AI agent compliance: why 192 jurisdictions should not scare you

The scene is always the same. Someone opens a world map of data protection law, counts the regimes, and concludes that multi-jurisdictional compliance is beyond a team of ten. That is true if you believe you must fill in a 192-row matrix before writing your first line of code. It is not what an agent actually meets.

The fear comes from a framing error

A regulatory map describes a space: every regime that exists. An agent decision happens at a point: this action, with this data, from here, to there. Confusing the two is confusing the road atlas with the journey.

Concretely, an agent action meets at most: the jurisdiction it starts from, the one the data lands in, and the sector that overlays it (health, finance). Three inputs, never more, no matter how large the map behind them.

Four possible answers, not a thousand

ESCALATE is the primitive compliance products avoid, because it admits a limit. It is the most useful one: below a confidence threshold of 0.90 our engine refuses to rule, and says so. A system that always answers something only teaches you that it does not know when it does not know.

Three attributes decide, not thousands of pages

For the 73 jurisdictions our engine actually decides on, the entire corpus collapses, at decision time, into three legal attributes.

1. The transfer regime — is moving data out open, conditional, or restricted to recognised destinations?
2. The localisation mandate — must certain categories stay on the territory?
3. Automated decision rights — does a decision taken exclusively by a machine trigger rights (notification, contestation, human intervention)?

The table is five rows long. Perceived complexity comes from the number of texts; real complexity comes from the number of attributes that change the answer. Those are not the same order of magnitude.

One example makes it tangible: the same customer-record read is unremarkable inside Quebec, and requires a transfer mechanism the moment the destination is American. The law did not change — an attribute of the destination did.

The invariant that makes the map harmless

A serious objection: adding per-jurisdiction rules increases the bug surface, and a compliance bug can permit what should have been refused. That is the real risk, and it is handled structurally.

Our engine holds this invariant: a jurisdiction rule may only tighten a decision, never loosen it. It is not entrusted to the diligence of rule authors; it is guaranteed by how the engine runs. The table is evaluated twice — once without jurisdiction rules, once with — and the stricter result wins.

pass A: table WITHOUT jurisdictional rules  ->  generic decision
pass B: table WITH jurisdictional rules     ->  localised decision

result = the stricter of the two   (ALLOW < APPROVE < ESCALATE < DENY)

The invariant is not theoretical. It was written after a real development incident: a carefully drafted cross-border transfer rule turned an ESCALATE into an APPROVE for a sensitive data replication in Europe. Its high confidence out-scored the cautious heuristic that had tripped the doubt threshold. The rule was right and the outcome was wrong. The test that caught it was not fixed — the engine was restructured.

Honesty about depth: two tiers, not one

Claiming to maintain 192 jurisdictions at the same cadence would be an unkeepable promise — and we made it first. The fix was not to shrink the map, but to state which entries are re-verified.

The definition of the priority tier is deliberately mechanical: it is exactly the set of jurisdictions whose legal attributes the engine models. We re-verify what we decide on. Modelling a new jurisdiction promotes it automatically; there is no separate marketing list to forget to update.

The rest of the map breaks down as: 168 data protection regimes in force, 24 still at bill stage, 18 AI governance frameworks and 5 cybersecurity frameworks. Three domains, three different depths — collapsing them into a single number was the original sin.

The practical corollary: every decision publishes the verification date of its oldest source. You do not have to take our word on freshness; it is in the response.

The protocol, in four questions

Here is how a team goes from an anxiety-inducing map to a finite work list. None of these questions needs a lawyer to be asked; some will need one to be settled.

1. Where does the data start? Where the individuals are — not where your head office is.
2. Where does it land? Every technical destination counts: an inference provider, a logging service, a backup. It is the most commonly ignored attribute and the one that most often changes the answer.
3. Does the action produce a decision about a person? Hiring, credit, pricing, access to a service: that is where automated decision rights fire.
4. Is the action reversible? A payment, a send, a deletion cannot be taken back. Irreversibility justifies human approval regardless of geography.

Answer these for your ten most frequent actions. In almost every case you will end up with two or three jurisdictions and a handful of combinations — not a global matrix. That is what the free compliance assessment walks an organisation through, and what the authority API then applies on every call.

To check one jurisdiction — instrument in force, authority, transfer regime, localisation mandate, last verification date — every record is published in the jurisdiction index, with three decisions computed by the engine on the page.

What this framing does not solve

• It does not replace legal advice. Citations are framework-level. A privacy impact assessment, a processor agreement, an impact analysis remain human work.
• It does not cover fine-grained sectoral duties. Health, defence and gambling add regimes that three attributes do not capture.
• It enforces nothing. The decision is advisory: your code executes or refuses.
• It does not erase the inventory debt. If nobody knows which actions your agents can trigger, no engine can decide for you — the protocol's first question stays the hardest.

The map is not the problem. The absence of a checkpoint at the moment the agent acts is. The rest is inventory.