AI compliance isn't a local problem.
It's a global one.
If your business operates across borders, uses AI tools with data from multiple countries, or employs people in different jurisdictions — multiple AI laws apply to you simultaneously. The UK, EU, US, and Canada all have active enforcement. We cover all four.
Your customers decide which law
applies to you. Not your address.
Where your customers are, where your staff are and where your AI has effect — those decide, not where the business is registered. We write frameworks to four legal systems, and serve four more on request.
- United Kingdom UK GDPR, in force now. The Data (Use and Access) Act added automated-decision duties from 5 February 2026.
- European Union The EU AI Act. General-purpose AI obligations already apply; enforcement begins 2 August 2026.
- United States State by state, not federal. Texas from 1 January 2026, California from 2 August 2026, Colorado from 1 January 2027.
- Canada PIPEDA plus provincial law. Ontario's AI hiring disclosure rules applied from 1 January 2026.
Every major AI compliance obligation for SMBs.
These are the four jurisdictions where enforcement is active, penalties are material, and where most SMBs already have exposure. We are the only provider that covers all four.
UK GDPR + ICO AI Auditing Framework
EU AI Act — the world's first AI-specific law
38 state laws — California, Texas and Illinois live now
Quebec Law 25 is live. Ontario now requires AI disclosure in job postings.
Which laws apply to your business?
AI compliance jurisdiction is determined by where your data subjects are, where your employees are, and where your AI systems have effect — not just where your business is registered.
UK + EU Laws Apply If…
- You have UK or EU customers, employees, or data subjects
- You use AI for automated decisions about UK or EU individuals
- You process UK or EU personal data in AI systems
- You market AI-enabled products into the UK or EU
US State Laws Apply If…
- You use AI in any US hiring or promotion decision (Illinois law has no territorial limit)
- You have California employees or sell to California consumers
- You make AI-driven decisions about Colorado residents
- You operate in Texas using AI for consequential decisions
Canada Laws Apply If…
- You have customers or employees in Quebec
- You use AI profiling on any Canadian individual
- You collect personal information from Canadians (PIPEDA baseline)
- You advertise jobs in Ontario and use AI to screen applicants (25+ employees)
The reality for most SMBs: If you use SaaS tools (ChatGPT, Copilot, HubSpot AI, LinkedIn Recruiter), process employee data, and operate in more than one country — you are almost certainly in scope for at least two of these jurisdictions simultaneously.
Operating in multiple jurisdictions compounds the risk.
Each jurisdiction has different definitions, different risk thresholds, and different timelines. A policy that satisfies UK GDPR may not satisfy Colorado's impact assessment requirements. A disclosure that works in California may not meet Quebec's opt-out obligations.
The EU AI Act, Colorado AI Act, and Quebec Law 25 all define high-risk AI differently. A system that isn't high-risk under one law may be under another. You need a unified view across all frameworks.
UK ICO audits want a Data Protection Impact Assessment. The EU AI Act requires a Conformity Assessment. Quebec Law 25 requires a Privacy Impact Assessment. Each needs different evidence.
Quebec Law 25 is already enforced. EU GPAI is live. US state laws are active. EU high-risk AI obligations hit in December 2027. Compliance planning needs a multi-jurisdiction calendar.
The language and timing of required disclosures to employees and customers varies by jurisdiction. What you must tell a UK employee about AI-assisted performance reviews differs from what you must tell a Quebec employee.
Our cross-border packages are built to satisfy all applicable jurisdictions from a single coherent framework — not four separate bolt-ons.
Australasia, the Middle East and the Far East.
We have written up what the law actually is in each of them — read at the legislature's own site, not summarised from somebody else's summary. There is no off-the-shelf framework for these markets yet, so each page ends in a conversation rather than a checkout.
No other provider covers all four Tier 1 jurisdictions for SMBs.
Enterprise law firms charge five figures for multi-jurisdiction AI compliance. We've productised it. Fixed-price frameworks built for businesses under 500 employees — delivered in days, not months.