It is a principle of natural law that what is novel in human artifice must nonetheless be subject to reason and order, lest it become an instrument of disorder. The European Union’s Regulation (EU) 2024/1689—commonly called the AI Act—represents the first concerted attempt by a sovereign body to impose a rational structure upon the burgeoning field of artificial intelligence, thereby extending the rule of law to a domain heretofore ungoverned. This framework, anchored in a risk-based classification, imposes phased obligations on both providers and deployers and reaches far beyond the territorial bounds of the Union itself. Its full force will be felt in August 2026, yet already it serves as a forcing function for enterprise governance, exposing a troubling lack of preparedness: a majority of corporations are not yet compliant, and fewer than three in ten European small and medium-sized businesses have taken even the first steps 3,39. The convergence of these obligations, the extraterritorial reach, and the divergence of national approaches creates for a company such as Salesforce—a US-listed provider of cloud and AI solutions with a substantial European presence—both formidable challenges and strategic opportunities.
The Architecture of Risk: A Four-Tiered Classification
The Act divides AI systems into four categories, each corresponding to the degree of risk they pose to the common good. At the apex are practices deemed unacceptable—social scoring, real-time biometric surveillance in public spaces—which are prohibited outright 11,15,17. These prohibitions took effect in February 2025 1,18. Next, high-risk systems, such as those employed in employment, healthcare, financial services, and critical infrastructure 16,21, bear the weight of extensive compliance controls. Limited-risk systems, including those that interact with natural persons, carry transparency obligations, while minimal-risk applications remain largely unencumbered. The classification is not static; it reflects a legislative judgment that certain uses of AI are inherently more dangerous to liberty and welfare, and thus demand commensurately rigorous oversight. That the Union has adopted such a tiered structure is a sensible acknowledgment that not all AI is equal, and that the law must calibrate its burdens to the gravity of the harm.
A Phased Chronology of Obligation
The legislature has wisely staggered the coming-into-force of the Act’s provisions, recognizing that compliance cannot be achieved in a day. General-purpose AI provisions took effect in August 2025 18. The principal wave of obligations—including transparency for AI-generated content under Article 50, conformity assessments for high-risk systems, and the operational establishment of the EU AI Office—commences on the second of August 2026 13,18,35. Certain high-risk system deadlines have been deferred to December 2027, a concession to the practical difficulties of implementation 18. This staggered timeline affords responsible firms a window for deliberate preparation, but it also demands immediate prioritization of governance roadmaps; those who delay may find themselves in breach when enforcement begins.
Substantive Compliance: From Declarations to Persistent Evidence
Compliance under the Act is no mere paper exercise. It mandates ‘Interpretability’ and ‘Human Oversight’ 33, requiring active runtime governance systems rather than static policy frameworks 33. History instructs us that the effectiveness of law depends not on declarations of intent but on the production of verifiable evidence. Thus, technical compliance necessitates logging every call to an AI tool and controlling operations within standardized sandbox environments 32,33. Providers of high-risk systems must furnish structured documentation detailing capabilities, limitations, and guidelines for the interpretation of outputs 21. Deployers, too, bear burdens: risk classifications, transparency disclosures, and documentation of recourse mechanisms and bias mitigation strategies are required 16,36,39. The convergence with existing data protection law—the General Data Protection Regulation—further elevates the standard; regulators are now employing a dual-citation approach to enforce workplace AI monitoring standards 2. Accordingly, the evidence tendered must take the form of auditable technical artifacts—system architecture diagrams, inference logs, entitlement trails—rather than unverified assumptions 8. The Act thus effects a paradigm shift from declarative design intent to verifiable, persistent runtime evidence 28. It is a shift toward accountability grounded in demonstrable fact—a principle that any jurist would applaud.
The Extraterritorial Reach and Its Consequences
Perhaps the most consequential feature for a global enterprise is the Act’s extraterritorial scope. It applies to any company that places or makes AI systems available to users within the Union, regardless of where the company is established 16,25. A single interaction with a citizen of the Union may trigger enforcement, exposing AI companies worldwide to fines and operational disruption 25. The Act further interacts with the NIS2 Directive and other sectoral rules, compounding the compliance burden for firms listed on US exchanges 16,34. Beyond direct penalties, non-compliance creates reputational risk and imperils access to a market that is a significant source of revenue for cloud and SaaS providers. The Union’s AI Pact and the proposed Cloud and AI Development Act signal that sovereignty and governance will be deeply embedded in future procurement processes 6,29. This is the natural extension of the principle that the law applicable to an activity follows the activity, not the actor—a doctrine long recognized in the law of nations.
