First: what “high-risk AI” means
The EU AI Act sorts every AI system into four tiers — prohibited, high-risk, limited-risk and minimal-risk — and the high-risk tier is where the heavy legal obligations live. A system is high-risk by one of two routes. Under the product-safety route, it is a product, or the safety component of a product, already covered by EU harmonisation legislation (medical devices, machinery, vehicles, radio equipment, toys) that must undergo a conformity assessment. Under the use-case route, it falls within one of the areas the Act enumerates in Annex III: biometrics; critical infrastructure; education and vocational training; employment and worker management; access to essential private and public services, including credit scoring and insurance; law enforcement; migration, asylum and border control; and the administration of justice. Recruitment tools, credit-scoring models, biometric systems and insurance-pricing engines are the everyday examples.
Being high-risk is not a label; it is a workload. The provider of a high-risk system has to run a lifecycle risk-management system, meet data-governance and quality standards, produce a full technical file, pass a conformity assessment, register the system in the EU database, and maintain post-market monitoring — with fines up to €15 million or 3% of worldwide turnover for getting it wrong. That is the cost that makes founders of high-risk AI businesses go looking for a way out. Incorporation is usually the first place they look.
Why incorporating in a “no-rules” jurisdiction doesn’t work for high-risk AI
A recurring pattern: a founder building a high-risk AI product incorporates in a jurisdiction with little or no AI regulation — a Gulf free zone, an offshore haven — on the theory that a light-touch home base keeps the system out of the Act. For many businesses that logic has some merit. For high-risk AI it is a costly misunderstanding, and it is worth being blunt about why.
The EU AI Act, like the GDPR before it, is extraterritorial. It applies based on where a high-risk system’s effects land, not where the company is registered. If your system is placed on the EU market or its output is used in the Union — directly, through a reseller, through an EU-hosted service, or through an API accessible to EU users — you are in scope regardless of whether you have any European presence. Incorporating in a no-regulation jurisdiction does not remove that exposure. For a high-risk system it makes things worse: a non-EU provider of a high-risk system must also appoint an EU authorised representative before going to market, a step an EU-established company would not need. So the offshore structure adds a compliance obligation on top of the high-risk obligations rather than removing any of them.
That does not mean jurisdiction choice is irrelevant for a high-risk AI business — it means it has to be made for the right reasons. Where you incorporate still drives tax, investor confidence, IP protection, banking access, talent and operational cost, and it determines which entity in your group is the high-risk system’s “provider” and therefore carries the obligations. The goal is to optimise those levers deliberately, with clear eyes about the one lever incorporation cannot pull: escaping rules that follow your users.
The questions that actually decide it for a high-risk business
Most founders arrive optimising for the lowest headline tax rate. For a high-risk AI company that is the wrong frame, and the better questions are these. Given where your users are, does the high-risk regime apply to you automatically — and does it apply in the EU, the fragmented US state patchwork, or a lighter regime like the UK? Which group entity should be the provider that carries the high-risk obligations, and where should it sit? Does the structure force you into an EU authorised representative, or can an EU-established entity avoid that? Which jurisdiction gives investors confidence at your next round when they see a high-risk product? Where does your AI IP — often the model itself — get the strongest protection and best tax treatment? And can the structure actually open a bank account and meet substance requirements, given that thin paper companies now face scrutiny everywhere?
Tax structuring should follow entity selection, not drive it. The corporate-tax and IP-box analysis matters, but for a high-risk business it is an input to the decision, not the decision itself — the provider-entity and regulatory-exposure questions come first.
The jurisdictions, through a high-risk lens
Each option below is assessed for what matters to a high-risk AI business specifically: whether it triggers the EU high-risk regime, whether it forces an authorised representative, and how it handles the provider role, IP and investor expectations — not just its headline tax rate.
United States (Delaware)
The default for venture-backed AI companies raising from US investors. There is no comprehensive federal AI law — instead a fast-growing patchwork of state measures (Colorado, California, Texas’s TRAIGA effective January 2026, Utah, Illinois and others), which means a US-incorporated AI company tracks a moving target rather than a single standard. Delaware’s advantage is investor familiarity and IP-assignment enforceability, not regulatory relief. Most global structures end up with a Delaware parent because that is what US venture capital funds into. If US institutional VC is your capital source, this is usually the top of the structure.
Ireland
The common EU home for AI companies that want genuine Union establishment. A 12.5% trading-tax rate, the Knowledge Development Box for qualifying IP income, an extensive treaty network, and — critically for AI — actual EU-established status, which removes the authorised-representative requirement and makes the company a comfortable counterparty for EU enterprise customers who increasingly prefer to contract with an EU entity. In a dual-entity structure, IP is often held in the Irish subsidiary for the KDB benefit while equity sits in a Delaware parent.
