EU AI Act obligations for aerospace suppliers outside the EU

Being an aerospace supplier outside the European Union is not, by itself, a status the AI Act names. The Regulation looks at role, purpose, and where the system or its output is used.

Status as of 14 October 2026: the Service Desk still presents the EUR-Lex consolidated version of the AI Act as at 27 July 2026, with NEW and AMENDED banners for the Digital Omnibus. Annex I Section A item 1 is still DELETED (Not present after the amendment). Civil-aviation Regulation (EU) 2018/1139 remains in Section B, still unmanned aircraft-limited.

The extra-territorial triggers

Article 2(1) applies the Regulation, among others, to:

• providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country;
• providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union;
• product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark;
• authorised representatives of providers which are not established in the Union.

Recital 22 explains why the output limb exists. In the Official Journal text, certain AI systems should fall within the scope even when they are not placed on the market, put into service, or used in the Union — for example where an operator in the Union contracts an operator in a third country and the output of that AI system comes back to the Union. The recital says the point is to prevent the circumvention of this Regulation.

Analysis, not sourced fact: a US or UK aerospace supplier that only sells to a US DoD program, with no placing on the Union market and no output used in the Union, is not described by those Article 2(1) limbs. The same supplier that puts a civil AI function on an EU-registered product, or that returns model output to an EU operator, is in the fact pattern the text addresses. That is a role-and-use question, not an industry label.

If you are a third-country provider of a high-risk system

Article 22 is the extra-EU hook that the official text states in must-language. Prior to making their high-risk AI systems available on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative which is established in the Union.

The mandate must empower that representative to verify that the EU declaration of conformity and the technical documentation have been drawn up and that a conformity assessment has been carried out; to keep the provider’s contact details, the declaration, the technical documentation and any notified-body certificate for a period of 10 years; to give authorities information, including logs under the provider’s control; and to cooperate on risk reduction. The representative shall terminate the mandate if it considers the provider is acting contrary to the Regulation, and must tell the market surveillance authority.

Those duties sit on top of the provider list in Article 16, which includes compliance with Section 2, a quality management system, documentation and logs, conformity assessment prior to placing on the market, an EU declaration of conformity, CE marking, registration, corrective action, and demonstrating conformity on a reasoned request. Article 16 applies to providers of high-risk systems. The text does not say that every aerospace supplier is a high-risk provider.

Civil aviation is not a blanket high-risk class

The only EASA Basic Regulation entry in Annex I is in Section B, and it is limited to unmanned aircraft: Regulation (EU) 2018/1139 on civil aviation, in so far as it concerns the design, production and placing on the market of unmanned aircraft and their engines, propellers, parts and equipment to control them remotely.

For high-risk systems related to Section B legislation, only Article 6(1), Article 60a and Articles 102 to 112 apply. Article 108 then amends the EASA Basic Regulation so that, when implementing and delegated acts are adopted for AI systems that are safety components, the requirements in Chapter III, Section 2 of the AI Act shall be taken into account.

Our reading, not an official statement: for manned civil aviation, the official pages we cite do not put the full Chapter III provider stack on the supplier just because the product is an aircraft part. EASA rulemaking is the channel the Act itself names. See the EASA concept paper and EU AI Act scope for defense and aviation.

Defence and national security

Article 2(3) does not apply to AI systems where and in so far they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes, regardless of the type of entity. It also does not apply to AI systems which are not placed on the market or put into service in the Union, where the output is used in the Union exclusively for military, defence or national security purposes.

The word “exclusively” is in both sentences. Recital 24 says a system placed on the market for both an excluded and a non-excluded purpose falls within the scope, and that a system developed for excluded purposes but used for civilian, humanitarian, law enforcement or public security purposes falls within the scope. Dual-use aerospace products are the recital’s fact pattern, not a carve-out for “defense industry” as a heading.

Dates if you are in scope

High-risk Chapter III, Sections 1–3 obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems, after Regulation (EU) 2026/1744. The consolidated AI Act on EUR-Lex is dated 27 July 2026. Planning documents that still say August 2026 or August 2027 predate the amendment.

This is general information, not legal advice. Read the consolidated text for your own analysis.