May 12, 2026 • 15 mins
The European Union has agreed on major changes to the AI Act to reduce overlap with machinery, product safety, and sector-specific regulation. But is this just simplification — or the beginning of a broader rethink of AI regulation in Europe? In this episode of Diritto al Digitale, Giulio Coraggio, technology and data lawyer, analyzes the latest AI Act amendments, the delay of high-risk AI obligations, the impact on industrial AI, medical devices, robotics, and what companies must do now to prepare for AI compliance, cybersecurity, and governance challenges.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_00 (00:08):
There's a question that today every company
investing in artificialintelligence should start asking
itself.
What happens when regulationdesigned to create trust in AI
starts becoming a barrier todeploying it?
Because that is exactly thedebate currently exploding
(00:28):
inside Europe.
For years, the European Unionpresented the AI Act as the
global benchmark for AIregulation.
The first comprehensive AI lawin the world, the European
model, the idea that Europecould lead not through scale or
technological dominance, butthrough regulation.
(00:49):
But now, only months before someof the most important
obligations become applicable,Brussels is already revisiting
the framework.
And this is not a minortechnical adjustment.
This is a political signal,because what started as an AI
regulation discussion is rapidlybecoming something much bigger.
(01:11):
A debate about industrialcompetitiveness, innovation,
cybersecurity, product safety,and Europe's ability to remain
relevant in the global AI race.
And the reality is that manycompanies, especially industrial
groups, manufacturers, andoperators deploying AI into
physical products, startedtelling European institutions
(01:34):
something very simple.
This framework is becomingimpossible to operationalize.
And when that message comes frommajor European industries,
particularly Germanmanufacturing groups,
policymakers normally listen.
(02:10):
And today we discuss one of themost important developments in
European AI regulation since theapproval of the EU AI Act
itself.
The decision by the EuropeanUnion to amend parts of the AI
Act in order to reduce overlapswith sector-specific
legislation, especiallymachinery regulation and product
(02:30):
compliance frameworks.
Because this story is not onlyabout AI compliance, it's about
the future of Europeanregulation itself.
Let's start from the beginning.
(02:52):
The AI Act was designed around arisk-based approach.
The higher the risk posed by anAI system to individuals, safety
or fundamental rights, thehigher the compliance
obligations are.
On paper, the logic was elegant.
Minimum risk AI systems facealmost no obligations, limited
(03:14):
risk systems requiretransparency, high risk systems
face extensive complianceobligations.
And prohibited AI practices arebanned altogether.
The issue is that reality ismuch messier than theory,
because many AI systems do notexist in isolation.
(03:37):
They are embedded insideproducts already heavily
regulated under European law.
Think about industrialmachinery, medical devices,
connected vehicles, robotics,manufacturing systems, critical
infrastructure, smart products,financial systems using embedded
AI.
These sectors were alreadysubject to extremely
(04:00):
sophisticated regulatoryframeworks, such as product to
product safety legislation,cybersecurity obligations,
conformity assessments,technical certifications, sector
specific standards, postmarketmonitoring, incident reporting
requirements.
And suddenly the AI Act addedanother compliance layer on top
(04:23):
of all of this.
The result, many companiesstarted realizing they would
potentially need to complysimultaneously with the AI Act,
the Machinery Regulation, theCyber Resilience Act, NIST 2,
DORA, the Data Act, the ProductSafety Legislation, the revised
Product Reliability Directive,and on top of them,
(04:44):
sector-specific certificationobligations.
And at a certain point, thequestion stopped being how do we
innovate using AI?
And it became how do we survivecompliance?
This is where the politicalpressure became enormous.
Over the last months,negotiations between the
European Parliament, theCouncil, and the Commission
(05:07):
became increasingly tense,particularly because Germany
strongly pushed to reduceoverlaps between the AI Act and
industrial machinerylegislation.
And eventually, Europe reached acompromise.
Under the latest agreement, manyAI-enabled machinery products
regulated under sectorlegislation will avoid direct
(05:30):
duplication with some AIobligations.
This is extremely importantpolitically, because for the
first time, the European Unionis implicitly acknowledging
something many companies haven'tbeen saying for years.
You cannot indefinitely stackoverlapping digital regulations
without creating acompetitiveness problem.
(05:52):
And this matters enormouslybecause the AI Act was never
operating in isolation.
