AI Act Beyond The EU: What Companies Need To Know

Artificial intelligence is no longer limited to the technology sector. It is now firmly embedded in everyday commercial operations, from automated recruitment processes and credit assessments to healthcare diagnostics and supply chain management. Recognising both the transformative potential and the inherent risks of these technologies, the European Union (“EU”) has enacted the world’s first comprehensive legal framework governing artificial intelligence: Regulation (EU) 2024/1689, widely referred to as the Artificial Intelligence Act (“AI Act”). Much like the General Data Protection Regulation (“GDPR”) reshaped the global privacy landscape, the AI Act is expected to set a new benchmark for AI governance that extends well beyond European borders.

The AI Act came into effect on 1 August 2024, with its various obligations being progressively rolled out over an extended transition period through 2028. The AI Act is fundamentally designed to ensure that AI systems available on the European market operate in a manner that is safe, transparent, free from discriminatory bias, and consistent with the protection of fundamental rights. In doing so, it establishes a harmonised regulatory framework across all 27 EU Member States, setting binding standards for a market of approximately 450 million people.

The AI Act imposes obligations on six categories of economic actors within the AI value chain, namely providers, deployers, importers, distributors, product manufacturers and authorised representatives. Crucially, the regulation carries significant extraterritorial reach. Companies established outside the EU, including those based in Türkiye, may fall within its scope where their AI systems, general-purpose AI models or the outputs generated by such systems are placed on the EU market, deployed within the EU, or intended for use by individuals or entities located in the EU.

What Does the AI Act Introduce?

The AI Act establishes a comprehensive regulatory architecture for the development, marketplacementanddeploymentofAIsystems. Its central organising principle is a risk-based approach: the greater the potential threat an AI system poses to health, safety or fundamental rights, the more stringent the compliance requirements it must satisfy. This graduated structure draws on principles that are broadly aligned with the OECD’s Recommendation on Artificial Intelligence, particularly as regards transparency, explainability, fairness, bias mitigation and human-centric design.

Before examining the risk categories, it is important to consider how the AI Act defines an “AI system”. Under Article 3 of the regulation, an AI system is defined as a machine-based system designed to operate with varying degrees of autonomy and that may exhibit adaptiveness after deployment, and which infers from the inputs it receives how to generate outputs, such as predictions, content, recommendations or decisions, that can influence physical or virtual environments. This definition is intentionally broad, and businesses should not assume they fall outside the regulation’s scope simply because they do not consider themselves to be in the “AI sector”.

Given this expansive scope, the AI Act is capable of capturing a wide spectrum of technologies, including AI-driven human resources and recruitment platforms, automated credit scoring and insurance risk assessment engines, biometric recognition systems, clinical decision-support tools, content recommendation algorithms, AI-enhanced document review solutions, and AI components integrated into regulated products such as medical devices, machinery and vehicles.

Risk-Based Classification

The AI Act classifies AI systems according to the level of risk they may create. Accordingly, AI systems are classified into four main categories:

From a compliance standpoint, high-risk AI systems represent the most consequential category. Although not prohibited, these systems are subject to extensive lifecycle obligations. Providers of high-risk AI systems are required to implement a comprehensive quality management system encompassing, among other things, a continuous and iterative risk management process, robust data governance measures, detailed technical documentation, automated logging for traceability, meaningful human oversight mechanisms, and demonstrable levels of accuracy, robustness and cybersecurity protection. Depending on the nature of the system, additional steps such as conformity assessment (either through internal control or involving a notified body), issuance of an EU declaration of conformity, affixing of the CE marking, registration in an EU database and establishment of a post-market monitoring system may also be required.

Beyond the risk-based classification of individual AI systems, the AI Act introduces a distinct regulatory regime for general-purpose AI (“GPAI”) models, that is, AI models trained on broad datasets at scale, capable of competently performing a wide array of distinct tasks and adaptable for integration into various downstream applications.

All providers of GPAI models must comply with baseline transparency obligations, including the preparation of detailed technical documentation on the model’s design, training process and capabilities, as well as compliance with EU copyright rules. GPAI models that are assessed as having high-impact capabilities, currently defined as those whose cumulative training computation exceeds certain level of floating point operations, are classified as posing systemic risks and are subject to additional requirements, including rigorous model evaluation through adversarial testing, comprehensive systemic risk assessment and mitigation strategies, prompt reporting of serious incidents, and enhanced cybersecurity protections.

Implementation Timeline

The AI Act does not take full effect simultaneously. Instead, its provisions are being introduced on a staggered timeline, affording companies varying preparation windows based on the category of AI system involved, the role played by the relevant economic actor and the applicable risk level. This graduated implementation is a deliberate design choice, reflecting the complexity of the regulatory requirements and the need for industry to develop adequate governance structures.

