AI and the International Business: How Artificial Intelligence Is Changing Company Structure, Banking, Compliance and Cross-Border Operations

AI and the Operating Model

AI Is Changing the Operating Model

The historic relationship between business growth and headcount was broadly linear. Revenue growth led to more customers, which required more administration, more staff, more premises and more management. AI is changing that relationship.

The emerging model looks different: revenue growth leads to more customers, which are served through automated workflows, AI-assisted operations and a smaller human team with different infrastructure. Customer support, document processing, compliance monitoring, invoicing, reconciliation, translation, content generation and data analysis can all be partially or substantially automated.

AI can change the relationship between revenue and headcount. That has structural consequences.

Those consequences affect how the business is structured, where it operates, what substance it has, how it banks, how it is regulated and how it is explained to counterparties. The structure must reflect the actual operating model — not the model the business used to have.

The Lean International Company

Consider a hypothetical AI-enabled business: £5 million annual turnover, customers in 30 countries, four employees, cloud infrastructure, automated customer support, AI-assisted administration, automated invoicing and reconciliation, and outsourced specialist functions. This is an illustration, not a recommendation.

This business is not small. It is lean. The distinction matters. A lean business with genuine functions, real management, appropriate technology, documented processes and clear commercial rationale may have genuine substance. Conversely, nominal staffing, unused premises or activity created primarily for appearance should not be assumed to satisfy applicable substance requirements merely because headcount exists.

Small team does not automatically mean small business.

The questions asked by banks, regulators and tax authorities remain: who owns it, who controls it, what does it do, where does it operate, where are decisions made, where does money come from and go, and why does it exist? AI changes the answers to some of these questions. It does not remove the questions.

Does AI Change Economic Substance?

AI challenges simplistic assumptions that substance requires a large office and many employees. But it does not remove statutory substance requirements. Economic substance concerns genuine functions, management, technology, assets, IP, expenditure, contracts, decisions, risks and actual activity. Specific regimes may prescribe particular people, expenditure, premises or activities — these must be verified from current authoritative sources.

AI may change how a function is performed. It does not change the need for the structure to reflect reality.

Headcount alone does not establish whether applicable substance requirements are satisfied. The analysis depends upon the entity's genuine functions, management, assets, expenditure, risks and the requirements of the relevant jurisdiction or regime.

Management, Control and Automated Decision-Making

If AI systems recommend pricing, approve routine workflows, prioritise customers and generate reports, the business still needs to know: who selected the system, who set its parameters, who approved its policies, who supervises its outputs, who can override it, and where directors and executives exercise genuine authority.

Automation can support management. It does not necessarily replace management.

AI Agents: Tool, Delegate or Decision-Maker?

AI agents are systems capable of carrying out multi-step tasks, interacting with software and taking actions based on instructions. They can book meetings, draft contracts, execute workflows, query databases and interact with external services. AI agents should not be assumed to possess independent legal personality or authority merely because they can act autonomously within a workflow. Their legal treatment and the authority attributed to their actions depend upon the applicable legal framework and the arrangements under which they are deployed.

An AI agent may perform a task. The business still needs to know who authorised the task and who is responsible for the result.

Governance frameworks for AI agents should address: what the agent is authorised to do, what it cannot initiate without human approval, what thresholds trigger escalation, what audit trail is maintained, and who reviews outcomes. The more consequential the action, the more important human oversight becomes.

Human Accountability Still Matters

A company can automate a process. It cannot automate away its legal obligations. The business remains responsible for establishing appropriate governance and accountability for its use of AI, subject to the applicable legal and regulatory framework. The allocation of legal responsibility between the company, directors, officers, employees, providers, deployers and other parties depends upon the applicable law, contractual arrangements and circumstances.

Automation does not remove accountability.

Governance frameworks should include: clear authority limits for automated systems, approval thresholds for consequential actions, escalation procedures, audit trails, human review where appropriate, and incident-response procedures. The question is not whether AI can act. It is who is responsible when it does.

