EU AI Act Compliance for MENA & Gulf Companies Selling to the EU (2026 Guide)

Yes, the EU AI Act can apply to companies outside the EU: if you sell an AI system in the EU, or its output is used there, you are in scope even without an EU office. Most obligations apply from 2 August 2026, so MENA and Gulf companies should map their AI use now.

Does the EU AI Act apply outside the EU?

The Act follows the product, not the company’s address. It covers providers that place AI systems on the EU market, deployers that use them in the EU, and providers or deployers outside the EU whose AI output is used in the EU. A Moroccan software company selling to French clients, a Gulf platform with European users, or a MENA agency using AI to produce work for EU clients can all be affected.

Being in scope does not mean heavy obligations. Most everyday AI uses fall in the lower risk tiers, where the main duties are transparency and good practice. The point is to know where you stand.

A practical test: if you removed every EU customer, user and partner from your business, would any of your AI systems still be used? If the answer is no for a given system, that system almost certainly needs a place in your EU AI Act inventory.

Who in MENA and the Gulf is typically affected

• Software and SaaS companies with EU customers that include AI features, such as scoring, recommendations or chat assistants.
• Recruitment, education, credit and insurance services used by people in the EU, which can fall in the high-risk category.
• Companies that use AI chatbots or generated content in communication with EU customers, which brings transparency duties.
• Suppliers to EU companies, whose clients will ask them to prove compliance in contracts and questionnaires.

Many companies discover they are concerned through a client. A European buyer sends a supplier questionnaire with a section on AI: which models you use, what data they see, who checks the output, how you inform end users. Being able to answer quickly and in writing is already a commercial advantage.

The key dates

The Act is already in force and applies in stages. The bans on prohibited practices and the rules for general-purpose AI models already apply. Most remaining obligations, including those for many high-risk systems, apply from 2 August 2026, with some later dates for specific cases.

Timelines can be adjusted by the EU, so always check the current timetable on the official EU website before planning, and do not rely on any article, including this one, as the final word.

The four risk tiers

• Unacceptable risk: banned practices, such as certain manipulation or social scoring.
• High risk: systems used in areas like hiring, education, credit or essential services, with requirements for risk management, data quality, documentation, human oversight and registration.
• Limited risk: transparency duties, for example telling people they are talking to an AI, or labelling generated content.
• Minimal risk: most other uses, with no specific obligations beyond good practice.

Penalties for breaches scale with the company’s worldwide turnover; the exact levels are set in the official text.

Classification is where most of the work and most of the debate sits. Write down your reasoning for each system, because a regulator or a client will want to know not only which tier you chose but why, and that note is what makes your choice defensible.

A six-step readiness checklist

1. Inventory: list every AI system you build, sell or use, including features inside third-party tools.
2. Scope: mark which ones reach the EU market or EU users.
3. Classify: assign each one to a risk tier, with your reasoning written down.
4. Gap analysis: compare what you do today with what each tier requires.
5. Document: prepare the records the Act asks for, starting with the highest risk.
6. Assign owners: name who keeps each system compliant, and review regularly.

Common mistakes: assuming the Act only concerns EU companies, forgetting AI features inside bought software, and leaving documentation until a client asks for it.

How OWL & GOATS helps you get ready

We run EU AI Act readiness as a fixed-price, scoped project rather than an open-ended engagement. Our AI specialists do the inventory and drafting, a person reviews every classification and document, and a founder approves the result. An EU AI Act audit is listed on our pricing page in credits, and a first project starts at $2,500 (12,900 MAD in Morocco).

We are not a law firm and do not give legal opinions. For formal legal advice, we prepare you and work alongside your lawyer. We work in English, French and Arabic, which matters when your teams and your EU clients do not share a language.

What happens if you ignore it?

The first consequence is usually commercial, not regulatory: EU clients add AI clauses to contracts and send compliance questionnaires, and suppliers who cannot answer lose deals. Later, regulators can investigate and fine, with penalties that scale with turnover. Starting with a simple inventory now costs little and protects both sales and reputation.

Readiness also improves your own operations. An up-to-date inventory of AI systems shows where data goes, who is responsible and what could go wrong, which is useful for security, privacy and quality, not only for the regulation.

Read next

• Fixed-Price EU AI Act Readiness Assessment
• Ready for Europe’s new rules
• AI Legal & Compliance
• Systems & Operations

Questions