This staggered approach is of particular significance for organisations active in high-risk domains. While certain foundational provisions, including the prohibition on unacceptable AI practices and AI literacy requirements, are alreadyinforce,themostdemandingsubstantive obligations for high-risk AI systems will only become applicable at later stages. Companies are therefore well-advised to commence their compliance preparations without delay, leveraging the transition period to establish internal governance frameworks, conduct AI system inventories and audits, and build the technical and documentary infrastructure necessary for full regulatory compliance. With the general application date of 2 August 2026 now imminent, the remaining preparation window has narrowed considerably. In parallel, the European Commission has published interpretive guidance on the prohibited practices and on the definition of an AI system, and has put in place supporting mechanisms such as the AI Pact and the AI Act Service Desk to assist companies in preparing for the new framework.

Sanctions for Non-Compliance

The AI Act underpins its compliance framework with a tiered administrative penalty regime, with the severity of sanctions calibrated to the nature and gravity of the violation. These financial penalties are comparable in scale to those imposed under the GDPR, signalling the EU’s intent to enforce AI regulation with equal rigour. Notably, the penalty structure applies to companies regardless of where they are established, provided that a sufficient nexus with the EU market exists.

Who is Affected by the AI Act?

The personal and territorial scope of the AI Act is anchored in two key factors: the role an organisation assumes within the AI value chain and the degree of connection between the relevant AI system, model or output and the EU market. The regulation adopts a functional approach, capturing not only entities physically established in the EU but also those based in third countries whose AI activities have a material link to the European market.

Within this framework, the AI Act principally targets two categories of actors. First, providers are entities that develop an AI system, or commission its development, and make it available on the market or put it into service under their own name or trademark, whether for remuneration or free of charge. The provider designation applies irrespective of the company’s geographic location, so long as the AI system or GPAI model is made available on the EU market. Second, deployers are entities that use AI systems under their own authority in the course of their professional or business activities. It is important to note that where an importer, deployer or distributor places its own trademark on an AI system, substantially modifies it or repurposes it for a high-risk application not envisaged by the original provider, that entity will itself be reclassified as a provider and bear the corresponding full set of obligations.

Deployers’ obligations under the AI Act are less extensive than those imposed on providers but remain significant. They encompass duties relating to proper use, human oversight, transparency towards affected individuals and, for high-risk systems, the conduct of fundamental rights impact assessments. Typical deployer scenarios include the use of AI tools for candidate screening, customer creditworthiness evaluation, fraud detection, automated document analysis or internal operational decision-making.

The AI Act also extends its reach to providers and deployers established outside the EU where the output generated by their AI system is used within the EU. Additionally, non-EU providers of both AI systems and GPAI models are required to appoint an authorised representative established in the EU to act as their compliance liaison. Other supply chain participants, including importers, distributors and product manufacturers, may also be captured by the regulation where they are involved in making AI systems or AI-enabled products available in the European market.

Why Turkish Companies Should Pay Attention

The AI Act applies to non-EU companies wherever a sufficient nexus with the EU market can be established. In practical terms, this connection arises where a non-EU entity places an AI system or a GPAI model on the EU market, puts an AI system into service within the EU, or deploys an AI system whose output is utilised by persons or entities located in the EU. Given the regulation’s extraterritorial design, the mere fact that a company is headquartered outside the EU does not, in itself, provide a safe harbour from compliance obligations.

In practice, a Turkish company may fall within the regulatory perimeter of the AI Act if it develops and markets AI-based products or services to customers in the EU, exports AI-enabled goods to European markets, or operates AI systems that produce outputs relied upon by EU-based individuals or businesses. These considerations are especially pertinent for companies active in sectors that the AI Act identifies as high-risk, including human resources technology, financial services and credit scoring, insurance underwriting, educationandvocationaltraining, healthcare and clinical diagnostics, biometric identification systems, critical infrastructure management, legal technology solutions, and industrial manufacturing involving machinery, medical devices, automotive components, aviation systems, unmanned aerial vehicles and robotics. The manner in which a Turkish company is affected will depend on its specific role in the AI value chain. The table below illustrates several representative scenarios in which compliance obligations may arise.

The compliance burden is most pronounced where the relevant AI system is classified as high-risk. In such cases, companies must satisfy an extensive set of requirements spanning risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity, and, where applicable, must successfully complete a conformity assessment and obtain CE marking before placing the system on the EU market. The AI Act also requires that companies engaged in developing, deploying or overseeing AI systems ensure that their personnel possess adequate AI literacy, meaning a sufficient understanding of AI technology to recognise risks, assess outputs critically and act in a responsible manner.

The consequences of non-compliance extend beyond administrative fines. Companies targeting the EU market risk significant commercial repercussions, including disruption of market access, deterioration of customer relationships, breach of contractual commitments, delays to product launches and the potential loss of ongoing business with EU-based partners. Furthermore, the AI Act is expected to be supplemented by the new Product Liability Directive, which will establish additional liability rules for defective AI-enabled products, thereby reinforcing the importance of proactive compliance. Commentators have also observed that the compliance burden associated with the AI Act tends to weigh disproportionately on smaller enterprises, which makes early and carefully planned preparation particularly important for Turkish SMEs seeking to maintain or expand their presence in the European market.

