The correct answers are A, C, and D because multiple regulatory regimes apply based on jurisdiction, data use, and deceptive practices. The EU AI Act applies because the system is being developed and tested in cooperation with an EU-based university and involves behavioral influence, which may fall under prohibited or high-risk AI practices, especially where manipulation or deception is present. The General Data Protection Regulation applies due to the processing of personal data of EU-based participants, particularly given the misleading study protocol, which violates principles such as transparency and informed consent. The Federal Trade Commission Act applies to the US company because deceptive or unfair practices, such as misleading participants about the purpose of experiments, fall under FTC enforcement. The Digital Services Act and PCI standards are not relevant to this specific use case.