Where the parties are, and whose law that makes applicable

About this documentUpdated 2026-09-21ShowHide

Sean McDermott, Co-Founder and CEO, UnGovr

Written by Sean McDermott (with AI assistance) using the LexLint law library, which supplied every legal instrument, status and date on these pages.

Every law named here links to its summary page on lexlint.org, translated to English (if needed) and restructured to a standard format for human and code use. Every case links to the court's or the regulator's own record where one could be reached.

© 2026 UnGovr, publishing as LexLint. The text and the figures are licensed under Creative Commons Attribution-ShareAlike 4.0: share and adapt them, including commercially, with credit to LexLint (UnGovr) and under the same licence. Please contact LexLint at hello@ungovr.org to discuss other terms. Logos and wordmarks belong to their owners.

Corpus figures as of 2026-09-21.

Legal information, not legal advice. This document describes the law as written and dated; it does not apply it to any system. The notice at the foot says what that means.

The server's location is the one fact almost no law turns on. Each body of law reaches an agent through where one of its parties is: the market a system was placed on, where its output is used, where a person lives or is sitting, where the operator is established, where the machine it read belongs. Which party, what counts as evidence of where they are, and what to do when nothing says.

1What this document is

Introduction: The 6 parties in AI law names six parties around an AGENT and says that each of them has a location. Every document after it rests on what that location does. Global AI law: 8 common threads states the finding in one line, that AI law reaches by market and by output and never by where the server is. What you must constrain and What you must be able to show each name the applicability question and leave it to this document. Incident reporting clocks filters its clocks by the places a project declares. Jurisdiction in logs argues that a record has to carry the answer. None of them says how the answer is reached.

This document does. It is the general treatment of one predicate: which jurisdiction's law reaches this run, decided from where the parties are. It states what each body of law reaches through, shows the rule the LexLint corpus applies to every requirement line, says what evidence of a party's location exists at run time and how far each piece can be trusted, and ends with the two rules a system needs when the evidence is thin: how a declared place widens, and what to do when the answer is unknown.

2What each body of law reaches through

Three things make the server the wrong answer. Data protection law reaches a controller with no establishment in the Union where its processing is related to offering goods or services to people there, or to monitoring their behaviour there; the GDPR's own recital says that a website being reachable from the Union is not enough, and that language, currency and named customers are what make an offer directed there (Regulation (EU) 2016/679, Article 3(2) and Recital 23). The DSA draws the same line harder: mere technical accessibility from the Union cannot establish a substantial connection to it (Regulation (EU) 2022/2065, Recital 8). And the AI Act reaches a provider or deployer established in a third country where the output produced by the system is used in the Union (Regulation (EU) 2024/1689, Article 2(1)(c)).

Where an operator does have an establishment, the question is answered by the operator's own footprint before any user's location is asked about. The Court of Justice reads establishment broadly: a representative, a bank account and a letter box in Hungary were enough in Weltimmo (C-230/14), and a registered office in another state where the company did nothing was not. Neither the targeting test nor the establishment test asks where a machine is. American personal-jurisdiction doctrine, from Zippo to Ford Motor Co. v. Montana, asks a version of the same question, what the defendant did toward the forum and the people in it.

The table takes the bodies of law the corpus holds and names, for each, the fact its reach turns on and the party in The 6 parties whose position supplies that fact. Every instrument named is a link to its corpus page, with the citation, the status and the date it was read.

Read down the third column and the point of the six parties becomes concrete. A single task, one USER asking an AGENT to read a site and email the result, has a data subject whose residence matters, a counterparty whose machine's location matters, a recipient whose place matters, and an operator whose establishment matters. Four hooks, four places, and the server's region is none of them.

3The corpus's own hook column

The LexLint corpus records every instrument's duties as requirement lines, and every line carries a territorial hook. The hook is not researched line by line. It is a rule applied to the line's topic and, where the instrument has one, its law family, and the register file that The sixteen themes, filled from law publishes prints it in a column of its own beside the party whose position triggers scope. The rule is printed here from the same data the register is built from, so the two cannot disagree. The column is a starting point, not the destination: the corpus is moving to a scope statement per instrument, in the law's own words with an identifier of its own, and where one exists it replaces the rule for that instrument.

Topic	The hook, where the family states nothing narrower
AI	Establishment of the operator; placing on the market; where the output is used
privacy	Residence of the data subject; establishment of the operator
scraping	Location of the counterparty (site, machine, rightsholder)
cybersecurity	Establishment of the operator; placing on the market

Three things to know when reading it. It is a rule about text, reviewed in samples, so it is the first column a reviewer of any line should correct, and a line whose own words state a narrower trigger is read by its words. The party column beside it is different in kind: that one is a hand classification, made line by line for a study of what a runtime control can enforce, and it names the one party whose location or status makes the duty apply rather than the party the duty protects. And the two answer at different grains: the hook says what kind of fact decides scope, the party says whose fact it is.

The logging research under What you must be able to show goes one level finer for the instruments it covers. There, each instrument records which of six triggers brings it into play: the operator's establishment, targeting a market, the user's location, the data subject's residence, the place of effect, or where the content originated. That reading is per instrument and per jurisdiction, and it is published at What the law requires of logs.

4What says where a party is, and how good it is

Once the hook is known, the question becomes evidence: what a running system can actually know about where each party is, when it can know it, and how far the knowledge can be trusted. The table is written for the moment a call is made. Two of its rows are decided once, at design time, and the rest are observed per call or not at all.

