Tobie Langel advises technology companies, standards organisations, NGOs and the European Commission on open technology ecosystems.

Understand the Intent
The EU's goal is to make software fair, secure, understandable and transparent. AI is software, so the Cyber Resilience Act, GDPR and DORA matter as much as the AI Act. "I think software is becoming regulated now, and we all have to accept this."

Compliance as an Outcome
Fix the basics first: data, development processes, security controls. One company that moved processing onto users' devices saw its sales cycles shrink dramatically.

Europe as an Organised Market
Europe uses the size of its single market to anchor its values in legislation, with effects well beyond its borders. Understanding that project matters more than any single line item.

Beyond the AI Act
Because the AI Act has "AI" in its name, many organisations look only at it. Yet AI is software that handles private or confidential data, so most other EU legislation applies too. The hard part is the basics: data in order, development processes, encryption, storage, who processes what. "Essentially, there's nothing very new."

Good Faith Counts
Market surveillance authorities are still organising themselves, and some countries have not yet designated them. In his view, they will be far more understanding towards organisations that strengthen their foundations than towards checkbox compliance.

Why Regulation Matters Known as "the IT guy" in his village, he’s seen an increase in people who have lost money to scams. "If you don't have regulation, you cannot have secure products. It's just not competitive to have secure products."His wish for the coming year: more people tinkering with AI, to understand its benefits, limits and dangers.

"You can't regulate what you don't control." Europe needs both regulation and massive investment in sovereign AI.