5 Things North American Firms Must Know About The EU AI Act

In August 2024, the European Union officially brought the EU AI Act into effect.

Although it’s a European regulation, its reach extends far beyond Brussels — and many North American tech firms are already feeling the consequences.

Here’s what business leaders should know — and how to act.

---

Why It Matters (Even Outside the EU)

• The EU AI Act has extraterritorial scope: any company that markets, deploys, or uses AI systems whose outputs are used within the EU can fall under its rules. [1]

• Canadian firms exporting AI-enabled products or embedding AI modules in tools used by European clients must assess compliance now. [2]

• The “Brussels Effect” suggests that many non-EU firms will end up aligning with EU standards to simplify compliance across multiple jurisdictions. [3]

---

What the Regulation Says

• AI systems are classified by risk levels — from “minimal” to “high risk” and “unacceptable.” The higher the risk, the stricter the obligations. [1]

• Penalties for non-compliance are severe: up to €35 million or 7% of global turnover, whichever is higher. [4]

• Implementation is phased:
  • Basic obligations begin in February 2025
  • Rules for general-purpose AI models start in August 2025
  • High-risk system requirements apply from August 2026 [5]

• Despite industry pressure, the EU refused to delay enforcement, signaling regulatory confidence. [6]

---

The Cost — Real or Theoretical?

• The Computer & Communications Industry Association (CCIA) estimates compliance with the AI Act could cost as much as USD $430 million annually for large U.S. service providers. [7]

• A KPMG / CIO Dive survey found that over 50% of business leaders expect AI compliance and security requirements to raise costs. [8]

• Data breaches in 2024 averaged $4.88 million per incident, with weak AI governance amplifying that risk. [9]

• An EY survey (2025) of nearly 1,000 executives found that almost every large company deploying AI reported initial financial losses totaling $4.4 billion globally, largely due to compliance failures and flawed outputs. [10]

---

Strategic Questions for Tech Leaders

Challenge	Key Question
Triggering jurisdiction	Will our product or AI output be used within the EU?
Risk classification	Does it fall under “general purpose” or “high risk”?
Compliance burden	What documentation, audit, and reporting obligations apply?
Cost vs ROI	Will compliance erode profitability or delay innovation?
Competitive positioning	Should we adopt EU compliance globally as a “trust signal”?

---

Actionable Steps

1. Map your AI exposure — identify all models or features that touch EU markets.

2. Classify risk levels — apply the Act’s definitions early.

3. Build compliance infrastructure — documentation, audits, bias checks, risk logs.

4. Adopt “trustworthy by design” principles — human oversight and transparency.

5. Monitor evolving guidance — the EU will release codes of practice and model risk templates further.

6. Plan market entry — consider delaying EU launches until compliance processes are mature.

---

Bottom Line

Europe’s AI regulation is no longer a local matter — it’s becoming the global baseline.

For North American firms, waiting is riskier than preparing early. 

---

References

[1] Skadden — “The EU AI Act: What Businesses Need to Know”
https://www.skadden.com/insights/publications/2024/06/quarterly-insights/the-eu-ai-act-what-businesses-need-to-know

[2] Miller Thomson — “Impact of the EU Artificial Intelligence Act on Canadian Companies”
https://www.millerthomson.com/en/insights/cybersecurity/eu-artificial-intelligence-act-implementation-timeline-impact-canadian-companies

[3] McCarthy Tétrault — “Navigating the Future of AI Law: The EU AI Act and Canada’s AIDA”
https://www.mccarthy.ca/en/insights/blogs/techlex/10-key-takeaways-navigating-future-ai-law-understanding-eu-ai-act-and-aida

[4] EY — “The EU AI Act: What It Means for Your Business”
https://www.ey.com/en_ch/insights/forensic-integrity-services/the-eu-ai-act-what-it-means-for-your-business

[5] TechRepublic — “Companies Request EU AI Act Delay, But Implementation Moves Forward”
https://www.techrepublic.com/article/news-companies-request-eu-ai-act-delay

[6] Techzine — “EU Sticks to AI Act Timeline Despite Pressure”
https://www.techzine.eu/news/privacy-compliance/132765/eu-sticks-to-ai-act-timeline-despite-pressure-from-companies

[7] CCIA Report — “EU Digital Regulation Factsheet” (2025)
https://ccianet.org/wp-content/uploads/2025/03/CCIA_EU-Digital-Regulation-Factsheet_reportfinal.pdf

[8] CIO Dive — “AI Regulation and Security Expected to Raise Enterprise Costs”
https://www.ciodive.com/news/enterprise-cost-increase-ai-regulation-security-data/724345

[9] DataRobot — “The Cost of Misbehaving AI”
https://www.datarobot.com/blog/misbehaving-ai-cost

[10] Reuters — “Most Companies Suffer Some Risk-Related Financial Loss Deploying AI — EY Survey (2025)”
https://www.reuters.com/business/most-companies-suffer-some-risk-related-financial-loss-deploying-ai-ey-survey-2025-10-08