The Illusory Normativity of Rights-Based AI Regulation

Whether and how to regulate AI is now a central question of governance. Across academic, policy, and international legal circles, the European Union is widely treated as the normative leader in this space. Its regulatory framework, anchored in the General Data Protection Regulation, the Digital Services and Markets Acts, and the AI Act, is often portrayed as a principled model grounded in fundamental rights. This Article challenges that assumption. We argue that the rights-based narrative surrounding EU AI regulation mischaracterizes the logic of its institutional design. While rights language pervades EU legal instruments, its function is managerial, not foundational. These rights operate as tools of administrative ordering, used to mitigate technological disruption, manage geopolitical risk, and preserve systemic balance, rather than as expressions of moral autonomy or democratic consent. Drawing on comparative institutional analysis, we situate EU AI governance within a longer tradition of legal ordering shaped by the need to coordinate power across fragmented jurisdictions. We contrast this approach with the American model, which reflects a different regulatory logic rooted in decentralized authority, sectoral pluralism, and a constitutional preference for innovation and individual autonomy. Through case studies in five key domains -- data privacy, cybersecurity, healthcare, labor, and disinformation -- we show that EU regulation is not meaningfully rights-driven, as is often claimed. It is instead structured around the containment of institutional risk. Our aim is not to endorse the American model but to reject the presumption that the EU approach reflects a normative ideal that other nations should uncritically adopt. The EU model is best understood as a historically contingent response to its own political conditions, not a template for others to blindly follow.