Banking, KYC & Compliance

Banking an AI-Enabled Business

An AI-enabled company may have high turnover, few staff, limited premises, high technology expenditure, international customers, automated workflows and unusual transaction patterns. None of this automatically indicates wrongdoing. But unusual operating models often need explanation.

Financial institutions may seek to understand: how the business generates revenue, who its customers are, what contracts underpin the revenue, which technology providers are used, who owns and manages the business, where decisions are made, what the source of funds is, and what the expected transaction flows are.

Unusual does not mean illegitimate. But unusual often needs explanation.

A structure can be perfectly lawful and still fall outside a particular institution's risk appetite. Banking feasibility should be assessed during structure design, not after incorporation.

Deepfakes, Synthetic Identity and the New KYC Problem

AI tools can make altered identity documents, photographs, video, voice and correspondence more convincing. This creates challenges for identity verification, document authentication and fraud prevention. The implications for international businesses are defensive and practical.

Businesses and institutions may need to consider: using trusted verification channels rather than relying solely on submitted documents, independent checks where material, provenance verification for key documents, anomaly escalation procedures, and impersonation protection for senior personnel.

AI makes document creation easier. That makes trusted verification more valuable.

Source of Funds in an Automated Economy

In an AI-enabled business, revenue may be generated through automated systems, subscription platforms, API integrations, digital marketplaces and automated billing. The format of financial evidence is changing. But the underlying questions remain: where does the money come from, what generates it, and can it be credibly explained?

Automatically generated invoices, payment records and system-produced financial summaries may be entirely legitimate. But they may also require additional context to be understood by a bank, investor or regulator. The business should be able to explain its revenue model, its customer relationships and its transaction flows in terms that a human reviewer can understand.

The format of evidence may change. The need for credible evidence does not.

Source-of-funds documentation should reflect the actual revenue model. If the business generates revenue through automated systems, the documentation should explain how those systems work, who the customers are, what contracts underpin the revenue and how payments are processed.

Data Is Part of the Structure

An AI-enabled business processes data continuously — customer data, transaction data, operational data, training data and output data. Where that data is stored, who can access it, which jurisdictions it crosses, which providers hold it and what contractual controls govern it can affect regulatory compliance, data-protection obligations, banking relationships and operational resilience.

For an AI-enabled business, data architecture can become part of business architecture.

Relevant questions include: where is data stored and processed, which cloud providers are used and in which jurisdictions, what personal or confidential data enters AI systems, what data is used to train or fine-tune models, who has access to outputs, and what contractual controls govern data use, confidentiality and portability. These questions do not require detailed legal advice to ask — but the answers may require it.

Cybersecurity and Operational Resilience

AI dependence can create new categories of operational risk: provider outage, model failure, credential compromise, data leakage, erroneous output, supplier termination and service-change risk. A business that relies heavily on a single AI provider or cloud platform has a concentration risk that should be understood and managed.

Automation can reduce manual dependency. It can also create technology dependency.

Resilience planning for an AI-enabled business should consider: what happens if a critical AI system or provider fails, what fallback processes exist, how quickly the business can operate without its primary AI tools, what supplier concentration exists, and what incident-response procedures are in place. These are not purely technical questions. They are business-continuity and governance questions.

IP, Contracts & People

Who Owns the AI?

The IP questions for an AI-enabled business include: who owns the software being used, who has rights to the underlying model, who owns or may use the outputs, who controls the training data, and who owns the customer relationship and associated data. The answers depend upon law and contracts — and are not always obvious.

Common arrangements include: proprietary software developed in-house, licensed models accessed via API, SaaS platforms, open-source models with varying licence terms, and AI-assisted outputs created by employees or contractors. Each arrangement has different IP implications. These should be understood before the business relies on the technology commercially.

Who owns the software? Who has rights to the model? Who owns or may use the output? Who controls the data?

