AI compliance isn't a local problem.
It's a global one.
If your business operates across borders, uses AI tools with data from multiple countries, or employs people in different jurisdictions — multiple AI laws apply to you simultaneously. We cover the UK, EU, US, Canada, the Middle East, the Far East and Australasia, each with its own rules on how you use AI.
Your customers decide which law
applies to you. Not your address.
Where your customers are, where your staff are and where your AI has effect — those decide, not where the business is registered. We write frameworks to four legal systems, and serve four more on request.
- United Kingdom UK GDPR, in force now. The Data (Use and Access) Act added automated-decision duties from 5 February 2026.
- European Union The EU AI Act. General-purpose AI obligations already apply; regulators have had enforcement powers since 2 August 2026.
- United States State by state, not federal. Texas from 1 January 2026, California from 2 August 2026, Colorado from 1 January 2027.
- Canada PIPEDA plus provincial law. Ontario's AI hiring disclosure rules applied from 1 January 2026.
Every major AI compliance obligation for SMBs.
Every market we write frameworks for, and the law in each that a small business meets first.
UK GDPR + ICO AI guidance
EU AI Act — the world's first AI-specific law
38 state laws — California, Texas and Illinois live now
Quebec Law 25 is live. Ontario now requires AI disclosure in job postings.
Dubai already has binding AI rules. Most firms working there have never read them.
Middle East AI Compliance →South Korea's AI Act reaches you from abroad. Japan's has no penalties. Neither leaves you clear.
Far East AI Compliance →Australia has no AI Act — and one hard deadline that catches automated decisions.
Australasia AI Compliance →The same work, done in-house.
862 pages of primary law to read, 27 documents to write, and 15 records a year to keep afterwards. Costed against what a member of staff on the median UK salary actually costs an hour:
£7,488
Your own staff — 289 hours of their time
£2,400/year
UK + EU Combined Compliance Framework — in your inbox by the end of the business day
Which laws apply to your business?
AI compliance jurisdiction is determined by where your data subjects are, where your employees are, and where your AI systems have effect — not just where your business is registered.
UK + EU Laws Apply If…
- You have UK or EU customers, employees, or data subjects
- You use AI for automated decisions about UK or EU individuals
- You process UK or EU personal data in AI systems
- You market AI-enabled products into the UK or EU
US State Laws Apply If…
- You use AI in any US hiring or promotion decision (Illinois law has no territorial limit)
- You have California employees or sell to California consumers
- You make AI-driven decisions about Colorado residents
- You operate in Texas using AI for consequential decisions
Canada Laws Apply If…
- You have customers or employees in Quebec
- You use AI profiling on any Canadian individual
- You collect personal information from Canadians (PIPEDA baseline)
- You advertise jobs in Ontario and use AI to screen applicants (25+ employees)
Middle East Laws Apply If…
- You are registered in the DIFC and run anything that answers customers, screens applicants or scores risk.
- You bought the system in. Regulation 10 names the deployer, not just the developer.
- Your customer-facing notices describe your data handling but say nothing about what the system decides on its own.
Far East Laws Apply If…
- You use generative AI on anything containing customer or staff information.
- You are in somebody's supply chain and cannot yet say who is accountable for the AI in it.
- You are bidding for work, or courting a Japanese partner, where alignment with a published AI framework is a question on the form.
- You have Korean customers and your AI answers them, drafts to them or scores them, and nothing on screen says so.
- You sell to people in China, or analyse what they do, and assumed the AI rules there were somebody else's problem. The AI rules may well be. The personal information law is not.
Australasia Laws Apply If…
- You use a tool that scores, ranks, shortlists or prices — recruitment screening, credit decisions, claims triage.
- You bought that tool rather than built it. The duty is on the business that arranged for the program to decide, not on whoever wrote it.
- You sell to customers in Australia, your turnover has passed three million Australian dollars, and your privacy policy was written before any of this existed.
The reality for most SMBs: If you use SaaS tools (ChatGPT, Copilot, HubSpot AI, LinkedIn Recruiter), process employee data, and operate in more than one country — you are almost certainly in scope for at least two of these jurisdictions simultaneously.
Operating in multiple jurisdictions compounds the risk.
Each jurisdiction has different definitions, different risk thresholds, and different timelines. A policy that satisfies UK GDPR may not satisfy Colorado's impact assessment requirements. A disclosure that works in California may not meet Quebec's opt-out obligations.
The EU AI Act lists the uses it treats as high-risk; Colorado's SB 26-189 instead catches automated decision-making in consequential decisions about people. A system caught by one may not be caught by the other. You need a unified view across all frameworks.
UK ICO audits want a Data Protection Impact Assessment. The EU AI Act requires a Conformity Assessment. Quebec Law 25 requires a Privacy Impact Assessment. Each needs different evidence.
Quebec Law 25 is already enforced. EU GPAI is live. US state laws are active. EU high-risk AI obligations hit in December 2027. Compliance planning needs a multi-jurisdiction calendar.
The language and timing of required disclosures to employees and customers varies by jurisdiction. What you must tell a UK employee about AI-assisted performance reviews differs from what you must tell a Quebec employee.
Our cross-border packages are built to satisfy all applicable jurisdictions from a single coherent framework — not seven separate bolt-ons.
Seven markets, fixed price, plain English.
Enterprise law firms charge five figures for multi-jurisdiction AI compliance. We've productised it. Fixed-price frameworks built for businesses under 500 employees — delivered in days, not months.