01 · The Question
What Happens When Research Crosses Borders and the AI Rules Differ?
You collaborate with researchers in another country. Your university permits a particular AI service, but your collaborator says their institution cannot use it for the same data. Then someone points out that the data are being transferred across a national border, potentially triggering another country's privacy rules.
At that point, this is no longer just a question about which university has the stricter AI policy. Several legal and governance systems may operate at the same time.
International collaboration can involve researchers governed by different institutional policies, research ethics systems, privacy laws, data-transfer restrictions, funder requirements, contractual terms, and publication rules. The challenge is to identify which rules attach to which people, data, systems, and activities before the collaboration's AI workflow is designed.
03 · What You Need to Know
International AI Governance Is a Jurisdiction Problem as Well as a Policy Problem
Different Countries Can Regulate the Same Research Activity Differently
Researchers often begin by comparing university policies. In international projects, that is only part of the picture.
National or regional rules can apply to personal data, research participants, data exports, cybersecurity, regulated technologies, intellectual property, or other aspects of research. A university may permit a particular AI workflow while the law governing a dataset or transfer imposes additional requirements.
The European Commission's guidance on ethics and data protection in Horizon Europe research explicitly warns that researchers must comply with the laws of countries where research is conducted, including national data-protection laws, and that additional authorisations may be required for transfers of personal data outside the country. It also notes that data-sovereignty provisions can restrict or prohibit transfers of certain information, including health or patient data.
The important point is broader than Europe: the country where data are collected, the country where researchers are located, the country where processing occurs, and the country associated with a service provider can all become relevant, depending on the applicable law.
Cross-Border Data Transfers Can Change the AI Question
Uploading research data to an AI service can create a transfer problem when the service processes or makes the information available in another country or jurisdiction.
For organisations subject to the EU GDPR, Chapter V establishes requirements for transfers of personal data to third countries or international organisations. The European Commission's research guidance similarly instructs researchers to check the applicable international-transfer conditions when personal data leave the EU.
The UK's Information Commissioner's Office updated its international-transfer guidance in January 2026 and emphasises a structured process for identifying restricted transfers under the UK GDPR. Its guidance also recognises the complexity that can arise when multiple organisations and transfer chains are involved.
Watch Out
Do not determine the transfer location solely from where the AI company's headquarters are located. Relevant analysis can involve where data are stored, accessed, processed, or transferred and which entities participate in that processing. For consequential transfers, use the applicable legal and institutional assessment rather than relying on a vendor's country label alone.
Data Can Be Legally Accessible but Still Restricted From AI Processing
A collaborator may have legitimate access to a dataset and still lack permission to send it to a third-party AI system.
Access rights and onward processing rights are different concepts. Data-use agreements, ethics approvals, participant consent, repository conditions, contracts, and privacy requirements can place restrictions on further disclosure or processing.
NIH guidance on human-participant data sharing recommends privacy protections and notes that data-use agreements can define responsibilities, data-use limitations, and confidentiality obligations. In international collaborations, these restrictions may interact with the laws of more than one jurisdiction.
Research Ethics Can Differ Across Countries
Ethics review structures are not identical internationally. One partner may work under a university research ethics committee, another under a national system, and another under both institutional and sector-specific review.
The substantive concerns can also differ in emphasis. A study involving sensitive health information may raise questions about consent, secondary use, confidentiality, automated decision-making, fairness, and participant expectations in every participating country, but the procedures for obtaining approval and the legally relevant requirements may not be identical.
International guidance from CIOMS and WHO provides shared ethical principles for health-related research involving humans, including privacy and responsible data use, but such international guidance does not automatically replace national law or institutional procedures.
This is why an international team should not assume that approval obtained in one country automatically settles the ethics requirements in another.
Institutional AI Policies Can Still Differ Even Under the Same National Law
International projects can have multiple policy differences operating within one legal environment, and then an additional layer of national differences appears.
For example, two European universities may both operate under the GDPR yet adopt different approved-AI lists, information-security controls, or internal requirements. The common legal framework does not make their institutional procedures identical.
