Regulating AI: What Europe Is Preparing

For a few months now, almost every business conversation I take part in ends up, sooner or later, at artificial intelligence. How we use it, what it costs, who it replaces. A question that comes up less often is just as important: what rules will there be? Because while we are testing ChatGPT in our companies, Brussels has spent two years writing a law that will say what you can and cannot do with AI in Europe. I have already written about how I use it in business and what GPT-4 means for jobs. Now it is the rules’ turn.

I am not a lawyer and I will not pretend to be one. I am an entrepreneur, I work with startups that build AI into their products, and I looked at what is coming through the eyes of someone who will, at some point, have to comply. Here is what I understood, in short, and what I think about it.

What the AI Act is, in plain language

In April 2021, the European Commission proposed a regulation on artificial intelligence, known as the AI Act. The core idea is simple and, honestly, smart: you do not regulate the technology itself, you regulate how it is used. An algorithm that recommends a film is not treated like one that decides whether you get a loan. The rules grow with the risk.

The proposal sorts AI applications into four categories:

• Unacceptable risk – practices banned outright, such as governments giving citizens a social score, along the lines of what we know from China.
• High risk – AI used in hiring, lending, education, critical infrastructure or law enforcement. This is where strict obligations apply: quality data, documentation, human oversight, assessments before launch.
• Limited risk – transparency obligations. If you are talking to a chatbot, you have to know you are talking to a chatbot.
• Minimal risk – the vast majority of applications: spam filters, product recommendations, games. No new obligations.

For most of us, the good news is that last category. If you use AI to write your newsletter or optimise your ads, not much is likely to change for you.

What changed after ChatGPT

The 2021 proposal was written in a world without ChatGPT. Then, at the end of 2022, the generative AI wave arrived, which I wrote about after my first weeks with ChatGPT, and lawmakers realised they were missing an entire chapter.

On 14 June 2023, the European Parliament adopted its negotiating position. On top of what was already in the text, it added rules for foundation models and generative AI: AI-generated content must be disclosed as such, models must be designed so they do not generate illegal content, and companies must publish summaries of the copyrighted data used for training. Parliament also called for a ban on real-time remote biometric identification in public spaces. The proposed fines can reach a percentage of global turnover, so these are not token amounts.

Now the so-called trilogue negotiations have started, between Parliament, the Council (the member states) and the Commission. The stated goal is a deal by the end of the year. The final text may look quite different, so everything I say here is a snapshot, not a conclusion.

Why I think we need rules

I wrote a long time ago about what a fair society means to an entrepreneur, and my view has not changed: a market works well only when the rules are clear and apply to everyone. AI is no exception.

Think of a hiring algorithm that, without anyone knowing, systematically filters out candidates of a certain age or from a certain neighbourhood. Of a scoring system that turns down someone for a loan and nobody can explain why. Of cameras that recognise the face of anyone walking down the street. Or of generated content so convincing that you can no longer tell manipulation from information. These are not movie plots, they are real risks, and a free society has the right to set limits.

And frankly, it is in our interest too, as entrepreneurs. People will use AI products only if they trust them. Good rules mean trust, and trust means customers.

But Europe must not regulate itself out of the game

This is the part that worries me. The biggest AI companies in the world are American and Chinese. Europe has excellent researchers and good startups, but it does not yet have a global champion. If the rules become so complicated that only a company with hundreds of lawyers can follow them, then the very giants we want to keep in check will be the only ones left standing.

The Sam Altman episode this spring was telling. In May, the head of OpenAI asked the US Senate to regulate AI. A few weeks later he said OpenAI might leave the EU if it could not comply with the new rules, and then walked that back. And in March and April, Italy temporarily blocked ChatGPT over data protection concerns. All of this shows how fragile the balance is: everyone wants rules, until the rules touch them.

The GDPR lesson

We have seen a similar film before. In 2018 I wrote a practical guide to GDPR for online stores. The principle was excellent: your data belongs to you. The result in practice was mixed. Big companies hired compliance teams and moved on. Small firms paid consultants, filled in paperwork and lived in fear of a fine. And all of us, as users, got cookie banners on every website, which we close without reading.

Meanwhile the market changed anyway for other reasons, as we saw when third-party cookies started going away. My conclusion: a law that is good in principle can become a burden in practice. I would not want the AI Act to give us a “cookie banner” for every chatbot.

What I would ask lawmakers for

If I had five minutes with the negotiators, I would ask for three things:

• Clarity. An entrepreneur should be able to work out alone, in a few minutes, which risk category their product falls into.
• Proportionate obligations. A five-person startup cannot face the same requirements as a global corporation. Regulatory sandboxes, guidance and free templates would do more than any fine.
• Stability. Technology changes every few months. The law should set solid principles, not be rewritten every time a new model appears.

What you can do right now

You do not have to wait for the final text to get ready. Make a list of the places where your company uses AI. Ask yourself whether any of them touch important decisions about people: hiring, money, access to services. Tell customers openly when they are talking to a bot or when a text is generated. And keep a human in the loop where it matters. These are common-sense steps that will probably become mandatory anyway.

In closing

I believe Europe has a real chance to show the world that you can have AI with both rules and innovation. But that takes balance, not fear. Rules should protect people, not drive entrepreneurs to other parts of the world.

How do you see it: do you need clearer rules to use AI in your business, or are you worried there will be too many?