With AI agents going rogue and warnings growing louder about the dangers artificial intelligence is posing, many in Europe were left to wonder: Are the European Union's artificial intelligence rules enough?
The EU insists that, yes, its law, known as the AI Act, is powerful enough since it forces companies to assess and mitigate risks, under threat of massive fines or even bans.
EU lawmakers, officials and experts appear more skeptical, pointing to gaps in the rules and questioning whether Brussels has the stomach for a fight with AI labs.
The EU agreed on its sweeping AI legislation in 2024, but delayed part of its implementation. Enforcement has only been possible since August this year.
Nonetheless, EU spokesperson Thomas Regnier says the rules are "fully fit for purpose."
"You can feel safe at home in Europe, precisely because we have put all these safeguards in place," he said.
So far, the EU has sent more than 30 requests for information – a preliminary step that can lead to investigations – to companies on issues from copyright to cybersecurity and safety.
Brussels says its rules are working because they have already forced AI providers to cough up information to regulators, though Regnier declined to give details.
There are, however, questions about Europe getting access to the latest models: It took months for the EU to test Anthropic's Mythos following U.S. export control orders.
Speaking on condition of anonymity, an EU official admitted such an issue could arise again.
EU chief Ursula von der Leyen has proposed talks with the main frontier labs to "pace" the technology's growth, arguing the AI Act puts Europe "in the position to shape global efforts" at regulation.
But that is a tall order without buy-in from the U.S. – where President Donald Trump firmly opposes regulating the sector.
And not everyone is convinced the EU law has what it takes.
Four EU lawmakers, including lead AI Act negotiator Brando Benifei, warn of "legislative gaps" after the EU shelved plans for AI liability rules.
Such rules would have made it easier to hold AI providers accountable for harm caused by their tools.
The lawmakers argue current rules do "not apply to the research, testing or development phase," leaving Europeans "unprotected."
The European Commission rejects the claim.
The law can be "enforced against any provider, starting from the testing phase, if they experience a loss of control that affects the EU's internal market," including cyberattacks and biological or chemical misuse, Regnier said.
Researcher Harshvardhan Pandit echoed lawmaker concerns about liability in the bloc.
"We are missing these pieces of accountability, and if we don't fix this now and we get more of these incidents, this is only going to get worse," said Pandit, of AI Accountability Lab in Trinity College Dublin.
If a model ends up hacking a website, once AI providers have sold their tools, Pandit said, "we don't know" who is ultimately responsible.
But he also said the AI Act requires developers "to have addressed" safety risks by the time a model reaches the market, noting that recent incidents, including with OpenAI agents, happened during testing.
And he noted the EU has other laws to counter risks, including laws on cybersecurity and data protection.
EU lawmaker Benifei said the AI Act correctly anticipated the threat of agents going rogue, but raised concerns about enforcement – including that staffing levels at the EU's AI Office are nowhere near enough to match the risks.
"The European Commission must guarantee the office political backing, operational independence, resources and technical staff to quickly deliver decisive enforcement," Benifei said.
Analyst Pandit agreed the AI Office needed "far more people and technical expertise."
The office currently employs around 125 staff.
And there is the question of whether the EU has the appetite for taking on AI providers, most of which are U.S.-based.
Brussels has already drawn Washington's ire with probes under different laws, culminating in fines worth billions of dollars.
The EU official admitted the bloc may think twice before enforcing its full powers against American firms, considering Europe's dependence on U.S. tech.
One way to have greater influence over AI safety, the official said, was to build its own technology.
"Europe must also build capabilities, from chips and cloud to a publicly funded CERN for AI," Benifei echoed, referring to the European physics lab in Switzerland that seeks to unravel the universe's composition.
He also said the EU, as von der Leyen pledged last month, should "work more closely with middle powers like Canada, which share an interest in rules that no power or company can dictate."
