AI safety cameras in Europe: what differs between UK and US vendors

EU sites buying AI video safety analytics often end up choosing between a UK-based and a US-based vendor. On features the two can look alike. Under EU law, they differ in one important place, data transfers, and are treated the same almost everywhere else.

This article sets out what really differs when a UK or US vendor deploys AI safety cameras at an EU site, and what to put in the contract. It does not cover Chinese camera makers, which are covered in Hikvision and Dahua restrictions by country, or the full matrix of vendor origins, which is in our vendor-by-country matrix.

The one real difference: data transfers

AI safety analytics processes video of workers, which is personal data under the GDPR. If the vendor processes that data outside the EU, the transfer needs a legal basis.

UK vendors. On December 19, 2025, the European Commission renewed its adequacy decisions for the UK, which now run until December 27, 2031 ^[1]. Personal data can flow from the EU to the UK without standard contractual clauses (SCCs) or other transfer tools ^[1]. The Commission found that UK protection remains essentially equivalent after the changes made by the Data (Use and Access) Act ^[1].

US vendors. Transfers to certified US companies rely on the EU-US Data Privacy Framework (DPF). The EU General Court rejected a challenge to the DPF in September 2025, and that ruling has been appealed to the Court of Justice of the EU ^[2]. If the Court of Justice invalidates the DPF, US vendors would fall back on SCCs plus transfer impact assessments, as they did after earlier frameworks were struck down. In our assessment, that is a real but manageable risk.

The US answer: EU hosting. US vendors respond by processing data inside the EU. Verkada, for example, launched a version of its Command platform fully hosted in a European data center in September 2023 ^[3]. A US vendor with genuine EU-only processing, including support access and backups, and an EU legal entity removes most of the transfer difference in practice. Check the details: where support staff access data from, where logs and model training data go, and which sub-processors are outside the EU.

What could change the UK edge. UK data law is diverging. Most of the Data (Use and Access) Act's data protection changes commenced on February 5, 2026, including looser rules on automated decision-making except where special category data is involved ^[4]. In our view, further divergence would be the main threat to UK adequacy before 2031.

Works councils: same rules for every vendor

In Germany, the works council has an enforceable right of co-determination over technical systems that are objectively capable of monitoring employees' behavior or performance, under section 87(1) no. 6 of the Works Constitution Act (BetrVG) ^[5]. The employer's intent does not matter ^[5]. A camera system bought only for forklift safety still qualifies if it could be used to monitor people. When AI is introduced, the law treats the council's use of an outside expert as always necessary; the expert, the scope and the cost are then agreed with the employer, which pays ^[5].

Vendor origin makes no difference here. What helps is a product designed for these negotiations: configurable blurring, no identification of individuals by default, short retention, and clear limits on who can see what. Expect to be asked for these by European works councils regardless of where the vendor is based.

Regulators also look closely at warehouse monitoring. France's data protection authority, the CNIL, fined Amazon France Logistique €32 million over warehouse monitoring, and France's highest administrative court cut the fine to €15 million in December 2025 ^[6]. The guide chapter on privacy law and workers covers these cases in more detail.

The product law calendar: same for UK and US

From an EU product law perspective, a UK vendor and a US vendor are both suppliers from outside the EU. Four laws take effect over the next two years:

• Product Liability Directive (PLD). The revised directive covers software and AI-enabled products and applies to products placed on the EU market from December 9, 2026, regardless of where the responsible company is based ^[7]. Liability can extend beyond the manufacturer to importers, online platforms and fulfilment service providers ^[7].
• Machinery Regulation. Regulation (EU) 2023/1230 replaces the Machinery Directive on January 20, 2027 ^[8]. It applies with no transition period and adds safety requirements for autonomous systems, including AI ^[8]. This matters where safety analytics is built into or controls machinery, not for cameras that only send alerts.
• Cyber Resilience Act (CRA). Reporting of actively exploited vulnerabilities and severe incidents started on September 11, 2026, and the main obligations apply from December 11, 2027 ^[9].
• AI Act. The AI Omnibus, Regulation (EU) 2026/1744, moved high-risk obligations for Annex III uses, which include employment, to December 2, 2027, and for AI in regulated products to August 2, 2028 ^[10]. Gibson Dunn reports that AI in products covered by the Machinery Regulation is "largely exempted" from the AI Act ^[11]. The ban on AI that infers workers' emotions, except for medical or safety reasons, has applied since February 2, 2025 ^[12][10]. Our article on the EU AI Act and workplace safety systems explains when a safety system becomes high-risk.

The GDPR itself may change. The Digital Omnibus proposal to amend it has not been adopted: the Council set out its position on June 22, 2026, and the Parliament's position and negotiations are pending ^[13].

Side by side

Contract clauses to ask for

Whether the vendor is from the UK or the US, the contract should cover:

1. Processing location. Every location where video, metadata, logs and backups are stored or accessed, with notice before any change.
2. Transfer fallback. For US vendors, what happens if the DPF falls: SCCs ready to sign, and the right to require EU-only processing. For UK vendors, the same fallback if UK adequacy is withdrawn or not renewed ^[1][2].
3. Liability. The name of the EU-based company that will answer product liability claims for products placed on the market from December 9, 2026 ^[7].
4. Security support. A security update period in years, a vulnerability reporting process consistent with the CRA, and notice of incidents ^[9].
5. AI Act documentation. The provider's own classification of the system under the AI Act, and a commitment to supply the documentation a deployer needs if the system is high-risk ^[10].
6. Works council support. Technical documentation in the local language, configuration options for blurring, identification and retention, and attendance at council meetings if requested ^[5].
7. Machinery conformity. Where the product forms part of or controls machinery, conformity documentation under the Machinery Regulation from January 20, 2027 ^[8].
8. Exit. Data export formats and deletion on termination.

The guide chapter on buying and piloting covers how to build these into a request for proposal.

What to do next

• Ask every shortlisted vendor for a data flow diagram that shows each processing location, including support access.
• For US vendors, confirm DPF certification and whether a full EU-only processing option exists.
• In Germany, open works council talks before the pilot, and budget for an outside AI expert for the council.
• Put the eight clauses above into the contract template now, since most will be signed before the 2027 dates.
• Record the vendor's AI Act classification and recheck it before December 2, 2027.