The EU AI Act and the Brazilian retailer that exports: the reach nobody planned for
The EU AI Act, Regulation (EU) 2024/1689, has extraterritorial reach. If your AI system’s output is used in the European market, the rule reaches you, even with a Brazilian headquarters. The rule seems like another continent’s. The liability enters through the back door.
The law entered into force in August 2024, with phased application through 2026 and 2027. Prohibited practices have applied since early 2025. Anyone who exports or serves a European customer needs to know where the line falls.
What the rule says, in plain text
The design is risk-based. Prohibited practices leave the stage. High-risk systems get heavy obligations of documentation, oversight, and transparency.
The point that catches Brazil is the reach. The rule does not look at where the company is headquartered; it looks at where the system’s output is used. A Brazilian retailer whose AI system affects a consumer or partner in the European Union can be in scope without ever having set foot there.
The systems the rule touches
It is not the whole company. It is the specific system, with a specific use, that reaches Europe.
- Scoring or risk applied to a European customer.
- Recommendation or pricing serving the EU market.
- Catalog and generated content circulating on a European marketplace.
- Automated service talking to a consumer there.
What changes for those who thought they were out of scope
Most exporters assume the European rule is a European problem. The project started with the right hypothesis, efficiency through AI, and ignored a detail visible since the design: where the output goes.
When the rule is remembered late, it shows up as expensive rework or as a closed door from a customer who now demands compliance. It is the kind of omission that unwinds the math of a project that looked finished.
The second-order effect almost every plan ignores
The rule changes vendor selection and architecture. The question stops being “does the system deliver” and becomes “does the system document and supervise the way Europe will require of anyone selling there”.
Telling what applies from what does not is the work. Not every Brazilian system falls in scope; the error is assuming none does. The right move is to map which outputs touch the EU, before the European customer asks. It is the same discipline as Brazil’s AI bill and LGPD in the camera.
Think about the AI system your operation runs whose output may reach a European customer or partner. Has anyone checked whether it is in scope? If the answer is “it is probably out”, that is an assumption, not a map.
Send me the list of AI systems whose output may touch Europe, through export, marketplace, or customer. In one hour I will send back a one-page gap analysis: what likely falls in scope, what stays out, and what needs documentation before the European customer demands it. If a front becomes a project, the two-week Diagnóstico is the next step. We do not give legal opinions; we map the operation against the rule.