“We use AI with customer data on two continents. What applies?”
A company with users in Europe and operations in Florida answers to several regimes at once: the GDPR, the EU AI Act with its revised timetable, and a patchwork of U.S. state privacy laws that keeps growing. Years inside the largest technology platforms taught one rule that still holds: map the data flows first, then the law. The map is the document regulators ask for, the document that decides a dispute, and the document most companies do not have.
If the system's output is used in the EU or the system is placed on the EU market — often yes, regardless of where the company sits. The classification of the system decides what, and by when.
The deadline and the data map. The first answer sets the frame for the whole inquiry; it is written once the flows are understood, not before.
Both, and in this order: the map and the plan prevent most disputes; when one comes anyway, the same map is the defense.
Loading…