EU AI Act for an Argentine automated company: what applies, and from when

Does it reach a company established in Argentina?

Article 2(1) lists who the Regulation applies to. Two of its seven points do not depend on where the company sits:

'(a) providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country; […] (c) providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union'.

Point (f) adds 'authorised representatives of providers, which are not established in the Union', and point (g) 'affected persons that are located in the Union'. So the test is not the registered office. It is whether the system reaches the Union market, or whether what the system produces is used there: a quote sent to a customer in Madrid, a support conversation with a user in Berlin, a credit decision about a resident of Lisbon.

What is outside: 'deployers who are natural persons using AI systems in the course of a purely personal non-professional activity' (Article 2(10)); research and development before a system is placed on the market (Article 2(8)); systems 'released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 or 50' (Article 2(12)); and military, defence and national-security uses (Article 2(3)). An automated company, by definition a professional activity, does not fit the personal-use exception.

Provider or deployer: the two roles that decide everything

The Regulation attaches obligations to roles, and a single company can hold a different role for each system it runs. Article 3 defines them:

Two definitions matter for the calendar. 'Placing on the market' is 'the first making available of an AI system or a general-purpose AI model on the Union market' (3(9)); 'putting into service' is 'the supply of an AI system for first use directly to the deployer or for own use in the Union for its intended purpose' (3(11)). And the Regulation's own definition of an AI system (3(1)) is broad enough to cover the agents this site writes about: 'a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments'.

The roles can switch. Under Article 25(1), a deployer or other third party 'shall be considered to be a provider of a high-risk AI system' if it puts its name on one already on the market, makes a substantial modification to one, or, point (c), modifies 'the intended purpose of an AI system, including a general-purpose AI system, which has not been classified as high-risk […] in such a way that the AI system concerned becomes a high-risk AI system'. An automated company that repurposes a general assistant to rank job candidates has just become the provider of a high-risk system.

The calendar after the July 2026 Omnibus

The Regulation entered into force on 1 August 2024 and 'shall apply from 2 August 2026' (Article 113, second paragraph). Regulation (EU) 2026/1744, the Digital Omnibus on AI adopted on 8 July 2026 and in force since 27 July 2026, rewrote two of the exceptions and added a third. The dates as they stand in the consolidated text:

Legacy rules follow the same logic. High-risk systems already on the market before the Chapter III date are covered 'only if, as from that date, those systems are subject to significant changes in their designs', except that systems 'intended to be used by public authorities' must comply by 2 August 2030 (Article 111(2)). Providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking duty of Article 50(2) (Article 111(4)). Providers of general-purpose models placed on the market before 2 August 2025 have until 2 August 2027 (Article 111(3)).

The Omnibus did more than move dates. It defined 'small mid-cap enterprise' or 'SMC' by reference to Recommendation (EU) 2025/1099 (Article 3(14b)) and 'SME' by reference to Recommendation 2003/361/EC (3(14a)); it let SMEs and SMCs use 'a simplified technical documentation form' that notified bodies must accept (Article 11(1)); it made the initial provider cooperate with whoever becomes the new provider under Article 25 (Article 25(2)); it narrowed what counts as a safety component (Article 6(1a) to (1c)); it required every Member State to have at least one regulatory sandbox 'operational by 2 August 2027' (Article 57(1)); and it lowered the fine cap for SMCs (Article 99(6a)).

What applies to every operator already

AI literacy (Article 4, since 2 February 2025)

'Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.'

The last sentence is the Omnibus's addition: the duty is one of means. For an automated company 'without requiring employees in a dependent relationship' (bill PE-193/26, art. 14), the persons 'dealing with the operation and use of AI systems on their behalf' are its directors, its human representative if the bill ends up requiring one, and whichever contractors configure the agents.

