Most teams ask which AI laws exist. The useful question is which laws attach to this tool, used this way, on these people, in these places.
01
The same product can produce different obligation profiles. A chatbot used for marketing copy is not the same deployment as the same chatbot used to screen job applicants. The people, the data, the decisions, and the places change what attaches.
That is why inventory lists and vendor questionnaires alone rarely answer the question. You need a deployment object: tool × use case × data × jurisdictions × industry.
02
Territorial reach — where the people live or are served, not only where your company is headquartered.
Role — provider, deployer, controller, processor, business, or covered entity under the relevant instrument.
Activity — automated decisions, profiling, special-category data, children’s data, employment, credit, clinical care, and similar triggers.
Assessments — whether the law requires a DPIA, FRIA, state privacy risk assessment, or similar work product for this activity.
03
A short check can name the assessments that are likely required and flag what still depends on missing facts. It cannot safely cite every provision or write the obligation text. That depth is the Compass report — verified to Meridian™, never AI-authored as findings.
