The EU Artificial Intelligence Act entered into force in August 2024, establishing the world's first comprehensive legal framework for artificial intelligence. While its primary jurisdiction is the European Union, its extraterritorial provisions have significant implications for businesses in Lebanon and the broader MENA region.

Under Article 2 of the Act, any provider placing an AI system on the EU market — regardless of where that provider is established — falls within scope. This means a Lebanese software company whose AI-powered product is used by a single EU-based customer is, in principle, subject to the Act's requirements.

The risk-based classification system divides AI systems into four tiers: unacceptable risk (prohibited), high risk (heavily regulated), limited risk (transparency obligations), and minimal risk (largely unregulated). High-risk systems — which include AI used in recruitment, credit scoring, biometric identification, and critical infrastructure — face the most stringent requirements: conformity assessments, technical documentation, human oversight mechanisms, and registration in the EU database.

For Lebanese businesses, the practical implications are threefold. First, any company with EU market ambitions must audit its AI systems against the Act's risk classification framework. Second, contracts with EU customers should be reviewed to ensure appropriate liability allocation. Third, internal governance structures — AI ethics boards, documentation protocols, incident response procedures — must be established before market entry.

The compliance timeline is not forgiving. Prohibited AI practices became enforceable in February 2025. High-risk system requirements apply from August 2026. General-purpose AI model obligations are already in effect. Companies that have not begun their compliance journey are already behind.

Lebanon remains one of the few countries in the MENA region without a comprehensive data protection statute. While draft legislation has circulated for years, no framework has been enacted. This creates a paradox: Lebanese businesses are legally unregulated domestically, yet face significant compliance obligations from foreign jurisdictions whose residents' data they process.

The GDPR's extraterritorial reach under Article 3 captures any Lebanese business that offers goods or services to EU residents, or monitors their behaviour. The UAE's Federal Decree-Law No. 45 of 2021 on Personal Data Protection similarly applies to data processed in connection with UAE residents. Saudi Arabia's Personal Data Protection Law (PDPL) adds another layer for businesses with Saudi operations or customers.

The practical consequence is that Lebanese businesses operating in the digital economy are subject to a patchwork of foreign data protection regimes, without the guidance of a domestic framework to anchor their compliance programs. This is not a comfortable position.

Our recommendation is to build compliance programs around the most stringent applicable framework — typically the GDPR — while layering in the specific requirements of other applicable regimes. This approach future-proofs the program against the eventual enactment of Lebanese domestic legislation, which is expected to draw heavily from GDPR principles.

A cybersecurity incident is not merely a technical event — it is a legal event with immediate and time-sensitive obligations. The first 72 hours following discovery of a breach are the most consequential from a legal perspective, and the decisions made in that window will shape the company's regulatory exposure, litigation risk, and reputational outcome.

The most pressing obligation for companies subject to the GDPR is the 72-hour notification requirement under Article 33. Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, the controller must notify the competent supervisory authority within 72 hours of becoming aware of the breach. Failure to notify — or late notification — is itself a regulatory violation, independent of the underlying breach.

Simultaneously, companies must activate their incident response legal team to manage evidence preservation. Digital forensic evidence is volatile; improper handling can destroy its admissibility in subsequent proceedings. Legal counsel should be engaged before forensic investigators begin work, to ensure the investigation is conducted under legal privilege where possible.

Contractual notification obligations to customers, partners, and insurers must be reviewed immediately. Many commercial contracts contain breach notification clauses with timelines shorter than regulatory requirements. Insurance policies typically require prompt notification as a condition of coverage. Missing these deadlines can void coverage and trigger breach of contract claims.

A smart contract is a self-executing program stored on a blockchain that automatically enforces the terms of an agreement when predefined conditions are met. The appeal is obvious: no intermediaries, no ambiguity, no enforcement costs. The legal reality is considerably more complex.

The fundamental tension is between the deterministic nature of code and the interpretive nature of law. A smart contract does exactly what it is programmed to do. A legal contract does what the parties intended — and intention is frequently disputed. When the code executes correctly but produces an outcome that one party argues was not the intended agreement, the question of legal enforceability becomes acute.

Under Lebanese contract law, the essential elements of a valid contract — consent, capacity, object, and cause — must be present regardless of the medium of expression. A smart contract can satisfy these requirements, but the analysis is not automatic. Questions of consent (was there genuine agreement to the coded terms?), object (is the subject matter lawful?), and cause (is the underlying purpose legitimate?) must be addressed.

Our recommendation for clients deploying smart contracts is to use a hybrid approach: a natural-language master agreement that governs the commercial relationship, with the smart contract serving as the execution mechanism for specific, well-defined obligations. This preserves the efficiency benefits of automated execution while maintaining the interpretive flexibility that complex commercial relationships require.

When a Lebanese business signs an IT procurement contract — whether for cloud services, enterprise software, or managed IT services — it is typically signing a vendor-drafted agreement optimised for the vendor's interests. The negotiation leverage may be limited, but the legal exposure is not.

The most consequential clause in any IT procurement contract is the limitation of liability. Standard vendor agreements typically cap liability at the fees paid in the preceding 12 months — a figure that may be a fraction of the actual loss suffered in the event of a major service failure or data breach. Negotiating carve-outs for data breaches, wilful misconduct, and intellectual property infringement is essential.

Service level agreements (SLAs) are frequently misunderstood. An SLA that promises 99.9% uptime sounds impressive — but 99.9% uptime permits 8.7 hours of downtime per year. More importantly, the remedy for SLA breach is typically a service credit, not damages. If your business loses significant revenue during an outage, a service credit is cold comfort.

Data ownership and portability clauses deserve particular attention. Who owns the data you generate on a vendor's platform? What happens to your data if the vendor is acquired, goes insolvent, or terminates the contract? The right to export your data in a usable format — and the vendor's obligation to assist with migration — should be explicitly addressed.