In Part 2 of my blog series related to the preparation for the application of the AI Act, I deal with the scope of the AI Act, i.e. I examine in more detail the personal, territorial and material scope of application of the regulation. The exceptions to the scope of the regulation will also be discussed below. The question of personal, territorial and material scope is contained in Article 2 of the AI Act, so I will start from the interpretation of this Article.

1. Who is covered by the AI Act and with what territorial scope?

As I discussed in Part 1 of these series, the scope of the AI Act covers the following operators:

• provider
• deployer
• importer
• distributor
• product manufacturer
• authorised representative of non-EU providers.

In order to decide whether the AI Act should apply to the specific activities of these operators, the provisions on territorial scope should also be taken into account. With regard to the territorial scope, it is worth pointing out that a solution familiar from the GDPR will also appear in the AI Act, according to which even entities established outside the EU will have to apply the requirements of the regulation if their activities also extend to the EU (e.g. AI systems are placed on the market or put into service in the EU, or outputs produced by an AI system are used in the EU).

This extraterritorial scope should ensure that providers or deployers of AI systems placed on the market or put into service in the EU or having an impact on persons located in the EU cannot avoid the application of EU law by choosing their place of establishment. This is also referred to in the recitals to the AI Act, which stresses the need to apply the regulation to providers of AI-systems in a non-discriminatory manner, irrespective of whether they are established within the Union or in a third country, and to deployers of AI systems established within the Union, in order to ensure a level playing field and an effective protection of rights and freedoms of individuals across the Union (see Recital (21)).

Let's take a look at the territorial scope rules for each operator:

• provider: the AI Act covers all providers that place AI systems on the market or put into service (or place general-purpose AI models on the market) in the EU, regardless of whether they are established or located in the EU or in a third country; [The place of establishment/location of providers is therefore not a decisive criterion for the applicability of the AI Act by providers, the essential element is that the AI system/general-purpose AI model is placed on the market or put into service in the EU or that the output produced by the AI-system is used in the Union.]
• deployer: it is established or located within the Union, except in the case of a deployer established or located in a third country that uses the outputs produced by an AI system in the EU;
• importer: it is part of the definition of importers that an importer must be a person located or established in the Union who places on the market an AI system bearing the name or trademark of a person established in a third country;
• distributor: being established or located in the EU is not a conceptual element, but the AI system must be made available on the Union market in any case for the AI Act to apply to distributors;
• product manufacturer: it is also not needed that the product manufacturer to be established/located in the EU, but the product must of course be placed on the market or put into service on the Union market;
• authorised representative: can only be a person established or located in the EU.

Overall, we see that in the case of the importer and the authorised representative, it is absolutely necessary that they are persons located or established in the Union, whereas this is also the general rule for the deployer, but there is an exception to this (when the output produced by the AI system operated by the deployer established or located in a third country is used in the Union). For other operators (providers, distributors, product manufacturers), the place of establishment/location is not decisive for the scope of the AI Act, but the AI system must be placed on the market or put into service in the EU. 

Affected persons are also required to reside in the EU for the purposes of being in the scope of the AI Act. (Therefore, the AI Act does not apply in cases where a provider/deployer from outside the EU applies an AI system to persons located outside the EU. E.g. if an EU citizen travels to the USA and an AI system developed and marketed by a local provider is applied to that person, then this activity does not fall within the scope of the AI Act, even if an EU citizen is affected by the use of the AI system.)

(For further visual explanation regarding the territorial scope, please see the Annex below.)

2. Material scope

The AI Act should apply to AI systems or general-purpose AI models and general-purpose AI systems.

2.1. AI system

According to the AI Act, an AI system means 

• a machine-based system
• that is designed to operate with varying levels of autonomy and
• that may exhibit adaptiveness after deployment, and
• that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions
• that can influence physical or virtual environments.

(See Article 3(1) of the AI Act.)

For the requirements of AI Act to apply, it is necessary that the given system falls within the scope of the above definition, i.e., it must be an AI system. In connection with the above conceptual elements, the question is how AI systems can be distinguished from "traditional" IT systems, since several of the above elements also apply to "traditional" IT systems. From the point of view of distinguishing AI systems from "traditional" IT systems, the existence of autonomy at different levels may be an essential element, since a system operating entirely as a rule-based system and showing no autonomy at all cannot qualify as an AI system, so the AI Act does not apply to it either. Adaptiveness may also be relevant, but the definition only mentions its existence as a possibility ('may demonstrate adaptiveness'), so it is not an essential element of an AI system.  

