Legal Status of AI Services in Uzbekistan: What Every Founder Needs to Know

Legal Status of AI Services in Uzbekistan: What Every Founder Needs to Know

The short answer: Uzbekistan doesn't yet have a dedicated AI law — but that doesn't mean your service operates in a legal vacuum. The regulatory framework emerges from the intersection of personal data protection, e-commerce, consumer rights, and general civil liability rules. The sooner you internalize this, the cheaper your compliance journey will be.

Key takeaways:

• The absence of a standalone "AI law" does not eliminate legal obligations — general legislation applies in full.
• Processing personal data through an AI service is governed by data protection law and requires clear documentation.
• Liability for an "algorithmic error" falls on the legal entity, not the algorithm — this must be addressed in your Terms of Service.
• If your AI assists with decisions in healthcare, finance, or legal services, the regulatory bar is significantly higher.

---

Why "No AI Law" Is No Reason to Relax

When we were building Pactum, one of the first questions we asked was: "Is there actually any AI regulation here?" The answer is yes — just indirect. Your service collects data → data protection law applies. Your service makes recommendations to users → consumer protection law applies. Your service generates revenue → tax and corporate law apply.

The global trend is moving toward direct AI regulation (the EU AI Act is the clearest example), and Uzbekistan, as it actively integrates into the digital economy, will inevitably follow suit. My strong advice: build your processes now so that tightening regulation doesn't force you to re-architect your product from scratch.

---

Personal Data: The Sharpest Risk

Every AI service runs on data. If that data includes names, contact details, behavioral patterns, biometrics, or any other information that can identify an individual, you fall squarely under personal data protection legislation.

What this means in practice:

• User consent must be obtained explicitly, prior to data processing, and properly documented.
• A privacy policy is not a formality — it's a working document that must accurately describe the purposes, methods, and retention periods for data processing.
• Cross-border data transfers (for example, if your model runs on servers outside Uzbekistan) require a separate legal basis.
• Rights to access and erasure — users are entitled to request their data or demand its deletion.

Practical tip: conduct a data mapping exercise — create a clear picture of what data you collect, where it's stored, and who has access. It takes a few hours and resolves about 80% of regulatory questions before they're ever asked.

---

Liability: Who Is Responsible for an Algorithmic Error?

The algorithm is not a legal entity and cannot be held liable. You can. That's exactly why your Terms of Service and B2B contracts must clearly describe what your AI does — and what it doesn't do — and where the line of responsibility sits.

---

Regulated Sectors: A Special Zone of Attention

If your AI service touches healthcare, legal services, financial advisory, or education, expect heightened regulatory scrutiny. These sectors frequently carry licensing requirements, and an automated service may fall within their scope regardless of whether you call it a "tool" or a "full advisor."

The core rule: if your product does what a licensed professional does, consult a lawyer before launch — not after your first regulatory complaint.

---

Intellectual Property and AI-Generated Content

Another gray area: ownership of AI-generated content. Who holds the rights to the text, images, or code your service produces? Traditional copyright law requires a human author. In practice, this means:

• Purely machine-generated content may fall outside copyright protection entirely.
• If users create content using your tool, the rights may belong to them — unless your ToS states otherwise.
• The reverse challenge: make sure the training data behind your model doesn't infringe third-party rights.

---

What to Do This Week: A Compliance Checklist

• [ ] Conduct data mapping: what data you collect, where it's stored, who has access
• [ ] Review your privacy policy against your actual data processing practices
• [ ] Verify that your data consent mechanism is legally sound
• [ ] Revisit your Terms of Service: do they clearly limit liability for algorithmic outputs?
• [ ] If B2B — confirm that liability allocation is explicitly addressed in client contracts
• [ ] If operating in a regulated sector — clarify applicable licensing requirements

---

FAQ

Does an AI service require a special business registration in Uzbekistan?

No dedicated registration category exists for AI services. You register a legal entity or sole proprietorship through the standard process. The exception is if your activity falls within a licensed sector.

Can I store user data on servers outside Uzbekistan?

Yes, but it requires a legal basis. Personal data legislation sets out requirements for cross-border transfers. The specific conditions vary and should be verified against your particular circumstances.

What should my Terms of Service say about AI features?

Describe the functionality honestly, frame recommendations as informational rather than advisory where that accurately reflects the product, and explicitly limit the company's liability for losses arising from automated outputs.

If the AI makes an error and a user suffers a loss — does that mean litigation?

Not necessarily, but a formal claim is a real possibility. A well-drafted ToS and documented processes are your first line of defense. The clearer your product's boundaries are defined, the weaker the grounds for a successful claim.

When will Uzbekistan introduce a dedicated AI law?

No confirmed timeline exists. Regulatory initiatives are under discussion, but the situation is evolving. I recommend tracking developments and building your product on a "compliance by design" basis starting now.

---

*This article is for general informational purposes only and does not constitute individual legal advice. Specific legal questions must be assessed in the context of your particular business — please consult a qualified professional.*

---

If you'd like to work through the legal side of your AI product in detail — book a consultation. At Pactum, this is exactly the kind of case we handle: where technology meets law.