Skip to main content
Regulatory Council
The state of ai impact assessment
Category: Regulatory Obligations Management

Applicable Law

Also known as: Governing Law, Proper Law, Choice of Law
Simply put

Applicable law refers to the specific laws, regulations, and legal frameworks that govern a particular situation, contract, or dispute. In different contexts it may also be called governing law, proper law, or the choice of law. Which body of law applies can depend on the circumstances, such as the type of matter, the parties involved, and the jurisdiction, and determining it can be a complex exercise.

Formal definition

Applicable law denotes the specific laws, regulations, and legal frameworks that govern or apply to a given situation, contract, relationship, or proceeding. Depending on the circumstances, the term is used interchangeably with governing law, proper law, or the choice of law, though these usages can carry distinct connotations in particular contexts. In dispute resolution and arbitration, determining the applicable law is often a discrete and complex analytical step that a tribunal or court must resolve, and it may differ from the law governing procedure or the merits. The term can also carry a statutory meaning within specific instruments; for example, one U.S. federal definition frames 'applicable law' as any law of general applicability under which a federal department or agency has jurisdiction, illustrating that the precise scope is instrument- and jurisdiction-dependent. Because applicability turns on jurisdiction, subject matter, and the parties' arrangements, the exact law that governs should be confirmed against the relevant primary sources, and questions of legal interpretation typically require professional legal advice.

Why it matters

Determining which body of law governs a situation, contract, or dispute is a foundational step in compliance and legal risk management. Because applicability can turn on the type of matter, the parties involved, and the jurisdiction, an organization that misidentifies the governing law may find its contractual protections weakened, its compliance obligations misjudged, or its position in a dispute undermined. What appears to be a settled arrangement can become contested when parties operate across borders or when a matter touches multiple legal regimes.

The stakes are especially visible in dispute resolution and arbitration, where determining the applicable law is a discrete and often complex analytical step that a tribunal or court must resolve. The law governing the substance of a dispute may differ from the law governing procedure, and getting this analysis wrong can shape the outcome of a proceeding before the merits are even reached. For compliance and legal teams, clarity on applicable law affects how contracts are drafted, how risk is allocated, and how confidently an organization can predict how its obligations will be interpreted.

Because the precise scope of "applicable law" is instrument- and jurisdiction-dependent, and can even carry a specific statutory meaning within particular legal instruments, treating it as a settled or uniform concept is itself a source of risk. Questions of applicability frequently require professional legal advice, and organizations should confirm the governing law against relevant primary sources rather than assuming a default.

Who it's relevant to

General Counsel and Legal Teams
Legal departments rely on a clear determination of applicable law when drafting contracts, allocating risk through governing law clauses, and advising the business on how obligations will be interpreted. Because questions of applicability often involve complex legal interpretation, these teams frequently coordinate the professional advice needed to confirm the governing law for a given matter.
Compliance Officers
Compliance professionals need to know which laws, regulations, and legal frameworks govern a particular situation before they can assess adherence obligations. Since applicability varies by jurisdiction, subject matter, and the parties involved, identifying the applicable law is a prerequisite to mapping and monitoring compliance requirements accurately.
Dispute Resolution and Arbitration Practitioners
For those involved in litigation or arbitration, determining the applicable law is a discrete and complex step that a tribunal or court must resolve, and it may differ from the law governing procedure or the merits. Getting this analysis right can shape the trajectory of a proceeding.
Risk Managers
Risk professionals benefit from understanding applicable law because uncertainty over which legal framework governs a contract or relationship is itself a source of legal and contractual risk. Confirming the governing law against primary sources helps reduce the exposure that arises when applicability is assumed rather than verified.

Inside Applicable Law

Statutes and Legislation
Primary laws enacted by legislative bodies that bind an organization within a given jurisdiction. The specific statutes that qualify as applicable typically depend on where the organization operates, incorporates, or does business.
Regulations and Subordinate Rules
Rules issued by regulatory authorities or agencies under delegated statutory authority. These often provide the operational detail that gives effect to broader legislation, and their scope varies by sector and regulator.
Jurisdictional Scope
The determination of which legal regimes apply based on factors such as geographic location, place of incorporation, markets served, and the nature of the activity. A single organization may be subject to multiple, sometimes overlapping, legal regimes.
Binding Obligations vs. Guidance
The distinction between legally enforceable requirements and non-binding regulatory guidance, industry codes, or leading practice. Applicable law, strictly construed, refers to obligations that carry legal force, though guidance often informs interpretation.
Contractual and Cross-Border Elements
Legal requirements that may arise from contractual commitments or from the extraterritorial reach of certain laws, where obligations can extend beyond an organization's primary jurisdiction depending on the activity and parties involved.
Relationship to Compliance Obligations
Applicable law forms a core input to the compliance function, which concerns adherence to external laws, regulations, and internal policies. Identifying applicable law is typically a prerequisite to defining an organization's compliance obligations.

Common questions

Answers to the questions practitioners most commonly ask about Applicable Law.

