{"course":{"slug":"agents-and-automation","title":"Agents and Automation","url":"https://addaly.com/learn/agents-and-automation","level":"intermediate","track":"build"},"lesson":{"slug":"rules-that-differ-by-country","title":"The rules, where they agree and where they do not","url":"https://addaly.com/learn/agents-and-automation/rules-that-differ-by-country","position":70,"of":72,"minutes":10,"answer":"Build the same four capabilities regardless of jurisdiction (records, human override, an explanation, and deletion) because they satisfy most regimes and nothing else you build transfers as well.","keyIdea":"Build the same four capabilities regardless of jurisdiction (records, human override, an explanation, and deletion) because they satisfy most regimes and nothing else you build transfers as well."},"body":{"format":"markdown","text":"## What this lesson is not\n\nIt is not legal advice, and it cannot be. The law here differs by country, is being written while you read this, and is contested in courts that have not finished. Anyone who tells you the position is settled is selling something. What follows is the shape of the argument, so you know which questions to take to somebody qualified.\n\n## Where things are broadly converging\n\nAcross quite different legal systems, four themes recur.\n\n**Transparency when a system interacts with people.** Some form of duty to say that an interaction is automated.\n\n**Records for consequential uses.** Where a system contributes to decisions about credit, employment, education, benefits, insurance or policing, expectations of logging, documentation and traceability rise sharply.\n\n**Human oversight.** Not a person present at every step, but a person able to intervene, override and be accountable.\n\n**Existing law applies anyway.** Data protection law covers personal data whether a model touched it or not. Sector regulators (financial conduct, medical devices, employment discrimination) apply their existing rules to systems that use models, often without needing anything new. This is the point most teams underestimate: the majority of the rules that bind you predate the technology.\n\n## Where they diverge sharply\n\n**What counts as high risk.** The EU AI Act sets tiers with obligations phasing in over several years. Other jurisdictions use sectoral rules, or state and provincial laws, or guidance rather than statute. The same product can be tightly regulated in one market and largely unregulated next door.\n\n**Automated decisions with legal effect.** European data protection law gives people rights around decisions made solely by automated means, including a route to human intervention. Other regimes address this narrowly, sectorally, or not at all.\n\n**Training data and copyright.** Genuinely unresolved. Some jurisdictions have text-and-data-mining exceptions with conditions and opt-outs; others have nothing comparable. Whether training on copyrighted works is permitted, whether outputs can infringe, and who owns model output are live questions with cases pending and decisions that have gone in different directions. Nothing in this course resolves it, and any confident answer you read, in either direction, is an opinion wearing a fact's clothing.\n\n**Data localisation and cross-border transfer.** India's DPDP Act, various sectoral rules and several national frameworks constrain where data may be processed. This changes which providers and which regions you may use, and it is a design constraint rather than a paperwork one.\n\n## The four things to build regardless\n\nThis is the useful part, because it transfers.\n\n1. **Records of what the system did.** Input reference, decision, config version, timestamp, whether a person reviewed it. Retained for a stated period.\n2. **A human who can override**, named, with the authority and the interface to do it, and evidence that overrides actually happen, because a review mechanism nobody has ever used is not oversight.\n3. **An explanation of the basis**, in the affected person's terms: what information was used and what rule applied.\n4. **A deletion path** that reaches every copy, tested.\n\nBuild those and you have the substance of most regimes' requirements, and a defensible position in the ones you have not read yet. Skip them and no amount of policy documentation compensates.\n\n## The rule that is not controversial anywhere\n\nIf a decision materially affects somebody's life (money, employment, housing, health, education) a person must be able to review it, and you must be able to say what it was based on.\n\nAlmost no regulator, in any jurisdiction, disagrees with that. It is also cheap to build if you build it from the start and expensive to retrofit, because retrofitting means finding out that you never logged the inputs.\n\n## How to work with the uncertainty\n\nDo not wait for clarity; it is not arriving soon. Do not pretend to certainty you do not have, in either direction: \"it's all illegal\" and \"there are no rules\" are both wrong and both lead to bad decisions.