The framework for regulation of these sorts of systems will almost certainly come down to “possession of data”.

You can build/host things anywhere, but something centered around “if you generate profits in the USA, and hold the data of Americans, these requirements exist for your system” makes sense. In particular, liability needs to rest somewhere, such that someone gives enough of a shit to do things right.

A civil engineering firm could outsource the design of a bridge anywhere, but in the end, somebody’s neck is on the line if it fails.