Prohibited practices (Article 5, since 2 February 2025)

Article 5(1) bans placing on the market, putting into service or using AI that: deploys 'subliminal techniques beyond a person's consciousness or purposefully manipulative or deceptive techniques' that distort behaviour and cause significant harm (a); exploits vulnerabilities 'due to their age, disability or a specific social or economic situation' (b); scores people socially with detrimental treatment in unrelated contexts or disproportionate to the behaviour (c); predicts criminal offending 'based solely on the profiling of a natural person or on assessing their personality traits and characteristics' (d); builds facial-recognition databases by 'untargeted scraping of facial images from the internet or CCTV footage' (e); infers emotions 'in the areas of workplace and education institutions', save for medical or safety reasons (f); categorises people biometrically to infer 'race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation' (g); or uses real-time remote biometric identification in public spaces for law enforcement outside the listed exceptions (h). From 2 December 2026, points (ba) and (bb) add sexual deepfakes of identifiable persons without 'freely-given, specific, informed, unambiguous and explicit consent' and child sexual abuse material, with the conditions of the new paragraphs 1a and 1b.

For a commercial automated company the live risks are (a), (b) and (f): a sales agent optimised to pressure, a pricing agent that targets people in financial distress, an internal tool that reads the mood of contractors on calls. Breaching Article 5 carries the highest fine tier (below).

Transparency: agents that talk, write and generate (Article 50, from 2 August 2026)

Article 50 is the part of the Regulation an automated company meets first, because it targets exactly what such a company does: interact with people and produce content. Four duties, by role:

The information 'shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure' (50(5)). Who owes the chatbot duty depends on who is the provider of the chatbot: a company that runs a licensed assistant is its deployer, and the design duty of 50(1) sits with whoever built it; a company that assembles its own agent on top of a general-purpose model and puts it into service under its own name is the provider. Breaches of Article 50 are in the second fine tier (Article 99(4)(g)). The Omnibus replaced paragraph 7: the Commission is to 'encourage and facilitate the drawing up of codes of practice at Union level' for marking and labelling and may adopt an implementing act if a code is inadequate.

High-risk systems: which uses, from when, what a deployer owes

Article 6 has two doors. Under 6(1), a system is high-risk if it is a safety component of a product listed in Annex I (machinery, toys, lifts, medical devices, vehicles and the like) that needs third-party conformity assessment; the Omnibus added that systems 'solely used for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control shall not qualify as safety components' (6(1a)). Under 6(2), 'AI systems referred to in Annex III shall be considered to be high-risk'. Annex III lists eight areas; the ones a service company can walk into are these:

• Employment, workers' management and access to self-employment (point 4): systems 'intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates', and systems used 'to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships'.
• Access to essential private and public services (point 5): systems 'to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud' (b), and 'for risk assessment and pricing in relation to natural persons in the case of life and health insurance' (c).
• Biometrics (point 1), where permitted: remote identification, biometric categorisation by sensitive attributes, emotion recognition.
• Education, critical infrastructure, law enforcement, migration, justice and democratic processes (points 2, 3, 6, 7, 8) concern public bodies and regulated sectors more than a trading company.

Article 6(3) takes a system off the list 'where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making', if it performs 'a narrow procedural task', improves 'the result of a previously completed human activity', only detects decision patterns without replacing human assessment, or performs 'a preparatory task'; but 'an AI system referred to in Annex III shall always be considered to be high-risk where the AI system performs profiling of natural persons'. A provider that relies on this carve-out 'shall document its assessment before that system is placed on the market or put into service' and register it (6(4), 49(2)).

What a deployer of a high-risk system owes (Article 26, from 2 December 2027 for Annex III)

• Use it 'in accordance with the instructions for use accompanying the systems' (26(1)).
• 'Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support' (26(2)).
• Ensure 'input data is relevant and sufficiently representative', to the extent it controls it (26(4)).
• Monitor operation, and where the use 'may result in that AI system presenting a risk', inform the provider or distributor and the market surveillance authority 'without undue delay' and 'suspend the use of that system'; report serious incidents (26(5)).
• Keep the automatically generated logs 'for a period appropriate to the intended purpose […] of at least six months' (26(6)).
• Where the deployer is an employer, inform 'workers' representatives and the affected workers that they will be subject to the use of the high-risk AI system' before using it at the workplace (26(7)).
• Use the provider's information to carry out a data protection impact assessment where the GDPR requires one (26(9)).