The opposite is also possible. Two universities may have similar AI policies while their national rules regarding data transfers or regulated research create different constraints.
Funder Requirements Can Add Another Cross-Border Layer
International projects are often supported by grants involving multiple institutions and countries. The funding agreement may impose requirements on data management, responsible research, confidentiality, security, publication, or AI use.
The European Commission's research programmes, for example, incorporate ethics and data-protection requirements into research governance. NIH-funded international collaborations are similarly subject to applicable NIH policies and U.S. requirements alongside local institutional and national rules.
A common funder therefore does not necessarily eliminate jurisdictional differences. It can add another common layer on top of them.
The AI Provider Can Become Part of the Governance Map
The AI tool itself can introduce another organisation into the data-processing chain. Researchers should determine the relevant service configuration, contractual terms, data processing arrangements, retention practices, and security commitments rather than treating "the AI" as a neutral endpoint.
This is especially important when researchers transfer data from one country's institution to a service operated through infrastructure in another jurisdiction.
A secure institutional AI environment may therefore be materially different from a publicly available consumer service, even when both are based on similar underlying models.
Some Countries May Impose Data-Localisation or Sovereignty Requirements
Data sovereignty rules can restrict where specific types of information may be stored, accessed, or transferred. The European Commission's Horizon Europe guidance explicitly notes that some data-sovereignty provisions may prohibit certain categories of information from leaving a country.
These rules can make an otherwise ordinary AI workflow impossible without architectural changes. The solution may involve local processing, controlled-access infrastructure, federated analysis, or another arrangement that keeps protected data within the permitted jurisdiction.
The appropriate technical solution depends on the applicable law and research context. Researchers should not assume that a verbal promise from an AI vendor resolves a sovereignty requirement.
International Collaboration Requires Mapping the Data Flow
A useful governance exercise is to draw the data and AI workflow explicitly.
Collection
Where are the research data collected, and under which jurisdiction and ethics approval?
Storage
Where are the data stored, and which institution or provider controls the environment?
Access
Which researchers and institutions can access the data?
AI processing
Where and by whom is the AI processing performed?
Transfer
Does information move across institutional or national boundaries at any stage?
Output
Where are AI outputs stored, shared, incorporated into the research record, or submitted for publication?
This often reveals that the apparent "AI policy conflict" is actually a data-transfer problem or a contractual restriction that should have been identified earlier.
Do Not Assume One Common Team Agreement Solves National Legal Differences
A research team can establish a shared AI-use plan, but an internal agreement cannot waive laws that apply to particular data or processing activities.
The plan should therefore identify jurisdiction-specific constraints and establish procedures that respect them. The team agreement is a coordination mechanism, not a substitute for legal or institutional compliance.
International Projects Need a Higher Threshold for Uncertainty
The consequences of guessing are potentially greater when data cross borders. An incorrect assumption can affect participant privacy, contractual compliance, research ethics, data security, and the ability to continue the project.
That does not mean international research must become paralysingly bureaucratic. It means high-risk uncertainty should be resolved before the data move, not after.
07 · A Quick Checklist
Before Using AI Across National Borders
Before transferring research material across borders, check:
Identify every country involved in collecting, storing, accessing, processing, or receiving the research information.
Map where the AI processing will actually occur and which entities will handle the information.
Determine whether the information is personal, sensitive, confidential, restricted, proprietary, or otherwise protected.
Check the national or regional data-protection and international-transfer rules that apply to the relevant data flow.
Review each participating institution's AI, privacy, information-security, and research requirements.
Check ethics approvals, informed-consent commitments, data-use agreements, contracts, and repository restrictions.
Check funder and sponsor conditions applicable to the international collaboration.
Determine whether a local-processing or secure-environment design can avoid unnecessary international data transfers.
Document the agreed data flow, AI system, responsibilities, and safeguards.
Recheck the arrangement when the AI provider, data, collaborators, country, contract, or relevant policy changes.
