If You Can Cherry-Pick Which Codes to Sign, That's Not Regulation — That's a Menu

Looking ahead to the next six months — through early 2027 — I genuinely don't anticipate dramatic developments. GDPR's first eight months were exploratory, DMA took fourteen months to produce its first real fine, and the AI Act will follow the same pattern. In this near-term window, the EU AI Office's primary practical task will be issuing Article 91 technical documentation and training data summary requests to GPAI providers, while beginning the classification work needed to determine which models qualify as high-risk GPAI with systemic risk. That classification framework is not yet finalized, meaning multiple layers of administrative process stand between today and any actual penalty. Meta and the other GPAI Code non-signatories get this window to solidify whatever self-compliance narrative they plan to put forward.

These quiet months do not mean nothing is happening, however. The compliance consulting industry will grow rapidly — AI law practices at major firms will double or triple in headcount, and AI companies will expand legal teams accordingly. For Europe's smaller AI startups, the estimated first-year GPAI compliance cost of $12 million to $25 million represents a serious strategic inflection point. Some may quietly exit the EU market or adopt a dual-track approach, offering only stripped-down compliance-friendly model versions in Europe while deploying fuller capabilities elsewhere. European VC funding stabilized after dropping from a peak of €107 billion in 2021 to €58 billion in 2023 — watching whether this new compliance cost burden suppresses additional new investment will be the most critical near-term indicator. The counterpoint: mega-rounds above €100 million already account for more than half of first-half 2026 European deal value, suggesting capital is not broadly drying up but is sharply polarizing toward large, compliance-capable players.

I will also be watching DSA enforcement as a parallel track. X received a €120 million DSA fine in December 2025, and since May 2025 alone, 19 DSA enforcement actions have been taken. The EU AI Office holds a technically distinct mandate from DSA enforcement, but in practice, competition for institutional resources — talent pipelines, political attention, and industry bandwidth — is real. The EU is running three large digital regulatory regimes simultaneously: DMA, DSA, and AI Act. Whether its institutional infrastructure can effectively staff all three will become visible in the near term, and any visible strain in DSA operations will invite legitimate questions about AI Act capacity.

Near-term implementation of the Transparency Code itself deserves close attention. The fact that 180 to 190 organizations signed is a positive headline, but signature and implementation are different things entirely. Requiring chatbots to disclose their AI nature, labeling deepfakes, and embedding machine-readable marks in AI-generated content are technically achievable standards — but who actually verifies that 180-plus organizations are executing them consistently? With 140 total AI Office staff, simultaneously running GPAI oversight and Transparency Code monitoring at scale is a genuine operational stretch. If even the simpler code cannot be meaningfully monitored, the credibility of oversight for the far more complex GPAI Code starts to erode before it even begins.

Corporate strategy divergence will be another near-term storyline worth tracking. Following OpenAI's signals about close collaboration with the European Commission — Tom Duff Gordon stated that the company had "collaborated closely with the European Commission and the wider ecosystem on implementing the AI Act, including its Codes of Practice" — most of the 26 GPAI Code signatories are publicly positioning cooperative engagement as a strategic market-access asset, not merely a compliance obligation. Meta and xAI, by contrast, will need to run independent compliance demonstrations without GPAI Code cover, and the tenor of their first formal interactions with the EU AI Office will set the tone for years of subsequent engagement. China's major AI companies — Alibaba, Baidu, and DeepSeek — remain entirely outside the EU code framework, though their European enterprise customers will feel indirect regulatory pressure regardless.

Moving to the medium term — roughly the second half of 2027 through 2028 — this period will represent the AI Act's true inflection point. The first formal investigations should begin, and the first Article 101 fines could plausibly land. If the DMA's fourteen-month timeline from activation to first major penalty provides a directional guide, late 2027 to early 2028 becomes the zone for the AI Act's first real enforcement actions. The central question is whether the EU AI Office will have built the capacity by then to conduct genuinely independent model evaluations. The currently vacant Head of Safety Unit and lead scientific advisor positions are not minor gaps — if they remain unfilled, the first investigations risk being procedurally thin, and companies with sophisticated legal resources will find and exploit every weakness in the process.

The technical difficulty of model evaluation is severely underappreciated in public discourse. Article 92's powers — API access, source code access, and structured dialogue about internal testing — are legally formidable. But operationalizing them requires staff who understand model architecture, can design safety evaluation benchmarks appropriate for frontier systems, and can technically demonstrate the presence of systemic risk in a legally defensible way. People with this skill level are globally scarce, and the vast majority work for private AI companies at compensation levels the EU cannot currently match. Even if the AI Office assembles an external independent evaluator pool, verifying that those evaluators are genuinely independent and free of conflicts of interest creates its own substantial challenge. This is not merely a funding and staffing problem — it is the task of inventing evaluation methodology from scratch in a regulatory domain with essentially no real precedent.