Intersection with Competition Law and the Broader Regulatory Landscape

The AI Act does not operate in isolation. It forms part of a broader framework of EU digital regulation that includes the Digital Markets Act (“DMA”), the Digital Services Act (“DSA”), the Data Act and the Data Governance Act. Companies operating in or exporting to the EU market should be aware that their AI systems and related products may simultaneously be subject to requirements under multiple regulatory instruments, creating a layered compliance environment that demands careful coordination.

The interplay between the AI Act and EU competition law is also gaining increasing attention. Although the AI Act expressly states that it applies without prejudice to Union competition rules, its provisions carry significant implications for antitrust enforcement in three principal respects. First, in terms of procedural powers, market surveillance authorities established under the AI Act are required to provide annual reports to national competition authorities and the European Commission containing any information identified during their supervisory activities that may be of relevance for the enforcement of EU competition law. This reporting mechanism effectively expands the information channels available to competition authorities, granting them indirect access to technical documentation, datasets and operational logs relating to high-risk AI systems, without the need for those authorities to first suspect an antitrust violation. Second, with respect to algorithmic collusion, competition enforcers are increasingly focused on the risk that AI-driven pricing algorithms and recommendation systems may facilitate tacit coordination among competitors, whether through the use of shared AI tools trained on overlapping datasets or through the parallel adoption of similar pricing optimisation models that lead to convergent market behaviour. Third, competition authorities are closely monitoring the concentration of critical AI inputs, including specialised computing hardware (such as GPUs), cloud infrastructure, large-scale training data, and technical expertise, in the hands of a small number of dominant technology firms. The European Commission has already signalled its readiness to investigate strategic partnerships and investment arrangements between major technology companies and AI developers, particularly where such arrangements may confer preferential access to essential resources or enable incumbent firms to extend their market power into adjacent AI markets.

Recent developments confirm that this intersection is rapidly maturing into an area of active enforcement. Competition authorities are not merely regulating AI; they are also embedding it in their own investigative work, relying on advanced analytical tools to screen large volumes of market data, detect suspicious pricing patternsandidentifypotentialbidrigging or gun jumping. The European Commission has already used AI-assisted screening of publicly available corporate communications to justify unannounced inspections, and several national authorities within the European Competition Network are deploying comparable screening technologies. In addition, the draft EU Merger Guidelines published in April 2026 expressly incorporate AI and algorithmic pricing into the substantive merger assessment, acknowledging that algorithmic tools may enable competitors to monitor one another’s behaviour even in complex markets.

For Turkish companies, these competition law developments carry practical implications that warrant careful attention. Companies deploying AI-powered pricing tools or recommendation engines in connection with the EU market should assess whether their algorithmic conduct could give rise to coordinated effects or be perceived as facilitating information exchange with competitors. Businesses entering into partnerships, licensing arrangements or data-sharing agreements with large technology firms for AI-related purposes should evaluate whether such arrangements could attract scrutiny under EU merger control rules or the abuse of dominance prohibition. Turkish companies that rely on third-party AI platforms or cloud-based AI services offered by dominant providers should also monitor the evolving application of the DMA to AI and cloud computing services, as any future designation of these services as core platform services could introduce additional compliance requirements that affect the terms on which Turkish companies access essential AI infrastructure in the EU. At a practical level, prudent measures include conducting periodic audits of AI tools used in commercially sensitive functions, performing due diligence on AI vendors to understand the data on which their models are trained, and incorporating contractual safeguards that allocate responsibility for algorithmic outcomes. Companies should also bear in mind that liability under competition and consumer protection rules attaches to them irrespective of whether the relevant decisions are taken by employees or by algorithms, and that the growing use of detection technologies by enforcers means that problematic conduct is likely to be identified far more quickly than in the past.

Conclusion

Th AI Act represents a landmark regulatory initiative that establishes the first comprehensive governance framework for AI systems with a connection to the European market. Its significance lies not only in the substantive obligations it introduces but also in its extraterritorial reach, which ensures that non-EU companies, including those based in Türkiye, are brought within its regulatory perimeter where their AI activities intersect with the EU market.

For Turkish companies, this regulatory development necessitates a thorough review of all AI-related products, services and internal tools that have any connection with the EU market. The need for early action is particularly important for companies operating in sectors identified as high-risk under the AI Act, including employment, education, financial services, insurance, healthcare, biometric systems, critical infrastructure, industrial manufacturing, medical devices, automotive, aviation, unmanned aerial vehicles and robotics.

The most extensive compliance obligations, particularly those applicable to high-risk AI systems, will become enforceable under the extended implementation timeline in 2027 and 2028. Turkish companies should utilise the remaining transition period to conduct a comprehensive inventory of their AI systems, determine their classification under the AI Act, assess their role as provider, deployer or other relevant actor, and build the necessary governance, documentation, contractual and technical compliance infrastructure. Where applicable, companies should also consider appointing an authorised representative in the EU and integrating AI Act compliance into their broader regulatory strategy alongside existing frameworks such as the GDPR.

Proactive preparation is essential, not merely to mitigate the risk of substantial administrative penalties, but also to safeguard continued EU market access, preserve commercial relationships with European partners, ensure seamless product launches and maintain long-term competitiveness in an increasingly regulated global AI landscape.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.