Over the last years, Europe hascreated an unprecedented wave of
digital regulation.
The GDPR, the DSA, the M ⁇ A,NISTU, DORA, the Data Act, the
Cyber Resilience Act, the AI Actindividually.
(06:13):
Each framework makes sense.
But inside companies, theseframeworks collide continuously.
And this is exactly whatBrussels is now starting to
confront.
Another critical aspect istiming.
Originally, many obligations forhigh risk AI systems were
(06:33):
expected to become applicablefrom August to 2026.
But companies increasinglywarned that implementation
timelines were unrealistic.
Particularly for industrialsystems integrated into products
requiring conformity assessmentsand technical certifications.
And the compromise nowsubstantially delays several
(06:58):
obligations.
Based on the latest agreement,certain high-risk AI obligations
may apply only from December2027.
AI systems embedded intoregulated products may be
postponed until August 2028.
And this delay is not simplyadministrative.
It reflects something deeper.
(07:19):
European institutions haverealized that many organizations
are still struggling with thefoundational AI governance
questions.
For example, what actuallyqualifies as an AI system under
the AI Act?
How should organizationsclassify AI tools internally?
How do you distinguish betweentraditional software and
(07:41):
regulated AI systems?
Who owns AI governance insidethe company?
Legal, IT, compliance,cybersecurity, risk,
procurement, business teams.
And this is something I seedaily when working with
companies, with clients.
Many organizations are stilltrying to build a basic
(08:02):
inventory of AI systems.
Some companies do not even knowhow many AI-enabled tools are
already being used internally.
And this becomes even morecomplicated when employees
independently adopt generativeAI solutions.
Because AI governance is nolonger only about compliance,
it's also about cybersecurity,confidentiality, data
(08:25):
protection, procurement risk,intellectual property, and
liability exposure.
And this leads to another majorshift happening in Europe.
The discussion around AIregulation is becoming far more
pragmatic.
For months, the European AIdebate focused heavily on
principles ethics, transparency,explainability, accountability,
(08:48):
fundamental rights, allextremely important concepts.
But industrial realityintroduces very different
questions.
How do you certify adaptive AIsystems embedded into machinery?
How do you manage continuoussoftware updates?
How do you conduct conformityassessments on systems that
evolve over time?
(09:08):
How do you coordinate AIgovernance with cybersecurity
obligations?
How do you ensure compliancewhen AI functionality depends on
third-party foundation models?
And perhaps most importantly,who becomes legally responsible
when AI systems integrate intoproducts function?
The manufacturer, the softwaredeveloper, the deployer, the
(09:30):
importer, the distributor, theprovider of the underlying AI
model, because one of thebiggest transformations
happening in Europe right now isthe convergence between AI
regulation and liabilityframeworks.
The revised product liabilitydirective now explicitly
recognizes software and AIsystems as products, meaning AI
(09:53):
failures may increasinglygenerate product liability
exposure.
At the same time, cybersecurityincidents involving AI systems
may trigger obligations underNIST II or DORA, for instance.
And suddenly, AI governance isno longer only a legal issue.
It becomes an enterprise riskmanagement issue.
(10:14):
And there is another interestinggeopolitical element behind all
of this.
Europe is starting to realizethat regulation itself has
economic consequences.
For years, the European approachto digital policy was largely
built around the idea that trustcreates competitive advantage.
But the global AI race isaccelerating incredibly fast.
(10:37):
The United States remains drivenby private investment and
innovation speed.
China continues scaling AIdevelopment aggressively.
Meanwhile, Europe risks becomingtrapped in regulatory
complexity.
And the irony is that largemultinational companies often
manage compliance better thansmaller players.
(10:58):
The real pressure falls onstartups, medium-sized
companies, industrial companiesadopting AI, mid-sized European
innovators, because largetechnology companies can absorb
compliance costs.
Smaller organizations oftencannot.
And this is why the AI Actdebate is increasingly becoming
part of the broader Europeancompetitiveness discussion,
(11:20):
initiated also after theso-called dragie report on
European competitiveness.
The fear is simple.
If deploying AI in Europebecomes excessively burdensome,
companies may simply innovateelsewhere.
But companies should notmisunderstand what's happening
now.
This is not the end of the AIAct.
(11:41):
Far from it.
