There is a recurring pattern in discussions around the EU AI Act.
Teams move quickly into questions of compliance:
What documentation is required?
How should governance be structured?
Which tools can support implementation?
But in many cases, a more fundamental question remains unanswered:
Are we actually in scope?
This is not a preliminary formality. It is a structural determination that shapes everything that follows.
The EU AI Act does not apply generically to “AI companies.”
It applies to specific roles within the lifecycle of an AI system—most notably providers, deployers, importers, and distributors.
Those roles are not static.
They depend on how a system is:
– developed
– integrated
– distributed
– used in a given context
A single system can fall in or out of scope depending on how it is positioned within a value chain. A company may operate outside the scope in one configuration and within it in another—without any meaningful change to the underlying technology.
This creates a layer of complexity that is often underestimated.
Most teams think in terms of products.
The regulation operates in terms of functions and responsibilities within a system.
That distinction matters.
If your role is misidentified, downstream work—risk classification, documentation, controls—will be built on incorrect assumptions. And those assumptions tend to surface at the worst possible moment: during procurement, due diligence, or regulatory review.
In practice, determining whether you are in scope requires:
– a clear mapping of your system architecture
– an understanding of how your system is placed in a broader ecosystem
– a precise identification of your role under the Act
Only once that foundation is established does it make sense to move into governance design or compliance execution.
Compliance does not begin with documentation.
It begins with correctly understanding your position.
Everything else follows from that.
