The European Union has finalised the Artificial Intelligence Act (AI Act)(1), one of its most significant legislative developments this century. The EU Parliament approved it in March 2024, and the European Council adopted it on 25 May. It will enter into force 20 days after publication in the Official Journal.

In 2021 it was described as “a world-first attempt at horizontal regulation of AI systems”(2) and this is still apt. The purpose of this article is to assess the ways in which the AI Act may affect businesses and government located outside the EU, particularly in relation to data privacy. I examined this question in 2021, when the AI Act was first in draft, and concluded that the AI Act was likely to become “the second most important EU law protecting data privacy”,(3) with major consequences for businesses outside the EU involved in AI.