Estonia
A lightweight EU incorporation option: 0% corporate tax on retained profits, fully digital formation, and EU establishment. Attractive for early-stage EU-facing AI companies that want Union status without Irish setup cost, though it offers less of the IP-box and enterprise-counterparty weight that Ireland carries.
United Kingdom
Post-Brexit, the UK is outside the EU AI Act and has taken a regulator-led, principles-based approach rather than a single AI statute — a lighter domestic burden than the EU. Fast, cheap incorporation and a deep talent and capital pool. Two cautions: a UK entity does not satisfy the EU authorised-representative requirement (so UK-only structures still need an EU appointment to serve EU users), and UK domestic law is evolving.
Switzerland
A mature, stable base with strong IP protection and a reputation that carries weight with enterprise and institutional counterparties. Outside the EU, so EU-market access still triggers the Act and the representative requirement, but attractive where credibility and IP are the priorities.
Singapore
The APAC gateway. A voluntary, pro-innovation AI governance framework (IMDA’s Model Framework) rather than binding high-risk rules, a MAS sandbox, 17% corporate tax with startup exemptions and IP incentives, and strong legal integrity that signals financial discipline to investors. Best for AI companies whose primary markets are APAC/MEA and whose capital is Asian or US, with EU access a secondary priority. US VC participation typically still needs a Delaware flip or parallel entity, and EU enterprise customers may prefer an EU counterparty.
United Arab Emirates (Dubai — DIFC/ADGM)
The most aggressive government AI push in the world: sovereign capital (G42, MGX), a new federal AI and Data Authority (approved June 2026), a regulatory sandbox, English-common-law free-zone courts, and 0% corporate tax on qualifying free-zone income with substance. Compelling for AI infrastructure, enterprise AI and defence-adjacent AI, and for access to GCC capital. But this is exactly where the haven misconception bites hardest: sources consistently note Dubai founders underestimate that the EU AI Act applies immediately once EU users are present, EU VC generally will not invest directly into a UAE entity without additional structure, and US VC needs a Delaware flip. Strong as an operating base or MEA HQ; rarely the whole answer for an EU-facing product.
Offshore havens (Panama, BVI, Cayman, Georgia and similar)
Genuinely low or zero tax and simple formation, but for an AI business serving regulated markets the drawbacks now dominate: no relief from extraterritorial AI regulation, mounting substance requirements, banking friction (banks increasingly decline thin offshore structures), and a credibility discount with serious investors. Viable for specific narrow roles (some IP-holding or DAO-treasury structures), rarely a sound home for an operating high-risk AI company.
The structure usually matters more than the country
For any AI company with cross-border ambitions, the answer is rarely a single jurisdiction — it is a structure. A typical shape is a Delaware or UK parent for capital and IP, an EU subsidiary (often Ireland) for EU establishment and enterprise contracting, and an operating base where the team and substance actually sit. Two design decisions do most of the work.
IP location
IP holding and operating entity are separable. Placing IP in the right entity — an Irish sub for the KDB, a Singaporean entity for the IDI, or the parent — is a deliberate tax-and-protection choice, and investors check founder-to-entity IP assignment first.
Provider entity
Under the AI Act, whichever entity places the high-risk system on the market under its own name is the provider carrying the heavy obligations. Which subsidiary contracts with EU customers therefore decides where the regulatory weight lands. This should be chosen, not defaulted into.
What we deliver — High-Risk AI Incorporation & Jurisdiction Strategy
A fixed-scope engagement that produces a defensible incorporation decision for a high-risk AI business, not a brochure. You receive: a market-and-user map showing where your users are and therefore which regimes (EU AI Act, US state patchwork, UK, APAC) apply to you automatically; a jurisdiction shortlist scored against your priorities — regulatory exposure, investor expectations, IP protection, tax, banking access, talent and substance; a recommended structure (single entity or multi-entity parent / EU sub / operating base) with the provider-entity and IP-location decisions made explicitly; an EU AI Act exposure assessment covering whether you need EU establishment or an authorised representative and the cost difference between the two routes; a tax and IP-box outline (KDB / IDI / free-zone) as an input, coordinated with local tax counsel for sign-off; a banking-and-substance reality check on whether the recommended structure can actually open accounts and meet substance; and an incorporation roadmap with sequencing (e.g. form parent now, add EU sub before EU launch).
Excludes / coordinates: local company formation filings and definitive local tax opinions, which we coordinate with local counsel and tax advisers in the chosen jurisdictions.
Who this is for
AI founders about to raise, being asked by a VC what their entity structure is. Non-EU AI companies that have (or will have) EU users and need to know their real exposure. Founders currently in an offshore or Gulf structure who suspect it doesn’t do what they hoped for EU access. Teams whose high-risk AI product needs the provider entity and IP placed deliberately before launch.