Adequacy decision
A determination by a jurisdiction (notably the European Commission under the GDPR) that another country provides an essentially equivalent level of data protection, allowing personal data to flow there without additional safeguards. Adequacy decisions can be challenged and withdrawn, which is one reason a shipping decision that relies on one carries a review trigger.
Defined in 4 GAGE programs, which carry 5 distinct definitions of it. The wording above is taught in Certified AI Governance Professional (CAIGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
A determination by a jurisdiction (notably the European Commission under the GDPR) that another country provides an essentially equivalent level of data protection, allowing personal data to flow there without additional safeguards. Adequacy decisions can be challenged and withdrawn, which is one reason a shipping decision that relies on one carries a review trigger.
A finding by a data protection authority that another country's regime offers an equivalent standard of protection, letting personal data flow to it without a further transfer mechanism. Usually a unilateral act by the granting authority, reviewable and revocable by that authority, even where a second country makes a matching finding about the first at the same time.
A determination, most developed under EU data protection law, that a non-EU jurisdiction's protections are equivalent enough to allow smoother cross-border data or, potentially, AI-related flows; no AI-specific adequacy mechanism yet exists as of August 2026, making arguments built on this model forward-looking and clearly labeled as such.
A formal finding by the European Commission that a non-EU country's data protection regime provides a level of protection essentially equivalent to the EU's, permitting personal data to flow to that country without additional transfer safeguards. China holds no EU adequacy decision as of this build.
A decision by the European Commission that a third country, territory, sector or international organisation ensures an adequate level of protection, so that transfers there require no specific authorisation. Article 45. Reviewed periodically and capable of change.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- The cross-border decision: where your organization may ship its AI feature, defended with citations · The World's Rulebooks, Certified AI Governance Professional (CAIGP)
- Treaties and Global Pacts as Domestic Leverage: OECD, G7, and Beyond · Government and Policy Navigation, The AI Lobbyist: Certified AI Policy Strategist
- Conflicting Requirements · China, EU, US: The Comparative Playbook, Certified China AI Regulatory Professional (CCARP)
- Inventories, records of processing, and transfer governance · Privacy and Data Governance, Certified Enterprise Governance, Risk and Compliance Professional (CEGP)
- Global privacy law map · Privacy and Data Governance, Certified Enterprise Governance, Risk and Compliance Professional (CEGP)
Where it shows up at work
A definition is where Adequacy decision starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Compares the EU AI Act, NIST AI RMF, ISO/IEC 42001 and sector rules by intent and control objective, and says where they do not overlap.
One lesson on this page teach it as a primary outcome.
Identifies value conflicts in an AI use, asks who benefits and who bears risk, and turns principles into criteria a review can apply.
One lesson on this page teach it as a primary outcome.
Traces where data came from, what transformed it, who owns each hop and where it flows downstream, so a number can be defended.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- Senior AI Compliance Analystneeds it at depth
- AI Compliance Managerneeds it at depth · 2 open postings this week
- Security Compliance Managerneeds it at depth · 4 open postings this week
- Responsible AI Leadneeds it at depth · 7 open postings this week
- AI Compliance Specialistneeds working knowledge · 1 open posting this week
- Ethical AI Specialistneeds it at depth · 5 open postings this week
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: EU AI Act; NIST AI RMF; ISO/IEC 42001; OECD AI Principles.
One interview question about it
Map one control to the EU AI Act, NIST AI RMF and ISO/IEC 42001 at once, and tell me where the mapping breaks.
Asked of candidates for framework crosswalking without false equivalence. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Nonprofit program and grants oversight carries it as a claim to back up: Mission accountability and beneficiary protection are ethical reasoning in practice.
- A law degree (JD, LLB or LLM), no AI work yet carries it as a claim to back up: Turning a value into a test is what a legal standard is.
- Privacy and data protection carries it as work you can show: Data maps and records of processing are lineage by another name.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.