AI-Generated Content and Intellectual Property

AI systems can generate text, images, code, analysis, contracts and other content. The copyright and IP status of AI-generated content varies by jurisdiction and is an area of active legal development. Businesses should not assume that AI-generated content is automatically owned by the business, automatically protected by copyright, or free from third-party IP claims. These questions require legal advice in the relevant jurisdiction.

Practical considerations include: what content is generated by AI systems, whether that content is used commercially, what the terms of the AI provider's licence permit, and whether any training data used to generate the content raises IP concerns.

Contracts, Liability and AI Suppliers

AI supplier contracts may require review of: permitted use of the system, confidentiality and data-use provisions, IP ownership of inputs and outputs, warranties and liability limitations, security and data-protection obligations, service levels and availability, termination and data portability, and regulatory support obligations. These are issues to identify and understand — not a substitute for legal advice.

Where AI systems make or influence material decisions — about customers, pricing, credit, employment or compliance — the business should understand its liability position if those decisions are wrong. Supplier liability limitations may not protect the business from its own regulatory or contractual obligations.

Employees, Contractors and Automation

AI can change workforce composition. The relevant structural questions are: where do key humans work, which entity employs them, what are the IP and confidentiality arrangements, how is management and control exercised, and what are the PE and payroll implications where relevant.

AI may reduce headcount. It does not remove the importance of where key people work.

A business with employees or contractors working across four countries may need to consider employment, payroll, tax, permanent-establishment and regulatory implications in each relevant jurisdiction. AI may change the functions those people perform, but it does not remove the need to consider where key people work and what legal or tax consequences may follow.

Regulation & Jurisdiction

Cross-Border AI Operations

A company incorporated in Country A, managed in Country B, with customers in Countries C, D and E, using a model provider in Country F and cloud infrastructure across multiple regions, is not unusual for an AI-enabled business. Each of those connections can have legal, regulatory, tax and data-protection implications.

AI can make a business more borderless operationally. Law and regulation remain jurisdictional.

Potential issues can include tax or permanent-establishment questions arising from the business's activities, personnel, agents or other relevant presence in a jurisdiction, together with data-protection, consumer, sector-specific, AI-regulatory, contractual and IP considerations where applicable. Remote customer access or digital sales alone should not be treated as automatically creating a permanent establishment; the analysis depends upon the applicable domestic law, treaty and facts.

The EU AI Act in 2026

The EU AI Act entered into force in August 2024. The AI Act applies progressively. Article 50 transparency obligations apply from 2 August 2026, subject to applicable transitional provisions. Enforcement responsibilities are allocated between national competent authorities and EU-level bodies according to the relevant provisions of the Act. The Commission's enforcement powers concerning applicable GPAI-provider obligations also apply from 2 August 2026. GPAI provider obligations began applying from 2 August 2025. Some high-risk-system obligations have later application dates.

The EU AI Act is risk-based. The question is not simply “do you use AI?” — it is “what AI do you provide or deploy, for what purpose, and which obligations apply?”

The Act distinguishes between providers, deployers and GPAI providers. Obligations differ by role and risk classification. Businesses with EU customers or operations should obtain specialist advice on their specific position.

The UK and Regulatory Divergence

As at 8 September 2026, the United Kingdom continues to rely substantially upon a context-specific and regulator-led approach, with existing regulators applying legal and regulatory frameworks within their respective remits. AI-specific statutory provisions can also arise in particular areas, and the framework continues to evolve. The UK approach should therefore not be described simply as “unregulated” or as equivalent to the EU AI Act. The applicable position depends upon the activity, sector and legislation concerned. The current UK legal and policy position should be verified from current GOV.UK and DSIT sources immediately before reliance.

International AI businesses should not assume that compliance in one market automatically satisfies another.

The UK and EU approaches differ in structure, scope and enforcement. A business that is compliant with the EU AI Act is not automatically compliant with UK requirements, and vice versa. The applicable position in each jurisdiction must be assessed separately.

