🧭 The GDPR Is Shaping the AI Race
AI Policy, Compliance & Regulation Must-Reads | Edition #168
👋 Hi, Luiza Jarovsky here. Welcome to our 168th edition, read by 51,400+ subscribers in 165+ countries. Not a subscriber yet? Join us.
🌎 We are a leading AI governance publication helping to shape the future of AI policy, compliance & regulation. It's great to have you here!
🧭 The GDPR Is Shaping the AI Race
Most people haven't realized it, but EU data protection authorities are more powerful than ever, and they're key players in the AI race. Here's what nobody is telling you:
It appears that nearly every EU data protection authority is investigating DeepSeek, the rising AI company from China (read my latest deep dive to understand DeepSeek's legal pitfalls.)
From a data protection perspective—especially under the General Data Protection Regulation (GDPR)—these authorities will determine which AI companies will thrive in the EU and, potentially, worldwide through a Brussels effect-style cascade.
How? By investigating data protection provisions with varying levels of rigor and scrutiny.
As I've been writing in this newsletter since December 2022, most companies developing cutting-edge AI models have not complied with core GDPR provisions. Now, with EDPB Opinion 28/2024, this is even more evident (read my deep dive on the topic here).
If data protection authorities were to interpret the GDPR to the letter and enforce it in the strictest way possible, there would likely be no AI models, AI systems, or AI ecosystems in the EU.
That’s probably not the ideal outcome, so interpretation and enforcement are evolving. We've witnessed this process in the past two years, especially with recent European Data Protection Board (EDPB) opinions and Data Protection Authorities (DPA) guidelines. (If you’ve been reading this newsletter, you know this!)
Data protection authorities can use the evolving nature of the interpretative and enforcement process to decide which legal provisions will be interpreted more strictly and which provisions they’ll allow to slide.
An example? Most data protection authorities are now raising concerns about DeepSeek’s data transfers to China and the lack of adequate safeguards. While the model can be used locally, most users access it via the web. In the current landscape, scrutinizing these data protection aspects directly affects DeepSeek—but not OpenAI, Anthropic, Meta, Google, etc.—thereby influencing the AI race.
In this specific example, if EU data protection authorities determine that data transfers to China and the lack of adequate safeguards are a dealbreaker, they will begin banning DeepSeek, country by country, until it is no longer available in the EU. On the other hand, if they find a creative technical or legal way to overcome this challenge—or decide to wait for an official EDPB Opinion—DeepSeek will not be banned. It’s up to them.
And what about the Brussels Effect-like impact I mentioned earlier? When EU data protection authorities raise concerns about an AI company, the world takes notice. Even if other countries don’t have identical GDPR provisions, they will face internal pressure—especially from advocates, non-profits, and consumer organizations—to take action. As a result, scrutiny of AI companies increases globally, triggering a cascade effect that directly shapes the AI race (which we’re already seeing with DeepSeek, as countries outside of the EU are also investigating the company).
If I had told you a few months ago that the GDPR would be a key factor in the AI race, you probably wouldn’t have believed me—right?
📈 AI Governance Careers Are Surging: Get Ahead
I invite you to join the 18th cohort of our AI Governance Training and gain the skills to meet the emerging challenges in the field. This 12-hour live online program goes beyond standard certifications and offers:
8 live sessions with me, curated self-study materials, and quizzes;
A training certificate and 13 CPE credits pre-approved by the IAPP;
A networking session with peers and office hours for career-related discussions.
Don't miss it! Join 1,100+ professionals who have advanced their careers with us:
*If cost is a concern, we offer discounts for students, NGO members, and individuals in career transition. To apply, fill out this form.
🇪🇺 New EU AI Act Guidelines
Yesterday, the EU Commission published the 140-page guidelines on the EU AI Act's prohibited AI practices. The document clarifies the strictest risk category of the EU AI Act, and everybody in AI should be familiar with it.
👉 On Sunday, paid subscribers will receive my deep dive breaking down these guidelines. Don't miss it!
🏛️ Are AI-Generated Works Copyrightable?
The U.S. Copyright Office published a must-read report on the copyrightability of works created using generative AI. Here’s a quick summary of the main points, along with my comments:
"1. Questions of copyrightability and AI can be resolved pursuant to existing law, without the need for legislative change.
2. The use of AI tools to assist rather than stand in for human creativity does not affect the availability of copyright protection for the output.
3. Copyright protects the original expression in a work created by a human author, even if the work also includes AI-generated material.
4. Copyright does not extend to purely AI-generated material, or material where there is insufficient human control over the expressive elements.
