EU tech regulation and the AI Act: Trump's self-policing accord collides with Europe's rules

Sony used 1 October to push AI into the base PS5. Its new Quick Spectral Super Resolution, built out of the Project Amethyst work with AMD, is a "new performance tier of AI upscaling," the company said in a blog post, and it shipped the same day as patches for Marvel's Wolverine and Ghost of Yotei, according to The Verge. Digital Foundry's early hands-on found QSSR slower than the PS5 Pro's PSSR because the base console has no dedicated machine learning silicon.

The same day, in Washington, six of the largest AI developers put their names to something with far wider reach. The White House Accord on Superintelligence, subtitled the "Joint Commitment on Frontier Responsibilities," was signed by Meta, Google, OpenAI, Anthropic, Nvidia and xAI and posted to Donald Trump's Truth Social account. The Register, which read the document, reported on 30 September that it requires nothing specific: no definition of "robust" internal controls, no fixed cadence for external audits, no frequency for evaluations.

What the accord does contain is four "layers of controls and audits."

• Internal controls that monitor model capabilities and alignment in cybersecurity, biosecurity and chemical threats, and that stop models hacking systems.
• An internal team to verify those controls and remediation work.
• An independent external auditor or evaluator to assess whether the controls operate as intended.
• A committee of the board of directors to receive reports from the internal and external teams.

German outlet heise online noted on 1 October that the first two of those measures were already standard practice at the signatories, and that the text is written throughout in the conditional, "we believe that ... should," never "we will." Only the penultimate sentence keeps the door open, saying it "may make sense to codify these steps into laws or regulations."

Brussels writes rules, Washington writes a page

The contrast with the EU's approach is not rhetorical. The AI Act is law; the accord is a single DIN A4 page. That gap now shapes how European industry talks about the technology. In a POLITICO Europe report published on 24 September, James Wise, a partner at Balderton Capital and chair of the UK government's sovereign AI fund, pushed back on the US-generated panic: "Sadly, it has jumped up to the Terminator is coming. I don't think the Terminator is coming at all."

Marcus Hutchins, the researcher credited with stopping WannaCry, told POLITICO that doomsday theories "completely neglect to factor [hacker] behavior and capabilities" into their models. Alexandru Voica of UK firm Synthesia argued the priority should be making existing rules work at scale rather than chasing theoretical risks.

That argument matters because the incidents cited as proof of danger are contested. Anthropic's new molecular biology lab said its AI agents had flagged a previously uncatalogued pattern around an enzyme, one "reminiscent" of the work that led to CRISPR. MIT Technology Review reported on 29 September that biologists disputed whether finding a pattern counts as a discovery at all. One researcher said his team had already found the same pattern, raising the question of whether Anthropic's system had learned from his conversations with Claude.

In Brussels, the AI Act is being tested on a second front. Google has challenged an EU order to share data with rival AI chatbots, according to a report from Global Banking & Finance Review on 30 September, a case that goes to how much access the Commission can compel from a dominant platform.

Self-regulation arrives while money keeps moving

European operators are not waiting for the political argument to settle. Comcast unveiled fiber sensing technology on 29 September that analyses vibrations travelling through fiber to detect construction near buried lines and pinpoint where activity is happening, with Elad Nafshi, its chief network officer, saying the goal is to make "the incredible complexity behind that connection invisible" to customers. The company is also exploring whether the same sensing could trigger an automated drone dispatch to inspect damage, vandalism or wildfires.

Spectrum has gone further on the compute side. At SCTE TechExpo, the newly combined Charter and Cox business said its Edge Compute Infrastructure, built with Nvidia accelerated computing, can reach more than 1,000 smaller facilities already embedded in its network, placing distributed compute within 10 milliseconds of 500 million devices across the US. CEO Chris Winfrey said multi-gigabit deployment "opens up the door" to deeper talks with global Big Tech providers, though he did not detail what those talks would produce, telling the audience: "We're working on that."

Spending plans are not slowing either. Omdia's 2027 outlook, published on 30 September, found 59% of organisations expect AI budgets to rise by 10% or more next year, even as the analyst house predicts buyers will judge those investments on ROI rather than technical superiority. The same report notes hardware delays are already affecting 60% of PC channel partners, and that more than 100 countries are now pursuing digital sovereignty initiatives.

That last figure is where the EU's position gets complicated. Sovereignty costs money, and Omdia's framing is blunt: complete technological independence "will rarely be practical or necessary."

Enforcement, not slogans

Meanwhile the practical failures that self-regulation is meant to catch keep arriving. The Hacker News reported on 30 September that ClickFix, a technique that tricks users into pasting and running malicious commands, was identified by Microsoft's Digital Defense Report as the most common initial access vector, at 47% of observed attacks, and reached 52% of detections in Q2 2026. Roughly one in two phishing attacks is now delivered outside email, and 89% of phishing domains stay active for under two days.

Against that backdrop, the European Commission's enforcement machinery is the part of the AI Act that carries weight. The Federal Reserve's own consultation, opened on 24 September, shows how other jurisdictions are moving through formal rulemaking rather than voluntary pledges: the US central bank asked for public comment on two proposals to build a regulatory framework for payment stablecoin issuers under the GENIUS Act, covering reserve backing, capital requirements and an application process, with comments closing 60 days after Federal Register publication.

The AI Act's problem is not design. It is that the largest developers of frontier models have just signed a document, in Washington, that commits them to nothing enforceable, while the EU's rules apply to the same companies operating in its market. The accord's own words concede the point: codification into law is something that "may make sense" one day.

Until that day, Brussels is the only regulator in the room with a penalty attached.