Skip to content
AI Policy Generator

ESWhat applies

Technology and SaaS

Software companies build, integrate and sell AI features to other organizations, so they carry provider duties: technical documentation, information for customers, transparency and security. Enterprise and public-sector buyers also demand evidence of AI governance during procurement, even where no law requires it.

Relevant sector rules

EU: general-purpose model providers have had documentation, copyright policy and training-data summary duties since Aug 2, 2025; providers of generative systems must mark synthetic content (Art. 50, grace period until Dec 2, 2026 for existing systems); vendors of systems for Annex III uses will carry conformity assessment from Dec 2, 2027; the Cyber Resilience Act covers software sold as a product. Ecuador: the amended SPDP general rule on AI requires providers to inform controllers about functioning, limitations and risks. Peru: developers are also within the AI regulation, with sector-based deadlines. US: the FTC acts against unsubstantiated AI claims, including in B2B sales; California AB 2013 requires publishing information on generative AI training data; Colorado SB 26-189 requires developers to give documentation to deployers from 2027; Texas TRAIGA offers a safe harbor for alignment with the NIST AI RMF. Colombia, Mexico, Chile, Argentina and Brazil: no AI law in force; data protection laws apply, along with contractual demand from customers who ask for documented AI governance.

Typical AI uses

Sector regulators

European Union
Spain
Ecuador
Colombia
Peru
Mexico
Argentina
Brazil
United States (federal)
California
Colorado
Texas

Related base documents

Find out what applies to you (free)