Does the EU AI Act apply to my Canadian startup?

Canada has no general AI statute, so for many Canadian AI startups the first AI-specific law they actually have to map against is European. The EU AI Act (Regulation (EU) 2024/1689) reaches companies outside the EU, and its obligations turn on what role you play and how risky the use is. For the Canadian picture, see is AI regulated in Canada and our AI law tracker.

When does the AI Act reach a company outside the EU?

Article 2 sets the scope. In broad terms, the Act applies to:

• Providers that place AI systems on the EU market or put them into service there, or place general-purpose AI models on the EU market, wherever the provider is established.
• Deployers established or located in the EU.
• Providers and deployers in a third country, such as Canada, where the output produced by the AI system is used in the EU.

So a Toronto SaaS company selling an AI feature to customers in Germany is likely a provider placing an AI system on the EU market. A Canadian company with no EU customers whose tool produces output used in the EU can also be caught. A company with no EU users or customers generally isn’t.

Am I a provider or a deployer?

Role	Who it is	Typical startup example
Provider	Develops an AI system or general-purpose model, or has one developed, and places it on the market or puts it into service under its own name or trademark	You build a product with an AI feature, including one built on a third-party model, and sell it under your brand
Deployer	Uses an AI system under its authority in a professional capacity	Your EU customer using your product, or you using an AI tool internally

Most obligations fall on providers, and the heaviest fall on providers of high-risk systems. Building on another company’s model doesn’t stop you being the provider of your own AI system. Putting your name on a high-risk system, substantially modifying one, or changing a system’s intended purpose so that it becomes high-risk can also make you its provider.

What are the risk tiers?

• Prohibited practices (Article 5). Including certain manipulative or deceptive techniques that cause significant harm, exploiting vulnerabilities, social scoring, untargeted scraping of facial images to build facial recognition databases, and emotion recognition in workplaces and schools, with limited exceptions. The AI Omnibus added a ban on AI systems that generate child sexual abuse material or non-consensual intimate imagery.
• High-risk systems. AI used as a safety component of regulated products (Annex I), and stand-alone uses listed in Annex III, which include areas such as employment and worker management, education, credit scoring, life and health insurance pricing, and access to essential services. These carry duties such as risk management, data governance, technical documentation, logging, human oversight and conformity assessment. A provider outside the EU must appoint an authorised representative in the EU.
• Transparency risk (Article 50). Disclosure duties for chatbots, generated content, deepfakes and some biometric uses.
• Minimal risk. Most AI features, such as spam filters or writing assistance with no other risk factors, have no specific obligations under the Act.

General-purpose AI models have their own rules on documentation, copyright policies and training content summaries, with more for models with systemic risk. These mostly concern the model developers, not startups building on their models.

What are the dates now?

In November 2025 the European Commission proposed a “Digital Omnibus” to delay the high-risk rules. The AI part was adopted as Regulation (EU) 2026/1744, published in the Official Journal on July 24, 2026 and in force since July 27, 2026. Based on that amendment and the Commission’s timeline:

Obligation	Applies from
Prohibited practices	February 2, 2025
General-purpose AI model obligations	August 2, 2025
Article 50 transparency duties	August 2, 2026
Machine-readable marking of generated content, for generative systems already on the market before August 2, 2026	December 2, 2026
New ban on systems generating child sexual abuse material or non-consensual intimate imagery	December 2, 2026
High-risk systems listed in Annex III	December 2, 2027
High-risk AI in products covered by Annex I	August 2, 2028

The high-risk duties were deferred, not removed. Fines under the Act can reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for most other breaches, with the lower of the two amounts applying to SMEs.

What do the transparency duties require?

Under Article 50, in summary:

• Providers must design AI systems that interact directly with people so users are told they’re dealing with an AI system, unless that’s obvious.
• Providers of systems that generate synthetic audio, images, video or text must mark the output in a machine-readable format so it can be detected as AI-generated.
• Deployers that publish deepfakes must disclose that the content is artificially generated or manipulated, and deployers of emotion recognition or biometric categorisation must inform the people exposed to it.

These overlap with good practice in Canada. See do I have to tell people my product uses AI.

What should a Canadian startup do?

• List each AI feature, who uses it and whether any customers, users or outputs are in the EU.
• Decide whether you’re a provider or deployer for each one.
• Screen for prohibited practices and Annex III uses, especially in HR tech, edtech, fintech and insurtech.
• Build the Article 50 disclosures and content marking into the product now, since they already apply.
• Put the allocation of AI Act responsibilities into your customer contracts and AI product terms.
• If anything may be high-risk, get advice from EU counsel on classification and conformity.

What to do next

We advise on Ontario and Canadian law, not EU law, but we can help you inventory your AI features, update your AI product terms and SaaS agreement, and work alongside EU counsel where you need one. Fixed fees are on our fees page. See also our resources for AI startups.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To talk through whether your product reaches the EU, book a free 15-minute consult.