The EU AI Act Newsletter #100: The European Way

Welcome to the EU AI Act Newsletter, a brief biweekly newsletter by the Future of Life Institute providing you with up-to-date developments and analyses of the EU artificial intelligence law.

This is the 100th edition of the newsletter. To mark the occasion, I've opened an Ask Me Anything in the Substack chat – questions, reflections and predictions all welcome.

Building AI the European way: Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, reflects on the first year of the Commission’s AI Continent Action Plan, which was built around five pillars: infrastructure, data, skills, adoption and simplification. On the infrastructure side, 19 AI Factories have been deployed across European supercomputers, whilst the proposed AI Gigafactories concept has already attracted 76 expressions of interest spanning 16 Member States. Turning to adoption, €1 billion in funding calls has been mobilised for strategic sectors, alongside targeted initiatives such as AI-powered cancer and cardiovascular screening centres and a Grand Challenge competition to develop sovereign European AI models. Meanwhile, the AI Omnibus, delivered in November, seeks to adjust the the AI Act's timeline and address implementation challenges. Virkkunen frames these together as a distinctly European approach that manages risk whilst encouraging innovation. Finally, she announces a forthcoming tech sovereignty package focusing on data centre capacity and AI chip production.

Cambridge Commentary on EU General-Purpose AI Law: The Leverhulme Centre for the Future of Intelligence at the University of Cambridge and the Institute for Law & AI have launched the first scholarly commentary devoted exclusively to the GPAI model provisions of the AI Act. Given the regulatory uncertainties surrounding these models – particularly those posing systemic risk – the editors argue that rigorous legal analysis is especially consequential. Rather than advocating a single preferred interpretation, the Commentary maps the interpretive landscape for each provision, identifying where the law is clear, where ambiguity exists, and what the strongest arguments on each side look like. It launches with Chapter V, with further articles to follow on a rolling basis.

Reclaiming Europe’s AI narrative: Kleitia Zeqo, Principal Consultant at Technopolis Group, argues that Europe’s AI ecosystem is frequently underestimated, despite the continent hosting a substantial number of AI companies, the largest share of AI research players globally, and deep engineering talent in France, Germany and the United Kingdom. Against this backdrop, the AI Act serves not as a brake on innovation but as institutional infrastructure offering three structural advantages: first, a single regulatory framework across 27 Member States, in contrast to over 35 fragmented state-level AI-related acts in the US; second, a risk-based approach targeting only high-impact use cases whilst leaving most applications largely unregulated; and third, demonstrated adaptability through initiatives such as the multi-stakeholder Code of Practice for general-purpose AI models. Beyond competitiveness, Zeqo stresses the importance of addressing systemic and sociotechnical risks, arguing that effective governance ensures deployment remains controllable, accountable and socially sustainable.

European regulators sidelined on Anthropic model: Pieter Haeck and Sam Clark from POLITICO report that Anthropic has decided to limit the release of its latest model, Mythos, which it claims can surpass most humans at finding and exploiting cyber vulnerabilities. The company handpicked 12 US-headquartered tech firms, including Apple, Microsoft and Amazon, as its closest partners, while also granting access to the UK's AI Security Institute for testing. By contrast, POLITICO found that of eight European national cyber agencies contacted, only Germany's had entered into conversations with Anthropic, and none had been able to test the model. Several experts expressed concern: Yoshua Bengio called it "deeply concerning" that private companies rather than regulators decide how to handle such risks, whilst former MEP Marietje Schaake warned against models with far-reaching impact being governed privately.

Open joint letter on AI Office resourcing: A coalition of civil society organisations, industry representatives and individual experts has written to Executive Vice-President Henna Virkkunen calling for adequate resources and the removal of administrative bottlenecks for the EU AI Office. The letter draws a stark comparison with DSA enforcement, which covers around 26 designated services with €50 million in annual funding and 160 staff, whereas the AI Office Unit A3, responsible for overseeing GPAI models with systemic risk, is planned to reach only around 40 staff. The signatories call for €100 million annually for Unit A3 and a gradual increase to a minimum of 100 staff by 2030, alongside more flexible administrative conditions such as permanent contracts, higher salaries and remote-work allowances to attract top frontier AI talent. The letter frames adequate resourcing not only as essential for the health, safety and fundamental rights of EU citizens, but also as a strategic investment in European competitiveness and sovereignty.

Responding to criticisms of the Annex I merger: DIGITALEUROPE addresses what it describes as factual inaccuracies circulating among parts of the certification industry, civil society and the Commission over the proposed merger of Sections A and B of Annex I. Under the current structure, Section A products, such as machinery, medical devices and radio equipment, must comply with both the AI Act’s high-risk obligations and their existing sectoral frameworks in parallel, whereas Section B products face AI Act requirements only once sectoral law has been updated. The merger, adopted by Parliament on 26 March 2026, would bring all New Legislative Framework-covered products under the Section B approach. DIGITALEUROPE emphasises that this does not amount to deregulation but consolidates two overlapping compliance pathways, that all high-risk obligations remain intact, and that the Section B model already exists within the Act.

AI Omnibus timeline overview: Kai Zenner, Head of Office and Digital Policy Adviser to MEP Axel Voss, published an overview of the AI Omnibus legislative schedule. The trilogue negotiations are entering their final stretch, with EU policymakers racing to conclude before the AI Act’s high-risk obligations take effect on 2 August 2026. Following the Parliament’s plenary vote on 26 March, interinstitutional technical meetings have been taking place throughout April, with the second political trilogue planned for Tuesday 28 April. If an agreement is reached, the timeline foresees an IMCO/LIBE committee vote in May, a plenary vote in June, and publication in the Official Journal in July, just days before the August deadline.