EU AI Act: rules, risks, and the innovation question
By Ioanna Lykiardopoulou
In 2024, the European Union adopted the world’s first comprehensive legal framework for artificial intelligence. Known as the EU AI Act, the landmark law has marked a pivotal moment in the global conversation around how advanced AI systems should be governed, by whom, and under what conditions.
At a time when AI capabilities are advancing rapidly, the goal of the AI Act, according to the European Commission, is to ensure the development of responsible and trustworthy AI, while supporting innovation. For developers and companies building AI systems in or for the EU market, the implications are wide-ranging — and in some cases, still unclear, raising questions about feasibility, unintended consequences, and the cost of compliance in a fast-moving field.
This article explores the architecture of the AI Act, its intended impact, the friction it creates in implementation, and the broader debate it has sparked, drawing on conversations with four experts across business, law, and policy:
Jeannette Gorzala, CEO and founder of AI ACT NOW, Vice Chair at the AI Board of the Austrian Government, and Member of the GPAI Working Groups of the EU AI Office
Michel van Leeuwen, Director of AI at the Dutch Ministry of Justice and Security
Monika Tomczak-Górlikowska, Chief Privacy Officer at Prosus
Nils Beers, CEO at KickstartAI, co-founder and former CEO of TechLeap
Understanding the AI Act’s principles
Before the Act, the EU relied on voluntary guidelines to encourage responsible and trustworthy AI development. But as Jeannette Gorzala notes, many companies ignored them, resulting in severe harm.
“This is the first reason why we need the AI Act. To establish a minimum set of safety standards for AI development.” The second reason, she adds, is to eliminate legal uncertainty and prevent market fragmentation with the introduction of a single, unified AI rulebook .
Van Leeuwen, Director of AI at the Ministry of Justice and Security, shares a similar perspective. “The core of the AI act is making sure that we can be innovative whilst getting all these precautionary measures in place and adhering to our values and human rights, if there are risks attached to use cases. That's also the core of the thinking in the Netherlands."
The AI Act applies a horizontal, risk-based approach covering all AI systems being developed, provided, or used in the EU market. It defines four levels of risk, each with its own corresponding rules. Obligations increase in proportion to the risk level. The Act also includes a special set of rules for General Purpose AI (GPAI) models, which will come into force on August 2, 2025.
“I think we need to be clear that the maximum governance scope of the Act only impacts about 10 to 15% of AI use cases in Europe — those that fall under the high-risk category,” Gorzala says. She adds that all other use cases are minimally impacted, essentially subject to transparency requirements. For this reason, Gorzala advises companies to identify their position within the Act’s categories and start creating an AI roadmap.
From Van Leeuwen’s perspective, the EU’s tiered risk-based approach is a good way to look at artificial intelligence. “Not all types of AI are equally harmful or supportive,” he explains. But he acknowledges that this approach has also drawn criticism. “We made a law on an AI that’s not really here yet in all its fullest and final forms.”
Implementation challenges on the ground
Concerns over ambiguity and complexity
A major concern voiced by many in the European tech sector is the regulation’s ambiguity.
The core of the risk categories is clear, according to Tomczak-Górlikowska, Chief Privacy Officer at Prosus. “But each of those categories contains a high number of descriptive elements that are subject to interpretation.” This makes it challenging for companies to assess whether they fall into the high-risk territory, which comes with the strictest obligations. Prosus, for instance, still doesn't have full clarity on which risk categories its various AI activities fall under.
Another source of complexity stems from how the law distinguishes between high-risk AI systems and GPAI models. “They’ve been treated separately, but in practice, things can quickly morph and the roles aren’t clearly cut,” Tomczak-Górlikowska says.
This means that companies need a constant monitoring and governance mechanism in place to ensure they’re still operating within your intended role, and to catch whether their business model has unintentionally shifted. To navigate the Act, she adds, companies need AI skills resources, risk management resources, as well as legal support.
For Van Leeuwen, who leads the implementation of the AI Act across the Ministry of Justice and Security, one of the challenging parts is deciding whether something constitutes AI or not based on the law’s definitions.
The Act includes some “open norms", he says, which he considers a positive element, as they enable the regulation to remain future-proof and adaptable to emerging technologies “But the flip side is that for the people who are making AI, it's not 100% clear in all of the situations how to make sure that you comply with this regulation.”
Multiple regulations at play
Adding to the challenges, Tomczak-Górlikowska points to the difficulty of navigating multiple regulations. “We have a number of laws in the digital space. They share similarities, but they also have their own twists and quirks. And the ability to simultaneously implement those at scale creates complexity.”
Nils Beers, CEO at KickstartAI, echoes this concern, hinting at the broader economic impact. “We have a large amount of rules and regulations, from the GDPR, to the DSA, the DMA, and now, the AI Act.”
