1. Map the Cross-Border Regulatory Footprint before Launch
Start with the system as it actually operates. Company role, system function, users, data locations, and deployment markets determine which legal regimes deserve attention first.
Identify Roles, Uses, and Data Flows
Build one factual map showing what the system does, who controls key decisions, and where data travels.
- Identify who develops, provides, deploys, or materially modifies the system.
- Map where personal data is collected, stored, accessed, and transferred.
- Record affected users, vendors, business functions, and deployment markets.
Broader domestic governance issues can be reviewed under AI Legal Compliance.
Separate Current Duties from Later Triggers
There is no single U.S. .pproval path for AI products. Federal, state, sector, and foreign rules can reach different parts of the same system.
- Match current duties to the company's actual role and use.
- Separate effective requirements from enacted rules with later dates.
- Flag product changes that could alter an earlier classification.
For example, General Business Law Article 47 regulates defined AI companion models. The RAISE Act creates separate duties for covered frontier-model developers beginning January 1, 2027.
2. Separate EU AI Act Duties from GDPR Transfer Rules
The EU AI Act and GDPR can apply to the same project for different reasons. One regulates specified AI activities, while GDPR addresses personal-data processing and transfers when its scope rules are met.
Classify the AI Role and Applicable Timing
The EU AI Act uses role- and risk-based duties. Its general application date is August 2, 2026, while certain high-risk obligations now apply later.
- Identify whether the company acts as a provider, deployer, importer, or other operator.
- Check whether the system falls within a prohibited, high-risk, or other regulated category.
- Match each duty to the application date that governs that category.
Test GDPR Scope before Choosing a Transfer Tool
Training or hosting location alone does not decide GDPR scope. Start with Article 3, then examine the processing activity and any Chapter V transfer.
- Identify personal data used in training, testing, prompts, outputs, or monitoring.
- Match controller and processor roles to the operating model.
- Determine whether a transfer outside the EEA requires a Chapter V mechanism.
Cross-border privacy issues can also be reviewed through Global Data Compliance.
3. Match Each Data Transfer to Its Legal Route
Standard Contractual Clauses are not the only transfer tool. The route depends on the destination, parties, structure, and safeguards.
Check the Transfer Mechanism against the Facts
Use the actual data flow rather than a template-first approach. Adequacy decisions, SCCs, BCRs, and derogations operate under different conditions.
| Review Point | Core Question |
|---|---|
| Data flow | What personal data moves or becomes remotely accessible? |
| Parties | Who exports, receives, or can access the data? |
| Mechanism | Which Chapter V route fits the transfer? |
| Safeguards | What contractual, technical, or organizational measures apply? |
Data flow
- Core QuestionWhat personal data moves or becomes remotely accessible?
Parties
- Core QuestionWho exports, receives, or can access the data?
Mechanism
- Core QuestionWhich Chapter V route fits the transfer?
Safeguards
- Core QuestionWhat contractual, technical, or organizational measures apply?
Check the AI Model against the Privacy Record
EDPB guidance treats AI-model privacy questions as fact-specific. Anonymity, legal basis, and prior unlawful processing can each affect deployment analysis.
- Assess whether personal data remains relevant to the model or its outputs.
- Document the legal basis relied on for covered processing.
- Recheck downstream use if upstream processing creates a legal issue.
Related privacy controls can be assessed through Privacy and Data Protection.
4. Build the Record before a Filing or Regulatory Response
Cross-border AI regulation does not use one universal filing or clearance process. A filing, notice, registration, or response should follow an identified legal trigger.
Confirm the Trigger before Submitting Anything
Start with the rule creating the obligation. Then identify the responsible entity, covered activity, required materials, and applicable timing.
- Identify the legal basis for any filing, notice, or registration.
- Confirm which entity bears the obligation.
- Track deadlines only after establishing that the duty applies.
Keep the Regulatory Record Consistent
Technical records, contracts, and submissions should describe the same system. Verify open facts before responding.
- Confirm material statements with product, privacy, and engineering teams.
- Separate verified facts from assumptions still under review.
- Record why a material legal or compliance decision was made.
5. Recheck Compliance When the System Materially Changes
New models, vendors, data sources, markets, or uses can change an earlier analysis. Review should follow material changes.
Define Events That Return the Project to Review
Set escalation points for facts that may change an earlier conclusion.
- Addition of a new deployment market or materially different use.
- Change in model function, data source, or processing purpose.
- New vendor access or a different cross-border data route.
Align Contracts with the Updated Data Flow
Vendor agreements can affect data access, processing roles, security, and change controls. Recheck them after a material operational change.
- Compare data-use rights with the intended AI function.
- Review vendor access and processing responsibilities.
- Update transfer terms when the relevant data flow changes.
Related agreements can be reviewed through Technology Transactions and Licensing.
6. Frequently Asked Questions
Does GDPR apply when an AI model is trained outside the EU?
Training location alone does not decide GDPR scope. Article 3, the processing activity, affected individuals, and company activities must be assessed.
Do Standard Contractual Clauses solve every AI data-transfer issue?
No. SCCs are one transfer mechanism. The transfer scenario, parties, safeguards, and underlying processing duties still require review.
Does every AI system need regulatory approval before launch?
No. The answer depends on the applicable law, system, role, sector, and use. Any filing or approval requirement needs a specific legal basis.
Can an AI model be treated as anonymous after training?
Not automatically. EDPB guidance treats anonymity as fact-specific, including whether personal data can be extracted from the model or obtained through queries.
7. Map the Rules before Cross-Border AI Decisions Are Fixed
Cross-border AI projects can raise AI, privacy, transfer, and contract issues. SJKP's attorneys can assess the system, data flows, legal triggers, and compliance record before deployment or material change.
14 Sep, 2026