Two things fall out of the table. Most of what a system knows about location is either declared once or looked up from a domain, and only one signal, the principal's IP address, is observed from the network per request. And the lookups are data to be maintained rather than inferences to be made: no consistent method maps a domain to the establishment of the business behind it from the wire, so a system that wants that answer holds a dataset and dates its entries.

LexLint offers one such lookup to a coding agent, resolving a domain the application talks to into a corpus jurisdiction. It answers from a maintained mapping of domains to known operators first, then from the domain's own suffix, and it names which method answered, because a mapping to a known operator is evidence and a country inferred from a top-level domain is a guess wearing a label. A result of nothing is not permission to guess: a vanity top-level domain says nothing about who operates a site.

5Why a client IP address is the weakest of those

At an origin behind a content delivery network, a load balancer or any reverse proxy, the peer IP address on the socket belongs to the edge node that relayed the request, not to the person. A jurisdiction check run on it returns a well-formed country code, on time, with no error, and it is the country of a point of presence. Nothing about the value says so. The only way the real client IP address reaches an origin is as an assertion the edge makes in a forwarded header, over a connection the origin can authenticate as its own, and a service the origin calls in turn never sees it at all.

That argument, the figure of the hops it is drawn from, and the rule that follows (the reading travels in the call, and each layer records what it was given rather than deriving its own) belong to What a tamper-proof log still cannot tell you, in its section on identifying the real client IP address. This document does not restate them. What it adds is the placement: even read correctly at the edge, the IP address answers one row of the table above, the principal's presence, and none of the others.

6Deciding jurisdiction is itself processing

The question answers itself in the act of being answered. An IP address is personal data for a party with the legal means to link it to a person, which is the holding in Breyer (C-582/14), and the GDPR lists location data among the identifiers that make a person identifiable (Article 4(1)). California makes geolocation sensitive once it places a person inside a circle of 1,850 feet (the precise-geolocation definition). So the record a system keeps about how it decided jurisdiction is itself regulated by the law it was trying to apply.

The two are separable, and separating them is the design. What is recorded is the result of the predicate, at country or state granularity with unknown a permitted value, together with a commitment to an evidence record held elsewhere; the signal the predicate ran on never enters the record, in clear or as a digest, because an IP address is recovered from its digest in seconds. A country label sits far outside California's line by construction, and a state age-verification statute is direct evidence that a jurisdiction can require exactly this shape, locate and characterise and then discard, as a matter of law. The field design is Jurisdiction in logs's section on location data, and the statutory reading behind it, jurisdiction by jurisdiction, is Knowing which law applied, without making the log personal data.

7A declared place brings its parents and its union

A jurisdiction in the corpus sits at one of four levels, supranational, national, subnational or local, and law at every level above a place reaches it. So a place is never read alone. A declared City of San Francisco brings California and the United States with it; a declared Germany brings the European Union, the one rung its name does not spell out. The lint reads a project's declaration this way, and Incident reporting clocks filters its clocks on the same widening, so a project that declares a city sees its state's and its country's clocks beside the city's own.

The union step is read from membership rather than from a list, so an accession or a withdrawal moves it without anyone editing a constant. The Union is also not the only union: an EU act reaches Norway, Iceland and Liechtenstein through the European Economic Area only once it has been incorporated into that agreement, and each EU instrument's corpus page says whether it has been. The rule runs one way. A declared country never brings its cities with it, because a city's ordinance binds inside the city, and a system that widened downward would read every local rule in the country against every run.

A place needs a name that two systems can read the same way. The identifier LexLint already publishes for a jurisdiction nests the way the levels do, so the state sits under the country and the city under the state, and it is published under a licence anyone may adopt. The proposal to carry it in an agent's record is Jurisdiction in logs's.

8What is undecidable, and what to do

Some of the hooks in section 2 cannot be decided per request, whatever the evidence, and a system should know which before it tries.

• Aggregate triggers. A significant number of users in a place is a property of the service over a period, not of the person in front of it. No per-request field answers it; the operator's own figures do, at design time.
• Targeting and intent. Whether an offer is directed at a place is read from the operator's own conduct: the languages offered, the currencies taken, the marketing. It is decided once, from what the operator knows about itself, never inferred from a visitor.
• Residence in a payload. A person's presence in what the AGENT sends is visible; where that person lives is not, and no inspection of the payload will make it so.
• A request with nothing but an edge. No claim, no account, and a peer IP address that belongs to a point of presence: the presence of the principal is unknown, and the correct value of the field is that word.

Four rules follow. Unknown is a permitted result, and a check that cannot answer says so, because coercing an unresolved signal to a default country is how a wrong answer is manufactured rather than inherited. When the answer is unknown, the run is read against the declared set as a whole rather than against no place, so an unknown narrows nothing. Where a person can be asked, ask them; a declared residence from the principal is better evidence than any inference. And the predicate records the signal it ran on, so a later reader can tell a reading from an artefact of the network path.

9What this document does not claim

It does not say which places' law reaches any particular system. That is decided per deployment, from the roles the system's parties hold and the evidence of where they are, and the tables above are the rules for making that decision rather than the decision itself. The hook column is a rule applied to text and reviewed in samples, not a finding made line by line. The instruments named are examples of each hook, read on the date beside them, and a law that moved after that date may have moved the answer. Nothing here is legal advice.