The Divergence of Nations and the Necessity of Harmonization
While the Union forges ahead with a prescriptive, risk-based model, the United States has adopted a more fragmented posture, characterized by a patchwork of state-level laws—such as the Colorado AI Act and California AB 3030—and the absence of comprehensive federal legislation 14,19,37. This divergence creates cross-jurisdictional compliance challenges, as companies must reconcile overlapping but not identical requirements. The interplay between California AB 2013 and EU AI Act Article 53 on training data disclosure is a case in point 9. Yet the global trend is unmistakably toward mandatory AI governance. The OECD AI Principles and the ISO 42001 standard are informing regulation across multiple jurisdictions 10,20. For multinational enterprises, a harmonized, proactive governance infrastructure is fast becoming a competitive necessity rather than a mere point of differentiation 10,23.
Current Deficiencies in Governance and the Industry’s Response
The majority of corporations are not compliant with the Act’s requirements, and many firms lack even basic AI governance structures, exposing them to significant regulatory risk 12. This gap has given rise to a dedicated AI governance platform market, with solutions such as Akitra and AnnexOps offering compliance enablement tailored to the EU AI Act 11,17,27. Leading AI developers, including OpenAI, have publicly aligned their self-regulation frameworks with the Act, mapping their practices to both EU and California standards 4,5,7. The industry is maturing toward standardized governance layers that enforce pre-execution verification of AI actions, ensuring compliance at runtime 17,30. This is a salutary development, for it demonstrates that the market itself, when guided by clear legal principles, can produce the tools necessary to uphold the common interest.
Strategic Implications for Salesforce, Inc.
For Salesforce, a US-headquartered enterprise that offers AI-driven services—Einstein, Marketing Cloud, Tableau, and others—to a substantial European customer base, the AI Act presents both immediate compliance imperatives and strategic opportunities. As a “deployer” under the Act whenever its customers use AI features targeting EU users, Salesforce must embed governance capabilities deep into its platform architecture. The requirements for runtime controls, audit logging, and sandboxing 31,33 directly impact the design of services such as Agentforce and Einstein Prediction Builder. The transparency mandates of Article 50 will affect how AI-generated content in Marketing Cloud and Commerce Cloud is labeled; in the absence of regulatory guidance on deepfakes, the default application of these rules must be presumed 22. Non-compliance fines of up to seven percent of global annual revenue 18 are material enough to warrant serious attention at the boardroom level.
Yet this regulatory pressure also plays to the company’s strengths. Salesforce has long championed trust, security, and compliance as core brand attributes. By proactively building a centralized, auditable AI control plane and integrating human-in-the-loop mechanisms into its product suite, the company can differentiate its offerings as “compliant by design,” thereby appealing to enterprises navigating the complexity of cross-border AI governance 24,29. The broader shift toward governance as a market driver 26 aligns with Salesforce’s existing governance, risk, and compliance ecosystem and its ability to offer compliance frameworks—ISO 27001, SOC 2, GDPR, EU AI Act—through native platform capabilities 38. The regulatory tailwind may accelerate adoption of Salesforce’s AI tools among risk-averse industries—healthcare, financial services—that require demonstrable governance, creating a competitive moat against less-prepared rivals.
On the competitive landscape, the Act’s extraterritorial scope means that while EU-headquartered cloud providers may possess a home-field advantage in understanding local regulations, Salesforce’s global scale and investment in compliance infrastructure can neutralize that edge. The divergence between EU and US regimes, however, requires the maintenance of a nimble, multi-jurisdictional compliance function capable of reconciling conflicting requirements without stifling innovation. The rise of specialized AI governance platforms and the inclusion of AI-related criteria in ESG frameworks 25 further suggest that market expectations around transparency and accountability will only intensify, transforming compliance from a cost center into a strategic enabler.
In sum, the EU AI Act is not a regional regulation of limited import; it is a blueprint for global AI governance that will reshape product roadmaps, procurement criteria, and investment analysis. For a company such as Salesforce, early and decisive action to close governance gaps and communicate its compliance posture clearly to stakeholders offers the surest path to turning regulatory obligation into competitive advantage 12,33. The Act’s extraterritorial reach and the fragmentation of US state-level rules demand a centralized, auditable control plane to reduce operational risk 16,25,29. In a market where a majority of firms lack governance frameworks, compliance readiness is a significant differentiator, and Salesforce’s heritage of trust positions it to capture demand for enterprise-grade, compliant AI solutions 3,26,39. Above all, the threat of fines of up to seven percent of global revenue and operational disruption makes non-compliance a material financial risk; proactive adaptation of product architecture to include logging, sandboxing, and transparency labeling is essential to maintain market access 18,22,33. The better view, therefore, is to embrace this legal order as an opportunity to reinforce trust and to secure a leading place in the commerce of the future.