Skip to content
Back to Scenario Playbooks
United States (Federal)United States — CaliforniaUnited States — ColoradoUnited States — TexasUnited States — IllinoisUnited States — New YorkEnterprise SaaSAI agentsGenAI & foundation models

Bringing AI SaaS to US enterprise buyers: SOC 2, state privacy and AI laws, and the DOJ bulk-data rule

A China-based team sells an AI application as SaaS to US enterprise buyers (collaboration, support, coding, risk, hiring and similar), who run it inside their workflows and pass employee or end-consumer data through the service.

Verified against official sources · 2026-09-12Verified against official text

Prerequisites

  • The US contracting entity is settled (US subsidiary or direct contracting by the offshore entity) and you know who the contractual data recipient is.
  • You can draw the full data-flow map: which systems US customer data enters, who accesses it (including engineers and outsourced staff located in China), how long it is retained, and whether it is reused for training.
  • You know your China nexus (ownership, control, staff nationality and location) — the input to the “covered person” determination under the DOJ bulk-data rule.
  • This playbook assumes ordinary commercial buyers; US federal government, regulated financial or healthcare buyers add FedRAMP, HIPAA or GLBA tracks that are out of scope here.

Stages (26–46 weeks, estimate)

  1. 1. Stage 1 — Federal and state applicability triage

    2–4 weeks

    The US has no single federal privacy statute, so applicability is a trigger table rather than one law. Work through it item by item: whether you are a “business” under the CCPA; whether the Texas TRAIGA territorial scope reaches you; whether you are a developer or a deployer under the Colorado AI Act; whether the product is used in employment contexts and therefore triggers the Illinois Human Rights Act and NYC Local Law 144; and whether you collect biometrics and therefore fall under Illinois BIPA with its private right of action. The output is a state-by-state trigger–obligation–owner table that drives every later stage.

    Obligations in this stage

    Deliverables

    Model Card

    Evidence to retain

    • · State applicability trigger table (state × trigger × conclusion × statutory basis × owner)
    • · Product use-case inventory, flagging “consequential decision” contexts such as employment, credit, housing, education and healthcare
    • · Biometric-processing determination record (whether it falls within the BIPA definition)
    • · Developer/deployer role memorandum

    Common blockers

    • · Assuming “we do not sell to consumers, so state privacy law does not reach us”: B2B services typically process customers’ employee and end-consumer data, and the duties arrive through the contract chain.
    • · Treating state AI laws as a future problem: employment-facing applications already carry explicit notice, audit and disclosure duties in several states, triggered on go-live.
    • · Overlooking the Illinois BIPA private right of action: it needs no regulator to open a case, which makes its risk profile unlike any other state.

  2. 2. Stage 2 — SOC 2 and the security control programme

    10–16 weeks

    US enterprise procurement treats SOC 2 Type II as the default ticket. The key here is the shape of the timeline: designing and remediating controls takes time, and a Type II additionally requires an observation window (commonly 3–12 months) during which operating evidence accumulates before the auditor issues the report. So the right order is gap analysis, then run the controls, then fix the observation-window start — not start when a customer asks for the report. Plan the California regulations’ annual cybersecurity audit alongside the SOC 2 control set so the work is not done twice.

    Obligations in this stage

    Deliverables

    SOC 2 Type II readiness checklist (Trust Services Criteria)Customer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)

    Evidence to retain

    • · SOC 2 readiness gap analysis and remediation tracker (organised by trust services criteria)
    • · Control operating-evidence repository accumulated month by month across the observation window
    • · Audit firm selection and observation-window start/end plan
    • · Scoping and phased-compliance schedule for the California annual cybersecurity audit
    • · Access control matrix, explicitly flagging access paths from China-based personnel to US customer data

    Common blockers

    • · Skipping Type I straight to Type II without observation-window evidence: the report cannot be issued before the sales commitment expires.
    • · Scoping SOC 2 too broadly: a wider scope means longer remediation, and the first report should cover the system boundary buyers actually ask about.
    • · Control design that ignores cross-border access: the one point auditors and US customers both press, and adding controls later restarts the observation window.

  3. 3. Stage 3 — State privacy, automated decision-making and risk assessments

    5–8 weeks

    Two workstreams: complete risk assessments before high-risk processing begins and submit the required information to the California Privacy Protection Agency; and, where automated decision-making technology is used for “significant decisions”, provide pre-use notice and handle opt-out and access requests. Colorado requires deployers to complete and periodically update an impact assessment. You can reuse the structure of the EU FRIA template here, but the section headings must be remapped to each state’s statutory elements or reviewers will not see the required components.

    Obligations in this stage

    Deliverables

    EU AI Act Article 27 Fundamental Rights Impact Assessment (FRIA)Model Card

    Evidence to retain

    • · Inventory of high-risk processing activities and the risk assessment reports (with evidence that assessment completion preceded the start of processing)
    • · Receipt for the information submitted to the California Privacy Protection Agency
    • · ADMT pre-use notice copy and records of how it is presented in the interface
    • · Intake process, deadlines and sample tickets for opt-out and access requests
    • · Impact assessment update log (triggering events and update dates)
    • · Description of human review and appeal channels (reviewer authority and override records)

    Common blockers

    • · Running the risk assessment after processing started: the requirement is “before”, and a back-dated document does not fix the timing.
    • · Folding the ADMT notice into the privacy policy: the requirement is a dedicated pre-use notice, and burying it in a long document does not count.
    • · Handing a raw EU FRIA to a US customer: it lacks elements the state statutes require — such as the specific discrimination-risk analysis and the appeal-mechanism description — and gets sent back.

