1. Principle of technology neutrality

Technology neutrality has become a key regulatory principle in the EU since the late 1990s, further reinforced by the emphasis on digital policy over the past decade. Technology neutrality stands for regulating the use and consequences of technology rather than the technology itself.Footnote ⁹ The law should not name or describe a particular technology, but rather utilise terms that encompass a broader array of possible technologies.Footnote ¹⁰ As such, the same regulatory principles should apply regardless of the technology used, without specifying technological means to achieve a given objective or picking winning technologies in a discriminatory fashion.Footnote ¹¹ The principle is motivated by how technological change can challenge regulation in four ways: (a) need for new laws to ban, restrict or encourage an emerging technology; (b) uncertainty over how existing laws classify and apply to new technologies, (c) over-inclusive or under-inclusive scope of laws; and (d) obsolescence of existing legal rules.Footnote ¹² A typical example of a technology neutral regulation is an emissions trading system that incentives reduction of carbon emissions without specifying the means to do so.Footnote ¹³

A key justification for technology neutrality is that it ensures that the regulation is flexible and future-proof to respond to the pace of technological change, without becoming obsolete, distorted or counterproductive. As noted by Puhakainen and Väyrynen,Footnote ¹⁴ the notion of technology neutrality is closely connected to future-proof regulation, which seeks to make legislation adaptive to technological changes by introducing a degree of flexibility to the regulation. For example, the EU’s Better Regulation Toolbox includes technology neutrality as a regulatory design instrument within the umbrella of “flexibility and future-proofing.”Footnote ¹⁵ In other words, neutrality should help the regulation stand the test of time without the need for frequent revisions.Footnote ¹⁶ Technology neutrality can future-proof law in at least two senses.Footnote ¹⁷ First, technology neutral regulation should have a better longevity than easily outdated technology specific legislation and thereby lessen the need for revisions or new laws. Secondly, technology neutrality can facilitate future technological innovations, reducing the chance of the regulation becoming obsolete or counterproductive. Since it is challenging for the regulator to predict adoption of emerging technologies, technology neutrality allows for market-based flexibility in policies.Footnote ¹⁸ While interrelated, the main focus of this article is the first interpretation of future-proofness as longevity of regulation.Footnote ¹⁹

There are multiple instruments by which regulation can be rendered more technology neutral and thereby potentially more future-proof. Generally, this involves drafting regulation in more general and vague terms, with emphasis on broad characteristics such as purpose and function of technologies.Footnote ²⁰ More concretely, future-proofing might mean utilising open-ended norms, goal-based regulation and experimental legislation, along with future-oriented impact assessments.Footnote ²¹ Technology neutral and future-proof regulation usually entails delegating more power to standardisation bodies, agencies and courts for interpreting the more vague legislative provisions and enforcing them in practice. KoopsFootnote ²² also includes multi-level legislation, teleological interpretation and sunset clauses as approaches for implementing technology neutral regulation. Moreover, regulatory sandboxes and technology foresight (including horizon scanning, scenarios, trends analysis) can aid future-proofness of regulation by better anticipating technological development.

However, the pursuit of regulatory flexibility through these instruments is not without drawbacks. A key trade-off is often the reduced legal certainty. This aligns with broader challenges associated with technology neutrality identified by Puhakainen and VäyrynenFootnote ²³ in their scoping review, such as its ambiguous application, lack of a theoretical basis, enforcement costs and potential misuse by regulators. As such, technology neutrality is subject to contextual and even contradictory interpretations depending on how expansively it is formulated.Footnote ²⁴ The principle is arguably subject to different levels of abstraction: technology neutrality primarily functions on a high-level of abstraction in lawmaking, whereas implementation of regulation tends to be more technology specificFootnote ²⁵ by necessity.Footnote ²⁶ The issue then becomes how the principle is operationalised in pursuit of certain goals, such as future-proofing.

