Reference / transfer law for AI inference
Regulatory transfer guides
One guide per regime, written for the DPO and the platform engineer at the same time: what the law requires of a prompt in flight, and the routing rule that enforces it.
Coverage by jurisdiction
- EU9
- UK1
- CH1
- GCC2
- APAC4
- US3
last revised 2026-11-06
- 20
- transfer guides across 6 jurisdictions, each with routing rules, Rego and an audit checklist
- EUR 20M or 4%
- of worldwide annual turnover, whichever is higher: GDPR Article 83(5) ceiling for unlawful international transfers
- Regulation (EU) 2016/679, Art. 83(5)(c)
- EUR 15M or 3%
- of worldwide annual turnover: EU AI Act ceiling for breaching high-risk and other operator obligations
- Regulation (EU) 2024/1689, Art. 99(4)
- 16 July 2020
- CJEU invalidates the EU-US Privacy Shield and requires supplementary measures for SCC transfers
- Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems
20 guides shown
- GDPR Chapter VGDPR Chapter V and AI Inference: A Transfer Guide
- Citation
- Regulation (EU) 2016/679, Chapter V, Articles 44 to 49
- Regulator
- European Data Protection Board and national supervisory authorities
- In force
- 25 May 2018
- EU AI ActDoes the EU AI Act Mandate Data Residency? What It Requires
- Citation
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 10, 12, 19, 26, 50, 53 and Annex IV
- Regulator
- European Commission AI Office and national market surveillance authorities
- In force
- 1 August 2024
- Schrems II supplementary measuresSchrems II Supplementary Measures for LLM Inference
- Citation
- CJEU Case C-311/18 (Schrems II); EDPB Recommendations 01/2020 on supplementary measures, version 2.0
- Regulator
- European Data Protection Board and national supervisory authorities
- In force
- 16 July 2020
- DORA ICT third-party riskDORA Compliance for AI Systems in Banking and Insurance
- Citation
- Regulation (EU) 2022/2554 (Digital Operational Resilience Act), Articles 28 to 30; Commission Implementing Regulation (EU) 2024/2956
- Regulator
- National competent authorities, with the EBA, EIOPA and ESMA as European Supervisory Authorities and Lead Overseers
- In force
- 17 January 2025 (date of application)
- EU-US Data Privacy FrameworkThe EU-US Data Privacy Framework and US AI Vendors
- Citation
- Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, adopted under GDPR Article 45; US Executive Order 14086
- Regulator
- European Commission (adequacy and periodic review) and EU supervisory authorities; US Department of Commerce and Federal Trade Commission on the US side
- In force
- 10 July 2023
- GDPR Article 9 special category dataGDPR Article 9 and LLMs: Special Category Data in Prompts and Outputs
- Citation
- Regulation (EU) 2016/679, Articles 9, 22(4), 35(3)(b) and 83(5)(a); Regulation (EU) 2024/1689, Article 10(5)
- Regulator
- National supervisory authorities, coordinated by the European Data Protection Board
- In force
- 25 May 2018
- EU AI Act Annex IVEU AI Act Annex IV: Technical Documentation for AI Inference
- Citation
- Regulation (EU) 2024/1689, Article 11 and Annex IV (with Articles 12, 18 and 19)
- Regulator
- National market surveillance authorities, notified bodies, and the European AI Office
- In force
- 1 August 2024
- France HDS CertificationFrance HDS: Hosting Health Data for AI Inference
- Citation
- Code de la santé publique, Article L.1111-8 and Articles R.1111-8-8 et seq.; HDS certification referential v2.0 (arrêté of 26 April 2024)
- Regulator
- Agence du Numérique en Santé (ANS), accredited certification bodies under COFRAC, and the CNIL for GDPR matters
- In force
- HDS referential v2.0 published 16 May 2024; transition for existing certificates ended 16 May 2026
- NIS2 DirectiveNIS2 and AI Infrastructure: Article 21 Measures for Inference
- Citation
- Directive (EU) 2022/2555 (NIS2), Articles 20, 21, 23 and 34; Commission Implementing Regulation (EU) 2024/2690
- Regulator
- National competent authorities and CSIRTs designated by each Member State (for example BSI in Germany, ANSSI in France)
- In force
- 16 January 2023; Member State transposition deadline 17 October 2024
- Saudi PDPL and NDMO standardsSaudi Arabia AI Data Sovereignty: PDPL and NDMO Rules
- Citation
- Personal Data Protection Law (Royal Decree M/19, as amended by Royal Decree M/148), Article 29 and the Regulation on Personal Data Transfer outside the Kingdom; NDMO Data Management and Personal Data Protection Standards
- Regulator
- Saudi Data and AI Authority (SDAIA), including the National Data Management Office (NDMO)
- In force
- 14 September 2023 (enforced from 14 September 2024)
- UAE PDPLUAE PDPL and AI Data Residency: Mainland, DIFC and ADGM
- Citation
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Articles 22 and 23; DIFC Data Protection Law No. 5 of 2020; ADGM Data Protection Regulations 2021