5. Whether human contributions to AI-generated outputs are sufficient to constitute authorship must be analyzed on a case-by-case basis.
6. Based on the functioning of current generally available technology, prompts do not alone provide sufficient control.
7. Human authors are entitled to copyright in their works of authorship that are perceptible in AI-generated outputs, as well as the creative selection, coordination, or arrangement of material in the outputs, or creative modifications of the outputs.
8. The case has not been made for additional copyright or sui generis protection for AI-generated content."
➡️ My comments:
- Item 4 above is the trickiest part: proving sufficient human control over the expressive elements. Why?
- If a person prompts an AI system like Midjourney multiple times to obtain the "perfect image," would it be considered 'sufficient human control' to receive copyright protection?
- There is a lawsuit covering a similar argument, where Jason Allen states that he prompted Midjourney 624 times to create the work "Théâtre D'Opéra Spatial" but was denied copyright protection. He is now suing the U.S. Copyright Office.
➡️ Here's what else the report says about the relationship between prompts and sufficient human control:
"The Office concludes that, given current generally available technology, prompts alone do not provide sufficient human control to make users of an AI system the authors of the output. Prompts essentially function as instructions that convey unprotectible ideas. While highly detailed prompts could contain the user’s desired expressive elements, at present they do not control how the AI system processes them in generating the output."
🚀 Daily AI Governance Resources
Thousands of people receive our daily emails with educational and professional resources on AI governance, along with updates on our free live sessions and training programs. Join our learning center:
🎙️ Join my Live Talk with Anu Bradford
The year has barely begun, and the global AI race is in full swing. What does this mean for AI regulation and governance? Here's why you won't want to miss my next live talk:
Anu Bradford is a professor of law and international organizations at Columbia University and a leading scholar on global economy and digital regulation. She coined the term 'Brussels Effect'―often discussed in the context of AI regulation―and published a book with the same name.
More recently, Bradford published the book "Digital Empires: The Global Battle to Regulate Technology," where she explores the global battle among the three dominant digital powers―the U.S., China, and the EU―and the choices we face as societies and individuals.
In this live talk, we'll discuss:
How the U.S., the EU, and China are strategically positioning themselves in the global AI race;
How the three dominant digital powers are approaching AI regulation and the practical implications of each approach;
The Brussels effect in the context of AI regulation;
and more.
👉 To participate, register here.
🎬 Find all my previous live conversations with privacy and AI governance experts on my YouTube Channel.
📚 AI Book Club: What Are You Reading?
📖 More than 2,200 people have already joined our AI Book Club and receive our book recommendations.
📖 The 17th recommended book was "Chip War: The Fight for the World's Most Critical Technology," by Chris Miller.
📖 Ready to discover your next favorite read? See our previous reads and join the AI book club:
📑 Reading List: AI Agents
Everybody is talking about AI agents, but most people don't know the legal, ethical, and governance challenges behind them. Here are 5 great resources to learn more:
1. "The Ethics of Advanced AI Assistants," Iason Gabriel et al. - read
2. "Navigating the AI Frontier: A Primer on the Evolution and Impact of AI Agents," by the World Economic Forum - read
3. "Governing AI Agents," by Noam Kolt - read
4. "Legal Challenges of AI Agents," by me - read
5. "AI Agents: RIP Autonomy," by me - read
📢 Spread AI Governance Awareness
Enjoying this edition? Share it with friends and colleagues:
📊 The Future of Jobs Report 2025
"The Future of Jobs Report 2025," published by the World Economic Forum, has intriguing insights on AI's impact on the job market. Key findings:
"Technology-related roles are the fastest-growing jobs in percentage terms, including Big Data Specialists, Fintech Engineers, AI and Machine Learning Specialists and Software and Application Developers. Green and energy transition roles, including Autonomous and Electric Vehicle Specialists, Environmental Engineers, and Renewable Energy Engineers, also feature within the top fastest-growing roles."
"AI and big data top the list of fastest-growing skills, followed closely by networks and cybersecurity as well as technology literacy. Complementing these technology-related skills, creative thinking, resilience, flexibility and agility, along with curiosity and lifelong learning, are also expected to continue to rise in importance over the 2025-2030 period. Conversely, manual dexterity, endurance and precision stand out with notable net declines in skills demand, with 24% of respondents foreseeing a decrease in their importance."
"(...) half of employers plan to reorient their business in response to AI, two-thirds plan to hire talent with specific AI skills, while 40% anticipate reducing their workforce where AI can automate tasks."
🔥 Job Opportunities in AI Governance
Looking for a job in AI governance? Check out our global job board and subscribe to receive our weekly alerts.