Scope and method
This report is a digest of published sources, not original research. Zunkiree Labs ran no survey and gathered no data for it. We read regulator pages and law-firm summaries for five markets, extracted what they say about two questions, and organised the results so a buyer can compare them: what AI-specific rules apply, and what happens when personal data crosses a border.
This is general information, not legal advice. Laws and guidance change, so check each point against the current regulator page and with qualified counsel before you act. Each fact below is stated as of the date of its source. Our earlier posts report that several regulator pages were checked on 2 October 2026.
Summary: five markets side by side
| Market | AI-specific rules | Cross-border data rule | Regulator reference |
|---|---|---|---|
| EU (incl. Netherlands) | EU AI Act, Regulation (EU) 2024/1689. Article 50 transparency duties apply since 2 August 2026; Annex III high-risk from 2 December 2027; Annex I from 2 August 2028. | Our sources do not set out the transfer rules; they advise asking a supplier outside the EU which transfer arrangement covers it. | Autoriteit Persoonsgegevens (NL); European Data Protection Board |
| United Kingdom | None described in our sources beyond existing data protection law. | Restricted transfers need UK adequacy regulations, appropriate safeguards with a transfer risk assessment, or an exception. | ICO; NCSC for Cyber Essentials |
| Canada | None described in our sources; PIPEDA applies to personal information in commercial activities. | Organisation stays responsible; contractual comparable protection; notice that data may be accessed by foreign authorities. | Office of the Privacy Commissioner of Canada |
| Australia | Voluntary AI Safety Standard (5 September 2024), ten voluntary guardrails. | APP 8: reasonable steps so the overseas recipient does not breach the APPs; section 16C accountability. | OAIC; Department of Industry |
| Switzerland | No separate AI act in our sources; the FDPIC says the Data Protection Act applies directly to AI. | Adequate-protection states listed by the Federal Council; otherwise recognised or approved standard clauses, or binding corporate rules. | FDPIC |
A blank or “none described” cell means our listed sources do not describe such a rule, not that none exists.
European Union and the Netherlands
The AI Act is Regulation (EU) 2024/1689. According to the implementation timeline (updated 31 August 2026, not the official EU text), it entered into force on 1 August 2024, with prohibitions and AI literacy requirements from 2 February 2025 and general-purpose AI model obligations from 2 August 2025.
The Digital Omnibus on AI, reported by Lewis Silkin, was published on 24 July 2026 and entered into force on 27 July 2026. It moved Annex III high-risk obligations (for example biometrics, critical infrastructure, education, employment, credit and insurance) to 2 December 2027 and Annex I product-embedded systems to 2 August 2028. Marking of AI-generated content in systems on the market before 2 August 2026 has a grace period to 2 December 2026.
Cooley reports that Article 50 transparency duties apply from 2 August 2026, with fines of up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher. Holland & Knight describes how non-EU companies can be in scope if they place a system on the EU market or the output is used in the EU.
In the Netherlands the Autoriteit Persoonsgegevens is the data protection authority and the Dutch member of the European Data Protection Board.
United Kingdom
The ICO’s guide to international transfers (updated 15 January 2026) says that a restricted transfer must be covered by UK adequacy regulations, by appropriate safeguards with a transfer risk assessment, or by an exception, and that you must not make the transfer if none applies.
For supplier assurance, the NCSC describes Cyber Essentials as the minimum standard of cyber security recommended by the Government for organisations of all sizes. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The NCSC notes that a growing number of organisations require suppliers to be certified to bid for work.
Canada
The Office of the Privacy Commissioner of Canada says PIPEDA sets the ground rules for how private-sector organisations collect, use and disclose personal information in commercial activities across Canada. Alberta, British Columbia and Québec have their own private-sector laws, described by the OPC as substantially similar, that apply instead in some cases for organisations operating entirely within those provinces (OPC summary of privacy laws).
On processing abroad, the OPC guidelines (27 January 2009) say an organisation is responsible for personal information in its custody, including information transferred to a third party. It must provide a comparable level of protection, through contractual or other means (the guidelines call a contract the primary means), and must tell people the information may be sent to another jurisdiction and accessed there by courts, law enforcement and national security authorities. The OPC adds that no contract can override the criminal, national security or any other laws of the country to which the information has been transferred.
Australia
The OAIC calls the 13 Australian Privacy Principles the cornerstone of the privacy protection framework in the Privacy Act 1988. Under APP 8, before disclosing personal information to an overseas recipient an entity must take reasonable steps to ensure the recipient does not breach the APPs, and under section 16C it can be accountable for the recipient’s acts or practices.
The Notifiable Data Breaches scheme requires covered organisations to notify affected individuals and the OAIC when a breach involving personal information is likely to result in serious harm.
