Source: Agenda Digitale

The piece contrasts two European regulatory models for technology governance, highlighting that GDPR embodies a mature, principle-based framework grounded in accountability, while the AI Act relies more on technical-organizational prescriptions tied to evolving AI technologies. It stresses that GDPR benefitted from decades of normative, jurisprudential and institutional development (including national laws from the 1970s and Directive 95/46/CE), which consolidated principles such as lawfulness, proportionality, transparency and accountability into an established compliance paradigm. By contrast, the AI Act is presented as a nascent regulatory project lacking an analogous layered heritage of jurisprudence and settled practice, aiming to steer technology to respect preexisting fundamental rights rather than to define a new right.

The article warns that anchoring regulation too closely to technical prescriptions carries a structural risk: the proximate tie to specific technological requirements can render rules quickly obsolete as AI systems evolve, potentially deterring innovation. It underscores a shift in regulatory grammar—from principle-driven rulemaking (where principle generates the application rule) to rulemaking where technical prescriptions become the primary vehicle for principles—affecting how organizations perceive compliance, the role of control functions, and the implementation of risk-assessment tools (noting the transition from DPIA to FRIA). The discussion also highlights the conceptual instability of the regulatory object—“artificial intelligence”—and the difficulty of a fixed definition in face of heterogeneous, rapidly changing techniques.