(I'll discuss the definition of AI systems in more detail in a separate post.)

2.2. General-purpose AI model and general-purpose AI system

General-purpose AI model means 

• an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale,
• that displays significant generality and
• is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and
• that can be integrated into a variety of downstream systems or applications,
• except AI models that are used for research, development or prototyping activities before they are placed on the market.

General-purpose AI system means

• an AI system which is based on a general-purpose AI model and
• which has the capability to serve a variety of purposes, both for direct use as well as for integration in other AI systems. 

(For the definitions, see Article 3, Points 63 and 66 of the AI Act.)

3. Exceptions to the scope of the AI Act

The AI Act provides for a number of exceptions when the AI Act does not apply even though the applicability of the AI Act could be established on the basis of its territorial and material scope. It is worth pointing out that an exception to the scope of the AI Act does not mean that other AI-specific or other relevant regulations, laws (e.g. data protection or Intellectual Property requirements) do not apply. Of course, this must always be checked separately in connection with the planned activity or system concerned. (E.g., an AI system developed solely for research purposes may not be subject to the AI Act - see below, but data protection rules will apply to the processing of personal data used to train the system.)

Several exceptions to the scope of the AI Act have been defined:

(i) Member States' competences concerning national security or AI systems for military, defence or national security purposes

The AI Act does not apply to 

• areas outside the scope of Union law, and shall not, in any event, affect the competences of the Member States concerning national security, regardless of the type of entity entrusted by the Member States with carrying out tasks in relation to those competences. 
• AI systems where and in so far they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities.
• AI systems which are not placed on the market or put into service in the Union, where the output is used in the Union exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities.

It is important to point out, however, that

... if an AI system developed, placed on the market, put into service or used for military, defence or national security purposes is used outside those temporarily or permanently for other purposes, for example, civilian or humanitarian purposes, law enforcement or public security purposes, such a system would fall within the scope of this Regulation. (See Recital (24), emphasis added) 

The exemption therefore extends only as long as the use is limited to military, defence or national security purposes.

The Act Act also applies when there is a placing on the market or putting into service for excluded use cases (military, defence or national security) and parallely, for other purposes (e.g. civil or law enforcement). (See also Recital (24).) 

(ii) AI systems for scientific research and development

The AI Act does not apply to 

• AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development.
• any research, testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service. Such activities shall be conducted in accordance with applicable Union law. Testing in real world conditions shall not be covered by that exclusion.

It should be highlighted from the recitals to the AI Act that "as regards product-oriented research, testing and development activity regarding AI systems or models, the provisions of this Regulation should also not apply prior to those systems and models being put into service or placed on the market" (see Preamble (25), emphasis added). Therefore, the exception from the scope of the AI Act can be applied not only for fundamental research but also for applied research. 

(iii) Use of AI systems by public authorities in third countries and international organisations in the framework of international cooperation or agreements for law enforcement and judicial cooperation

The AI Act does not apply to

• public authorities in a third country or to international organisations falling within the scope of the AI Act, where those authorities or organisations use AI systems in the framework of international cooperation or agreements for law enforcement and judicial cooperation with the Union or with one or more Member States, provided that such a third country or international organisation provides adequate safeguards with respect to the protection of fundamental rights and freedoms of individuals.

In this context, the recitals to the AI Act highlights that 

[...] The authorities competent for supervision of the law enforcement and judicial authorities under this Regulation should assess whether those frameworks for cooperation or international agreements include adequate safeguards with respect to the protection of fundamental rights and freedoms of individuals. Recipient national authorities and Union institutions, bodies, offices and agencies making use of such outputs in the Union remain accountable to ensure their use complies with Union law.  (See Recital (22). emphasis added)

The use of outputs by Member States' authorities should therefore also be subject to the provisions of the AI Act.

(iv) Personal use by natural persons

The AI Act does not apply to 

• obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity.

(This exception shows similarity with the so-called “household exception” under the scope of the GDPR. See Article 2 (2) c) of the GDPR.)

(v) AI systems released under free and open-source licences

The AI Act does not apply to

• AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 (prohibited AI practices) or 50 (transparency obligations for providers and deployers of certain AI systems).