The expansion of EU AI Office capacity is the single most important medium-term variable, and it cannot be overstated. The policy NGO Pour Demain recommended adding 30 GPAI-dedicated hires by end of 2027, expanding total staff to at least 160 by 2030, and raising the annual budget from €46.5 million to €50–60 million. Realizing this requires navigating EU budget negotiation processes — specifically getting AI Office expansion onto the priority list in the 2028–2034 Multiannual Financial Framework discussions. The salary competitiveness problem also needs a structural fix. The UK AI Safety Institute's international hiring model is one option, but achieving something comparable within the EU's 27-country consensus structure is politically fraught. Which combination of Pour Demain's five proposed funding pathways — the Digital Omnibus bill, the 2028–2034 MFF, the annual EU budget, a supervisory fee on GPAI providers, or a levy on AI services — ends up adopted will determine the pace of medium-term capacity growth.

One medium-term dynamic that could significantly reshape the AI Act's trajectory is what happens to the GPAI Code as an institution. Currently sitting at roughly 26 signatories, does the code attract more participants, or does the Meta and xAI model of selective engagement spread? If the EU AI Office's first enforcement action targets a GPAI Code signatory rather than a non-signatory, that would paradoxically demonstrate that being outside the code was the more strategically advantageous position. Conversely, if heightened supervisory scrutiny of non-signatories generates real operational burden, it could draw additional companies in gradually. China's major AI firms remain the wildcard: if any of them engage with EU codes to secure European market access, it would provide the most powerful validation yet that the code framework carries genuine global reach.

Geopolitical pressure remains a non-negligible medium-term variable. The Trump administration's template for DMA and DSA — designating them as digital trade barriers and imposing visa restrictions on EU officials — could extend to AI Act enforcement as tensions escalate. With the U.S. having signaled potential tariffs of up to $200 billion on EU exports spanning automobiles, luxury goods, and agricultural products, the political cost of maintaining aggressive AI enforcement could rise sharply if broader trade tensions intensify. MEP McNamara's warning about Washington viewing EU enforcement as an attack on U.S. commercial interests has not lost relevance. The outcome of the 2028 U.S. election could fundamentally reset the EU-U.S. tech regulatory relationship in either direction, and that geopolitical uncertainty is baked into every medium- and long-term scenario for the AI Act.

Looking to the long term — 2028 through 2030 and beyond — GDPR's enforcement arc remains the most useful reference point. When annual GDPR fine totals jumped from €158.5 million in 2020 to approximately €1.1 billion in 2021 — roughly sevenfold in a single year — the regulation's real enforcement bite became undeniable. AI Act enforcement, once its institutional infrastructure reaches maturity, could follow a comparably steep acceleration curve. GDPR is not a perfect analog — the AI Act covers technically far more complex territory — but the EU's structural enforcement pattern of slow start followed by rapid escalation is deeply embedded in its regulatory DNA and is likely to recur. By around 2030, AI Act annual fine totals could approach several hundred million euros, and Meta's theoretical $6 billion ceiling — the 3% statutory maximum on approximately $200.97 billion in revenue — will begin to feel less like an abstraction and more like a real operational risk. Google's €890 million DMA sanction, combined with the threat of additional daily penalties at 5% of global revenue for continued non-compliance, illustrates how quickly EU financial exposure can become genuinely threatening once enforcement is in motion.

The long-term restructuring of the European AI ecosystem deserves serious attention. With AI absorbing 60.3% of European VC deal value while deal count hits a six-year low, the current trajectory suggests that as regulation intensifies, smaller players face increasing pressure to exit or limit their EU offerings, while the market reorganizes around large, compliance-capable incumbents. This is potentially the inverse of what EU regulators originally intended — a level playing field where innovative SMEs can compete fairly. When compliance costs function as moats, regulation ends up protecting entrenched incumbents rather than challenging them. How the EU manages this paradox will be a defining factor in European AI competitiveness over the coming decade, and there is no easy answer in sight.

