Buying AI from outside the EU: why the European buyer inherits a risk it cannot verify

A briefing by law firm Holland & Knight, published in April 2026, spells out the EU AI Act's extraterritorial reach: a provider established outside the Union is covered whenever it places a system on the EU market, or whenever that system's output is used in the Union, regardless of where its servers sit. But the clause most directly operational for our target sectors sits elsewhere: any business that imports or distributes an AI system embedded in a product sold in the EU must comply, whether or not it developed that system.

In practice, a French aerospace integrator embedding a computer-vision module bought from a North American vendor, an energy operator deploying a predictive-maintenance tool built by a non-EU startup, or a luxury house relying on a personalization platform developed outside the EU each inherit a share of the compliance burden — even though none of them controls the code, the training data, or the technical documentation of the system they are integrating.

This is precisely the structure of an adverse selection problem in Akerlof's sense ("The Market for Lemons", 1970): the EU buyer cannot observe, before purchase, the true compliance quality of a system built outside the Union — rigor of the technical documentation, traceability of training data, robustness of the risk assessment. Unable to distinguish a rigorous vendor from an opportunistic one, the market structurally tends to under-price rigorous vendors (whose compliance carries a real cost) in favor of the cheapest ones — precisely those whose documentation is most likely to be weak.

The Act's requirement that every non-EU provider appoint an EU-based authorized representative is exactly the separating signal that signaling theory (Spence, 1973) predicts in this kind of setting: a costly-to-produce signal — setting up legal representation in the EU, assembling the compliance file — that only genuinely committed vendors have an incentive to emit. Yet this signal remains largely under-used by European buyers today, who tend to treat it as an administrative formality rather than the main screening tool available to them before purchase.

The risk asymmetry structurally disadvantages the buyer: in the event of confirmed non-compliance, Article 99 provides for penalties of up to €15 million or 3% of global annual turnover, and market surveillance authorities can order the outright withdrawal of the product embedding the non-compliant system — a risk that lands on the European integrator even though the compliance failure originates with a vendor it does not control.

This mechanism complements, from a different angle, our August 6 analysis of critical-infrastructure scope ambiguity and our August 2 piece on the deferral calendar: where those two pieces dealt with the "when" and the "what" of compliance, the question here is the "who" — and the answer is not only the vendor that built the system, but also the European company that bought it without verifying its documentation upstream.

The operational takeaway for a European industrial buyer is direct: treat verification of a vendor's EU authorized-representative status and receipt of complete technical documentation as a contractual precondition before signing, not a compliance box to tick after deployment — the cost of upstream verification remains, in this framework, far lower than the cost of an ex-post penalty.