together with their product under their own name or trademark. May become providers under Article 25(3).
Para 1(f)
Authorised representatives
Authorised representatives of providers not established in the Union. Article 22 governs their obligations.
Para 1(g)
Affected persons
Natural persons located in the Union who are subject to AI systems within scope. They hold rights (Articles 85\u201386) but not obligations under the Regulation.
Regulatory context
The structural exclusions
Para 3
National security & military
Blanket exclusion for AI systems placed on the market, put into service, or used exclusively for military, defence or national security purposes. Unconditional — applies regardless of entity type.
Para 4
Third-country public authorities & international organisations
Excluded where using AI systems under international cooperation agreements for law enforcement and judicial cooperation, provided adequate fundamental rights safeguards exist.
Paras 6 & 8
Scientific R&D
AI systems or models specifically developed and used solely for scientific research and development, or research/testing/development activity prior to market placement. Real-world condition testing is NOT excluded.
Para 10
Personal non-professional use
Deployer obligations do not apply to natural persons using AI systems in the course of a purely personal non-professional activity. Provider obligations still apply to the provider of the system.
Para 12
Open-source AI (conditional)
AI systems released under free and open-source licences are excluded — unless they are high-risk AI systems or fall under Article 5 (prohibited practices) or Article 50 (transparency obligations).
The Section B Annex I partial-scope rule
Relationship with GDPR and other Union law
Requirements
What organizations must do
- Run the Article 2 scope analysis before any other compliance step — Article 6 classification and Chapter III obligations only become relevant once Article 2 is satisfied.
- Apply the output-use test in Article 2(1)(c) to third-country operations — a provider established outside the EU whose AI system’s output is used by anyone in the EU falls within scope.
- Do not rely on the open-source exclusion without checking the three exceptions — an open-source AI system that is high-risk, prohibited, or subject to Article 50 transparency obligations remains within scope.
- Read the scientific R&D exclusion carefully — real-world condition testing is not excluded, and a system that moves from R&D to market placement triggers full scope from that point.
- Monitor the Digital Omnibus’s effect on Article 2 — scope is the provision most likely to have changed in ways that affect practical reach, particularly for third-country actors.
Common mistakes
Assuming the AI Act applies only to EU-established companies is a common mistake — Article 2(1)(a) covers providers irrespective of location, and Article 2(1)(c) extends scope to any provider or deployer whose AI system’s output is used in the Union.
Treating the open-source exclusion as a blanket carve-out is a second mistake — the exclusion does not apply if the system is high-risk, prohibited, or subject to Article 50 transparency obligations.
Assuming the scientific R&D exclusion covers pilot deployments or proof-of-concept testing in real conditions is a third mistake — Article 2(8) explicitly preserves scope for real-world condition testing.
Assuming GDPR and the AI Act operate independently is a fourth mistake — Article 2(7) preserves GDPR applicability in full; AI Act compliance activities that involve personal data processing must comply with both.
Open questions
- Whether the Digital Omnibus has changed the scope, exclusions, or output-use test in Article 2 — the page carries the Omnibus disclaimer; the text described here is pre-amendment and may not reflect the current legal position.
- How the “output used in the Union” test in Article 2(1)(c) is interpreted in practice — no Commission guidance specifically addressing the output-use threshold was identified on this research pass.
- Whether the Section B Annex I partial-scope rule has been affected by the Omnibus — not confirmed; the Omnibus disclaimer applies to the whole of Article 2.
Frequently asked
FAQ
FAQ
FAQ