EU Swings the Ban Hammer on AI

The message is clear and satisfying - on paper.

Europe will not allow AI to become a tool of mass surveillance or social control.

It bans a long list of mushily defined practices - harmful manipulation, social scoring across contexts, real-time remote biometric identification in public spaces for law enforcement, emotion recognition in workplaces and schools, untargeted facial scraping, biometric categorisation that reveals protected characteristics, and systems that generate non-consensual intimate images of identifiable people.

The applications that actually make sense for AI - border control, biometric matching, fraud detection, spotting people who travel under multiple identities - are labelled “high-risk.” Of course we wouldn’t want to scan the migrant flows too carefully.

Beware the incoming exemptions.

The sequence is predictable:

1. Pass a regulation that looks very strict on biometric surveillance.
2. Build the institutional capacity that will need exactly those tools.
3. Discover that the new structures require “limited, carefully ring-fenced” exceptions in the name of security.
4. Keep the moral language about fundamental rights intact.

While the Act was being finished, the same Commission under Ursula von der Leyen has been pushing a new European Security Strategy, the operational strengthening of Europol, further reinforcement of Frontex, and exploration of closer Commission-level intelligence and analysis capacity - her private secret service of sorts.

The tools that the regulation appears to restrain are precisely the tools that an expanding EU-level security architecture will eventually need to use.

The planned Chat Control is the clearest current example - without AI, it's impossible.

We remember the EU's greatest digital invention (no, not the attached bottle cap) - the Cookie Banner.

Cookie banners were supposed to give citizens meaningful control over their personal data. Instead, every human now clicks “Accept All” while trying to find the opening hours of a restaurant.

The computational cost is not trivial.

One analysis estimated that running cookie consent banners and their infrastructure consumes roughly 10 million kWh of electricity per day worldwide. Europeans alone spend an estimated 575 million hours per year dealing with these prompts.

We look forward to seeing AI transparency notices, risk labels and “you are now interacting with a high-risk AI system” warnings bolted onto existing cookie banners or spawning their own versions.

AI is a tool. Tools are used.

The US still has no comprehensive federal AI law - just a patchwork of state rules and executive orders that mostly try not to get in the way. China regulates specific uses (generative models, deepfakes, companion bots, agents) through targeted measures and standards, not one big horizontal act with risk tiers and bans.

Only the EU, heroically, stepped forward and decided to produce a detailed, solemn, risk-based and vague framework that can later mean whatever is convenient. The text is soft enough to accommodate various exemptions. The language was never meant to stop the people who wrote it.

Meanwhile, here is an imaginary adult woman. Fully fictional.