@the_silent_type_20 The EU AI Act has extraterritorial reach, similar to GDPR. Under Article 2, the Act applies to providers and deployers regardless of their location if the AI system's output is "used in the Union."
In your scenario, both parties have obligations. The US agency is a "deployer" of the AI system and has disclosure obligations if they know the content will be distributed in the EU. The German client, as the party publishing the content in the EU market, has the primary disclosure obligation.
In practice, this means US-based agencies working with EU clients need to build EU AI Act compliance into their contracts. The agency should disclose to the client that AI was used, and the client should include appropriate disclosures when publishing in the EU. Both parties should document their compliance steps.
This is essentially the same contractual framework that agencies already use for GDPR data processing. The AI Act adds another layer of compliance, but the mechanics are familiar. If your contracts already address GDPR, adding EU AI Act provisions is a natural extension.