\n\nPractically: write down what your system does in plain language, one page. Take that page to a lawyer in each market you operate in, and ask specific questions rather than general ones. Record what you were told and the date, because the answer will change and you will want to know which version you built to. And keep a note of anything you chose not to do because the position was unclear: that record is worth a great deal if anyone ever asks how you approached it."},"check":{"question":"A team operates an automated eligibility check in several countries with different and shifting rules. Which investment is most likely to satisfy requirements they have not yet read?","options":[{"text":"A published model card describing the system’s architecture, training data and known limitations.","correct":false,"tempting":"Valuable documentation, but it describes the system rather than giving an affected person a route to review a decision about them."},{"text":"A policy document stating the organisation’s AI principles and approving each use case.","correct":false,"tempting":"Governance paperwork is often requested, but principles without records, override and deletion do not evidence anything about a specific decision."},{"text":"Per-decision records, a named human who can override, an explanation of the basis in plain terms, and a tested deletion path.","correct":true},{"text":"Restricting processing to servers in each customer’s own country, which resolves the strictest constraint first.","correct":false,"tempting":"Localisation addresses one divergent requirement while leaving oversight, explanation and record-keeping (which recur nearly everywhere) untouched."}]},"prev":{"slug":"telling-people-what-is-automated","title":"Saying so, and the tools that cannot prove it","url":"https://addaly.com/learn/agents-and-automation/telling-people-what-is-automated"},"next":{"slug":"what-it-keeps-and-what-it-must-forget","title":"Retention: the duty to keep and the duty to delete","url":"https://addaly.com/learn/agents-and-automation/what-it-keeps-and-what-it-must-forget"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'The rules, where they agree and where they do not', in Agents and Automation. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/agents-and-automation/rules-that-differ-by-country (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"The rules, where they agree and where they do not","courseTitle":"Agents and Automation","module":{"index":8,"slug":"living-with-it","title":"The year after it ships"},"answer":null,"keyIdea":"Build the same four capabilities regardless of jurisdiction (records, human override, an explanation, and deletion) because they satisfy most regimes and nothing else you build transfers as well.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"what-this-lesson-is-not","runs":[{"text":"What this lesson is not"}]},{"t":"p","runs":[{"text":"It is not legal advice, and it cannot be. The law here differs by country, is being written while you read this, and is contested in courts that have not finished. Anyone who tells you the position is settled is selling something. What follows is the shape of the argument, so you know which questions to take to somebody qualified."}]},{"t":"h2","id":"where-things-are-broadly-converging","runs":[{"text":"Where things are broadly converging"}]},{"t":"p","runs":[{"text":"Across quite different legal systems, four themes recur."}]},{"t":"p","runs":[{"text":"Transparency when a system interacts with people.","b":true},{"text":" Some form of duty to say that an interaction is automated."}]},{"t":"p","runs":[{"text":"Records for consequential uses.","b":true},{"text":" Where a system contributes to decisions about credit, employment, education, benefits, insurance or policing, expectations of logging, documentation and traceability rise sharply."}]},{"t":"p","runs":[{"text":"Human oversight.","b":true},{"text":" Not a person present at every step, but a person able to intervene, override and be accountable."}]},{"t":"p","runs":[{"text":"Existing law applies anyway.","b":true},{"text":" Data protection law covers personal data whether a model touched it or not. Sector regulators (financial conduct, medical devices, employment discrimination) apply their existing rules to systems that use models, often without needing anything new. This is the point most teams underestimate: the majority of the rules that bind you predate the technology."}]},{"t":"h2","id":"where-they-diverge-sharply","runs":[{"text":"Where they diverge sharply"}]},{"t":"p","runs":[{"text":"What counts as high risk.","b":true},{"text":" The EU AI Act sets tiers with obligations phasing in over several years. Other jurisdictions use sectoral rules, or state and provincial laws, or guidance rather than statute. The same product can be tightly regulated in one market and largely unregulated next door."}]},{"t":"p","runs":[{"text":"Automated decisions with legal effect.","b":true},{"text":" European data protection law gives people rights around decisions made solely by automated means, including a route to human intervention. Other regimes address this narrowly, sectorally, or not at all."