An Australian business may need to assess the EU AI Act when it supplies an AI system into the EU or its system's output is used there. Duties depend on the role, use case and applicable provisions. Map those facts and check current official guidance before making a compliance decision; this article is an orientation, not a legal determination for your business.
Does the EU AI Act apply to Australian businesses?
EU market activity and use of AI outputs in the EU can bring an Australian organisation within scope. The result depends on the organisation's role, the specific system and applicable exclusions. Location alone is not a complete test.
The Act is extraterritorial in the same way the GDPR is. It catches providers and deployers outside Europe when their systems or outputs reach the EU. Concrete examples of Australian exposure:
- An Australian SaaS product with EU customers that includes AI features - you are likely a provider placing a system on the EU market.
- An Australian recruiter screening candidates for EU-based roles with an AI ranking tool - the output is used in the EU, and hiring is a high-risk category under the Act.
- An Australian manufacturer exporting products with embedded AI into the EU - covered through the product rules.
If there is EU exposure or uncertainty about the role your business plays, obtain advice on that specific use case. Existing Australian obligations need their own assessment.
What does the EU AI Act actually regulate?
The Act takes a risk-based approach with prohibited practices, high-risk requirements, transparency duties and rules for general-purpose models. Classification depends on the actual use and legal conditions; everyday product labels are not a substitute for that assessment.
The tiers, from heaviest to lightest:
- Prohibited practices: specific uses listed in the Act, with defined conditions and exceptions.
- High-risk systems: specified product and use-case categories with additional duties.
- Transparency: requirements for certain interactions and generated content.
- Other uses: assess applicable provisions and other laws rather than assuming that a lower-risk label removes every obligation.
Separately, providers of general-purpose AI models - the companies behind Claude, ChatGPT and Gemini - carry their own documentation, copyright and safety obligations. Those duties sit with the model providers, not with the businesses using the models.
Key dates and penalties
Implementation is phased and the timetable has changed. Check the European Commission's current timeline and the enacted provisions for the system involved before relying on an older 2026 or 2027 deadline.
As checked on 29 September 2026, the Commission describes 2 December 2027 for certain high-risk use cases and 2 August 2028 for high-risk AI embedded in regulated products, following the AI Omnibus political agreement. Other provisions apply on different dates. Confirm the final legal position for the specific obligation.
Penalties depend on the breach and the organisation. Use the official material and qualified advice rather than a single headline maximum to assess exposure.
What is Australia doing instead?
Australian privacy, consumer, discrimination and sector obligations may apply to AI use. Check the current rules for the business and proposed use rather than assuming that the absence of a single AI statute removes those duties.
Use the relevant Australian regulator's current guidance, including OAIC guidance where personal information is involved. Identify the accountable person, permitted data use, review process and required records.
Australian and EU requirements are separate assessments. A design principle or voluntary framework is not a certificate of legal compliance.
What should an Australian SMB actually do now?
List the proposed AI uses, responsible people, data flows and consequential outputs. Identify any EU connection and obtain the right legal or professional review before treating the workflow as compliant.
None of this requires a compliance team. An inventory is a page. An approval gate is a workflow rule. A data map is part of scoping any decent automation build - it is how we run security and data handling on every Horizon AI workflow: defined data paths, human approval on client-facing and regulated outputs, and an audit trail of every AI action.
A technical assessment can document the system and intended use. A legal interpretation of the Act should be confirmed by qualified counsel; a short implementation call does not settle it.
Official sources
Product information checked on 2026-09-29. Availability and permissions should be confirmed for your account.