AI automation, by market.

The workflow is portable. A referral routing system for a clinic in Manchester and one for a clinic in Chicago read the same kind of document, extract the same fields, and route on the same logic. What does not travel is the rulebook around it: which decisions a machine is allowed to make on its own, how long records must be kept, where the data is allowed to sit, and who has to be able to audit it afterwards.

That is why these pages are split by city rather than written once. The engineering estimate barely moves. The compliance scaffolding, the documentation an auditor will ask for, and the approval gates you have to build in do move, and they are a real part of the cost.

In the United Kingdom, UK GDPR governs personal data and, since 5 February 2026, Articles 22A to 22D govern significant automated decisions. The default for ordinary personal data moved from prohibition to permission plus safeguards, but special category data, which includes health records and welfare data, stays restricted. Sector regulators sit on top: the FCA and PRA in financial services, the NHS Data Security and Protection Toolkit and CQC in healthcare, the SRA in legal services.

In the United States the frame is sectoral rather than general. HIPAA governs protected health information, the information blocking rules govern how it moves, SEC and FINRA record-keeping rules govern communications and supervision in financial services, and state privacy law adds a layer that varies by where your customers live rather than where you are.

In the Middle East the frameworks are newer and move faster. The UAE PDPL sits alongside emirate-level health data law in Dubai and Abu Dhabi, and Saudi Arabia's SDAIA guidance governs AI use in regulated sectors. Data residency requirements are stricter and more explicit than in either of the other two markets, which changes hosting decisions before a line of code is written.