EU AI Act Explained for Companies Outside the EU
Basics4 minInnovialabs editorial team
In short
The AI Act applies based on where AI is used, not where a company is registered: if your AI system is placed on the EU market or its output is used in the EU, the law covers you, and your duties depend on the risk category.
The short answer
The AI Act is a European Union regulation that governs artificial intelligence systems by level of risk. The key point for non-EU companies: the law does not look at where you are registered, but at where your AI is used.
If a company in Tashkent sells an AI product to customers in the EU, or the output of its system is used in the EU, the law may apply to it. If your product serves only the local market, the AI Act does not directly concern you.
This is an overview, not legal advice. For a specific product, check the requirements with a lawyer familiar with EU law.
Four risk categories
| Category | Examples | What is required |
|---|---|---|
| Unacceptable risk | Social scoring, manipulative techniques that exploit vulnerabilities, untargeted scraping of faces for recognition databases, emotion recognition at work and in education | Prohibited |
| High risk | AI for hiring and evaluating employees, credit scoring, access to education and essential services, and AI as a safety component of regulated products | Risk management, data quality, documentation, logging, human oversight, conformity assessment |
| Limited risk | Chatbots, generation of text, images, audio and video, deepfakes | Transparency obligations |
| Minimal risk | Spam filters, recommendations, AI in games | No specific requirements |
Separate rules cover general-purpose AI (GPAI) models — large language models. They mainly target the developers of those models, not companies that use them via an API.
Transparency: chatbots and generated content
This is the category most business projects fall into:
- Chatbots. Users must know they are talking to an AI, not a person, unless that is obvious from the context.
- Generated content. AI-created text, images, audio and video must be marked in a machine-readable way so they can be detected as synthetic.
- Deepfakes. Realistic AI-made images, video or voices of real people must be clearly labelled.
- Emotion recognition and biometric categorisation. People must be informed when such a system is applied to them.
For a typical support chatbot this means a clear "You are chatting with an AI assistant" message at the start and a way to reach a human.
When the law reaches a company in Uzbekistan or the CIS
The AI Act distinguishes roles:
- Provider — develops an AI system and places it on the market under its own name.
- Deployer — uses an AI system in its own activities.
The law may apply to a non-EU company if:
- You sell or provide an AI product to customers in the EU — for example, SaaS with AI features.
- The output of your system is used in the EU — for example, you score candidates for a European employer.
- You embed AI into a product that is shipped to the EU.
Third-country providers of high-risk systems must appoint an authorised representative in the EU.
Usually out of scope: internal tools with no EU users, products for the local market only, and pure research.
What to do now
- Build an AI inventory. Where AI is used in products and processes, which models, for which tasks.
- Check whether you have users or customers in the EU.
- Assess the risk category of each system. Pay special attention to hiring, lending, education and biometrics.
- Add transparency: AI disclosure in chatbots, labelling of generated content.
- Document data, models, tests and human oversight — it helps with other laws too.
- Track the timeline. Requirements take effect in phases, and dates and details are refined through European Commission guidance.
Common mistakes
- Assuming the law only applies to European companies.
- Confusing the AI Act with GDPR: personal data processing is governed by GDPR separately, and both may apply at once.
- Believing that using someone else's model via an API removes all responsibility. Deployer and transparency duties stay with you.