Commentary. Europe’s latest phase of artificial-intelligence regulation presents a familiar political temptation: to mistake the passage of rules for the achievement of their purpose. The European Union is moving ahead with transparency obligations for general-purpose AI providers and expanding the European Commission’s supervisory role. That is a consequential step. It is also only the beginning.
Our view is straightforward: the EU should enforce meaningful safeguards, but resist the urge to measure success by the volume or complexity of compliance paperwork. Regulation should make AI systems more accountable to the public without making responsible innovation possible only for the largest companies.
The case for stronger oversight
The argument for transparency is not theoretical. AI systems are increasingly used to generate information, assist decisions and mediate access to services. Users need to know when content is machine-generated, while regulators and affected people need enough information to identify foreseeable risks. The EU’s new obligations reflect that reality and give the Commission a more direct role in supervising providers of general-purpose models. [Source]
That oversight can also address a genuine imbalance of power. Model developers possess technical knowledge, computing resources and proprietary data that governments, consumers and smaller businesses generally do not. Requiring documentation, risk assessment and cooperation with authorities can narrow that information gap. In principle, this is not anti-technology. It is a way to ensure that technology with broad social effects is not governed solely by the firms selling it.
Europe’s approach also reflects a broader international trend. Policymakers in Japan and China are advancing their own data and AI compliance frameworks, while the United Kingdom is developing measures involving police use of AI and medical technologies. [Source] The details differ, but the direction is clear: governments no longer regard advanced AI as an issue that can be left entirely to voluntary corporate commitments.
The costs of getting it wrong
Still, the strongest case for regulation does not justify every regulatory burden. Europe already faces concerns about technological dependence on US companies, whose firms dominate critical distribution channels such as operating systems, browsers and search engines. [Source] Adding layers of unclear or rapidly changing obligations could deepen that dependence if smaller European developers cannot afford legal, auditing and engineering teams comparable to those of global incumbents.
That concern deserves more than a dismissive answer. Compliance costs can be absorbed by large platforms, but they may stop universities, start-ups and public-interest developers from deploying useful systems. Rules that are technically sound but impossible to interpret consistently will reward scale rather than safety. They may also encourage companies to limit products in Europe while continuing to offer them elsewhere, leaving European users with less choice without necessarily making them safer.
Industry’s broader objection is that regulators may be trying to govern capabilities that remain difficult to define in advance. A model’s risks can vary according to its deployment, user population and surrounding safeguards. A general-purpose system used for drafting marketing copy is not the same as one connected to medical, financial or public-sector decisions. A proportionate framework should distinguish those contexts instead of treating every model as equally dangerous.
What responsible enforcement looks like
The answer is not regulatory retreat. It is disciplined implementation. The Commission should publish clear technical guidance, provide realistic transition periods and explain how it will prioritize inspections. Enforcement should focus first on demonstrable harms—deceptive content, serious privacy failures, unsafe high-impact uses and systematic evasion—rather than minor formal errors.
Authorities should also protect room for experimentation under controlled conditions. Sandboxes, accessible testing tools and support for small developers would make compliance a shared public infrastructure rather than a private tax on entry. Independent researchers need access to enough information to evaluate claims, while legitimate trade secrets and security-sensitive details should remain protected.
Critics are right that Europe cannot regulate its way to technological leadership. Supporters are right that leadership without public trust will not last. The choices are not “innovation or rules,” but vague rules that entrench incumbents versus clear rules that make accountability predictable.
The EU has made a defensible choice in demanding transparency from powerful AI providers. Now it must show equal seriousness about proportionality, technical competence and enforcement. If it succeeds, Europe can demonstrate that public oversight need not be an enemy of innovation. If it fails, the result will be the worst of both worlds: an elaborate rulebook that smaller builders cannot navigate and powerful companies can absorb.