- Regulator
- UAE Data Office (mainland); DIFC Commissioner of Data Protection; ADGM Office of Data Protection
- In force
- 2 January 2022 (PDPL)
- Singapore PDPA Transfer LimitationSingapore PDPA Transfer Limitation Obligation for AI Inference
- Citation
- Personal Data Protection Act 2012, section 26; Personal Data Protection Regulations 2021, Part 3
- Regulator
- Personal Data Protection Commission (PDPC)
- In force
- 2 July 2014 (data protection provisions)
- Australia APP 8Australia APP 8 and s.16C: Cross-Border AI Inference
- Citation
- Privacy Act 1988 (Cth), Schedule 1, Australian Privacy Principle 8, and section 16C
- Regulator
- Office of the Australian Information Commissioner (OAIC)
- In force
- 12 March 2014 (APPs); penalty increase from 13 December 2022; Privacy and Other Legislation Amendment Act 2024 assented 10 December 2024
- India DPDP Act Section 16India DPDP Act 2023: Cross-Border Transfers for AI Inference
- Citation
- Digital Personal Data Protection Act, 2023 (No. 22 of 2023), section 16; Digital Personal Data Protection Rules, 2025, Rule 15
- Regulator
- Data Protection Board of India; Ministry of Electronics and Information Technology (MeitY) for rule-making
- In force
- Act assented 11 August 2023; Rules notified 13 November 2025, with most obligations, including Rule 15, applying 18 months later
- China PIPL Cross-Border TransfersChina PIPL Articles 38 to 40: Cross-Border AI Data Transfers
- Citation
- Personal Information Protection Law of the PRC, Articles 38 to 40 and 55; CAC Provisions on Promoting and Regulating Cross-Border Data Flows (22 March 2024)
- Regulator
- Cyberspace Administration of China (CAC) and its provincial offices
- In force
- 1 November 2021 (PIPL); 22 March 2024 (cross-border data flow provisions)
- US CLOUD ActThe US CLOUD Act and European AI Prompts
- Citation
- Clarifying Lawful Overseas Use of Data Act, Pub. L. 115-141, Division V; 18 U.S.C. 2713, 2703(h) and 2523
- Regulator
- US Department of Justice and US federal courts
- In force
- 23 March 2018
- HIPAA Privacy and Security RulesHIPAA and AI Inference: Why Covered Entities Route PHI US-Only
- Citation
- 45 CFR Parts 160 and 164 (Security Rule, Subpart C; Breach Notification Rule, Subpart D; Privacy Rule, Subpart E); HITECH Act of 2009
- Regulator
- HHS Office for Civil Rights (civil enforcement), the Department of Justice (criminal enforcement) and state attorneys general under the HITECH Act
- In force
- 14 April 2003 (Privacy Rule compliance date); 20 April 2005 (Security Rule compliance date)
- ITAR and FedRAMPITAR and FedRAMP Boundaries for AI Inference
- Citation
- International Traffic in Arms Regulations, 22 CFR Parts 120 to 130 (including 120.33, 120.50, 120.54, 120.56 and 120.62); FedRAMP Authorization Act, 44 U.S.C. 3607 to 3616; DFARS 252.204-7012
- Regulator
- Directorate of Defense Trade Controls (DDTC), US Department of State, for ITAR; the FedRAMP Board and the FedRAMP Program Management Office at GSA for FedRAMP
- In force
- 6 September 2022 (restructured ITAR Part 120 definitions); 23 December 2022 (FedRAMP Authorization Act)
- 01SummaryWhat the regime asks of an inference path, in three sentences.
- 02Key factsCitation, regulator, in-force date and the maximum penalty as written in the law.
- 03Statutory textThe articles that bite, summarised section by section with the exact references.
- 04Technical requirementsWhat the law means for the data plane, failover, logging and keys.
- 05Routing rulesThe rules a YTT Secunet policy pack applies, each with its legal rationale.
- 06Rego excerptThe OPA v1 policy fragment that enforces those rules, ready to review.
- 07Audit checklistItems an auditor or DPO can verify against receipts and configuration.
- 08FAQ and relatedThe questions procurement and counsel ask, and the neighbouring regimes.
Every guide ends in a policy pack id. Once your DPO has agreed which regime governs a tenant, the application names that pack in the X-YTT-Policy header and the gateway evaluates it on each request, before a byte leaves the region.
The pack version that made the decision is written into the signed receipt on the response, so the rule you read in the guide, the Rego that ran, and the evidence your auditor samples all point at the same artefact.
- EU tenants:
eu-gdpr-strict, pluseu-ai-act-high-riskfor Annex III systems - UK and Swiss tenants:
uk-gdpr-idta,swiss-fadp-compliant - GCC and US:
saudi-pdpl-sovereign,uae-pdpl-local,us-hipaa-only,us-itar-fedramp
httprequest with a pinned policy pack
POST /v1/chat/completions HTTP/1.1
Host: eu.yttsecunet.com
Authorization: Bearer jr_live_...
X-YTT-Policy: eu-gdpr-strict@4.2.0
X-YTT-Tenant: claims-de
HTTP/1.1 200 OK
X-YTT-Proof-Signature: eyJhbGciOiJFZERTQSIsImtpZCI6Imp...Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.