AI and data rules: where to look by region

Planning a road trip across several countries, you would check the driving rules before setting off. Which side of the road, which documents, which tolls. You would not need to be a lawyer to know where to look.

Running AI across borders is similar. Different places have different rules about data and about AI itself. This piece gives a starting map of the kinds of rules to look for, so your team knows which questions to take to its lawyers.

This article is general information, not legal advice. Rules change, and how they apply depends on your facts. Check with qualified counsel for your situation.

Four kinds of rules to look for

Most rules that affect where AI work can run fall into four groups. One workload can be touched by several at once.

Data protection and privacy rules. These govern how personal data is collected, used, stored and moved. They often include conditions on sending personal data to other countries.

AI-specific rules. These are newer. They focus on how AI systems are built, tested, documented and used, often with more duties for uses judged higher risk.

Sector rules. Health, finance, telecoms and other regulated industries often have their own rules on records, outsourcing and where data may be held.

Public-sector and security rules. Governments and their suppliers may face extra requirements on location, staff access and certification.

Europe

The European Union's General Data Protection Regulation (GDPR) is the most widely known data protection law. It sets rules for handling personal data and for transferring it outside the EU and related countries. (We explain the basics of keeping data in a place in Data residency in one page.)

The EU's AI Act adds rules aimed at AI systems themselves. It sorts uses by risk and places different duties on those who build and those who deploy AI. Its obligations apply in stages over time.

The United Kingdom has its own data protection law, closely related to the GDPR, and its own approach to AI. Individual European countries can add national rules, especially in sectors.

North America

The United States has no single national privacy law covering all personal data. Instead there are federal rules for particular sectors, such as health and finance, and a growing number of state privacy laws. Several states have also passed or proposed rules on specific AI uses.

Canada has national and provincial privacy laws. Public bodies in some provinces face rules about where data is stored.

Asia-Pacific and elsewhere

This region varies widely. Some countries have broad privacy laws modelled in part on European ideas. Others have rules that require certain data to stay in the country, or to pass a security review before it leaves. (We explain the difference between these in "Data residency or data localisation?".)

Several countries are also writing AI guidance or rules. Some focus on particular uses, such as generated content. In the Middle East, Africa and Latin America, many countries have adopted or updated data protection laws recently.

For any country your work touches, it is worth checking three things: the main privacy law, any data localisation rules, and any AI-specific rules in force or on the way.

Turning the map into questions

A map helps you know where to look. It does not tell you what to do. These questions help turn it into a plan with your legal and compliance teams:

1. Which countries do our users, our data and our AI processing touch?
2. Does the workload use personal data, and of what kind?
3. Is the use likely to count as higher risk under any AI rule?
4. Do sector rules apply to us or our customers?
5. Must any data, or any processing, stay in a particular country?
6. What records would we need to show a regulator where and how the work ran?

The last question matters more than it first appears. A rule about location is only useful if you can show where things happened. (See Stored here, processed there and A receipt for AI work.)

What we are building

Rules about place need infrastructure that can respect place and show it did.

Starfield deploys standardized compute close to power, connectivity and demand, then connects it through one programmable network for AI inference. Workloads are placed by policy, on latency, data residency, model and load, and every workload can generate an auditable record of commitment, placement and delivery.

That is designed to let a compliance team set the boundary once and check the record afterwards. Location in those records is attested, not cryptographically proven.

If your AI work must run within specific borders, use Request capacity below.