"The Odyssey of Regulating and Developing AI"
Last July witnessed the convergence of two events that, at first glance, appear to have nothing in common: the release of Christopher Nolan’s The Odyssey and the European Union’s decision to postpone the implementation of much of the AI Act until December 2027. With the delay announced in July, Europe’s push for trustworthy AI, launched back in 2017, will have spanned an entire decade—exactly as long as it took Odysseus to return to Ithaca following the Trojan War.
The EU will need that same amount of time to complete its own regulatory journey. And, just as in Homer’s epic, the voyage has been marked by detours and changes of course that no one could have foreseen when it all began. Yet the main lesson from this journey may not be the delay itself, but rather the realization that regulating AI alone is not enough to compete in the global AI race.
Europe embarked on this journey with a clear objective in mind: developing trustworthy AI. It began with ethical principles drafted by a panel of experts, followed by the 2020 White Paper, which sought to combine an ecosystem of trust with one of excellence. In 2021, the European Commission presented its proposal for the AI Act, focusing on banning the most dangerous uses of AI while regulating systems the use of which could significantly affect citizens.
The main lesson from this journey may not be the delay itself, but rather the realization that regulating AI alone is not enough to compete in the global AI race.
But just as a political agreement seemed within reach in late 2022, generative AI burst onto the scene. The co-legislators quickly realized that the regulatory framework they had designed was not equipped to navigate this new ocean. They therefore had to introduce requirements for general-purpose AI models, thus delaying the AI Act’s final adoption until August 2024.
The arrival in Ithaca was set for August 2, 2026, the date on which the obligations governing high-risk AI systems were due to take effect. However, as that deadline approached, it became clear that the European Commission’s AI Office would not have its interpretive guidance ready in time. At the same time, there were growing concerns that persistent regulatory uncertainty would widen the gap between Europe and the United States and China, which are already well ahead in the race.
The EU’s response has been the AI Digital Omnibus package, which postpones the application of much of the AI Act by 16 months. Its swift adoption sends a positive signal: European institutions are capable of responding quickly when circumstances demand it. However, it also lays bare the limits of that consensus. More precisely, the urgency of reaching an agreement left little room to address some of the concerns most frequently raised by businesses and developers, such as the risk of overly broad interpretations of the definition of an AI system or the criteria used to identify high-risk systems.
Like Penelope’s shroud, the delay buys time, but fails to solve the underlying problem. Regulatory uncertainty remains, along with the possibility that the AI Act’s effective scope could ultimately prove far broader than many stakeholders had anticipated.
In tandem with this, the EU has recognized that regulation alone is not enough. If Europe wants to compete in AI, it must also develop its own capabilities. In recent years, it has launched initiatives to mobilize investment, strengthen computing infrastructure, improve access to data, and develop AI talent. The latest is the proposed Cloud and AI Development Act (CADA), unveiled in June, which aims to promote European infrastructure, coordinate investment, and strengthen European control over critical public services based on cloud computing and AI.
Regulatory uncertainty remains, along with the possibility that the AI Act’s effective scope could ultimately prove far broader than many stakeholders had anticipated.
Meanwhile, AI continues to reshape the course of the journey. The most advanced models have raised concerns about their potential to facilitate cyberattacks or the exploitation of software vulnerabilities. In response, on July 7 the European Commission presented an action plan to strengthen AI-related cybersecurity. This time, the concern is shared by other countries, including the United States, which in June issued an executive order requiring certain AI models to be evaluated before deployment. Even the country that has traditionally been the most reluctant to intervene is beginning to change course.
The great unknown is no longer whether Europe will eventually reach Ithaca. The real question is what it will find when it gets there. Because the true challenge is not simply completing the regulatory journey, but ensuring that, while Europe was sailing toward a framework for trustworthy AI, the rest of the world had not already set sail on the next voyage.