The AI Act remains the mostambitious AI regulatory
framework globally.
And organizations making themistake of posing compliance
initiatives may face seriousproblems later.
Because what is happening is nottheir regulation, it's
regulatory redistribution.
The complexity is shifting.
(12:02):
Companies now need to understandwhen the AI Act applies
directly, when sectoriallegislation prevails, when
overlaps are managed, how AIgovernance integrates with
cybersecurity and productcompliance, how contractual
allocation of liability shouldwork across supply chains.
And this requires much moremature governance structures.
(12:24):
AI governance can no longer behandled exclusively by IT teams.
Organizations increasingly needmultidisciplinary AI governance
committees, AI inventories,internal risk classification
methodologies, vendor duediligence frameworks, AI
procurement controls, monitoringmechanisms, escalation
(12:45):
procedures, incident responseframeworks, coordination between
legal, cybersecurity,compliance, HR, procurement, and
business teams.
And this is particularlyimportant because regulators
themselves are stillinterpreting many provisions.
Meaning that guidance, delegatedacts, standards, and enforcement
(13:08):
approaches will continueevolving over the coming years.
And perhaps this entire storytells us something even bigger
about the future of technologyregulation in Europe.
For years, regulators focused onregulating technologies
individually.
Privacy, platforms,cybersecurity, data sharing,
(13:29):
artificial intelligence, butcompanies do not experience
regulation in silos.
Inside organizations, theseframeworks merge operationally.
And Europe is now facing thereal challenge.
How do you create a coherentdigital regulatory ecosystem
without paralyzing innovation?
Because the future of AIregulation will not depend only
(13:50):
on legal principles.
It will depend on whetherregulation remains operationally
sustainable for businesses.
And that may become one of thedefining legal and economic
questions of the next decade.
Will Europe succeed in creatingan AI governance model that
balances trust andcompetitiveness?
(14:11):
Or will economic pressuregradually force a broader
simplification of the AI Act?
And could strong AI governanceeventually become a competitive
advantage for European companiesrather than simply another
compliance button?
Send me an email with yourthoughts at giuccoraggio at
(14:33):
yellowlipiper.com.
And if you found this episodeinteresting, subscribe to
Diritto al Digitale, activatethe notification bell so you
don't miss future episodes andleave us a 5-star review on
Apple Podcasts or Spotify.
I'm Giulio Coraggio, this is thepodcast Diritto al Digitale.
There's a question that today every company
investing in artificialintelligence should start asking
itself.
What happens when regulationdesigned to create trust in AI
starts becoming a barrier todeploying it?
Because that is exactly thedebate currently exploding
(00:28):
inside Europe.
For years, the European Unionpresented the AI Act as the
global benchmark for AIregulation.
The first comprehensive AI lawin the world, the European
model, the idea that Europecould lead not through scale or
technological dominance, butthrough regulation.
(00:49):
But now, only months before someof the most important
obligations become applicable,Brussels is already revisiting
the framework.
And this is not a minortechnical adjustment.
This is a political signal,because what started as an AI
regulation discussion is rapidlybecoming something much bigger.
(01:11):
A debate about industrialcompetitiveness, innovation,
cybersecurity, product safety,and Europe's ability to remain
relevant in the global AI race.
And the reality is that manycompanies, especially industrial
groups, manufacturers, andoperators deploying AI into
physical products, startedtelling European institutions
(01:34):
something very simple.
This framework is becomingimpossible to operationalize.
And when that message comes frommajor European industries,
particularly Germanmanufacturing groups,
policymakers normally listen.
(02:10):
And today we discuss one of themost important developments in
European AI regulation since theapproval of the EU AI Act
itself.
The decision by the EuropeanUnion to amend parts of the AI
Act in order to reduce overlapswith sector-specific
legislation, especiallymachinery regulation and product
(02:30):
compliance frameworks.
Because this story is not onlyabout AI compliance, it's about
the future of Europeanregulation itself.
Let's start from the beginning.
(02:52):
The AI Act was designed around arisk-based approach.
The higher the risk posed by anAI system to individuals, safety
or fundamental rights, thehigher the compliance
obligations are.
On paper, the logic was elegant.
Minimum risk AI systems facealmost no obligations, limited
(03:14):
risk systems requiretransparency, high risk systems
face extensive complianceobligations.
