IN 2020, BEFORE LLMS WERE A GLIMMER IN THE public’s eye, the European Union published a white paper announcing its intent to become the first economic powerhouse to comprehensively regulate AI. Six years and hundreds of pages later, it succeeded. But now, as AI innovation flourishes in the US, Gulf States, and Asia, many in Europe and beyond are wondering: was first-to-regulate-AI the right race to win?
One problem quickly emerged: AI is a far more difficult beast to tame than past iterations of the “Brussels Effect.” Where the GDPR set a global baseline for one risk domain (privacy), regulating AI meant tackling many competing evolving risks, from safety, accuracy, fairness, explainability, and agency to continuous change and evasion of human control.
Another enduring problem: AI is not – and never was – one thing. Years into drafting the AI Act, European regulators listed the definition of AI as a critical open issue. Up to the tail-end of negotiations, no one could agree on what they were regulating.
Adding to this was AI’s rate of change. The EU spent years drafting rules for what is now “old-fashioned” AI – single-purpose, deterministic, gatekept by IT teams. Midway through AI Act negotiations, generative AI arrived: multi-purpose (from cake-baking to code-breaking), probabilistic, and as accessible as speaking commands. Rather than remake the law, the EU shoehorned weighty new “GPAI” sections into the bill.
The result? A proposal exceeding 100 pages, yet rife with open questions. Days before the first major deadline, the EU issued over 100 pages of guidance on which practices were “prohibited.” With the next deadline came similarly copious guidance on whether a company’s AI is “high risk.” The stakes were global and high: the law was extraterritorial by design, and fines for the worst offenses reached a staggering 7% of worldwide annual revenue. All this sat within a broader web of EU laws – the Digital Decade – reflecting over 700 pages of rules.
The EU had the world’s attention. But where did that lead?
The Act promised benefits to open-source models, but the largest open-source provider held back EU releases in 2024 and 2025 for fear of regulatory risk. A survey of over 1,000 tech firms found nearly 60% of EU and UK developers reported launch delays and one-third stripped features to comply. Sixty percent reported delayed access to frontier AI models, the foundation of both next-gen start-ups and future corporate productivity.
Despite the guidance issued, uncertainty was the norm. The Commission estimated only 5% to 15% of AI systems should qualify as high risk; one study found nearly one-third of EU AI start-ups thought their AI was subject to those higher burdens. Forty percent weren’t sure where they landed at all. Even European market authorities wondered aloud whether parts of the Digital Decade had gone too far, too fast.
What’s more, the world proved bad at predicting AI’s risks. The Act cited chatbots operating outside high-risk areas as paradigmatically lower risk; those now sit at the center of the storm in the US and beyond, from IP litigation and workforce disruption to claims of psychosis and harmful outputs. What if the AI Act was a massive net that tangled up innovation while harm slithered through?
Counternarratives exist: the European think tank Bruegel argued against blaming digital regulation, citing a decline in European R&D that was decades in the making. But in a challenged R&D environment, is piling on new regulation the right move? Ultimately, the EU itself reported a tangible economic burden on AI start-ups under the law.
In May 2026, the European Council and Parliament provisionally agreed to revisions extending high-risk timelines and better aligning the Act with sectoral laws. But the overhang remains. Just recently, OpenEvidence, the medical AI hailed as a “gamechanger” in US healthcare, withdrew from the EU and UK, citing regulatory risk.
In the United States, the opposite problem has emerged: stalled federal efforts have left a patchwork of state laws and litigation. But downstream deployment risk doesn’t halt innovation the way upfront regulatory capture does.
No one doubts that well-targeted regulation can drive AI innovation. If AI is inevitable, we need smart, targeted rules to keep it on a productive path, away from competition-driven mutually assured destruction.
Still, two things are clear: regulation must be lighter on procedure and more adaptive to a technology and harms that refuse to sit still, lest regulators spend their tenure trying to catch falling knives. And no region can go it alone without inviting comparison with easier places to invest and deploy. On an issue this large, heavy local regulation is like squeezing a balloon: press it flat in one place and you will watch it swell in another.
ABOUT THE AUTHORS
DR. DANNY TOBEY is Global Chair of AI at DLA Piper and Senior Consultant to the United Nations’ Office of Counter-Terrorism on Parliamentary Engagement on AI.
JOHN J. GILLULY III is Global Vice-Chair, Global Head of Transactions at DLA Piper.
