EU compliance for US tech companies — what changes when you sell into Europe
European regulation reaches you where your customers are, not where your company is. For most US technology companies the question is not whether EU rules apply, but which ones, from what point, and what has to exist in Europe rather than in Delaware.
First hour’s on us. No commitment.
What you get
- A map of which EU regimes reach your product, and from which date — not a list of everything that exists
- Clarity on what must exist inside the EU — representatives, entities, points of contact
- Customer-facing documentation that survives European procurement and diligence
- Contract terms built for EU counterparties rather than translated from US paper
- A sequence, so the work matches your go-to-market rather than blocking it
How it works
- Intake, 45 minutes. What you sell, to whom, and where you are in your EU plans. Free.
- Assessment, two to four weeks. Scope, gaps, and what has to be in place before first revenue.
- The plan. Sequenced against your launch, with fixed pricing.
Who you’ll work with
Narmin Abbasova, Legal Advisor for EU and business law, leads this work. She specialises in EU business law, cross-border matters and commercial agreements, with experience from international firms and bar associations, and holds an LL.M. in European Business Law from Lund University. Lawgent is Sweden’s first law firm dedicated to AI and EU regulation — meet the team.
Extraterritorial reach, in plain terms
Four points decide whether a European regime touches you, and none of them is where you are incorporated.
Do you offer goods or services to people in the EU? That is the GDPR’s main trigger, alongside monitoring behaviour in the EU.
Do you place a product on the EU market? That is the AI Act’s, and it applies to providers established anywhere. It also reaches providers outside the EU where the output of their system is used in the Union.
Do you serve EU users at scale as an intermediary? That is the DSA’s.
Do your customers carry regulation you inherit? This is the one that surprises people. DORA does not apply to you directly — but every EU financial customer must have DORA-compliant contract terms with their ICT providers, so it arrives through procurement anyway. NIS2 works the same way through supply chain security requirements.
What has to exist in Europe
Several regimes require a presence, and they are not the same presence.
Under the GDPR, controllers and processors outside the EU without an establishment there generally need a representative in a member state where the data subjects are, unless a narrow exemption applies.
Under the AI Act, a provider established outside the EU that places a high-risk system on the EU market needs an authorised representative in the Union, appointed by written mandate, before placing it on the market.
Under the DSA, providers without an establishment in the EU need a legal representative and a point of contact.
These are distinct roles and can be held by different parties. Deciding whether to appoint representatives or to establish a subsidiary is one of the earlier and more consequential decisions — it affects tax, employment, contracting and how customers perceive you.
Where US assumptions cause the most friction
Privacy is not a disclosure regime. A US-style privacy notice describing what you collect does not satisfy the GDPR, which requires a lawful basis for each purpose before processing, and rights that must actually work.
Data transfers are a live question, not a solved one. Moving personal data to the US requires a valid transfer mechanism and, in many cases, a documented assessment. Customers ask about this in diligence.
“AI-powered” is a regulatory statement in Europe. Marketing copy that positions a feature as making decisions can pull it toward Annex III. What you say about the product matters to its classification.
Your standard contract will be renegotiated. EU enterprise and financial customers need specific clauses — data processing terms, audit and access rights, exit assistance, incident notification, subprocessor control. Arriving with them drafted is a commercial advantage; arriving without them costs weeks per deal.
Consumer rules bite differently. If you sell to individuals, EU consumer protection — including withdrawal rights for digital content — applies regardless of what your terms say.
Sweden as an entry point
Companies entering the EU have to pick somewhere. Sweden is a reasonable choice for technology businesses: English is used throughout business and government, company formation is fast and largely digital, the regulator community is accessible, and the market is used to buying software from abroad.
It is not automatically the right choice. Where your first customers are, where you need people, and which supervisory authority you would rather deal with all matter more than any general ranking. We work through that with you rather than assuming the answer.
Frequently asked questions
We have no EU entity and no EU staff. Do EU rules still apply?
Yes, where you target or affect people in the EU. Establishment matters for some obligations — such as whether you need a representative — but not for whether the regimes reach you at all.
Do we need an EU subsidiary?
Not always. Representatives cover several requirements without an entity. A subsidiary starts to make sense when you hire in Europe, contract locally, or when customers require an EU counterparty.
Our customers keep sending us DORA addenda. Are we regulated?
Not directly, unless you are designated a critical ICT third-party provider. But your financial customers must have those terms, so it reaches you contractually. The efficient answer is a DORA-ready position of your own rather than negotiating each one separately.
How long does this take?
An initial assessment is two to four weeks. What follows depends on which regimes apply and how much contract work is needed.
Can you work with our US counsel?
Yes, and that is the usual arrangement. They hold the company; we hold the European side.
Where to start
With what you sell and to whom. That conversation is free, and it usually narrows the field considerably.