Which AI laws apply to my business?
There is no single global AI law. Which rules apply to you depends on four questions. Answer them in order and you will usually end up with a short list.
1. Where are your users and customers?
Most AI laws follow the people affected, not where your company is registered. If you sell to customers in the EU, state by state in the US, or in Canada, those places' rules can apply to you.
2. What does your AI do?
Use case matters more than the technology. AI that makes or supports decisions about people (jobs, credit, housing, insurance, healthcare, education) gets far more scrutiny than a spell checker. Chatbots and AI-generated content face disclosure rules in a growing number of places.
3. What is your role?
Most laws separate the people who build an AI system (providers or developers) from the people who use it (deployers). The duties are different. If you build a product on top of someone else's model, you may count as both.
4. What data is involved?
If personal data is involved, privacy laws such as GDPR, UK GDPR, PIPEDA and US state privacy laws apply on top of any AI-specific rules.
Quick guide by region
- European Union: the most detailed binding AI law. See the EU AI Act explained.
- United Kingdom: no AI Act, regulator-led. See UK AI regulation.
- United States: federal agencies plus a patchwork of state laws. See US AI regulation.
- Canada: no federal AI statute in force, privacy law does the work. See Canada AI regulation.
- Elsewhere: other countries are moving too, including South Korea, Japan, Brazil, China and Singapore, with very different approaches from binding law to voluntary frameworks. We will cover them in future guides, and you should check official sources in the meantime.
A simple checklist
- List each AI system and what it does.
- List the countries and US states where its outputs reach people.
- Note whether you are a provider, a deployer, or both.
- Flag any use that affects people's jobs, money, housing, health or education.
- Write down how each system was built, tested and monitored. Nearly every regime asks for this, in one form or another.
If your list includes the EU, start there. It is the most demanding regime and a good benchmark for the rest.
This article is general information, not legal advice. Rules change often, so check official sources before you rely on it.