The entry into force of Regulation (EU) 2024/1689, better known as the AI Act, has immediately sparked a comparison that is likely to become a recurring theme in both legal and technological debates: is the European Union achieving, in the field of artificial intelligence, what the GDPR represented for the protection of personal data?

This is not merely a journalistic or popular question. Rather, it provides an opportunity to reflect on the role that the European Union intends to play in regulating emerging technologies and on the gradual construction of a European model of digital governance grounded in the protection of fundamental rights. If the GDPR marked a turning point in the way personal data protection is conceived, establishing itself as a regulatory benchmark far beyond the borders of the Union, the AI Act appears to be a candidate for a similar role in the field of artificial intelligence.

The two instruments, however, should not be conflated merely because they share a European origin. The GDPR and the AI Act emerged in different contexts, pursue partially distinct objectives, and are built around different legal interests. On the one hand, Regulation (EU) 2016/679 protects the fundamental right to personal data protection; on the other, the AI Act seeks to regulate the risks associated with the development and deployment of artificial intelligence systems, with the aim of ensuring that such technologies remain safe, trustworthy, and consistent with the fundamental values of the European legal order.

The parallel between the two regulations nevertheless appears inevitable. Both represent ambitious attempts to govern global technological phenomena through supranational legal intervention; both are based on the premise that innovation cannot develop in the absence of appropriate safeguards for individuals; and both aspire to generate effects that extend beyond the European market, influencing standards and operational practices worldwide.

It is precisely this phenomenon, often described in legal scholarship as the “Brussels Effect,” that may re-emerge in relation to artificial intelligence. The economic importance of the European market and the extensive reach of the AI Act make it plausible that many international operators will choose to align their systems with European requirements not only for activities carried out within the Union but also on a global scale. Access to the European market could therefore become a powerful driver of regulatory harmonisation, encouraging developers, providers, and users of AI systems to adopt common standards of transparency, security, and human oversight.

This potential extraterritorial impact derives not only from the size of the European market but also from the philosophy underlying the regulation itself. The AI Act does not merely introduce a series of sector-specific obligations; rather, it establishes a broader framework for governing artificial intelligence and its interaction with society.

Beyond its specific provisions, what is most striking about the AI Act is the ambition underlying the legislative intervention. The European Union is not simply attempting to keep pace with technological developments; it is seeking to anticipate them by creating a legal framework capable of governing phenomena that remain in constant evolution. In this sense, the regulation appears less as a sectoral instrument and more as a statement of principle: technological innovation is not regarded as a sphere beyond the reach of law, but rather as an area in which legal rules must provide guidance, direction, and protection.

The true novelty of the AI Act may therefore lie not in the individual obligations it introduces, which will inevitably evolve alongside technology, but in the affirmation of a more general principle: the development of artificial intelligence cannot be left exclusively to market dynamics or to the self-regulation of economic actors. Instead, it requires a common framework capable of balancing innovation, competitiveness, and the protection of rights.

This broader perspective helps explain why the comparison with the GDPR remains so compelling. In both cases, the European Union has sought not merely to regulate an existing technology, but to promote a particular vision of the digital society, founded on the belief that technological progress and legal safeguards must evolve together. If the GDPR represented an attempt to define the rules of the data-driven society, the AI Act may represent a first step toward defining the rules of the algorithmic society.

Almost ten years after the GDPR came into force, the European Union is once again asserting itself as a key actor in the regulation of emerging technologies. While Europe continues to lag behind the United States and China in the industrial development of artificial intelligence, it appears determined to lead in shaping its legal framework, promoting a model based on the protection of fundamental rights, transparency, and accountability.

In this context, describing the AI Act as the “GDPR of artificial intelligence” is undoubtedly a simplification, but not an entirely unfounded one. Just as the GDPR contributed to redefining global standards for personal data protection, the AI Act aspires to become an international reference point for the governance of artificial intelligence systems, leveraging both the regulatory influence and the economic attractiveness of the European market.

Whether the regulation will ultimately achieve an impact comparable to that of the GDPR remains to be seen. What already appears clear, however, is that the debate surrounding artificial intelligence is no longer confined to technological innovation alone. It increasingly concerns the rules that will shape its development. And once again, Europe appears intent on playing a leading role, not in the race to build the most advanced algorithms, but in designing the legal framework within which those algorithms will operate.