A few days ago, I was speaking to a group of business school students at the Saïd Business School at Oxford on the EU AI Act. At one point, when asked a simple question: what do you think of the EU’s approach to regulating artificial intelligence? Is it good legislation?
One student’s answer stuck with me. He shrugged and said, “Who cares.”
Not hostility. Not a considered critique. Just indifference. And that, I’d argue, is a far more worrying reaction than outright opposition would have been. These are the future leaders of European and global business, and the EU’s flagship attempt to regulate one of the most consequential technologies of our time barely registered as something worth having an opinion about.
I think that reaction tells us something important about what’s gone wrong with digital regulation in Europe.
The accumulation problem
Over the past few years, the European Union has produced an extraordinary wave of legislation aimed at the technology and digital space. The GDPR, the NIS2 Directive, the Digital Services Act, the Digital Markets Act, the AI Act, the Data Act, the Cyber Resilience Act, and more still on the way. Each of these instruments was designed with a legitimate purpose: protecting individuals, securing critical infrastructure, ensuring fair markets, and governing emerging technologies responsibly.
But here’s the paradox. The more we regulate, the harder we make it for companies to actually comply.
Individually, each piece of legislation might be reasonable. Collectively, they create a dense, overlapping, and sometimes contradictory web of obligations. A single company operating in the digital space may need to map its activities against half a dozen regulatory regimes at once, each with its own definitions, thresholds, reporting timelines, and enforcement bodies. What was meant to bring clarity ends up producing confusion.
Complexity changes behavior
This is the core of the problem. When the law is accessible, simple, and pragmatic, companies think about compliance the way it’s supposed to work: “this is important, how do we do it right”. That’s a mindset oriented toward genuine adherence to the spirit of the law.
But when the legal framework becomes too complex and too burdensome, the question quietly shifts. Instead of “how do we comply”, organizations start asking “what’s our exposure if we don’t”, or “how do we minimize risk without doing everything”. Compliance stops being a good faith objective and becomes a risk management exercise, a calculation of probability of enforcement versus cost of adherence, rather than a genuine effort to meet the law’s purpose.
That shift is the opposite of what regulation is supposed to achieve.
Overregulation defeats its own purpose
This is the underlying message of everything above. The goal of regulation is compliance, not the regulation itself. A legal framework that is too dense to be practically followed doesn’t produce more compliant companies. It produces companies that are strategically selective about which rules they take seriously. And it advantages large organizations with the resources to hire armies of compliance specialists, while smaller companies are left either overwhelmed or unknowingly non-compliant.
If the EU wants the digital economy to genuinely respect data protection, cybersecurity, and responsible AI use, the answer isn’t more rules. It’s better designed ones. Laws that are accessible enough for a company to understand without a battalion of lawyers. Simple enough that implementation doesn’t require restructuring an entire compliance department. Pragmatic enough that the obligations map to real, manageable actions.
The legislator has a role to play
There are signs that this problem is being recognized at the highest level. Earlier this year, the European Commission proposed a Digital Omnibus package aimed at simplifying and consolidating parts of the EU’s digital rulebook. Whatever form it ultimately takes, the initiative reflects a genuine opportunity, and a genuine responsibility, for the legislator.
The lesson of the accumulation problem isn’t just that businesses need to work harder to keep up. It’s that the legislator has a role to play in making the law itself more accessible, more coherent, and more practical to apply. Simplification shouldn’t be read as a retreat from protection. Done well, it’s the opposite: a legal framework that companies can actually understand and implement protects people more effectively than one that is technically comprehensive but practically unworkable. The Digital Omnibus is a chance to prove that the EU can regulate with the same ambition and greater discipline.
How companies can navigate through the legislative maze
None of this is an argument against regulation itself. EU digital regulation has produced real, necessary protections. It’s an argument for regulatory discipline: consolidation over proliferation, clarity over volume, and outcomes over box ticking.
In the meantime, businesses still have to operate within the framework as it exists today, however complex it may be. This is where I try to make a difference. With twenty years advising organizations on European privacy, data protection, cybersecurity, AI, and digital legislation, my approach is deliberately business friendly, risk-based and pragmatic. Proust Legal helps organizations cut through the complexity of overlapping EU legislation, put in place compliance frameworks that are actually workable day to day, and carry out risk assessments before they bring products and services to the European market. The goal is always the same: turning an intimidating wall of regulation into a set of practical, manageable steps.
The need for more balanced legislation
Which brings me back to that classroom in Oxford. When a future business leader answers “who cares” to a question about AI regulation, that is not a sign that regulation doesn’t matter. It’s a sign that the regulation, as currently constructed, has failed to make its own case. Good law should provoke engagement, not indifference.
If we want the next generation of business leaders, and the companies they will one day run, to genuinely care about compliance, we need to give them rules they can actually understand and follow. Because a law nobody can be bothered to engage with is a law that, in practice, protects no one.
Published on: September 19, 2026