2. From telecommunications to AI

The current technological landscape, characterised by AI, is different from the one in which the principle of technology neutrality initially emerged. This raises questions as to whether the principle is still a sound regulatory principle in the light of advanced AI systems. The principle of technology neutrality was first enacted in the EU in the context of telecommunications through Directive 2002/21/EC on a common regulatory framework for electronic communications networks and services. In the regulation technology neutrality was operationalised through minimal intervention, emphasising competitive market outcomes and non-discrimination between competing networks.Footnote ²⁷ The legislation explicitly cautions against regulating emerging telecommunication markets and assumes that the sector will be gradually deregulated due to effective competition. To its credit, the regulatory framework for electronic communications has largely managed to adapt to the sector’s technological transformations due to its technology neutral approach. Yet, even in this case the commitment to neutral and future-proof principles has waned over time within the EU legislature.Footnote ²⁸ Indeed, the hegemonic standing of technology neutrality has come under more criticism in recent years both by scholars and policymakers.Footnote ²⁹ Policy priorities like trustworthy AI systems can require technology specific regulation or subsidies, whereas staunch commitment to technology neutrality might inadvertently maintain unsustainable and outdated technological infrastructure due to market incentives.Footnote ³⁰ AI and previous technological contexts like telecommunications are also subject to other differences, outlined below.

First, the role of AI as a general-purpose technology is not facilitative but constitutive in nature, unlike telecommunication which has a clear intended purpose for facilitating communication. AI systems actively shape and redefine social activities and economic structures, affecting fundamental rights in contexts like health care, education and the justice system. Consequently, AI regulation is intrinsically tied to value-laden political choices,Footnote ³¹ concerning fairness, autonomy and power, rather than about operational concerns like network service disruptions typical of telecommunications. Yet, technology neutrality can mask such normative considerations by delegating democratic decisions to market competition. Second, technical architecture and size of AI models directly affects their capabilities and associated risks. Specifically, larger models can exhibit emergent, unpredictable behaviour – capabilities or outcomes not explicitly programmed – making their societal risks difficult to anticipate and govern.Footnote ³² These emergent capabilities mean that AI systems can effectively transcend their intended purpose or function, posing issues for purely technology neutral regulation designed for telecommunications. Given these new technological affordances, one cannot assume that treating AI “neutrally” will produce equivalent legal outcomes as with previous technologies.Footnote ³³ Third, AI can give rise to more significant path dependencies and lock-in effects in terms of social values and harms, going beyond the market-based interoperability concerns in telecommunications. Machine learning is based on extrapolation of existing social patterns into future predictions through data, therefore potentially reinforcing discriminatory biases across society.Footnote ³⁴ Counterintuitively, technology neutral regulation can exacerbate such lock-in effects by favouring dominant technological infrastructure.Footnote ³⁵

While the differences above should not be overstated, AI does appear to present more emergent risks to fundamental rights that necessitate precautionary and preventive regulatory measures. Moreover, Liu and others warn that reactive, temporary and domain-specific approach – often qualities of technology neutrality – to AI regulation is problematic because: (i) it misconstrues actual severity of AI risks; (ii) treats symptoms of AI rather than the structural causes; (iii) limits anticipatory policies; (iv) overlooks overarching risks of AI; and (v) is ineffective due to rapid technological change.Footnote ³⁶ To avoid a regulatory game of a whack-a-mole, future-proof regulation of AI requires more explicit focus on anticipation of emerging risks, which are not necessarily neutral in terms of technology. The above discrepancies in technological contexts call into question whether strict adherence to technology neutrality is compatible with future-proof regulation of AI. Hence, in the next section I will examine whether the AI Act’s supposed technology neutrality makes it more future-proof in practice, especially in terms of risk governance.

1. Definition of AI

The AI Act’s capacity to include future AI systems in its scope is intrinsically tied to how technologically neutrally it defines AI systems. Both the European Commission and Parliament advocated for a technology neutral, general definition of AI that is future-proof in the Act. The Commission’s proposal for the regulation stated that “The definition of AI system in the legal framework aims to be as technology neutral and future proof as possible, taking into account the fast technological and market developments related to AI.” Footnote ⁴⁷ In adopting its negotiating position, the European Parliament added that it “…wants to establish a technology-neutral, uniform definition for AI that could be applied to future AI systems.” Footnote ⁴⁸ Aligned with the OECD’s influential definitionFootnote ⁴⁹ of AI, the Article 3(1) of the AI Act defines AI systems as machine-based systems with varying levels of autonomy and adaptiveness that infer and generate outputs such as predictions, content, recommendations, or decisions, that can influence their environment after deployment. As such, it broadly covers machine learning and logic- and knowledge-based approaches, while leaving certain simpler systems outside of its scope (Recital 12).Footnote ⁵⁰

