The AI Act's paper trail: what Europe's rulebook can and cannot show

The freshest item in this file is not a Brussels announcement. It is a question about method.

On 3 November, Tech Policy Press published an analysis. It asks how the EU AI Office can see the choices behind frontier labs' safety claims. The piece lands in the gap between what the AI Act requires companies to write down and what a regulator can verify. That gap is not a detail of drafting. It is the difference between a filing and a finding. The analysis treats it as the central problem, not a footnote.

The same gap shows up in a different sector, with harder numbers attached.

A contract, a claim, and 29 trusts

The Guardian reported on 2 November that 29 hospital trusts are listed by NHS England as "realising benefits" from Palantir's £330m federated data platform. Those trusts said the system is not live or that they use none of its applications. The findings came from more than 100 freedom of information requests obtained by the medical charity Medact. NHS England states on its website that 137 trusts are "live" with the FDP.

The individual statements are specific. Epsom and St Helier said it was "not using FDP at the moment". Kent and Medway said the trust "has been focused on other priorities ... the FDP is not currently live". University Hospitals of North Midlands was blunter: "FDP is not live. We do not intend to roll it out in the future."

One senior health official quoted by the Guardian called the gap between the NHS claim and the trusts' understanding "very misleading". This matters to the AI Act argument. It is the same failure mode in miniature: a deployment recorded as a benefit, a user saying otherwise, and no independent register that settles it.

The Guardian also notes that NHS England has claimed 117,539 more operations were carried out by trusts using the FDP in a year. NHS England conceded this summer it could not prove cause and effect. The Office for Statistics Regulation ran an investigation and told the paper it will now take the matter forward under its casework function.

"If many NHS trusts don't see the value of the FDP, serious questions need to be asked about whether the hype surrounding Palantir's products matches reality."

That is Chi Onwurah, chair of the Commons science and technology committee, quoted in the Guardian's report. She called on the government to activate the 2027 break clause in Palantir's contract. She also wants an open competition for a UK-based supplier. The Commons health select committee is also calling for ministers to pull the deal. Palantir's UK and Europe chief executive, Louis Mosley, told the Guardian that ending the contract would be "putting politics above patients".

What the rulebook can see

The AI Act's transparency obligations rest on documentation: technical files, risk assessments, declared training data summaries, incident reports. A regulator reads what a lab wrote. The Tech Policy Press analysis asks the obvious next question. Does the AI Office have any route to the choices behind those sentences, or only to the sentences themselves? The EU AI Office's response is not public, so the question stays open here.

Other recent coverage points at the same institutional strain. Voxeurop argued on 3 November that Big Tech has made itself effectively untouchable in European enforcement. That is a claim about political economy, not compliance. Tech Times reported on 3 November that Europe, Japan and South Korea have proposed a global AI standards body modelled on 5G, without the US or China in the room. The same outlet reported on 3 November that an AI agent hacked GitHub during a government AI safety test. It also reported that TÜV is demanding pre-market AI audits.

Each of those stories describes a mechanism for checking claims. None of them describes a working one.

The money is not waiting

The investment picture sits awkwardly beside the compliance debate. Tech.eu's weekly recap, published on 2 November, tracked more than 60 European tech funding deals worth over €1.3 billion in the previous week. AI took €815.6 million of it, ahead of healthtech at €121.1 million and fintech at €104.1 million. The UK alone accounted for €1 billion, followed by Switzerland on €74.4 million and Spain on €59.5 million.

Smaller rounds show the same direction of travel. Tech.eu reported on 2 November that London-based LO:TECH raised $12 million in a Series A led by MMC. Faction, 13 Books Capital and Atka participated. The company builds trading infrastructure for round-the-clock and onchain markets. Tim Meggs and Marcus Horsley founded it, and it is pitching execution services across traditional, digital and prediction markets. Whatever the AI Act says about a trading system, the capital is already committed.

Hardware is moving faster still.

TechCrunch reported on 2 November that Marvell has signed an all-stock deal to acquire Lumentum. The deal has an enterprise value of $115 billion, including debt, and an equity value of about $80 billion. It offers 4.5 Marvell shares per Lumentum share. The transaction is expected to close in the first half of calendar year 2028, subject to shareholder and regulatory approval. Nvidia is a shareholder in both companies, having invested $2 billion in each earlier this year, according to TechCrunch.

Research does the measuring

Where policy is thin, the technical literature is at least producing numbers. Semiconductor Engineering's 3 November roundup lists new papers. They include work from imec and Vrije Universiteit Brussel on the embodied emissions of 2.5D and 3D scaling in chipletized GPUs for low-carbon AI. KU Leuven and EURECOM contributed work on SecDMP, described as provably secure data memory-dependent prefetching. IBM Research contributed work on meter-scale quantum interconnects between large quantum processors.

Those papers do not regulate anything. They do something the current enforcement debate lacks: they state a method and a result that someone else can check.

The AI Act's audit trail will need the same property. The Guardian's FOI haul suggests how far the UK is from having it. The questions now going to the EU AI Office suggest Brussels knows the same test is coming.