Every prompt to a foreign model is a transfer

On the prevailing reading of Egypt's data protection law, sending personal data to an AI model hosted outside Egypt is a cross-border transfer. Every prompt that carries a customer's, employee's or supplier's details to a foreign-hosted model is therefore in scope of the licensing rules. That reading has not been tested by any published enforcement action, and we say so plainly below.

AI calls are the least mapped data flow in most estates we see, usually because nobody in the room has thought of them as a transfer at all. This briefing is not legal advice.

1Why an API call can be a transfer

Because the Executive Regulations define cross-border transfer to include processing and making data available abroad, not only moving files. Article 16, in the English rendering we rely on, covers transfer, storage, sharing, processing or making personal data available across borders. A prompt containing personal data, sent to a model running on servers outside Egypt, makes that data available to and processed by a system abroad.

The same applies whether the call comes from a chatbot, a document-processing pipeline, a coding assistant with access to customer records, or an employee pasting a spreadsheet into a public chat tool.

2The AI-specific obligation

The regulations also address AI directly. Article 4(7), as rendered in English, requires processors involved in artificial intelligence training and emerging technologies to comply with locally, regionally and internationally recognised principles, so that the use of those technologies does not harm the data subject. It is a principles-based obligation rather than a technical rulebook, but it means AI use is not outside the regime's attention.

3Foreign providers without an Egyptian presence

A foreign processor with no branch or office in Egypt is required to appoint an accredited local representative. Article 4(5) sets this out. Most global AI providers have no Egyptian entity, which leaves an open practical question about how that obligation will be applied to them and what it means for the organisations using them.

4Where AI calls hide

• customer service chatbots built on a hosted model
• email, meeting and call summarisation tools
• document extraction for invoices, contracts or identity documents
• CRM and helpdesk features that "suggest a reply" by sending the ticket to a model
• staff using consumer AI tools with company data, outside any approved system
• analytics and search features added to existing SaaS by the vendor, often switched on by default

5Options that keep AI useful

The choice is not between AI and compliance. The workable patterns are:

1. Inventory first. List every feature and tool that sends data to a model, and where that model runs.
2. Remove personal data before the call where the task does not need it, through redaction or pseudonymisation at the boundary.
3. Host the model in Egypt for workloads that must see personal data, using open-weight models on local infrastructure.
4. License what stays abroad, naming the destination in the cross-border application, where a foreign model is genuinely needed.
5. Set a staff policy for consumer AI tools, because the transfer happens whether or not IT approved it.

6Where we might be wrong

• Untested reading. No published enforcement action has yet confirmed that an AI API call is a regulated transfer. It is the reading most consistent with Article 16's wording, not a settled position.
• No AI guidance. We are not aware of guidance from the Centre specifically on AI models, inference or training data.
• Anonymised prompts. The regulations allow data to be made non-identifiable, but anonymisation standards are not yet regulated, so it is unclear when a redacted prompt stops being personal data.
• Article numbering. English renderings differ in places. Check article numbers against the Arabic text before relying on them.

Raqmix is certified to ISO/IEC 42001, the international standard for AI management systems, which is why we look at AI flows first. To map yours, book the 90-minute data audit. For the wider picture, read Storage abroad is a transfer.

Sources

Executive Regulations, article level: Consortio Law Firm English rendering, ID Law Firm overview

Primary law in translation: Law 151 of 2020, Matouk Bassiouny translation via ACC

Practitioner alerts: Baker McKenzie, Kennedys