The EU wants to regulate generative AI tools

Generative AI had a massive breakout year, with tools like ChatGPT and Stable Diffusion letting regular people create text and art in seconds. But behind the impressive demos lies an open secret: the companies building these foundation models are fiercely secretive about the training data and inner mechanics behind them.

That era of launching experimental models into the wild without guardrails might be coming to an end. Regulators in Europe are actively drafting new rules under the upcoming EU AI Act specifically aimed at reigning in generative systems.

Opening the black box under threat of massive fines

Under the EU framework, tools like GPT-3, LaMDA, and Stable Diffusion fall under the label of general-purpose AI systems. Because they can do almost anything, the risks run both ways: they can power harmless customer chatbots or churn out large-scale disinformation, create festive greeting cards or produce nonconsensual explicit deepfakes.

Dragoș Tudorache, a member of the European Parliament negotiating the bill, indicated that leading model creators like OpenAI, Google, and DeepMind will likely be forced to disclose much more about how their models are trained and built.

The legislation is on track to pass in the second half of this year. Once in effect, tech firms that fail to comply while operating in the EU could face financial penalties reaching up to 6% of their total annual global turnover. In the US, the Federal Trade Commission is similarly weighing its own moves.

The two-headed governance puzzle

Regulating general-purpose models is notoriously difficult because they generate two entirely different categories of harm, according to Brookings Institution researcher Alex Engler.

The first problem is the rapid dissemination of toxic outputs, such as hate speech and nonconsensual imagery. The second is systemic bias, which creeps in when businesses plug unvetted language models into hiring pipelines or legal document analysis.

While transparency helps downstream developers inspect the engines they rely on, stopping bad actors requires hard engineering constraints. Engler argues that creators must embed strict generation filters, actively monitor outputs, and ban repeat offenders, even if determined bad actors will still try to poke holes in defenses.

Why it matters

We think this marks the end of the AI wild west, where tech giants could deploy raw, unchecked models and apologize later.

For developers building products on top of large language models, mandatory transparency is a huge win. Today, third-party startups are essentially flying blind on proprietary APIs, unaware of what training flaws or copyright violations might be baked into the weights. Clear documentation reduces downstream liability.

However, there is an obvious downside. If compliance demands become too onerous or border on surrendering proprietary trade secrets, big labs may simply delay releasing cutting-edge features in Europe. Furthermore, hefty regulatory burdens often favor deep-pocketed incumbents over smaller open-source alternatives that lack legal teams.

The EU is setting the world's first enforceable speed limits on generative AI, and every major lab will have to decide whether to hit the brakes or adapt.