Is the EU AI Act future proof?

Resumen

[Purpose] The EU AI Act, adopted in March 2024 and largely effective by 2026, represents the world's first comprehensive horizontal AI regulation. Building on the EU's experience with the GDPR, it employs a risk-based approach, broad definitions for AI systems and General-Purpose AI Models (GPAI) and asserts extensive extraterritorial reach. This article critically examines whether the AI Act is truly “future-proof” against AI’s rapid evolution.

[Methodology/approach/design] The article employs doctrinal legal analysis of the EU AI Act's provisions, particularly its risk-based classification framework, examining the Act's structural architecture against established risk governance principles and comparing its approach with emerging national legislation and international frameworks. The analysis focuses on the interaction between Articles 5, 6, 9, 51, and 55, examining how static regulatory classifications interact with dynamic AI capabilities.

[Findings] While the Act demonstrates commendable ambition- including technology-neutral definitions, extraterritorial reach, integration with existing frameworks like the GDPR, and establishment of a centralized AI Office- it suffers from a fundamental architectural flaw that compromises its long-term viability. Key weaknesses include a highly complex and potentially slow enforcement mechanism, risks of EU consumer discrimination due to compliance burdens, and the potential for regulatory circumvention. A more fundamental flaw is the regulation of inherently dynamic AI systems through static risk classifications. This static approach creates three cascading failures. First, it cannot capture AI systems that evolve post-deployment from low-risk to high-risk. Second, rigid thresholds (particularly the 10^25 FLOPs threshold for systemic risk GPAI) incentivize regulatory arbitrage. Third, enforcement mechanisms remain reactive rather than proactive, creating a ‘regulatory firefighting’ approach incompatible with genuine future-proofing. While Article 9's risk management framework is theoretically sound, it operates within this static classification system and cannot compensate for the broader structural weakness.

[Practical implications] The Act represents a vital first step in AI governance, but its static classification, internal inconsistencies, and unaddressed challenges severely compromise its long-term adaptability- means it will require continuous reactive amendments to remain relevant. It is less a future-proof edifice than a foundational structure already showing cracks. The Act's static architecture is already prompting Member States to develop conflicting supplementary regulations (exemplified by Italy's AI Law), creating fragmentation rather than harmonization.