Can the Brussels Effect Keep Pace With Artificial Intelligence?
The European Union’s General Data Protection Regulation did more than establish privacy rules within Europe. It influenced how organizations handled personal information around the world. For many multinational companies, applying a broadly consistent privacy framework across their operations was more practical than maintaining entirely different systems for different jurisdictions.
This international influence became known as the Brussels Effect. Access to the European market gave European rules practical reach beyond Europe’s borders.
A new SANS Institute discussion paper, The EU AI Act: GDPR for the 2020s, or the Limits of the Brussels Effect?, asks whether the European Union’s Artificial Intelligence Act could have a similar influence. The comparison is understandable, but it also reveals why governing artificial intelligence may be substantially different from governing personal data.
A More Dynamic Compliance Problem
GDPR compliance required considerable organizational work. Companies had to identify the personal data they held, understand how it moved, document processing activities, manage vendors, respond to individual rights, and prepare for data breaches.
Once established, much of that compliance infrastructure could become part of an organization’s continuing operations.
The SANS paper suggests that AI governance may be less stable. An organization must first identify the AI systems it uses, including capabilities embedded within licensed software or introduced through vendor updates. It must then determine how each system is classified and what obligations follow from its particular use.
That assessment may not remain valid for long.
An AI system can change through updates, fine-tuning, integration, or a new use. A system that initially appears low risk might later support decisions involving employment, access to services, safety, or other consequential matters. The organization’s legal role may change as well. The paper notes that a company deploying a third-party system could acquire greater responsibilities if it substantially modifies, rebrands, or repurposes that system.
AI compliance may therefore require more than constructing a governance framework and maintaining it. It may require continuously asking whether the organization is still governing the same system, performing the same role, and facing the same risk.
Governance Across a Supply Chain
The comparison with GDPR also becomes more complicated when supply chains are considered.
Data protection law commonly distinguishes between controllers and processors. AI systems may involve a longer and less transparent chain consisting of model developers, system providers, integrators, distributors, deployers, data suppliers, and downstream users.
One organization’s ability to evaluate an AI system may depend on documentation, testing, and disclosures produced by another organization. Yet downstream organizations may have limited visibility into how a model was trained, modified, evaluated, or updated.
This creates an important practical question. Can a company demonstrate responsible AI governance when essential evidence remains elsewhere in the supply chain?
The answer may influence whether organizations standardize their practices globally or separate their European operations from activities elsewhere.
What Might Spread Beyond Europe?
The Brussels Effect does not necessarily require every country to adopt legislation identical to the EU AI Act. Its broader influence may appear through organizational practices.
Companies preparing for the Act may develop AI inventories, assign accountability, classify systems by risk, strengthen vendor reviews, document important decisions, and monitor systems after deployment. Once those capabilities exist, organizations may use them beyond Europe because maintaining one governance process can be easier than operating several incompatible ones.
In that sense, the most influential export may not be the precise language of the regulation. It may be a collection of governance habits.
There are also reasons for caution. AI technologies and uses change rapidly. Regulatory interpretations are still developing, technical standards remain important to implementation, and different jurisdictions are pursuing different approaches. Organizations may decide that regional separation is more practical than a single global standard.
The SANS paper does not claim to resolve that uncertainty. It presents questions about organizational readiness, responsibility, implementation costs, supply-chain dependence, and the continuing strength of the Brussels Effect. Those questions may be more useful than an early prediction.
The GDPR helped make privacy a permanent organizational responsibility. The EU AI Act may do something similar for artificial intelligence, but under more fluid conditions.
If the technology, its uses, and the roles surrounding it continually change, can regulation still produce a stable global standard? Or will the Brussels Effect itself have to evolve?
References and Further Reading
SANS Institute. The EU AI Act: GDPR for the 2020s, or the Limits of the Brussels Effect? Discussion paper, September 2026.
Regulation (EU) 2024/1689: Artificial Intelligence Act, EUR-Lex.