Draghi calls for deep cuts to privacy rules and pause on 'high risk' AI Act

Mario Draghi has urged “radical” cuts to the EU’s General Data Protection Regulation (GDPR) and called for a pause on implementing parts of the AI Act in order to foster regional AI development. 

The Italian economist and former prime minister made the call for a “radical simplification” of the GDPR in a speech on the one-year anniversary of his landmark report on European competitiveness, delivered at a conference hosted by Commission President Ursula von der Leyen on Tuesday.

Draghi argued that the Commission’s simplification drive should also cover how the regulation is implemented by EU countries, which are responsible for enforcing the rules on companies established locally.

In broader remarks, he warned that Europe needs “new speed, scale and intensity” in the face of growing competition from China and the US, particularly in key tech sectors such as artificial intelligence. His speech pressed the Commission to deliver “results within months and not years.”

AI Gigafactories insufficient

In her own speech, delivered before Draghi’s, von der Leyen flagged the Commission’s efforts over the past year to amp up investment in AI technologies – highlighting the AI Gigafactories initiative to establish powerful training hubs.

She also pointed to existing plans for a digital simplification package, due to be presented by the end of the year.

However, Draghi urged greater ambition, saying that while AI is a key technology, it cannot be the sole focus for support. He stressed that AI depends on “at least four other technologies” – naming cloud, super computing, cybersecurity and connectivity as also vital for developing Europe’s AI ecosystem.

Draghi’s speech zeroed in on the role of data in enabling AI, noting that generative AI models require vast amounts of information to train. The Commission must tackle obstacles to accessing data, he said, accusing the GDPR of creating high levels of legal uncertainty for AI developers.

Since 2023, when Italy’s privacy watchdog launched a probe into OpenAI’s ChatGPT, regulators across the EU have opened a number of investigations into generative AI tools. Yet relatively few of these GDPR probes have concluded, as authorities wrestle with how to apply the bloc’s rules to cutting-edge technologies.

Digital simplification vs AI Act

On digital simplification, the Commission has so far proposed reducing GDPR record-keeping requirements for companies with fewer than 750 employees.

It has also been in talks with industry over recent months to discuss how digital laws should be applied, but has yet to present a clear set of next steps.

With the full shape of the Commission’s digital omnibus still unclear, Draghi let rip – saying the EU could be doing far more.

He also turned his fire on the AI Act itself, calling for the next stage of implementation to be “paused until we better understand the drawbacks” – a reference to the Act’s provisions that apply to “high risk” uses of AI in areas like critical infrastructure.

Industry and some member states have been calling for the EU to “stop the clock” on implementing the law for several months, citing delays to compliance tools, structures and standards.

As the Commission eyes how to apply its digital simplification push to the EU’s AI law, Draghi’s remarks are likely to fire up the AI Act’s “stop the clock” proponents once again.

(nl, aw)