The EU AI Act reaches outside the EU on purpose — the trigger is where an AI system's output is used, not where the business is located.
Short answer
It can, even though the business has no EU office. The EU AI Act (Regulation (EU) 2024/1689) writes its own scope to cover providers and deployers “located in a third country, where the output produced by the AI system is used in the Union”. A Canadian business selling an AI product to EU customers, or whose AI tool's output reaches people in the EU, can be captured by a European law it never opted into — something Canada has no equivalent of at all right now.
This is EU law, not Canadian law, and no Canadian regulator administers it — it is included here because the question is specifically about a European statute's reach into Canada. Article 2(1) of the Regulation lists who it applies to, and the operative clause for a Canadian business is clause (c): “providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union”. A separate clause, (a), catches any provider “placing on the market or putting into service” an AI system in the Union “irrespective of whether those providers are established or located within the Union or in a third country”. Between the two, a Canadian company can be reached either by selling into the EU market directly, or simply because what its AI system produces is used by someone in the EU, even if the sale itself happened elsewhere.
It's tempting to ask which Canadian rule is the EU Act's counterpart, and the honest answer is none. Bill C-27, which would have enacted the Artificial Intelligence and Data Act, never became law. As recorded on LEGISinfo, C-27 is shown against the 44th Parliament, 1st session (22 November 2021 to 6 January 2025) — a session the page itself marks as prior — with its status listed as “At consideration in committee in the House of Commons” and its latest activity second reading and referral to committee on 24 April 2023. Nothing past that point happened. So a Canadian business checking its EU exposure is not comparing one country's AI law to another's; it is comparing a real, enforceable European regulation to a Canadian bill that stalled in committee.
In practice the question to ask is not “are we a Canadian business” but “does our AI system's output land in the EU.” A tool used entirely on Canadian customers and Canadian data, with no EU users and no EU sales channel, is unlikely to be caught by either clause above. A tool embedded in a product sold into the EU, or a service whose output a European user receives directly, is a different question entirely and worth checking against the Regulation's text rather than assuming distance is a defence. This is exactly the kind of exposure question a due-diligence review is built to catch before a deal or a market expansion closes, not after.
See what a diligence review checks before regulatory exposure becomes a surprise.