Does 'applicable law' mean only the laws of the jurisdiction where an organization is headquartered?
No. Applicable law is not limited to the jurisdiction of an organization's headquarters or place of incorporation. Depending on the nature of an activity, applicable law may include the laws of jurisdictions where an organization operates, where its customers or data subjects are located, or where a transaction has effect. Many regulatory regimes assert extraterritorial reach in defined circumstances, so the set of laws that apply is typically determined by the specific activity, parties, and connecting factors rather than by a single 'home' jurisdiction. Determining which laws apply to a given situation is often a matter of legal interpretation that warrants qualified professional advice.
Is 'applicable law' the same thing as an organization's internal policies and compliance obligations?
Not exactly. Applicable law typically refers to binding external legal obligations, such as statutes, regulations, and, in some jurisdictions, binding case law and enforceable regulatory guidance. Internal policies are self-imposed requirements an organization adopts to direct its own conduct. While compliance programs commonly address both, and internal policies are frequently designed to implement or exceed legal requirements, the two are distinct: internal policies are not themselves 'applicable law,' and adherence to internal policy does not necessarily establish compliance with external legal obligations. The precise boundary can be context-dependent and may vary by jurisdiction and sector.
How can an organization identify which laws are applicable to its activities?
Identification typically begins with mapping the organization's activities, products, services, geographic footprint, customer and counterparty locations, and data flows, then relating these to the legal regimes that may govern each. Many organizations maintain a legal and regulatory inventory or 'obligations register' that is periodically reviewed. Inputs often include legal counsel, subject-matter specialists, industry associations, and regulatory sources. Because applicability can turn on connecting factors and on evolving statutory and regulatory language, this exercise is generally treated as ongoing rather than one-time, and complex or contested questions of applicability commonly require qualified legal advice.
How should organizations keep track of changes in applicable law over time?
Because legal and regulatory requirements change, many organizations establish a regulatory change management process to monitor, assess, and act on developments. This often includes assigning ownership for tracking relevant sources, screening for changes across applicable jurisdictions, assessing the impact of changes on activities and controls, and updating policies, procedures, and the obligations inventory accordingly. The specific approach varies by organization size, sector, and jurisdictional exposure, and the effectiveness of such processes generally depends on clear accountability and reliable sources. Timelines and effective dates for specific changes should be verified against the primary legal source.
Where does responsibility for interpreting applicable law typically sit within an organization?
Responsibilities are frequently distributed across roles. In many organizations, legal counsel or the general counsel function provides interpretation of legal requirements, while compliance functions translate obligations into policies, procedures, and controls, and business units apply them operationally. Governance bodies, such as the board or designated committees, often hold oversight responsibilities. This allocation is commonly described using models such as 'three lines' arrangements, though structures vary by organization. Definitive interpretation of legal obligations, particularly where they are ambiguous or contested, generally falls to qualified legal professionals rather than being resolved solely within operational functions.
How does applicable law relate to the design of controls in a compliance program?
Applicable law commonly serves as a source of the obligations that a control environment is designed to address. In many programs, identified legal requirements are mapped to policies, procedures, and specific controls intended to promote adherence and to provide evidence of it. It is important to distinguish the obligation itself from the controls that support compliance with it: a control is a measure intended to modify risk, and no control can be said to guarantee compliance or eliminate the risk of non-compliance. The design and calibration of controls typically reflect the nature of the obligation, the associated risk, and the organization's risk appetite and tolerance, and applicability of specific requirements varies by jurisdiction and sector.

Common misconceptions

Applicable law is a single, fixed list that applies uniformly to all organizations.
The body of applicable law is context-dependent and typically varies by jurisdiction, sector, activity, and organizational characteristics. It also evolves over time as laws are amended, introduced, or repealed, so it requires ongoing monitoring rather than a one-time determination.
Regulatory guidance and industry codes carry the same legal weight as applicable law.
There is an important distinction between binding legal obligations and voluntary standards, guidance, or leading practice. While guidance may inform how obligations are met and can influence regulatory expectations, it does not generally have the same enforceable status as statutes and regulations unless incorporated by reference into binding rules.
Applicable law is limited to the laws of the country in which an organization is headquartered.
Depending on the activity, markets served, and the extraterritorial reach of certain laws, an organization may be subject to multiple legal regimes simultaneously. Determining which laws apply in cross-border situations often involves legal interpretation that falls outside a general definition and may require professional advice.

Best practices

Maintain a documented and regularly reviewed inventory of applicable laws and regulations mapped to the organization's jurisdictions, activities, and business lines.
Distinguish clearly within your compliance framework between binding legal obligations and non-binding guidance or leading practice, so that resourcing and controls reflect legal enforceability.
Establish a monitoring process to track legal and regulatory changes, since applicability evolves and framework or statutory language may be amended over time.
Assess cross-border and extraterritorial exposure where the organization operates in or serves multiple jurisdictions, and confirm which regimes apply rather than assuming a single home-country standard.
Engage qualified legal counsel for questions of legal interpretation, jurisdictional scope, or contested applicability that fall outside the scope of internal compliance determinations.
Verify specific statutory references, effective dates, and requirements against primary sources before relying on them in policies, disclosures, or controls.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide