What can you build, reuse, and defend? Legal research for product decisions.

The AI Act, Regulation (EU) 2024/1689, is the EU's horizontal rulebook for artificial intelligence. It does not regulate the technology as such. It sorts each use case into four tiers: practices that are prohibited outright, high-risk systems subject to a full conformity regime, limited-risk systems with transparency duties, and minimal-risk uses that are largely untouched. General-purpose models sit on a parallel track with their own documentation and copyright obligations.

The duties phase in across several years, so the roadmap question is rarely whether the Act applies but when each obligation attaches to each feature. One product can straddle every tier at once, which is why classification has to happen at the feature and model level, and early enough to change the build.

There is no comprehensive federal AI statute in the United States, so AI obligations arrive as a patchwork of state laws. The recurring themes are training-data disclosure, provenance and labelling of synthetic content, guardrails on automated decisions, and safety reporting for the largest models. California sets the strictest baseline and most other states either track or exceed it.

Because coverage is uneven and effective dates are staggered across 2026 and 2027, a US-wide product has to design to the strictest applicable state rather than the average, and to keep a current map of which features trigger which state's rules.

The Digital Markets Act imposes ex-ante duties on designated gatekeepers to keep digital markets open and contestable. It binds the gatekeepers rather than ordinary developers, but it directly changes what third parties and business users may do on those platforms: distribution, payments, steering, and access to operating-system and hardware features.

For a product team the DMA is best read as a set of newly available capabilities plus a moving target. The Commission keeps refining technical specifications and gatekeepers keep revising their terms, so capabilities that were blocked a year ago may be live now, and vice versa.

In the United States, the injunction in Epic Games v. Apple bars Apple from enforcing anti-steering rules, so iPhone apps may include buttons, external links and other calls to action that send users to purchase mechanisms outside the app. The Supreme Court declined to stay the order, leaving it in force while the merits continue.

What remains unresolved is the economics. Whether Apple may charge a commission on purchases initiated through link-outs is back before the district court on remand. Outside the United States, Apple's own entitlements and regional rules still govern external purchases, so the practical position differs sharply by market.

The Data Act, Regulation (EU) 2023/2854, does two things. It makes data generated by connected products accessible to the users of those products and to third parties they choose. And it makes cloud switching easy by removing the contractual, technical and, eventually, financial barriers to changing provider.

It applies broadly to manufacturers, data holders and cloud providers serving the EU. The design consequences are front-loaded: access and portability have to be built into the product, not bolted on when a customer asks to leave.

Privacy law is the oldest constraint in this set and the one that touches the most of the product. The GDPR governs personal-data processing for anyone offering goods or services to people in the EU and EEA. In parallel, US state privacy laws grant consumers rights to know, delete, correct and opt out, and set consent rules for sensitive data.

Together they shape ads, personalisation, analytics and any feature that profiles people. The GDPR is principles-based and enforced heavily; the US patchwork is newer, rights-focused, and growing.

The Cyber Resilience Act, Regulation (EU) 2024/2847, sets cybersecurity requirements for products with digital elements placed on the EU market. It is a lifecycle law: security by design, a vulnerability-handling process, and a declared support period during which security updates must keep flowing.

It reaches beyond traditional software to firmware, apps and connected hardware. Open-source stewards get a lighter regime, but manufacturers, importers and distributors all carry duties. The incident-reporting clock is the most operationally demanding part.

The revised Product Liability Directive, Directive (EU) 2024/2853, modernises no-fault liability to fit software. Software, including SaaS, counts as a product, and updates, upgrades and continual learning count as part of it. A defect introduced or left unaddressed through an update can therefore give rise to liability even without fault.

The directive also eases the claimant's path, adding disclosure of evidence and presumptions of defect and causation in complex cases, including AI. For teams, it pushes safety analysis past launch and across the whole life of the product.

The European Accessibility Act, Directive (EU) 2019/882, requires a defined list of products and services to be accessible to people with disabilities. The in-scope services include e-commerce, online banking, electronic communications, e-books, and transport and payment services; in-scope products include computers, smartphones and related hardware.

Requirements are functional rather than prescriptive, and compliance is presumed when a product or service meets the harmonised standard EN 301 549, which maps to WCAG. For digital teams the effect is that accessibility becomes a release gate, not a best-effort polish.

Almost every product is a stack of other people's code and, increasingly, other people's models. Each carries licence terms that decide what you may ship, modify and keep proprietary. Permissive licences such as MIT, Apache-2.0 and BSD ask mainly for attribution; copyleft licences such as the GPL, LGPL and AGPL impose source-disclosure and same-licence duties on distribution, and the AGPL extends that to network use.

AI model licences add a second layer. Open-weight models increasingly ship under bespoke terms with acceptable-use policies, field-of-use limits, attribution duties and usage thresholds, so "open" rarely means unrestricted.

Age assurance is moving from a data-protection question to a product-design requirement. Federal COPPA rules have long governed children's data, and states are adding design codes and age-verification laws. In parallel, app stores are becoming the enforcement point, offering age signals to apps and, in some states, being required to verify age themselves.

The direction of travel is consistent: know the age range of your users, default to privacy-protective settings for minors, and avoid designs that nudge young people into weaker privacy. Enforcement is still shifting through litigation.

Once a product hosts other people's content or hosts a community, platform-safety law attaches. The EU Digital Services Act and the UK Online Safety Act impose transparency, risk-assessment and illegal-content duties that scale with size and reach. A small intermediary has light obligations; a very large platform carries audits, systemic-risk assessments and external scrutiny.

Both regimes reward documented process. The obligations are less about any single takedown and more about showing that you assess risk, act on it, and can prove it to a regulator.

Outside the United States, software is not categorically unpatentable, but the bar is framed differently. The European Patent Convention excludes programs for computers as such from patentability. In practice the EPO and the UK courts grant patents to computer-implemented inventions that solve a technical problem in a non-obvious way, an approach usually traced to the COMVIK line of EPO board decisions and the UK's Aerotel and Macrossan test.

Canada sits between the two. The Federal Court of Appeal in Canada (Attorney General) v. Amazon.com held that a computer-implemented invention is not automatically excluded, and the Canadian Intellectual Property Office examines for a technical solution to a technical problem. The practical upshot is that one claim can be granted in one jurisdiction and refused in another, so portfolio strategy has to be jurisdiction by jurisdiction.

Both the UK and Canada have so far chosen frameworks and guidance over a single AI statute. The UK has taken a pro-innovation, cross-sector approach: rather than one AI act, existing regulators apply existing law, supported by a central function and principles such as safety, transparency and fairness.

Canada's first attempt, the Artificial Intelligence and Data Act inside Bill C-27, died when Parliament was prorogued in January 2025, and no federal AI statute is in force. Provinces and federal instruments are filling the space, so obligations arrive through privacy law, human-rights law and sector regulators rather than a dedicated act.

The UK operates a UK GDPR that mirrors the EU regime, read with the Data Protection Act 2018, and relies on an EU adequacy decision to keep data flowing. Canada's federal private-sector law is PIPEDA, supplemented by Quebec's Law 25, which is the most demanding provincial regime.

For product teams these regimes look familiar: lawful basis, purpose limitation, consent, access and deletion rights, and rules for automated decision-making. The differences sit in detail, enforcement style and transfer mechanics, and they matter when one data pipeline serves several regions.

Cybersecurity duties for products are spreading beyond the EU's Cyber Resilience Act. The UK's Product Security and Telecommunications Infrastructure Act 2022 and its 2023 security regulations require manufacturers of connectable products to meet baseline requirements: no default universal passwords, a published vulnerability-disclosure policy, and a published minimum security-update support period.

In the United States there is no equivalent lifecycle mandate. Security regulation is sectoral, and the most visible consumer-facing effort is the voluntary US Cyber Trust Mark for IoT labelling. The CRA remains the strictest model, and its reporting duties are a useful reference for what a global product will eventually face.

Product liability for software stays uneven outside the EU. In the United States, products liability is state law, generally harm-based and strict for tangible goods. Software is often treated as a service or a hybrid, or is analysed under the Restatement, so whether it is a product depends on the jurisdiction and the facts.

The UK's Consumer Protection Act 1987 imposes strict liability on producers of defective products, and its application to software is still being tested. Canada relies on common-law negligence and sale-of-goods law, with no software-specific strict-liability rule. The EU's revised Product Liability Directive, which expressly covers software and updates, sets a contrasting benchmark.

Digital accessibility is not an EU-only obligation. In the United States, the Americans with Disabilities Act and Section 508 of the Rehabilitation Act require accessible services and federal-facing technology, benchmarked to WCAG. The UK's Equality Act 2010 and the public-sector accessibility regulations impose comparable duties.

Canada's Accessible Canada Act governs federally regulated entities and sets a direction toward barrier-free services, aligned to WCAG. The common thread across all three is the Web Content Accessibility Guidelines as the practical standard, with differing scope and enforcement.

The UK's Digital Markets, Competition and Consumers Act 2024 creates a digital-markets regime alongside strengthened consumer powers. The Competition and Markets Authority can designate firms with Strategic Market Status in a digital activity, then impose conduct requirements and pro-competition interventions.

The regime came into force on 1 January 2025. It is the UK counterpart to the EU's Digital Markets Act, though structured differently, and it matters to anyone building on or competing with designated platforms, or selling to UK consumers.