I. The Claim
The EU AI Act (Regulation 2024/1689) is described by the European Commission as "the first-ever comprehensive legal framework on AI worldwide," designed to "foster trustworthy AI" and protect fundamental rights. It entered into force on August 1, 2024, with full applicability for high-risk systems due on August 2, 2026. It is presented as Europe's democratic answer to unregulated American and Chinese AI development.
II. The Inversion
What the regulation says vs. what the regulation does
The AI Act says it regulates AI in the public interest. What it structurally does is create a compliance market worth billions, controlled by the same actors who lobbied to weaken the regulation in the first place. The companies that spent the most to water down the rules are now best positioned to sell compliance with the weaker rules they helped write. The regulation does not primarily regulate: it redistributes costs from those who create risk to those who must prove they are managing it.
III. Who Lobbied
According to data from the EU Transparency Register analyzed by Corporate Europe Observatory (CEO) and LobbyControl (October 2025), the tech industry spends approximately €151 million annually on lobbying in Brussels, a rise of more than 50% compared with four years ago. The ten largest spenders alone account for €49 million, up from €40 million two years prior. CEO/LobbyControl, Oct 2025
Meta: €10 million/year
Top spender. Simultaneously the subject of multiple enforcement actions under existing EU law (GDPR, DSA) and a leading voice calling for "regulatory simplification."
EU Transparency Register via CEOMicrosoft & Apple: €7 million/year each
Microsoft increased its budget by €2 million. Microsoft is also the largest investor in OpenAI, which develops the general-purpose AI systems that the Act was supposed to regulate most strictly.
Euronews, Oct 29, 2025Amazon: budget increase of €4.2 million
The largest single budget increase among the top ten. Amazon Web Services is a leading provider of cloud infrastructure on which AI compliance tools will run.
Euronews, Oct 29, 2025Google & Microsoft: lobbied to remove "large-scale illegal discrimination" from systemic risks
Internal documents obtained by CEO show a coordinated effort to reclassify large-scale illegal discrimination from "systemic risk" (requiring mandatory mitigation) to an "additional risk for consideration" (optional). They succeeded.
CEO, "Coded for Privileged Access," Apr 2025IV. The Revolving Door
Aura Salla: European Commission → Meta/Facebook lobbyist
Left the European Commission, became a Meta lobbyist within three months. After a one-year cooling-off period, she resumed direct engagement with Commission officials, including meetings with members of Vice President Vestager's cabinet. Corporate Europe Observatory found that approximately three-quarters of Google and Meta's EU lobbyists have formerly worked for a governmental body at the EU or member state level.
CEO, "The Lobbying Ghost in the Machine," Feb 2023Cédric O: French Secretary of State for Digital Transition → Mistral AI
Former Secretary of State with direct access to President Macron, placed in charge of Mistral AI's EU lobbying office in Brussels. Co-authored an open letter signed by 150 European companies claiming the AI Act "would jeopardise Europe's competitiveness." Played a key role in pushing France to oppose regulating foundation models.
CEO/Social Europe, Nov 2023V. What They Got
The lobbying produced measurable results. General-purpose AI models (the products of Google, Microsoft, OpenAI, Meta, Mistral) were largely exempted from the strictest rules, reduced to transparency obligations rather than the fundamental rights assessments originally proposed. High-risk AI systems can be self-assessed by their own developers rather than by independent bodies. Large-scale illegal discrimination was removed from the category of systemic risks requiring mandatory mitigation. CEO, Mar 2024
In November 2025, the European Commission went further. Its "Digital Omnibus" package proposed weakening both the GDPR and the AI Act simultaneously, including permitting the use of personal data (including sensitive data such as sexuality, political beliefs, and ethnicity) for AI training. Corporate Europe Observatory and LobbyControl traced the Commission's proposals line by line to industry lobbying positions. CEO/LobbyControl, Jan 2026
VI. The Compliance Market
With the August 2, 2026 deadline for full applicability of high-risk AI rules, a compliance industry has materialized. Conformity assessments, risk management systems, quality management frameworks, technical documentation, EU database registration: each requirement creates a market. The companies best positioned to serve this market are the large consulting firms and tech companies that participated in drafting the standards, sitting on CEN/CENELEC committees alongside the companies they would assess. The AI Act explicitly relies on harmonized standards for compliance, and the standardization process has been dominated by industry participants.
The circular structure
Step 1: Spend €151 million/year lobbying to weaken the regulation. Step 2: Secure self-assessment instead of independent assessment for high-risk systems. Step 3: Get large-scale discrimination removed from mandatory systemic risk mitigation. Step 4: Participate in drafting the technical standards that define compliance. Step 5: Sell compliance consulting, tools, and infrastructure to every company that must now comply with the rules you helped write. The cost of compliance is paid by smaller companies that had no seat at the table. The benefit accrues to those who shaped the table.
VII. The Pressure from Washington
The lobbying is amplified by direct pressure from the US government. In February 2025, Vice President JD Vance publicly stated that "in Europe free speech is in retreat." In August 2025, Secretary of State Marco Rubio instructed diplomats to undermine the EU's Digital Services Act. The Computer and Communications Industry Association (CCIA), a Big Tech lobby group, called for a pause in the implementation of the AI Act. Mario Draghi's competitiveness report singled out the GDPR and AI Act as burdens on innovation, echoing industry talking points. Euronews, Oct 2025
The alignment between American deregulatory pressure and European industry lobbying is not coincidental. It is structural. The same companies (Meta, Google, Microsoft, Amazon) fund lobbying on both continents, and the Trump administration's hostility to European regulation serves the same commercial interests that the €151 million annual lobbying budget serves in Brussels.
VIII. Who Pays
Citizens whose fundamental rights protections were weakened. Small and medium enterprises that must now comply with rules they had no role in shaping, using standards they had no role in drafting, often through consulting services sold by the companies that lobbied to shape those very rules. Civil society organizations that were structurally excluded from the drafting process: 86% of high-level Commission meetings on AI were with industry, not with the public the regulation claims to protect. Workers subject to AI-driven hiring, scoring, and management systems, whose protection under the Act was reduced to accommodate the business models of the companies deploying those systems. And everyone who interacts with AI systems that can now discriminate at scale without mandatory mitigation, because Google and Microsoft successfully argued that large-scale illegal discrimination should be merely optional to address.
The AI Act is not a failure. It is a success, for those who shaped it. It creates the appearance of regulation while structurally benefiting the regulated. It transfers the cost of compliance to those with the least power and the least voice. It is a textbook case of regulatory capture, executed in broad daylight, with public money paying for the institutions that were captured.
Every source cited in this document is a public record. Every claim is verifiable. This is what the regulation looks like when you read it from the position of those it claims to protect.
Commission a Radiograph
This analysis was produced by Claude for Andrea Colamedici as a demonstration of the radiograph methodology: sourced power mapping of any entity, policy, or network using public records. If your organization needs this kind of analysis, it is available as a service.
Get in touch