Other International Regulatory Approaches

Other jurisdictions are developing their own AI regulatory frameworks. In the United States, AI governance involves a combination of federal executive policy, existing federal laws and regulators, state-level measures and ongoing legislative activity. Federal AI policy has changed materially in recent years and should be verified from current authoritative sources before reliance. China has introduced specific AI regulations including requirements for generative AI providers. Singapore, Canada, Japan and other jurisdictions have published AI governance frameworks or guidelines. The regulatory landscape is evolving rapidly.

International AI businesses operating across multiple jurisdictions should not assume that any single framework applies universally. The applicable regulatory position in each market must be verified from current authoritative sources.

Does AI Change Jurisdiction Selection?

AI adds new factors to the jurisdiction-selection analysis. In addition to the established factors — tax, banking, regulation, substance, operating cost, treaties, investor requirements and business geography — AI-enabled businesses may also need to consider: the applicable AI regulatory framework, data-protection and privacy law, talent availability for AI roles, cloud and digital infrastructure, IP protection, sector-specific AI regulation, and the AI investment and technology ecosystem.

The best jurisdiction for an AI business is not necessarily the jurisdiction with the most AI companies. It is the jurisdiction that fits the actual operating model.

These factors do not replace the established analysis. They add to it. A jurisdiction that is attractive for AI regulation but has poor banking infrastructure, limited treaty access or inadequate substance requirements may not be the right choice for a particular business. The analysis remains holistic.

AI and International Expansion

AI can change the economics of international expansion. A business that previously needed a local team to enter a new market may now be able to serve customers in that market through automated systems, with a smaller local presence or none at all. This changes the branch-versus-subsidiary analysis, the substance analysis and the PE analysis.

But it does not remove the need for analysis. A business serving customers in a new market through automated systems may still need to consider whether its wider activities, personnel, agents, infrastructure or other relevant presence create tax, permanent-establishment, data-protection, consumer, regulatory or licensing consequences. Remote sales or customer access alone should not be treated as automatically creating a permanent establishment.

AI can change the economics of international expansion. It does not remove the legal and regulatory questions.

Practical Application

AI and the Small High-Revenue Company

Consider a hypothetical AI-enabled business: £5 million annual turnover, customers in 30 countries, four employees, cloud infrastructure, automated customer support, AI-assisted administration, automated invoicing and reconciliation, and outsourced specialist functions. This is an illustration, not a recommendation.

This business is not small. It is lean. The distinction matters. A lean business with genuine functions, real management, appropriate technology, documented processes and clear commercial rationale may have genuine substance. Conversely, nominal staffing, unused premises or activity created primarily for appearance should not be assumed to satisfy applicable substance requirements merely because headcount exists.

Small team does not automatically mean small business.

The questions asked by banks, regulators and tax authorities remain: who owns it, who controls it, what does it do, where does it operate, where are decisions made, where does money come from and go, and why does it exist? AI changes the answers to some of these questions. It does not remove the questions.

Explaining an AI Business to a Bank or Investor

A bank or investor examining an AI-enabled business may ask questions that a conventional business would not face. These can include: how does the business acquire customers without a sales team, who performs the service if there are few employees, which AI providers are used and what happens if they fail, who owns the IP and what is its value, how are decisions made and who is responsible for them, and how are automated systems controlled and audited.

These are legitimate questions. The business should have clear answers. A business that cannot explain its operating model to a bank or investor is in a weaker position than one that can — regardless of how sophisticated the technology is.

The more unusual the operating model, the more important a clear commercial narrative becomes.

The commercial narrative for an AI-enabled business should cover: what the business does, how AI enables it to do that, who the customers are, how revenue is generated, who owns and manages the business, where decisions are made, what the technology dependencies are, and how the business would operate if a critical system failed.