While he acknowledges that the intention behind these laws is to uphold European values and safety, he warns that the outcome often tells a different story. “American companies get bigger, while European companies get smaller.”
Potential impact on innovation and competitiveness
According to Jeannette Gorzala, framing the AI Act as a trade-off between regulation and innovation is misleading. “I actually very much oppose this regulation-versus-innovation axis,” she says. “What we want is safe innovation — and for that, we need minimum safety standards.”
In her view, the AI act won’t stifle innovation, especially as the vast majority of AI use cases in the EU fall outside of the law’s scope. She also points to the Act’s pro-innovation measures. “It mandates that every member state must implement a regulatory AI sandbox, a space specifically designed to help innovators and entrepreneurs develop and test their AI applications.”
Tomczak-Górlikowska sees the sandboxes as a helpful mechanism for supporting innovation. Still, she cautions that they’re “only going to cover a subset of innovative solutions” and shouldn’t be seen as a fix for the broader tech ecosystem
One risk she highlights is that startups — especially those without the resources to manage compliance — may adapt their business models not to scale, but to avoid falling into the high-risk category. Similarly, the rules on GPAI models within the systemic risk group may also push companies away from cutting-edge work.
Beers illustrates how limiting that dynamic could be. “Imagine that you’re a small startup that can’t afford a legal team,” he says. “You will stop your development at least 40% before what is technically possible to make sure that you don’t fall into the high-risk area, which calls for hefty fines.”
This, according to Beers, creates a competitive disadvantage. Not only can big American or Chinese companies absorb any fines more easily, but they can also move faster and establish market dominance by being less bound by rules.
For investors weighing risk and return, Europe will also become less attractive, he adds. “Why would you invest in a company that’s ten times more likely to be regulated?”
“In theory, we’re trying to create responsible AI companies,” Beers says. “But in practice, we might end up making it harder for such companies to succeed, simply because they have to comply with a much higher standard compared to their American or Chinese counterparts.”
This, he argues, has wider consequences: Europe risks losing both its market and its sovereignty in the AI era.
Van Leeuwen acknowledges that regulation in general “always has some kind of decelerating effect.”
“There is a cost to regulatory compliance,” he says, “but if we agree that artificial intelligence will be one of the major drivers of societal change in the coming decades, it's impossible to imagine a reality where it won't be regulated.”
Call for support and open dialogue
Earlier in July, Prosus — alongside major European (and Dutch) companies including ASML, Philips, Cradle, and Mistral, led by the EU AI Champions initiative — signed an open letter, calling the Commission for a two-year delay of the Act.
“We welcomed the call from the European Commission to provide our views on simplification of the EU AI Act and other digital laws — and we responded with concrete proposals,” Tomczak-Górlikowska explains.
“We signed the open letter not because we want the Act to go away for a while, but because we thought that a pause is a beneficial moment to assess some opportunities, simplify some of the requirements, and have a refreshed version aligned with the novel character of the technology and the advancements organizations have made in AI governance.”
The EU is expected to introduce its Digital Omnibus Package and Digital Fitness Check (aimed at streamlining and simplifying multiple digital laws) in the second half of 2025.
Beyond simplifying the AI Act’s requirements, Beers is also calling for greater support from national governments and the EU to help companies navigate the regulation, provide clear guidance, and offer financial assistance.
He argues that innovation-friendly regulation should be agile and fast, focused less on rigid processes and more on preventing actual harm.
“If you look at the vast majority of algorithms being applied today, 95% to 99% of the AI we’re using is designed to improve people’s lives,” he says. “It's about healthcare, it's about efficiency, it's about greening the economy, it's about reducing poverty.”
And precisely because of AI’s huge benefit to society, Beers believes that European companies have a strong negotiating power and the right to ask for regulation changes. “Imagine what would happen if we had an AI strike tomorrow,” he says.
“If we paused AI, if we closed data centers even for a couple of days, the whole society would come to a stop. I think it would show that AI isn’t a concept — it’s a fundamental part of our life, and if we change the rules around it, we need to make sure that we’re actually making things better.”
From the Dutch government's perspective, preparations for the AI Act are already underway, led by the Ministry of Economic Affairs. This includes setting up key oversight mechanisms, such as the national market surveillance authority and a single national contact point. At the same time, the government is investing in awareness and education initiatives — both within ministries and across the broader industry.
“We’re doing a lot of work not only to educate people about the AI Act, but also facilitating organizations in compliance, and invest in ongoing deliberations with Brussels on specifying certain open elements in the regulation,” Van Leeuwen says.
💡 Want to learn more about the KickstartAI community and our mission to accelerate AI adoption in the Netherlands? Check out our website, listen to our podcast, or follow us on LinkedIn!