Article 26(2) is the closest thing in the Regulation to the Argentine bill's duty of configuration and supervision: oversight must be assigned to natural persons, and to competent ones. For an automated company that is precisely the question the Senate has been debating since August: who those persons are.

Selling an AI system into the Union: the authorised representative

If the automated company is the provider of a high-risk system and wants it on the Union market, Article 22(1) comes first:

'Prior to making their high-risk AI systems available on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative which is established in the Union.'

The mandate must empower the representative to verify that the EU declaration of conformity and the technical documentation 'have been drawn up and that an appropriate conformity assessment procedure has been carried out', to keep them 'for a period of 10 years' at the disposal of the authorities, to hand over documentation and 'access to the logs' on reasoned request, to cooperate with the authorities and to handle registration (22(3)(a) to (e)). The representative 'shall terminate the mandate if it considers or has reason to consider the provider to be acting contrary to its obligations' and must tell the authority why (22(4)). Failing to appoint one, or the representative failing its duties, is in the second fine tier (99(4)(b)).

Two further duties travel with the provider role. Article 25(4), rewritten by the Omnibus, requires the provider of a high-risk system and 'the third party that supplies an AI system, AI model, tools, services, components, or processes that are used or integrated in a high-risk AI system' to specify 'by written agreement' the information, capabilities and technical access the provider needs to comply; the exception is third parties publishing under free and open-source licences other than general-purpose models. And Article 53 puts the documentation, copyright-policy and training-content-summary duties on providers of general-purpose AI models: a company that builds its agents on somebody else's model does not inherit them, unless it trains and markets a model of its own.

Fines, and the SME and small mid-cap caps (Article 99)

The amounts are ceilings that Member States apply through their own regimes (99(1)), which 'may also include administrative fines, warnings and non-monetary measures'; when imposing penalties they 'shall take into account the interests of SMEs, including start-ups, and SMCs, and their economic viability'. The SME definition is borrowed from Recommendation 2003/361/EC (3(14a)), which turns on headcount and turnover; the consolidated text does not condition it on being established in the Union. Whether a given Argentine company qualifies is a question for counsel, not for this page.

Side by side with the Argentine bill

The two texts regulate different layers. The AI Act says nothing about who the company is; the bill says nothing about which systems are risky. Where they touch, this is how the questions line up (the bill's articles as transcribed on this site; the AI Act as consolidated on 27 July 2026):

The practical consequence: an Argentine automated company that trades with Europe would carry the bill's human responsible at home and the Regulation's competent overseers and, if it sells a high-risk system, an EU representative. None of the three roles replaces another.

What an automated company would do now

1. Map every AI system it runs and, for each, whether it is provider or deployer (Article 3(3), (4)) and whether outputs reach the Union (2(1)(c)).
2. Check Article 5 against each system's design and incentives; that duty has applied since 2 February 2025 and carries the top fine tier.
3. Document AI literacy measures for directors, representatives and contractors (Article 4): a duty of means, already in force.
4. From 2 August 2026, comply with Article 50: customer-facing agents must disclose they are AI unless it is obvious; generated content must be marked; deep fakes and AI text on matters of public interest must be disclosed.
5. Classify against Annex III: recruiting, task allocation, performance monitoring, credit scoring and insurance pricing are high-risk from 2 December 2027; if a carve-out of 6(3) is claimed, write down the assessment (6(4)).
6. If it is the provider of a high-risk system for the Union market, appoint an authorised representative established there before selling (Article 22), and put the supplier obligations of Article 25(4) in writing.
7. Assign human oversight to named, competent natural persons and keep logs for at least six months (26(2), (6)); those are also the facts the Argentine directors will need to show they configured and supervised the system (bill, art. 102).
8. Check the SME or SMC definition with counsel: it decides which fine cap applies (99(6), (6a)) and whether the simplified technical documentation form is available (11(1)).