The definition of AI systems was heavily debated during the drafting of the AI Act, with the European Council and AI industry advocating for a narrow, fixed definition based on machine learning to ensure legal certainty and ease regulatory burden.Footnote ⁵¹ For instance, the Center for Data Innovation claims that the AI Act violates the basic tenets of technology neutrality because “Instead of addressing unique concerns about uninterpretable machine learning (ML) systems – a subset of AI systems – the Act would apply to a much broader set of AI systems that do not need regulatory intervention.” Footnote ⁵² It is unclear how this supposedly violates technology neutrality, especially as the AI Act primarily regulates certain high-risk AI systems. Such a critique appears to narrowly focus on neutral treatment between AI and other technologies, while disregarding how this forces one to discriminate between different AI technologies (e.g., machine learning versus symbolic reasoning). If one is concerned that the AI Act’s broad definition of AI also covers systems that do not pose novel risks, then that appears a call for technology specific regulation, rather than neutrality. Indeed, proponents of the chosen broad approach argued that a narrow definition would have excluded many existing and future AI systems that pose risks to citizens’ fundamental rights from the regulation’s scope.Footnote ⁵³

The regulation of general-purpose AI (GPAI) models became a key test for the legislation’s definition of AI after the rapid proliferation of large language models and generative AI, like ChatGPT, in late 2022. General-purpose models had not been considered in the original AI Act and their versatility across application domains invalidated the initial focus on only regulating specific use cases of AI. A political agreement was eventually reached on a tiered approach, where all general-purpose model providers have to provide transparent technical documentation, instructions, training summary and follow the Copyright Directive (Article 53(1)).Footnote ⁵⁴ More stringent requirements apply to larger and more capable models that are presumed to pose systemic risk, trained with more than 10^25 FLOPs (Article 51(2)) of computing power (including model evaluations, adversarial testing, risk mitigation, incident reporting and cybersecurity protection as per Article 55(1)). This approach was initially opposed by France, Germany and Italy, who stated that a two-tier approach for GPAI (or foundation) models would violate the technology neutral nature of the AI Act and underlined that “the AI Act regulates the application of AI and not the technology as such.”Footnote ⁵⁵ Similarly, DOT Europe among other industry signatories expressed concern that regulation of GPAI systems is “…not consistent with the AI Act’s technology neutral risk-based approach, which regulates the use of AI systems according to risk, not the types of technology being used” Footnote ⁵⁶ implicitly arguing against technology specific provisions even when faced with more systemic risks of general-purpose models (see section II.2).

Taken together, the broad and technology neutral definition of AI and the specific regulation of GPAI models both appear to render the AI Act more future-proof. The broad definition increases the scope and flexibility of the regulation to respond to technological progress. Simultaneously, the AI Act would have been severely outdated if it did not manage to specifically include GPAI models within its scope. The safety risks and societal impacts of GPAI models are not restricted to specific use cases, arguably necessitating earlier intervention during the development.Footnote ⁵⁷ Even so, the uncertainties and emergent capabilities of such systems make predicting future applications and uses nearly impossible. The critics are right to point out that the provisions for general-purpose models and the FLOP threshold partly violate technology neutrality by regulating the potential risks of a specific subset of AI technologies more strictly. Nevertheless, the key here is that the explicit regulation of GPAI models broadened the scope of the AI Act by expanding its intended-purpose and use case approach to cover more general AI systems. This reduces the chance that certain AI systems or technologies escape the regulation, enhancing its future-proofness in terms of risk regulation. In other words, technology-specific interventions can complement future-proof regulation in so far as they expand its scope and flexibility, at least in the context of AI. As such, the issue for future-proofness is not technology neutrality per se, but whether its implementation expands or restricts the regulatory perimeter in response to technological development.

