The Challenge of European AI Risk Management: An Iron Cage for Water?

ABSTRACT The European Union recently approved and adopted a new regulation for artificial intelligence (AI) that represents a watershed approach. It is the first regulation valid for all Member States, also affecting providers of AI operating outside Europe but providing AI services/applications for the EU market. The regulation, to be adopted within 2 years by the Member States, outlines a new regulatory apparatus based on a risk management approach, with high‐level principles such as human centricity, and at the same time, very specific technical requirements to manage future risks. However, AI applications are malleable and evolving. Moreover, an original AI application can be taken and used to build another application, thereby continually expanding AI tools and reach. In this article, we focus on the challenges for the public sector, ostensibly the orchestrator of regulatory apparatus implementation proceeding at the time of this article. This article's specific focus is on risk management and the emergence of another malleable concept—trustworthiness. It offers insights and guidance for public sector researchers and policymakers, highlighting the distinctive characteristics of AI and the European AI Act and warning of the danger that the apparatus could become an iron cage of specific requirements that fail to contain AI, which can behave like water unconstrained by a regulatory iron cage.