And prohibited AI practices arebanned altogether.
The issue is that reality ismuch messier than theory,
because many AI systems do notexist in isolation.
(03:37):
They are embedded insideproducts already heavily
regulated under European law.
Think about industrialmachinery, medical devices,
connected vehicles, robotics,manufacturing systems, critical
infrastructure, smart products,financial systems using embedded
AI.
These sectors were alreadysubject to extremely
(04:00):
sophisticated regulatoryframeworks, such as product to
product safety legislation,cybersecurity obligations,
conformity assessments,technical certifications, sector
specific standards, postmarketmonitoring, incident reporting
requirements.
And suddenly the AI Act addedanother compliance layer on top
(04:23):
of all of this.
The result, many companiesstarted realizing they would
potentially need to complysimultaneously with the AI Act,
the Machinery Regulation, theCyber Resilience Act, NIST 2,
DORA, the Data Act, the ProductSafety Legislation, the revised
Product Reliability Directive,and on top of them,
(04:44):
sector-specific certificationobligations.
And at a certain point, thequestion stopped being how do we
innovate using AI?
And it became how do we survivecompliance?
This is where the politicalpressure became enormous.
Over the last months,negotiations between the
European Parliament, theCouncil, and the Commission
(05:07):
became increasingly tense,particularly because Germany
strongly pushed to reduceoverlaps between the AI Act and
industrial machinerylegislation.
And eventually, Europe reached acompromise.
Under the latest agreement, manyAI-enabled machinery products
regulated under sectorlegislation will avoid direct
(05:30):
duplication with some AIobligations.
This is extremely importantpolitically, because for the
first time, the European Unionis implicitly acknowledging
something many companies haven'tbeen saying for years.
You cannot indefinitely stackoverlapping digital regulations
without creating acompetitiveness problem.
(05:52):
And this matters enormouslybecause the AI Act was never
operating in isolation.
Over the last years, Europe hascreated an unprecedented wave of
digital regulation.
The GDPR, the DSA, the M ⁇ A,NISTU, DORA, the Data Act, the
Cyber Resilience Act, the AI Actindividually.
(06:13):
Each framework makes sense.
But inside companies, theseframeworks collide continuously.
And this is exactly whatBrussels is now starting to
confront.
Another critical aspect istiming.
Originally, many obligations forhigh risk AI systems were
(06:33):
expected to become applicablefrom August to 2026.
But companies increasinglywarned that implementation
timelines were unrealistic.
Particularly for industrialsystems integrated into products
requiring conformity assessmentsand technical certifications.
And the compromise nowsubstantially delays several
(06:58):
obligations.
Based on the latest agreement,certain high-risk AI obligations
may apply only from December2027.
AI systems embedded intoregulated products may be
postponed until August 2028.
And this delay is not simplyadministrative.
It reflects something deeper.
(07:19):
European institutions haverealized that many organizations
are still struggling with thefoundational AI governance
questions.
For example, what actuallyqualifies as an AI system under
the AI Act?
How should organizationsclassify AI tools internally?
How do you distinguish betweentraditional software and
(07:41):
regulated AI systems?
Who owns AI governance insidethe company?
Legal, IT, compliance,cybersecurity, risk,
procurement, business teams.
And this is something I seedaily when working with
companies, with clients.
Many organizations are stilltrying to build a basic
(08:02):
inventory of AI systems.
Some companies do not even knowhow many AI-enabled tools are
already being used internally.
And this becomes even morecomplicated when employees
independently adopt generativeAI solutions.
Because AI governance is nolonger only about compliance,
it's also about cybersecurity,confidentiality, data
(08:25):
protection, procurement risk,intellectual property, and
liability exposure.
And this leads to another majorshift happening in Europe.
The discussion around AIregulation is becoming far more
pragmatic.
For months, the European AIdebate focused heavily on
principles ethics, transparency,explainability, accountability,
(08:48):
fundamental rights, allextremely important concepts.
But industrial realityintroduces very different
questions.
How do you certify adaptive AIsystems embedded into machinery?
How do you manage continuoussoftware updates?
How do you conduct conformityassessments on systems that
evolve over time?
(09:08):
How do you coordinate AIgovernance with cybersecurity
obligations?
How do you ensure compliancewhen AI functionality depends on
third-party foundation models?
