Issue #11 - Nov 20, 2025

The EU is giving away its regulatory leverage without securing the innovation policy it needs to compete

The Digital Omnibus package proposal revealed yesterday by the European Commission is probably the most consequential EU shift on regulatory rules for the past decade, influenced by US pressure over trade tariffs and the political acknowledgement that being first of regulation is vain if we can’t be first on technology. The EU is substantially weakening GDPR's AI constraints by giving a free pass with legitimate interest. The impact of such changes could be massive for EU enterprises and tech companies, who had so far treated data processing mostly as a legal risk rather than a business opportunity. Still, big tech will be the immediate beneficiary of such change. Right now this political announcement may represent a huge leverage to appease the US administration. The file will have to go through the EU legislative process, and so much can happen until its final adoption. This follows a pattern of retreat under US pressure that began with July's asymmetric trade deal and intensified with Trump's August threats to target digital regulations with tariffs. While the EU undoubtedly has to change its regulatory rules, it must at the same time run an ambitious innovation policy largely laid out by Draghi/Letta. Otherwise we risk seeing A16Z keep making bad jokes about us for a very long time.

Big tech could immediately boost the training of its AI models

What is this file about? First, providing an additional delay for high-risk systems developers to comply with the AI Act. The second, and by far the most significant, is the clarification of the legal basis for the use of personal data to train AI models. After a public campaign led by Meta, then joined by many EU companies, and likely after acknowledging the uncertainty caused by the current rules, the EC suggests to amend the GDPR and to allow legitimate interest (instead of consent) to train AI models. This is big, because it essentially allows the use of personal data without asking for consent, and instead proposing opt out, with consent bundled into terms of use at sign-up. For US big tech, it would have been impossible to collect consent from EU users, unless a significant improvement of service would have been offered in exchange, thus the proposition of the EC represents a major win for them. It also represents a win for all companies who have called for a legal certainty over the use of legitimate interest made somehow complex after the EDPB opinion. The file also allows the collection and AI training of special categories of data, which involves for example race, religion or belief, and sexual orientation, a red flag for privacy advocates such as NOYB. Critics also warn the proposal could enable access to data stored on users' devices and intimate personal information. Overall the proposition could represent an immediate boost for large tech companies, starting with Meta, Google or Amazon, already sitting on these data but legally prevented from using them.

Fast growing EU startups get a compliance release

Small and mid-cap companies (less than 750 employees and EUR 150 million turnover) are proposed to benefit from a proportionate scrutiny from AI Act provisions, likely a win for Mistral and other similar fast-growing players in the EU who need a temporary regulatory relief to compete with US champions.

What it could mean for the future development of AI in Europe

The simplification of rules for AI training proposed by the EC would provide legal certainty and compliance ease for companies currently developing AI systems or models. Many constraints are still around such as copyright issues, but the EU is clearly moving towards leveling the playing field with the US on data protection. The impact for any EU company using data for AI purposes could be major. Banks and insurance companies for example could suddenly be able to train systems with sensitive data of customers, allowing predictive models, personalized banking assistants trained on customer interactions, etc. as long as they respect GDPR obligations that remain the same, such as running a balancing test, providing the right to object/opt-out, respect transparency obligations and purpose limitations. But the shift from requiring explicit consent to legitimate interest fundamentally transforms the compliance burden.

In the meantime, A16Z openly joke about the EU

In a recent podcast recorded by A16Z, a leading Silicon Valley VC, Marc Andreessen, A16Z’s CEO along with David Sacks, the crypto chief of the US admin, joke about the EU and how far they are from the current AI revolution, by commenting on the EU fund saying “they just announced a big new public private sector tech growth fund for EU companies to scale. It's almost like a game show or something. They do everything they can to strangle them in their crib, and then if they make it through like a decade of abuse of small companies, then they're gonna give them money to grow”. And then David Sacks jumps on it and says “Well, Ronald Reagan had a line about this, which is if it moves, tax it, if it keeps moving, regulate it, if it stops moving, subsidize it. The Europeans are definitely at the subsidize it stage”. To be fair, it’s embarrassing to see that prominent voices of the US tech industry, and strong support of the Trump Administration, openly make fun of a whole continent knowing that there will be no consequences to their saying. Marc Andreessen even acknowledges it by saying “I shouldn’t beat on them too much”... But, they also have a lot of ideas. Among these, A16Z has recently published tech policy principles on AI. They essentially contradict everything the EU does, starting with the precautionary principle. They are extremely influential since they have led the US tech departure from the Democratic to the Republican side ahead of the past Presidential election. They are shaping the crypto policies of the US, advocating for a single federal AI law that would represent the least common dominator, and use the China threat as a driver of “effective” regulation. In this depiction of the world, the EU has somehow become an annoying partner that essentially prevents the US companies from fully competing with China.

Where is the EU Innovation strategy?

Arguably, the omnibus package sounds like a direct response to this criticism. With a European Parliament prone to compromises, the EC may have found the perfect line of direction: ease relations with the US by getting rid of rules Big tech doesn't like anymore.

But here's what's missing: an actual innovation strategy. The omnibus is all stick removal, no carrot addition. The omnibus removes barriers to AI training, but data access alone won't create European AI champions. Where's the coordinated compute infrastructure investment? Where's the talent retention strategy when European AI researchers flee to San Francisco? The EU is playing defense when it needs offense. Weakening GDPR under US pressure might buy temporary relief from tariff threats, but it doesn't address why Mistral raised €6 billion while OpenAI commands $500 billion in valuation. It doesn't explain why European pension funds invest in US tech stocks instead of European startups. It doesn't solve why the EU has produced zero $100 billion tech companies in the past decade. This is the dangerous part: the EU is giving away its regulatory leverage without securing the innovation investments needed to compete. Draghi's report outlined €800 billion in annual investment gaps. The omnibus costs the EU nothing politically but delivers exactly what Big Tech lobbied for. Meanwhile, the US combines loose regulation with massive CHIPS Act investments, defense procurement for AI, and aggressive talent recruitment.

The real question isn't whether GDPR needed fixing—it did. It's whether the EU has the political courage to build European AI capabilities, or whether data deregulation is just the EU's way of managing decline while Silicon Valley writes the rules. Draghi can still wait, it seems. But Europe's strategic autonomy can't.