Maître Florence Ivanier hosted a webinar alongside Aliénor Fagette, and Clément Thiébault at the Embassy of Canada (Trade Commission) aimed at a delegation of Canadian Tech companies ahead of VivaTech 2025.
Key takeaways
Here’s what you need to know to turn AI and Data European regulatory requirements into trust-building opportunities for your EU prospects.
Compliance as a differentiator
Demonstrating robust compliance capabilities with GDPR and the NIS2 Cybersecurity Directive can distinguish non European companies as trusted partners for major European accounts, turning regulatory obligations into strategic business advantages.
GDPR and the AI Act have a global scope
GDPR applies to any organization offering goods or services to EU residents or processing their personal data (even established outside EU).
The AI Act applies to any provider or deployer of AI systems—whether established inside or outside the EU—whose systems are placed on the EU market or whose outputs are used within the EU.
GDPR & personal data transfers outside EU
Thanks to the EU-Canada Adequacy Decision, Canadian companies benefit from seamless personal data flows.
In comparison with their competitors located in countries without an Adequation Decision, it definitely gives them a head start. Such competitors may transfer personal data under Standard Contractual Clauses.
Reminder: US companies may also transfer personal data under the Data Privacy Framework. However this framework is currently challenged before the European Court of Justice.
Preparing for the EU AI Act
From 2026, the AI Act will impose obligations based on product risk level.
High-risk applications face stringent requirements and penalties of up to 7% of global turnover.
Map your role in the AI value chain— supplier, deployer—to pinpoint your exact compliance duties.
A big thanks to Frederic Chieux, Thierry Weissenburger Aliénor Fagette and Clément Thiébault for their support. Thanks Marie-Amélie DUGRAIS for your invaluable work as an intern at Aurele IT.