}]},{"t":"p","runs":[{"text":"Training data and copyright.","b":true},{"text":" Genuinely unresolved. Some jurisdictions have text-and-data-mining exceptions with conditions and opt-outs; others have nothing comparable. Whether training on copyrighted works is permitted, whether outputs can infringe, and who owns model output are live questions with cases pending and decisions that have gone in different directions. Nothing in this course resolves it, and any confident answer you read, in either direction, is an opinion wearing a fact’s clothing."}]},{"t":"p","runs":[{"text":"Data localisation and cross-border transfer.","b":true},{"text":" India’s DPDP Act, various sectoral rules and several national frameworks constrain where data may be processed. This changes which providers and which regions you may use, and it is a design constraint rather than a paperwork one."}]},{"t":"h2","id":"the-four-things-to-build-regardless","runs":[{"text":"The four things to build regardless"}]},{"t":"p","runs":[{"text":"This is the useful part, because it transfers."}]},{"t":"ol","start":1,"items":[[{"text":"Records of what the system did.","b":true},{"text":" Input reference, decision, config version, timestamp, whether a person reviewed it. Retained for a stated period."}],[{"text":"A human who can override","b":true},{"text":", named, with the authority and the interface to do it, and evidence that overrides actually happen, because a review mechanism nobody has ever used is not oversight."}],[{"text":"An explanation of the basis","b":true},{"text":", in the affected person’s terms: what information was used and what rule applied."}],[{"text":"A deletion path","b":true},{"text":" that reaches every copy, tested."}]]},{"t":"p","runs":[{"text":"Build those and you have the substance of most regimes’ requirements, and a defensible position in the ones you have not read yet. Skip them and no amount of policy documentation compensates."}]},{"t":"h2","id":"the-rule-that-is-not-controversial-anywhere","runs":[{"text":"The rule that is not controversial anywhere"}]},{"t":"p","runs":[{"text":"If a decision materially affects somebody’s life (money, employment, housing, health, education) a person must be able to review it, and you must be able to say what it was based on."}]},{"t":"p","runs":[{"text":"Almost no regulator, in any jurisdiction, disagrees with that. It is also cheap to build if you build it from the start and expensive to retrofit, because retrofitting means finding out that you never logged the inputs."}]},{"t":"h2","id":"how-to-work-with-the-uncertainty","runs":[{"text":"How to work with the uncertainty"}]},{"t":"p","runs":[{"text":"Do not wait for clarity; it is not arriving soon. Do not pretend to certainty you do not have, in either direction: “it’s all illegal” and “there are no rules” are both wrong and both lead to bad decisions."}]},{"t":"p","runs":[{"text":"Practically: write down what your system does in plain language, one page. Take that page to a lawyer in each market you operate in, and ask specific questions rather than general ones. Record what you were told and the date, because the answer will change and you will want to know which version you built to. And keep a note of anything you chose not to do because the position was unclear: that record is worth a great deal if anyone ever asks how you approached it."}]}],"check":{"question":[{"text":"A team operates an automated eligibility check in several countries with different and shifting rules. Which investment is most likely to satisfy requirements they have not yet read?"}],"options":[{"text":[{"text":"A published model card describing the system’s architecture, training data and known limitations."}],"correct":false,"tempting":[{"text":"Valuable documentation, but it describes the system rather than giving an affected person a route to review a decision about them."}]},{"text":[{"text":"A policy document stating the organisation’s AI principles and approving each use case."}],"correct":false,"tempting":[{"text":"Governance paperwork is often requested, but principles without records, override and deletion do not evidence anything about a specific decision."}]},{"text":[{"text":"Per-decision records, a named human who can override, an explanation of the basis in plain terms, and a tested deletion path."}],"correct":true,"tempting":null},{"text":[{"text":"Restricting processing to servers in each customer’s own country, which resolves the strictest constraint first."}],"correct":false,"tempting":[{"text":"Localisation addresses one divergent requirement while leaving oversight, explanation and record-keeping (which recur nearly everywhere) untouched."}]}],"order":[3,1,2,0],"why":null},"prev":{"slug":"telling-people-what-is-automated","title":"Saying so, and the tools that cannot prove it","minutes":9},"next":{"slug":"what-it-keeps-and-what-it-must-forget","title":"Retention: the duty to keep and the duty to delete","minutes":9}}}