And perhaps most importantly,who becomes legally responsible
when AI systems integrate intoproducts function?
The manufacturer, the softwaredeveloper, the deployer, the
(09:30):
importer, the distributor, theprovider of the underlying AI
model, because one of thebiggest transformations
happening in Europe right now isthe convergence between AI
regulation and liabilityframeworks.
The revised product liabilitydirective now explicitly
recognizes software and AIsystems as products, meaning AI
(09:53):
failures may increasinglygenerate product liability
exposure.
At the same time, cybersecurityincidents involving AI systems
may trigger obligations underNIST II or DORA, for instance.
And suddenly, AI governance isno longer only a legal issue.
It becomes an enterprise riskmanagement issue.
(10:14):
And there is another interestinggeopolitical element behind all
of this.
Europe is starting to realizethat regulation itself has
economic consequences.
For years, the European approachto digital policy was largely
built around the idea that trustcreates competitive advantage.
But the global AI race isaccelerating incredibly fast.
(10:37):
The United States remains drivenby private investment and
innovation speed.
China continues scaling AIdevelopment aggressively.
Meanwhile, Europe risks becomingtrapped in regulatory
complexity.
And the irony is that largemultinational companies often
manage compliance better thansmaller players.
(10:58):
The real pressure falls onstartups, medium-sized
companies, industrial companiesadopting AI, mid-sized European
innovators, because largetechnology companies can absorb
compliance costs.
Smaller organizations oftencannot.
And this is why the AI Actdebate is increasingly becoming
part of the broader Europeancompetitiveness discussion,
(11:20):
initiated also after theso-called dragie report on
European competitiveness.
The fear is simple.
If deploying AI in Europebecomes excessively burdensome,
companies may simply innovateelsewhere.
But companies should notmisunderstand what's happening
now.
This is not the end of the AIAct.
(11:41):
Far from it.
The AI Act remains the mostambitious AI regulatory
framework globally.
And organizations making themistake of posing compliance
initiatives may face seriousproblems later.
Because what is happening is nottheir regulation, it's
regulatory redistribution.
The complexity is shifting.
(12:02):
Companies now need to understandwhen the AI Act applies
directly, when sectoriallegislation prevails, when
overlaps are managed, how AIgovernance integrates with
cybersecurity and productcompliance, how contractual
allocation of liability shouldwork across supply chains.
And this requires much moremature governance structures.
(12:24):
AI governance can no longer behandled exclusively by IT teams.
Organizations increasingly needmultidisciplinary AI governance
committees, AI inventories,internal risk classification
methodologies, vendor duediligence frameworks, AI
procurement controls, monitoringmechanisms, escalation
(12:45):
procedures, incident responseframeworks, coordination between
legal, cybersecurity,compliance, HR, procurement, and
business teams.
And this is particularlyimportant because regulators
themselves are stillinterpreting many provisions.
Meaning that guidance, delegatedacts, standards, and enforcement
(13:08):
approaches will continueevolving over the coming years.
And perhaps this entire storytells us something even bigger
about the future of technologyregulation in Europe.
For years, regulators focused onregulating technologies
individually.
Privacy, platforms,cybersecurity, data sharing,
(13:29):
artificial intelligence, butcompanies do not experience
regulation in silos.
Inside organizations, theseframeworks merge operationally.
And Europe is now facing thereal challenge.
How do you create a coherentdigital regulatory ecosystem
without paralyzing innovation?
Because the future of AIregulation will not depend only
(13:50):
on legal principles.
It will depend on whetherregulation remains operationally
sustainable for businesses.
And that may become one of thedefining legal and economic
questions of the next decade.
Will Europe succeed in creatingan AI governance model that
balances trust andcompetitiveness?
(14:11):
Or will economic pressuregradually force a broader
simplification of the AI Act?
And could strong AI governanceeventually become a competitive
advantage for European companiesrather than simply another
compliance button?
Send me an email with yourthoughts at giuccoraggio at
(14:33):
yellowlipiper.com.
And if you found this episodeinteresting, subscribe to
Diritto al Digitale, activatethe notification bell so you
don't miss future episodes andleave us a 5-star review on
Apple Podcasts or Spotify.
I'm Giulio Coraggio, this is thepodcast Diritto al Digitale.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Joe Rogan Experience
The official podcast of comedian Joe Rogan.