Common AI Structuring Errors

1. Treating AI as a technology issue only. AI has structural, legal, regulatory and governance consequences.
2. Assuming automation removes substance requirements. Substance depends on genuine functions, not headcount alone.
3. Allowing systems to act without clear authority limits. Every automated action should have a defined scope and escalation path.
4. Ignoring human accountability. Automation does not remove corporate or director responsibility.
5. Incorporating before considering AI and data regulation. Regulatory obligations should be assessed during structure design.
6. Ignoring supplier concentration. Dependence on a single AI provider or cloud platform is a risk.
7. Failing to understand IP and data rights. Who owns the software, model, output and data matters commercially.
8. Treating AI-generated evidence as automatically reliable. AI-generated documents require the same scrutiny as any other evidence.
9. Assuming a small workforce needs no explanation. Unusual revenue-to-headcount ratios require a clear commercial narrative.
10. Ignoring where key people still work and manage. AI may reduce headcount. It does not remove the structural significance of where key people are.
11. Assuming compliance in one jurisdiction works everywhere. AI regulation is diverging. Each market must be assessed separately.
12. Failing to review the structure as technology changes. The AI system used today may not be the system used in three years.

The Coutts AI-Enabled Business Test

This is a Coutts planning framework. It is not a universal statutory test.

1. Business Model — What does AI actually do in this business?
2. Human Control — Who remains responsible for decisions and outcomes?
3. Authority — What may AI initiate or approve without human review?
4. Substance — What genuine functions exist and where?
5. Management — Where are strategic decisions actually made?
6. Data — What data is used, stored and transferred, and where?
7. IP — Who owns or controls the software, model rights and outputs?
8. Banking — Can the business explain its economics and transaction flows?
9. Regulation — Which AI, sector and data rules apply in each market?
10. Resilience — What happens if a critical AI system or provider fails?
11. Security — How are systems, credentials and sensitive information protected?
12. Future — Can governance evolve as AI capability changes?

AI should be part of the structure review — not an afterthought.

Building for the Next Five Years

AI capability is changing rapidly. The models, tools and platforms used by businesses are likely to continue evolving materially over the coming years. A business that builds its structure around a specific AI system, provider or capability may need to restructure as technology evolves. A business that builds its structure around sound governance principles — clear authority, human accountability, explainable processes, appropriate data controls and resilient operations — is better positioned to adapt.

The AI system a business uses today may not be the system it uses in three years. The governance framework should survive the technology change.

Building for the future means designing governance frameworks that are technology-agnostic where possible — focused on what the system is authorised to do, who is responsible for outcomes, and how the business would operate if the system changed or failed. It means reviewing AI dependencies periodically, not only when problems arise. It means understanding the contractual terms that govern AI supplier relationships, including termination, data portability and transition provisions.

It also means staying informed about regulatory developments. AI regulatory frameworks are evolving rapidly across many major markets. A business that is compliant today may face new obligations as regulation develops. Periodic review of the regulatory position — not only at incorporation — is part of responsible governance.

Technology can scale faster than governance. Good structure helps them scale together.

Before You Implement AI Across an International Business

Before implementing AI across an international business, consider the following twenty questions:

1. What commercial problem is AI solving?
2. Which functions will it perform?
3. Which decisions remain human?
4. Who has authority to approve or override?
5. Which provider or model is used?
6. What data enters the system?
7. Where is data processed and stored?
8. What confidential or personal data is involved?
9. Who owns relevant IP and contractual rights?
10. What outputs can be used commercially?
11. What customer disclosures may be required?
12. What jurisdictions are affected?
13. Which AI, data and sector rules apply?
14. Does the operating model change the substance analysis?
15. Does it change where key functions occur?
16. Can the model be explained to a bank or investor?
17. What happens if the provider fails?
18. What cybersecurity controls are required?
19. What records and audit trail are appropriate?
20. When will the arrangement be reviewed?

Clear answers provide a stronger basis for professional analysis and implementation.