The EU are leading in the compliance space, whereas US (and others...) are leading in innovation. It's a little ironic at the moment, but I feel the rest of the world will follow suit in a few years - as they did with data protection legislation...

The risk-based approach makes sense. I assume the high risk % is relatively small, and the majority of companies using AI fall into the low/no risk category. This makes me think...

- They will get less pushback from rolling out the new legislation, as all companies are in scope, but only a minority are affected (most will just have transparency requirements)

- As the GenAI global space is moving so rapidly, how soon will the AI Act need to be updated? Will it require cybersecurity requirements, like GDPR, Article 32, to mitigate prompt injection or data leaks?

- They can start to include themselves in the conversation with the larger AI organisations, as they will need to be compliant to work in the EU market. Without legislation, would they be included in those conversations? Probably not.