01EU AI Act — do we need it?
Short answer: yes, but only the lightweight part — and there's no legitimate workaround, because the obligation is a disclosure, not a licensing regime.
Aiconomy's agents (Ava, Leo, Maya, Zara, Sam, Dex) are conversational AI systems that interact directly with your customers and staff. That puts them squarely inside Article 50 of the EU AI Act, the "transparency" tier, which applies to any AI system used for direct human interaction — regardless of whether the system is otherwise classified as high-risk.
Article 50 became enforceable on 2 August 2026 and remains in force; a separate package of high-risk obligations (which don't apply to a customer-service or admin-automation agent like ours) was pushed back to December 2027 / August 2028 under the EU's "Digital Omnibus" reform, but that delay does not touch transparency duties.
What Article 50 actually requires is narrow: a person interacting with the AI system must be told, clearly and before or at the start of the interaction, that they're dealing with an AI — unless that's already obvious from context. There's no product review, registration, or certification step for a system at this tier.
02How Aiconomy meets Article 50
- Every customer-facing message Leo, Ava or another Agent sends identifies the sender as an AI employee (by name and role) rather than presenting as a human.
- Any live chat or voice interaction opens with a clear statement that the customer is talking with an AI system.
- Internal, staff-facing use (for example, Maya flagging a reconciliation issue to your finance team) is disclosed in your Agent's onboarding, since the obligation is about clarity for the person interacting with the system, not just external customers.
This satisfies the transparency tier. It does not, by itself, establish which of your specific use cases might edge into a higher-risk category — for example, if you configure Zara to make (rather than merely support) hiring or dismissal decisions. If you're using an Agent for anything touching employment decisions, credit decisions, or similarly consequential automated decision-making, flag it to us so we can review whether it changes your obligations.
03UK & EU GDPR
Aiconomy is a data controller under UK GDPR (as a company registered in England & Wales) and, for customers based in the EU, under EU GDPR. Our approach — legal bases, retention, international transfers, and your rights — is set out in full in our Privacy Policy. Aiconomy is registered with the UK Information Commissioner's Office (ICO).
04UAE — Personal Data Protection Law
The UAE's Personal Data Protection Law applies extraterritorially: it covers any organisation processing the personal data of UAE residents, regardless of where that organisation is based. Because Aiconomy serves UAE-based customers, this applies to us.
| Requirement | Aiconomy's position |
|---|---|
| Lawful basis | Consent or contractual necessity for each processing activity, documented per activity |
| Data subject requests | Responded to within the 30-day statutory window |
| Cross-border transfer | UK-approved safeguards / standard contractual clauses applied when UAE resident data leaves the UAE |
| Breach notification | Reported to the UAE Data Office within 72 hours where required |
Unlike GDPR, the UAE PDPL doesn't offer a broad "legitimate interests" basis for most commercial processing — so for UAE customers we lean on explicit consent and contractual necessity rather than legitimate interest for anything discretionary, such as analytics profiling.
05Saudi Arabia — PDPL
Saudi Arabia's PDPL, enforced by the Saudi Data & AI Authority (SDAIA), also applies extraterritorially to foreign entities processing the data of Saudi residents. Its principles largely mirror GDPR — lawful basis, data subject rights, 72-hour breach notification to SDAIA, and cross-border transfer safeguards (risk assessment, standard contractual clauses, or binding corporate rules).
06Open items we're tracking
- Saudi Arabia local representative appointment (see above) — required before actively selling into Saudi Arabia specifically.
- Independent legal review of this page and the Privacy Policy / Terms of Service in each jurisdiction served.
- Re-checking this page against the EU's Digital Omnibus review as further guidance is published, since high-risk timelines are still being finalised.