  4. 4. Stage 4 — The DOJ bulk-data rule and data-flow restructuring

    4–8 weeks

    For AI SaaS with a China nexus this is the compliance point most likely to close the US market outright, and therefore the one to front-load. The sequence: identify US sensitive personal data and government-related data against the thresholds; screen counterparties and yourself for “covered person” status; stop prohibited data-brokerage transactions; restructure restricted transactions to meet the CISA security requirements; and stand up the data compliance programme, annual independent audit and 10-year recordkeeping. Bulk human omic data and human biospecimens are subject to an absolute prohibition that no security measure cures.

    Obligations in this stage

    Deliverables

    Customer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)

    Evidence to retain

    • · Identification and threshold-measurement records for US sensitive personal data and government-related data
    • · Covered-person screening records (including determinations for your own entity and affiliates)
    • · Evidence of security-requirement implementation for restricted transactions, mapped item by item to the CISA requirements
    • · Data compliance programme documentation and the annual independent audit report
    • · 10-year transaction recordkeeping arrangement and the annual certification of completeness
    • · Contractual no-onward-resale clauses for provision to non-covered foreign persons, plus the breach-reporting process

    Common blockers

    • · Concluding “we do not sell data, so it does not apply”: the rule governs access, and operational access by China-based engineers can itself constitute a covered transaction.
    • · Measuring against the thresholds once and never re-checking: thresholds are measured on a cumulative basis over a period, and growth crosses them unnoticed.
    • · Staffing the annual independent audit internally: the rule requires independence, and a report from the internal team does not satisfy it.

  5. 5. Stage 5 — AI claims, training-data disclosure and content transparency

    3–5 weeks

    Align the external story with actual product behaviour. The FTC enforces Section 5 against overstated AI capability claims, so every “accuracy”, “fully automated” or “no human needed” line in marketing needs substantiation held before publication. California adds two: generative AI training-data documentation must be published on your website, and covered providers must embed latent disclosures in content and offer a manifest disclosure option. Under Texas law, build the evidence chain in advance for the 60-day cure period and the statutory defences.

    Obligations in this stage

    Deliverables

    Data Card — datasheet for a training, validation or test datasetTender / RFP compliance response pack (covering both EU public procurement and enterprise procurement)

    Evidence to retain

    • · Marketing claims register (each claim × substantiation × live version × reviewer)
    • · Published generative AI training-data documentation and its version history
    • · Technical note on latent and manifest disclosure implementation plus detection results
    • · Algorithmic-fairness safeguards description and monitoring metrics
    • · Cure-period evidence pack (timeline of detection, internal handling and completion of remediation)

    Common blockers

    • · Marketing and technical narratives diverging: a sales page saying “100% automated” against product docs saying “human review recommended” is itself the exposure.
    • · Training-data documentation vaguer than the claim it supports: California asks for checkable documentation, not “sourced from the public internet”.
    • · Keeping substantiation in someone’s inbox: an enforcement inquiry needs retained, versioned, searchable records.

  6. 6. Stage 6 — Procurement response and annual upkeep

    3–5 weeks

    Compress the first five stages into a repeatable procurement pack and put the annual duties on the calendar: annual SOC 2 refresh, the California annual cybersecurity audit, the DOJ rule’s annual independent audit and annual reports, and reports of rejected prohibited transactions. US enterprise re-review typically runs annually, and stale materials lose deals more often than missing ones — because staleness says the governance is not running.

    Obligations in this stage

    Deliverables

    Customer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)SOC 2 Type II readiness checklist (Trust Services Criteria)Tender / RFP compliance response pack (covering both EU public procurement and enterprise procurement)

    Evidence to retain

    • · Procurement response pack (SOC 2 report summary, security whitepaper, sub-processor list, data-flow diagrams, insurance certificates)
    • · Annual compliance calendar (duty × due date × owner × last completion date)
    • · Tracking record of peer enforcement outcomes and the internal remediation register
    • · Quarterly refresh log for the customer questionnaire answer bank

    Common blockers

    • · Annual duties without an owner: one fiscal year later nobody remembers to file, and a missed annual report is harder to explain than a first-time filing.
    • · Shipping last year’s sub-processor list in the pack: customers compare it against the contract annex, and one mismatch devalues the entire set of materials.

Common failure modes

  • · Extrapolating from the EU: the EU runs on one comprehensive law, the US on targeted federal rules plus a state patchwork, and “we did GDPR so we did the US” is simply wrong.
  • · Leaving the DOJ bulk-data rule to the end: it can invalidate the existing architecture outright (who may access, where data sits), and the later it surfaces the costlier the rework.
  • · Inverting the SOC 2 schedule: promising the report first and starting controls afterwards leaves the observation window short and the report perpetually three months away.
  • · Underrating state and city requirements for employment-facing applications: bias audits, candidate notices and employee notices carry explicit deadlines, and because they are the customer’s duties, customers pass them straight through to the vendor.
  • · Ignoring how outbound-investment and ownership structure affect market access: beneficial-ownership and control questions are now standard in US vendor questionnaires.
  • · Contracting through a China-based entity that promises “data never leaves the US” while operations and model-training pipelines still run onshore in China — the most common fatal inconsistency found in diligence.

Sources (20)

Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.

Request accessContact an advisor
GDPR · PIPL · CCPA control mapping
Traceable AI · cited when sourced
ISO 27001 alignment in progress
WCAG 2.1 AA accessibility target
Bringing AI SaaS to US enterprise buyers: SOC 2, state privacy and AI laws, and the DOJ bulk-data rule · Scenario playbook | HaiWen HQ