(vi) Applicability of other legislation in the context of AI systems

• Union law on the protection of personal data, privacy and the confidentiality of communications applies to personal data processed in connection with the rights and obligations laid down in the AI Act. The AI Act shall not affect Regulation 2016/679 (GDPR) or 2018/1725 (data protection rules applicable to EU institutions and bodies), or Directive 2002/58/EC (e-Privacy Directive) or 2016/680 (Law Enforcement Data Protection Directive), without prejudice to Article 10(5) (exceptional processing of special categories of data for the purpose of ensuring bias detection and correction in relation to the high-risk AI systems) and Article 59 of the AI Act (further processing of personal data for developing certain AI systemsin the public interest in the AI regulatory sandbox).
• The AI Act is without prejudice to the rules laid down by other Union legal acts related to consumer protection and product safety.
• The AI Act shall not affect the application of the provisions on the liability of providers of intermediary services as set out in Chapter II of Regulation 2022/2065.
• The AI Act does not preclude the Union or Member States from maintaining or introducing laws, regulations or administrative provisions which are more favourable to workers in terms of protecting their rights in respect of the use of AI systems by employers, or from encouraging or allowing the application of collective agreements which are more favourable to workers.

(vii) Limited application regarding AI systems classified as high-risk AI systems in accordance with Article 6(1) related to products covered by the Union harmonisation legislation listed in Section B of Annex I

For AI systems classified as high-risk AI systems in accordance with Article 6(1) related to products covered by the Union harmonisation legislation listed in Section B of Annex I, only Article 6(1), Articles 102 to 109 and Article 112 apply. Article 57 applies only in so far as the requirements for high-risk AI systems under the AI Act have been integrated in that Union harmonisation legislation.

(This topic will be further discussed in separate posts.)

4. Checklist on the applicability of the AI Act

Each operator under the AI Act (provider, deployer, importer, distributor, product manufacturer, authorised representative) should ask the following (checking) questions regarding the applicability of the AI Act:

(a) For the purpose of determining material scope:

• Does the system concerned qualify as an AI system under the AI Act?
• (In the case of providers, the question may also arise: are they developing a general-purpose AI model?)

(b) With regard to territorial scope:

• Will the AI system be placed on the market or put into service in the EU or made available on the market or used in the EU?
• If the AI system is not placed on the EU market, put into service or used in the EU, will the outputs produced by the system be used in the EU?

(c) For defining the roles:

• Does the given entity place the AI system on the market or put it into service in the EU or does it make available on the market or use the AI system in the EU?
• (Regarding the use of the AI system: Under whose authority is the AI system used? Who is responsible for the AI system?)
• Does the entity use the outputs produced by the system in the EU?
• Is the entity established or located in the EU?
• Does the entity market the system under its own name or trademark or under the name or trademark of a third party? (Or does the entity represent a non-EU provider in the EU on the basis of an agreement?)

(d) Exceptions under applicability:

• Is the AI system placed on the market, put into service or used exclusively for military, defence or national security purposes, or is the output produced by the system used for those purposes in the EU?
• Is it an AI system or AI model developed and put into service specifically for the sole purpose of scientific research and development?
• Is it intended for use exclusively in the course of a personal, non-professional activity by a natural person?
• Is it an AI system released under free and open source licences? (Could these systems constitute prohibited AI practices or should transparency obligations for providers and users of certain AI systems apply?)
• Is the AI system that classifies as a high-risk system a product covered by the Union harmonisation legislation listed in the AI Act?
• (Is the AI system used by authorities in third countries or international organisations in the context of law enforcement and judicial cooperation?)

e) Other applicable legislation:

• What other legislation applies to a given AI system (general-purpose AI model), in particular rules on data protection, consumer protection, product safety, cyber and data security, intellectual property protection?

Annex: 

Visual explanation to some scenarios* to the territorial scope of the AI Act (under Art. 2 (1) of the AI Act) 

(*It is not an exhaustive list of scenarios, it gives only examples how the territorial scope of the AI Act might be applicable.)

1. Art. 2 (1) a) – Scenario 1: providers established or located within the Union placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union:

2. Art. 2 (1) a) – Scenario 2: providers established or located in a third country placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union: 

3. Art. 2 (1) b): deployers of AI systems that have their place of establishment or are located within the Union

4. Art. 2 (1) c): providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union

5. Art. 2 (1) d) – Scenario 1: importers of AI systems

6. Art. 2 (1) d) – Scenario 2: importers and distributors of AI systems

7. Art. 2 (1) e) – Scenario 1: product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark

8. Art. 2 (1) e) – Scenario 2: product manufacturers placing on the market or putting into service an AI systemtogether with their product and under their own name or trademark

9. Art. 2 (1) f):  authorized representatives of providers, which are not established in the Union

10. Art. 2 (1) b): affected persons that are located in the Union