Obligations
The question feels like it should have a list for an answer. It does not — because nothing applies to an organisation. Instruments attach to deployments, and your organisation has more of those than it has tools.
Five axes decide it
This is why a list of laws by country is the wrong shape of answer. Country is one axis, and on its own it resolves almost nothing.
The tool, and what it does
Not who built it. What function it performs — because the duty follows the function, not the vendor.
The use case, expressed as a decision
The single most decisive axis, and the one most often collapsed. The same model screening applicants and drafting internal notes attracts two unrelated obligation sets.
The jurisdictions where the affected people are
Residency of the people the system touches, not where you are incorporated. This axis expands faster than organisations expect.
The industry
Sectoral instruments attach because of what your organisation is. They frequently carry the heaviest duties in the set and are the ones a generic AI review misses.
The data types it touches
Health, biometric, financial, children’s and other sensitive categories change which instruments engage, and change them sharply rather than gradually.
This page cannot answer the question for you. It sets out the questions that decide it. Whether a duty attaches to a particular deployment depends on facts specific to your organisation, and whether your position is adequate is a judgement for your counsel. Nothing here is legal advice.
Three answers that sound right and are not
They are wrong in the same direction: they treat the organisation as the unit when the deployment is the unit.
GDPR is one instrument among several that may attach, and it does not displace sectoral law, employment law, or AI-specific statutes that reach the same deployment.
Obligations attach by where the affected people are. A US organisation with European customers, applicants or employees is inside the question.
A tool does not have a compliance status. Your deployment of it does, and your vendor does not know what your departments are doing with it.
One deployment answers it properly
Name one tool, one use case, and where the people are. That question has a real answer, and it can be cited.