The EU AI Act for Australian software vendors: what actually applies to you

Last updated: 28 July 2026 · Verified against Regulation (EU) 2024/1689 and the adopted Digital Omnibus texts · Not legal advice.

Australian SaaS vendors often arrive at the EU AI Act section of a buyer's questionnaire with a reasonable-sounding objection: Australia chose guidance over legislation, so a Sydney or Melbourne company answers to the AI Ethics Principles, not to Brussels. The objection fails on the Regulation's first pages: scope turns on where your system is sold and where its output is used, not on what your home jurisdiction chose to regulate.

Does the EU AI Act reach you?

Two clauses of Article 2(1) decide it for an Australian vendor:

• The market trigger — Art. 2(1)(a). Providers placing AI systems on the market or putting them into service in the Union are in scope irrespective of whether they are established in the Union or in a third country. One paying customer in the Netherlands or Spain puts an Australian vendor in scope as provider — full stop.
• The output trigger — Art. 2(1)(c). Third-country providers and deployers are in scope where the output produced by the AI system is used in the Union. An APAC-only customer list does not protect you: if a customer's European teams consume your AI's reports, scores or content, the output has crossed into the Union — and so have you.

These two clauses are the whole doorway. If neither applies, you are out of scope and entitled to say so. Our Article 50 checker runs the test question by question; the full non-EU vendor guide covers both triggers in depth.

What you owe if it does

For most B2B SaaS — limited-risk systems outside Annex III — the obligations are the Article 50 transparency duties, applicable since 2 August 2026. The Digital Omnibus postponed high-risk obligations; it did not postpone Article 50.

• 50(1) — if your product includes AI that interacts directly with people (chatbots, voice agents), users must be informed they are dealing with a machine.
• 50(2) — synthetic audio, image, video or text your product generates must carry machine-readable marking as artificially generated; systems already on the market have until 2 December 2026.

Mind the rebranding rule: a deployer becomes the provider when it markets a system under its own brand or substantially modifies it. An Australian SaaS that wraps GPT, Claude or any third-party model under its own name is the provider of the resulting system — the Article 50 duties are yours, not your model supplier's.

High-risk (Annex III) obligations apply from 2 December 2027, and only if your use case is listed. Article 50 fines can reach €15,000,000 or 3% of worldwide turnover, whichever is higher (Art. 99(4)(g)); SMEs pay the lower of the two (Art. 99(6)).

What Australian law adds (and what it doesn't)

Domestically, Australia has so far chosen voluntary settings over a standalone AI act: the AI Ethics Principles, the Voluntary AI Safety Standard (September 2024, updated by the National AI Centre's Guidance for AI Adoption in October 2025) and the National AI Plan of December 2025 — which confirmed reliance on existing technology-neutral laws and sector regulators, shelving the earlier proposal for mandatory guardrails in high-risk settings — alongside a rolling reform of the Privacy Act 1988. Canberra has since signalled that binding rules may follow, but as at this guide's legal base date there is no general, binding Australian AI act in force — verify the current state before asserting otherwise to a buyer. That cuts both ways: nothing domestic duplicates your Article 50 duties, but nothing Australian answers a buyer asking about the EU AI Act either. "We follow the AI Ethics Principles" or "we apply the Voluntary AI Safety Standard" answers a different, voluntary framework — reviewers notice.

Australian vendors inherit a second gap in EU deals: no EU adequacy decision. Transfers of personal data from EU customers to your Australian operations typically rest on Article 46 safeguards — in practice the Standard Contractual Clauses (Implementing Decision (EU) 2021/914) in your DPA. That is GDPR, not AI Act — but the same buyer reviews both, usually in the same document.

The questionnaire reality

Direct enforcement against a vendor with no EU establishment is not the near-term risk. The near-term risk arrives by email: your enterprise customers are in scope, so AI-CAIQ and SIG 2026 questionnaires — and AI sections in RFPs — now ask Australian vendors to state their EU AI Act position, and the buyer's legal team reads the answer.

Mini-FAQ

Australia has no binding AI law — does that keep the EU AI Act away from us?

No. The Act's scope is set by its own Article 2(1), irrespective of where the provider is established: placing a system on the EU market (Art. 2(1)(a)) or output used in the Union (Art. 2(1)(c)) is enough, whatever Australian law requires at home.

Do we need to appoint an authorised representative in the EU?

Not for a limited-risk system. The authorised-representative duty (Art. 22) attaches to providers of high-risk systems; Art. 54 extends a similar duty to general-purpose AI model providers. Most B2B SaaS is neither.

What about data transfers from EU customers to Australia?

A GDPR question, not an AI Act one — but it lands in the same questionnaire. Without an adequacy decision, EU-to-Australia transfers typically rely on the Standard Contractual Clauses in your DPA. Expect the buyer to check both sections.