user
Persons or entities that use technologies, including cross‑border users.
How the laws define this
Regulatory frameworks establish that a user is an individual or entity employing, deploying, operating, or interacting with a technology or artificial intelligence system in practice, subjecting them to operational controls, usage instructions, or oversight requirements. However, frameworks diverge sharply on whether the term applies to organizational deployers or individual consumers. Instruments such as the Draft Royal Decree on Business Operations Using Artificial Intelligence Systems, the National Artificial Intelligence Policy 2025, and the Code of Ethics in the Field of Artificial Intelligence treat businesses, government bodies, and organizations that deploy or operate systems as users. In contrast, Regulating artificial intelligence companion chatbots strictly limits users to natural persons interacting for personal use, explicitly excluding developers and operators. Meanwhile, the Generative AI Guidelines for the Public (SDAIA) uniquely includes individuals or organizations merely affected by system outputs, and the Malta Digital Innovation Authority (Amendment) Act, Act No. XIX of 2024 explicitly extends coverage to users outside its domestic jurisdiction.
Synthesised from the 10 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first. Showing 8 of the 10 instruments that define this term; all are listed under Definitions below.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Washington, United States | Regulating artificial intelligence companion chatbots | Awaiting Entry | Limits users to natural persons interacting with AI companion chatbots for personal use, explicitly excluding operators, developers, or their agents. |
| Malta | Malta Digital Innovation Authority (Amendment) Act, Act No. XIX of 2024 | In Force | Explicitly includes cross-border users beyond domestic ones, extending protections and authority oversight to relevant foreign jurisdictions. |
| France | Decree No. 2022-676 of 26 April 2022 - Authorising creation of the 'Service de garantie de l'identité numérique' (SGIN) electronic identification service | In Force | Restricts to natural persons holding a CNIe who voluntarily create, use, and manage electronic identification means via the SGIN application. |
| Spain | National AI Sandbox | In Force | Applies in the regulatory sandbox context, imposing responsibilities on users for operational deployment, oversight compliance, and monitoring cooperation. |
| Thailand | Draft Royal Decree on Business Operations Using Artificial Intelligence Systems | Draft | Confines to entities or persons deploying or operating AI systems in business operations or relying on outputs for decision-making or service delivery. |
| Russia | Code of Ethics in the Field of Artificial Intelligence | Adopted | Covers organisations or persons deploying, operating, or configuring AI systems, excluding developers, in a non-binding ethical code context. |
| Lithuania | National AI Strategy update / National AI Governance Forum | Adopted | Encompasses natural or legal persons using AI systems under their responsibility, in a non-binding national strategy and governance forum context. |
| Pakistan | National Artificial Intelligence Policy (National AI Policy) 2025 | Adopted | Broadens to actors including government departments, businesses, and individual operators using AI in real-world contexts, in a non-binding policy. |
What it triggers
- In the National AI Sandbox, users must follow oversight instructions, cooperate with monitoring, and meet reporting requirements.source
- Under the Malta Digital Innovation Authority (Amendment) Act, users trigger user-protection duties and accountability requirements for providers.source
- In the SGIN electronic identification service, users are afforded GDPR rights such as information, access, rectification, and limitation on their data.source
- In Washington's HB 2225, the law regulates operators with transparency disclosures and safeguards for minors interacting with AI companion chatbots.source
Definitions (10)
A defined class including individuals or entities that use recognised or registered technologies; the definition explicitly covers users both in Malta and, where relevant, in other jurisdictions, thereby extending certain protections and the Authority's interest beyond strictly domestic users. The term underpins user‑protection duties and accountability requirements in the Act.
An individual or organisation that interacts with, consumes or is affected by the outputs of a generative AI system, and who may require disclosures, explanations or redress when decisions or content affect their rights or safety.
An entity or person who deploys or operates an AI system in the course of business operations or who relies upon the system's outputs for decision‑making or service delivery, and who must follow usage instructions, report incidents, and cooperate with regulators as required.
The natural person who holds a CNIe and who voluntarily creates, uses, manages (including revocation and deletion) the electronic identification means via the application; users are afforded GDPR rights such as information, access, rectification and limitation in relation to their data processed by SGIN.
A natural or legal person who uses an AI system under their responsibility, expected to follow instructions for use, apply mitigation measures and comply with applicable obligations when deploying or operating the system.
Actors who deploy, operate, or otherwise use AI systems in real-world contexts — including government departments, businesses, and individual operators — and who are responsible for operational controls, oversight, and adherence to deployment requirements.
A natural or legal person that deploys, operates or uses an AI system in practice; in the sandbox context the user is responsible for operational deployment, following oversight instructions and cooperating with monitoring and reporting requirements.
A natural person who interacts with an AI companion chatbot for personal use, explicitly excluding operators, developers, or their agents, ensuring protections are for the general public.
A natural person who interacts with an AI companion chatbot for personal use who is not an operator, developer, or agent thereof.
Organisations or persons that deploy, operate, configure, or rely on AI systems in practice (excluding developers), who are expected to follow the Code's recommendations on transparency, labelling, risk mitigation and internal governance when using such systems.
Not to be confused with
End-user covers persons or organizations using or affected by an AI system, while most definitions here focus on deployers or operators excluding mere affected parties.
Questions and answers
Who counts as a user under Washington's AI companion chatbot law?
A natural person who interacts with an AI companion chatbot for personal use, excluding operators, developers, or their agents. The law targets protections for these users via operator obligations.
Does 'user' include cross-border individuals in Malta's law?
Yes, the definition explicitly covers users both in Malta and relevant other jurisdictions, underpinning extended user-protection duties.
What obligations apply to users in Spain's AI Sandbox?
Users who deploy or operate AI systems must follow oversight instructions, cooperate with monitoring, and meet reporting requirements in the sandbox.
Related Terms
provider of a regulated service
Entity operating one or more regulated services....
users
Actors who deploy or operate AI systems....
Operator (User)
Entity that deploys or operates an AI system in Austria....
End-user
Person or organization using or affected by an AI system....
Certificate
MDIA-issued attestation of an ITA's assessed attributes and permitted behaviours....