The long-term global dimension — the potential Brussels Effect — cannot be ignored. GDPR became the de facto global standard for data protection precisely because the EU actually enforced it, creating market pressure on companies worldwide to align with EU standards regardless of geography. The AI Act has the structural potential to do the same for AI governance. Canada, Brazil, and South Korea are already referencing the EU framework as they develop their own AI regulatory structures. But the Brussels Effect requires one nonnegotiable precondition: the EU has to actually enforce its own law in a manner that is visible, credible, and consequential. If AI Act enforcement remains superficial for several years, other jurisdictions will look to the U.S. innovation-first model or China's state-led approach rather than the EU framework. In my view, the AI Act's genuine global regulatory influence will not fully materialize until after the first major penalty cycle concludes around 2029 to 2030.

The most fundamental long-term question is whether Meta's cherry-picking strategy remains an outlier or becomes the industry standard. If the EU introduces cross-code linkage mechanisms — making participation in one code a condition for favorable treatment under another — or if heightened monitoring of non-signatories generates sufficient practical burden to draw most companies toward signing, today's cherry-picking will prove to have been a transitional phenomenon. But if capacity constraints persist indefinitely and non-signatory oversight stays largely ceremonial, more companies will rationally adopt the Meta model. At that point, the entire voluntary code architecture loses its regulatory meaning, and the EU's credibility as an AI governance standard-setter is fundamentally undermined.

My base case is that the EU builds enforcement capacity slowly but ultimately delivers. With both GDPR and the DMA, the early consensus was that the EU probably wouldn't follow through — and then billions in fines materialized anyway. EU bureaucratic machinery has one defining characteristic: slow to build momentum, but once moving, relentlessly persistent. The AI Act will pass through its 2026–2027 exploratory phase and enter genuine enforcement mode after 2028. That said, the base case is not the only plausible scenario. Stronger-than-expected U.S. political pressure, AI technological development that outpaces regulatory comprehension, or a growing internal EU coalition for deregulation could all leave enforcement effectively nominal. The fact that internal EU discussions about softening the AI Act were already underway as recently as May 2026 is a data point worth keeping in mind.

There is a third scenario that deserves serious consideration: regulation as an accelerant for better AI. Safety evaluation requirements, transparency mandates, and risk mitigation demands impose short-term costs that could, over a longer horizon, drive meaningful improvements in AI model quality and trustworthiness. If models trained and deployed in Europe come to carry an "EU AI Act compliant" designation that functions as a quality signal in global markets, European-origin AI could command a genuine premium. This is the most optimistic scenario, and it requires the EU to engage with industry not simply as a penalty-issuing authority but as a genuine quality-standard collaborator. When regulation operates as infrastructure for excellence rather than a fine-collection mechanism, the virtuous cycle between regulatory rigor and innovation becomes possible — and that cycle, once established, has compounding returns.

One structural element cannot be omitted from any responsible forecast. AI Act enforcement is not solely the EU AI Office's responsibility — the official Commission press release specifies "the European Commission's AI Office, together with national authorities," meaning all 27 member state authorities participate in enforcement. In GDPR, this distributed architecture was one of the primary sources of enforcement lag — Ireland's Data Protection Commission, as the lead supervisory authority for Big Tech European headquarters, was repeatedly criticized for investigation timelines that stretched into years. The same inter-member-state gaps in capacity, legal interpretation, and political will are likely to surface in AI Act enforcement. How the EU AI Office coordinates across 27 national counterparts will be central to the regulatory framework's coherence and credibility. Repeating GDPR's Irish enforcement pattern in the AI Act context — where slow-moving lead authorities create de facto regulatory havens — would meaningfully damage the framework's global authority.

Finally, three concrete indicators are worth tracking as this story unfolds over the next several years. First, watch when the first Article 101 fine is issued, against which company, and on what grounds. This will be the AI Act's defining data point. The penalty size and timeline relative to DMA precedent — fourteen months, €500 million-plus for first sanctions — will be the primary barometer of the EU's actual enforcement will. Second, follow EU AI Office hiring closely through 2027. Whether the 30 GPAI-dedicated hires Pour Demain recommended are in place by year-end, and whether the Head of Safety Unit and lead scientific advisor positions get filled, are the concrete measures of enforcement capacity building. Third, watch whether and when Meta changes its position on the GPAI Code, or holds firm indefinitely.

Meta's choice is not merely one company's regulatory strategy — it is an ongoing live stress test of the EU AI Act's structural integrity. How other companies calibrate their own strategies will follow directly from the result of that test. If all three indicators move in a positive direction simultaneously, the AI Act has a genuine pathway toward becoming GDPR's successor in the AI domain. If all three stagnate, the cherry-picking label will prove difficult to remove.