About this ebook
Most business owners do not set out to become experts in AI law. They adopt an AI tool, or hire a team to build one, and then discover that privacy and AI rules may apply. This ebook gives a calm overview of that landscape: who the rules can reach, what has changed in 2026, how data crossing a border is treated, and what to ask a supplier.
It is built from published regulator pages and law-firm summaries, listed in the Sources section with dates. This is general information, not legal advice. Laws and guidance change, so check each point against the current regulator page and with qualified counsel before you act.
For a lightweight internal checklist, see our AI governance and data privacy checklist for SMEs. For a market-by-market digest, see the companion report. This ebook is about how to think about compliance as a whole.
1. Why compliance is now an owner-level question
AI changes where personal data goes. A customer record pasted into a chatbot, a support transcript sent to a model provider or a pipeline built by an offshore team each moves data somewhere new. Privacy laws already regulate that movement, and newer AI-specific laws add duties on top.
Two points shape everything that follows. First, existing law already applies to AI. Switzerland’s Federal Data Protection and Information Commissioner (FDPIC) stated on 9 November 2023 that the Swiss Data Protection Act is formulated to apply to all types of technology and therefore applies directly to AI-supported data processing. Second, you stay responsible when a supplier does the work. Canada’s regulator says an organisation is responsible for personal information in its possession or custody, including information transferred to a third party for processing.
2. Who the rules can reach
Where your company is registered is not the only test. The EU AI Act is Regulation (EU) 2024/1689. According to Holland & Knight, non-EU companies can be caught in two ways: by placing an AI system or model on the EU market, including software used by EU customers, and where the output of an AI system is used in the EU.
Privacy law works on a similar principle of following the data. Australia’s APP 8, for example, applies when an entity discloses personal information to an overseas recipient, and the OAIC guidance treats that as a question about the Australian entity’s steps, whoever the supplier is. In practice, an offshore team is an overseas recipient.
Our own suggestion, not a legal requirement: for each AI tool, write down three facts. Where are your users or customers? Where is the data stored and processed? Who supplies the model or service? Those three answers tell you which regulators to read first.
3. The EU AI Act in business terms
The Act sorts AI systems by risk and sets duties for providers (who build or supply systems) and deployers (who use them). The published dates, as summarised by the sources below:
| Date | What happens | Source |
|---|---|---|
| 1 August 2024 | The AI Act enters into force | Implementation timeline |
| 2 February 2025 | Prohibitions on certain AI systems and AI literacy requirements begin | Implementation timeline |
| 2 August 2025 | Obligations for general-purpose AI models begin | Implementation timeline |
| 2 August 2026 | Article 50 transparency duties apply | Cooley |
| 2 December 2026 | Grace period ends for marking AI-generated content in systems already on the market before 2 August 2026 | Lewis Silkin |
| 2 December 2027 | Annex III high-risk obligations (for example employment, credit, education) apply | Lewis Silkin |
| 2 August 2028 | Annex I product-embedded high-risk obligations apply | Lewis Silkin |
The Digital Omnibus on AI was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, and it produced the 2027 and 2028 dates. Delayed does not mean cancelled. Cooley reports Article 50 fines of up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher.
4. What Article 50 asks of ordinary businesses
Cooley summarises four situations. Providers must make clear when an AI system interacts directly with people unless that is obvious, and must add machine-readable markings to synthetic audio, image, video or text with limited exceptions. Deployers must inform people affected by emotion recognition or biometric categorisation, and must disclose deep fakes and AI-generated text on matters of public interest unless it has had substantive human editorial review.
For a typical company this translates into a short list of practical checks:
- Does any customer-facing chatbot or voice agent say clearly that it is an AI system?
- Do you publish AI-generated images, video or audio, and are they labelled?
- Does any AI text go out on matters of public interest without human editorial review?
- Do you use emotion recognition or biometric categorisation anywhere?
Cooley also notes that content generated before 2 August 2026 does not need retroactive labelling.
5. Privacy and cross-border rules, market by market
Data protection regulators describe a common idea in different words: if personal data leaves the country, you remain accountable and must be able to show how it is protected. The detail differs.
| Market | What the regulator says | Practical point |
|---|---|---|
| United Kingdom | The ICO says a restricted transfer must be covered by UK adequacy regulations, appropriate safeguards with a transfer risk assessment, or an exception, and must not be made if none applies. | Ask which of the three routes covers a non-UK supplier. |
| Canada | The OPC says organisations must use contractual means to provide comparable protection and must tell people their information may be processed in another jurisdiction and accessed there by courts, law enforcement and national security authorities. | Update your privacy notice if processing happens outside Canada. |
| Australia | Under APP 8 an entity must take reasonable steps to ensure an overseas recipient does not breach the APPs, and under section 16C can remain accountable for the recipient’s acts. | Treat an offshore team as an overseas recipient. |
| Switzerland | The FDPIC says transfers abroad are allowed where the destination state has adequate protection (listed in Annex 1 of the Data Protection Ordinance); otherwise recognised or approved standard clauses, such as the EU standard contractual clauses, or binding corporate rules are options. | Ask which mechanism covers the transfer. |
| Netherlands / EU | The Autoriteit Persoonsgegevens is the Dutch data protection authority and the Netherlands’ member of the European Data Protection Board. | Settle how transfers outside the EU are covered before sharing personal data. |
Canada’s regulator adds one blunt limit: no contract can override the criminal, national security or any other laws of the country to which the information has been transferred. Location of processing is therefore a risk in its own right, not only a contract detail.