On AI specifically, the Australian Government’s Voluntary AI Safety Standard was published on 5 September 2024 with ten voluntary guardrails. A later Guidance for AI Adoption, published in October 2025, updates and simplifies it, according to our earlier post; check the current version on the department’s site.
Switzerland
The FDPIC stated on 9 November 2023 that the Federal Act on Data Protection is formulated to apply to all types of technology and is therefore directly applicable to AI-supported data processing. It says developers, providers and users of AI applications must make the purpose, functioning and data sources of AI-based processing transparent, and that the law requires a data protection impact assessment in high-risk cases. It separately lists comprehensive real-time facial recognition and comprehensive monitoring and assessment of lifestyle (“social scoring”) as applications that are prohibited under data protection law.
On transfers abroad, the FDPIC says disclosure is allowed where the destination state’s legislation ensures adequate protection (Art. 16(1) FADP), based on a list the Federal Council keeps in Annex 1 of the Data Protection Ordinance. Without such a decision, standard data protection clauses can be used. The FDPIC has recognised the EU standard contractual clauses and the Council of Europe model contractual clauses, while clauses drawn up by others must be approved by the FDPIC beforehand. Binding corporate rules are an option within a company group, and the FDPIC page lists further routes, so check it for your case.
What the markets have in common
- Accountability stays with you. Canada, Australia and the UK sources all keep the data owner responsible when a supplier or overseas team handles data.
- Transparency. The EU Article 50 duties, the Canadian notice about foreign access and the Swiss transparency expectations all ask you to tell people what is happening.
- Location is a risk factor. The OPC states that contracts cannot override foreign laws.
- Dates keep moving. The EU high-risk dates were delayed in 2026, which is why each fact here carries its source date.
Our own suggestion, not a legal requirement: use the table above to decide which regulator pages to read first, then put the supplier questions in our ebook to each vendor in writing.
Limits of this digest
- It is a summary of published sources, not legal advice and not original research.
- It covers five markets and does not cover the United States, Germany specifically, Asia, the Middle East or sector rules such as health or finance.
- Law-firm summaries are interpretations; the regulator or the official text controls.
- The industry.gov.au page for the Australian standard did not load for us on the day of checking, so the Australian AI facts rest on the earlier post that cites it. Verify before use.
- Penalties and thresholds are quoted as reported and may be revised.
For help applying this to a project, schedule a call.
Sources
- AI Act implementation timeline, page updated 31 August 2026 (not the official EU text)
- Cooley, EU AI Act: Transparency Obligations Take Effect 2 August 2026, 3 August 2026
- Lewis Silkin, The Digital Omnibus on AI enters into force today, 27 July 2026
- Travers Smith, EU agrees to delay key AI Act compliance deadlines, May 2026
- Freshfields, EU AI Act unpacked #34: The final Digital Omnibus on AI
- Holland & Knight, U.S. Companies Face EU AI Act’s Possible August 2026 Compliance Deadline, 28 April 2026
- European Data Protection Board, members
- ICO, International transfers: a guide, updated 15 January 2026
- NCSC, Cyber Essentials overview
- OPC, PIPEDA fair information principles, last modified 29 May 2025
- OPC, Summary of privacy laws in Canada
- OPC, Guidelines for processing personal data across borders, 27 January 2009
- OAIC, Australian Privacy Principles
- OAIC, APP 8: cross-border disclosure of personal information
- OAIC, Notifiable Data Breaches
- Australian Government, Voluntary AI Safety Standard, 5 September 2024
- FDPIC, Current data protection legislation is directly applicable to AI, 9 November 2023
- FDPIC, Cross-border transfer of personal data
Frequently asked questions
Is this original research?
No. It is a digest of published regulator pages and law-firm summaries, each listed in the Sources section with its date. Zunkiree Labs did not run any survey or collect any data for it.
Is there a single global rule on where AI data must be stored?
None of the sources in this digest describes one. Each market sets its own rules, mostly about accountability and safeguards when personal data is transferred, rather than a blanket ban on processing abroad.
Do any of these markets require data to stay in the country?
The sources reviewed describe transfer conditions, not a general requirement to keep personal data in-country. Specific sectors or public bodies may have stricter rules that this digest does not cover, so check your sector.
How current is the information?
Each fact is stated as of its source date, which ranges from 2009 for one Canadian guideline to October 2026 for the EU timeline summaries. Check the current regulator page before relying on any point.
What you get:
- A five-market comparison table of AI-specific rules and cross-border data rules
- EU AI Act dates as published, including the 2026 delays
- What the UK, Canadian, Australian and Swiss regulators say about transfers
- The common threads: accountability, transparency and location risk
- A clear list of what the digest does not cover