EU AI Act's Real Enforcers Are Law Firms, Not Governments

A Dentons partner is writing GDPR-AI crossover memos. K&L Gates is tracking Luxembourg's harmonization timeline. The EDPB and EDPS issued a joint opinion on implementation that Inside Privacy covered at length, that Hunton Andrews Kurth summarized for clients, and that nobody else noticed. This is what a regulation looks like when it's working as designed — handed off from legislators to the professional class whose job is to make it operational. The EU AI Act didn't die in committee. It graduated into billable hours.

The scale of that graduation is real. The volume of AI regulation coverage has roughly doubled over the past month, but almost none of that increase comes from controversy. It comes from process: guidance documents, compliance deadlines, consultation windows, and law firm newsletters written for general counsel who need to know what their European subsidiaries have to do before 2026. The EU's decision to push certain provisions to 2027 generated its own coverage cycle, but even that landed as administrative news rather than political drama — a scheduling adjustment, not a retreat. The story that would have set activist Twitter ablaze five years ago now lands in an IAPP roundup and moves on.

The one community watching with genuine anxiety is the open-source and IP crowd tracking the copyright consultation. The EU's parallel process on training data provisions has pulled in a different audience than the compliance world — developers and IP lawyers who understand that how the Act classifies general-purpose AI models will determine whether training on unlicensed data becomes legally untenable in Europe. That fight is unresolved, and it's the one most likely to generate the next real public controversy, because its stakes are legible to people who aren't regulatory attorneys. A compliance deadline is abstract. A rule that changes what you can train a model on is not.

Scroll through the American side of this conversation and you find almost nothing. The r/politics posts that brush against AI regulation are about Trump, the SAVE Act, and Iran — the classification is catching general political noise, not a genuine domestic debate about AI governance. That absence is its own story. There is no U.S. equivalent of the EU AI Act conversation happening anywhere ordinary people argue about policy. This isn't just a legislative gap; it's a public attention gap. The question of whether the United States should have AI rules at all has quietly been set aside, and no one seems particularly agitated about that — not on Reddit, not on X, not in the general-interest press.

What's developing is a two-speed world. Europe is arguing about implementation — dense, procedural, boring to everyone except the people for whom it will eventually mean audits, fines, and restructured products. America isn't arguing about much at all, which means the European framework will default into the position of setting global standards for any company that operates across both markets. That outcome was never voted on in the U.S., and it will arrive so gradually that by the time American companies start objecting loudly, the compliance infrastructure will already be built. The lawyers finishing their fine-print reading aren't just preparing for a fight — they're winning it in slow motion.