6. Frameworks to anchor your approach
Where binding law is thin or still arriving, three voluntary or international references help you structure what you do. Their stated dates are below.
- UNESCO Recommendation on the Ethics of AI: adopted in November 2021 by 193 member states. On oversight it says AI systems should not displace ultimate human responsibility and accountability.
- OECD AI Principles: adopted in 2019 and updated in May 2024, with 47 adherents, per our earlier post that cites the OECD page. They include transparency and explainability, robustness and accountability.
- NIST AI Risk Management Framework: AI RMF 1.0 was released on 26 January 2023 for voluntary use, built around four functions: Govern, Map, Measure and Manage.
For generative AI, NIST’s companion profile (July 2024) names risks such as confabulation, which it describes as confidently stated but erroneous or false content, and data privacy. Each needs a control, such as human review or access limits. Australia’s Voluntary AI Safety Standard, published on 5 September 2024, sets ten voluntary guardrails, including data governance for quality and provenance.
7. Questions to put to any AI supplier
These combine the questions the regulators’ guidance suggests. Ask them in writing, and ask them of us too.
- In which countries is data stored, processed and backed up, and can that be restricted?
- Which sub-processors are involved, and where are they?
- Which transfer mechanism covers the arrangement, and can we see it?
- How are requests from foreign authorities handled, and will we be told?
- Which staff can access production data, from which countries, and how is access logged?
- How quickly will you tell us about a suspected breach?
- What is deleted at the end of the contract, and how can we verify it?
- Which of the product’s functions might fall under the EU AI Act categories?
If the supplier’s tools can act on your systems, add the access-control questions in our agent security checklist. For custom builds, see our custom AI agent work.
8. A short owner’s action plan
Our own suggestion, not a legal requirement:
- This month: list every AI tool in use and where its data goes.
- Next: write down the markets your customers are in and the regulator for each.
- Then: check your customer-facing AI for disclosure and labelling duties.
- Contracts: add the supplier questions above to your next renewal or purchase.
- Calendar: mark 2 December 2026, 2 December 2027 and 2 August 2028 if the EU rules may reach you.
- Advice: have a qualified lawyer in each relevant market confirm the points that matter.
If you want to talk through a specific project, you can schedule a call.
Sources
- Cooley, EU AI Act: Transparency Obligations Take Effect 2 August 2026, 3 August 2026
- Lewis Silkin, The Digital Omnibus on AI enters into force today, 27 July 2026
- Travers Smith, EU agrees to delay key AI Act compliance deadlines, May 2026
- Holland & Knight, U.S. Companies Face EU AI Act’s Possible August 2026 Compliance Deadline, 28 April 2026
- AI Act implementation timeline, page updated 31 August 2026 (not the official EU text)
- European Data Protection Board, members
- ICO, International transfers: a guide, updated 15 January 2026
- Office of the Privacy Commissioner of Canada, Guidelines for processing personal data across borders, 27 January 2009
- OPC, PIPEDA fair information principles, last modified 29 May 2025
- OAIC, APP 8: cross-border disclosure of personal information
- Australian Government, Voluntary AI Safety Standard, 5 September 2024
- FDPIC, Current data protection legislation is directly applicable to AI, 9 November 2023
- FDPIC, Cross-border transfer of personal data
- UNESCO, Recommendation on the Ethics of AI, November 2021
- OECD, AI Principles, 2019, updated May 2024
- NIST, AI Risk Management Framework, 26 January 2023
- NIST AI 600-1, Generative AI Profile, July 2024
- Regulation (EU) 2024/1689 and the Digital Omnibus on AI, Official Journal of the European Union, 24 July 2026 (as described in the law-firm sources above)
Frequently asked questions
Does the EU AI Act apply to a business outside the EU?
It can. Law-firm summaries describe two routes: placing an AI system on the EU market, including software used by EU customers, and cases where the output of an AI system is used in the EU. Whether it applies to you depends on the facts, so ask a qualified lawyer.
Which EU AI Act rules apply now?
As reported in October 2026, the Article 50 transparency duties have applied since 2 August 2026, for example telling people when they are interacting with an AI system. The heavier high-risk obligations were delayed to 2 December 2027 and 2 August 2028.
If a contract promises data protection, is the data safe from foreign authorities?
Not entirely. Canada's privacy regulator says no contract can override the criminal, national security or any other laws of the country to which the information has been transferred. A contract is still needed, but where data is processed remains a risk factor.
Is this ebook legal advice?
No. It summarises published regulator and law-firm sources as of the dates shown in the Sources section. Laws change, so confirm each point with a qualified lawyer in your market.
What you get:
- Who AI and privacy rules can reach, including non-EU and offshore arrangements
- The EU AI Act dates as published, with what applies now and what was delayed
- A market comparison of cross-border transfer rules in five jurisdictions
- The questions to put to any AI supplier, in a form you can paste into a contract review
- A short owner’s action plan with calendar dates