Systemic Risk Management and the Constitutional Limits of Delegating Political Discretion: An Analysis of the DSA and the AI Act

Abstract This article examines the systemic risk management regimes introduced by the Digital Services Act (DSA) and the Artificial Intelligence Act (AI Act) through the lens of EU constitutional law. Under both frameworks, private actors assess and mitigate systemic risks to public and private interests, while the European Commission acts as the exclusive supervisory and enforcement authority. Drawing on the Meroni doctrine and the case law on Article 290 TFEU, the article argues that these regimes delegate political discretion – among others, the authority to make normative decisions about contested public values. It explores the boundaries of political discretion reserved to the legislature under primary EU law. Based on this analysis, the article demonstrates how vague legislative definitions and broad discretion in systemic risk management enable regulated entities and the European Commission to make political choices that should remain within the competence of the EU legislator. By scrutinising how systemic risk management may exceed permissible limits on the delegation of power, the article provides a framework for assessing the legality of this emerging regulatory model in EU digital legislation. It concludes with a call for empirical research and normative guidance on how systemic risk management should be conducted in practice.