2. Risk-based approach

The AI Act’s future-proofness is tied to its risk-based approach, which is designed to be technology neutral by focusing on potential risks of AI systems. Regulation of risks is by its nature future-oriented and involves accounting for uncertainty in the type of future harm, its likelihood and severity.Footnote ⁵⁸ Accordingly, the AI Act is built on the distinction between different levels of risks in AI systems: minimal, limited, high and unacceptable, the last of which is prohibited outright (e.g., social scoring). These risk levels are predominantly use case and sector-based following a technology neutral approach. Systems with minimal risks, supposedly covering most AI systems in the market, remain largely unregulated, whereas limited risks systems (e.g., chatbots) only face basic transparency obligations towards the end-users (Article 50). At its core, the regulation targets high-risk AI systems – those posing significant threats to health, safety, or fundamental rights of individuals – which are subject to (self-)conformity assessments to gain access to the EU market (Article 6). High-risk systems include (i) AI systems in products already under EU health and safety harmonisation legislation, and (ii) standalone systems in critical areas listed in Annex III, such as education, law enforcement or migration, unless performing narrow procedural task without affecting decision-making (Article 6(3)).

Under the AI Act, high-risk AI systems must comply with essential requirements covering risk management system, technical documentation, data governance, human oversight, accuracy, robustness, and cybersecurity (Articles 9–15) to enter the market. However, the implementation of this seemingly neutral, risk-based framework reveals potential tensions with democratic and anticipatory practices. The AI Act outsources the crucial task of developing technical standards that operationalise the essential requirements to industry-driven European standardisation organisations (ESOs), namely CEN/CENELEC.Footnote ⁵⁹ Providers of high-risk AI systems then demonstrate compliance with these harmonised standards, either through self-assessment or certification by private conformity assessment bodies, with limited public oversight. Entrusting opaque and private standardisation bodies to interpret the vague ethical and social requirements risks regulatory capture and violation of fundamental rights, and has already drawn criticism for conflicting with EU treaties.Footnote ⁶⁰ Delegating regulatory authority is especially problematic given the social and value-laden nature of AI systems, where normative political decisions can be concealed in technocratic language.Footnote ⁶¹ Despite aiding regulatory flexibility, technology neutral standardisation can thereby result in a democratic deficit where crucial decisions about risks and safety occur outside accountable public processes. This industry dominance can also undermine the credibility of the AI risk assessment process itself, subvert the regulatory goals and hinder proactive risk anticipation and mitigation by AI companies. As noted by Divissenko, technology neutral frameworks tend to largely delegate risk assessment to the market actors and data they report, which can create perverse incentives to under-report risks, thereby hurting the anticipatory capacity of the regulation.Footnote ⁶²

The only explicit mention of future-proofness in the final AI Act links it to capacity for risk anticipation via mechanisms like regulatory sandboxes: “To ensure a legal framework that promotes innovation, is future-proof and resilient to disruption, Member States should ensure that their national competent authorities establish at least one AI regulatory sandbox at national level to facilitate the development and testing of innovative AI systems under strict regulatory oversight before these systems are placed on the market or otherwise put into service.” (Recital 138). Regulatory sandboxes (Article 57) can help the anticipation of AI risks and co-evolution of regulation by allowing pre-deployment testing of AI systems in controlled environments. Although promising, this is also dependent on the rationale underlying the use of sandboxes, which are often dominated by fast market adoption rather than thorough risk mitigation. More centrally, the mandated risk management system for high-risk AI (Article 9(2)), though framed in general, technology-neutral language spanning the AI lifecycle, is inadequately anticipatory and precautionary. The legal requirements focus on identifying and mitigating “reasonably foreseeable risks” from both the intended use and misuse (Article 9(2)) and rely heavily on reactive post-market monitoring (Article 72) after AI systems are deployed.Footnote ⁶³ When pre-deployment requirements exist, they are not particularly broad or binding, such as the fundamental rights impact assessments of potentially affected individuals for public service high-risk AI deployers (Article 27). This coupled with the lack of explicit technology foresight or forecasting mechanisms render the AI Act’s technology neutral approach limited in anticipating more systemic and emergent AI risks.

In essence, while the AI Act’s risk-based approach is by its nature future-oriented, its operationalisation through technology neutrality reveals significant tensions in terms of risk anticipation. The challenges detailed above, including the democratic deficits inherent to standardisation and the reactive risk management system focused on “foreseeable risks” restrict the future-proof potential of the AI Act’s risk-based approach. These limitations are further exacerbated by the reliance on a pre-defined, static list of high-risk AI areas in Annex III, that restricts the regulation’s flexibility, even if partly amendable.Footnote ⁶⁴ This is especially so if some AI technologies, such as more agentic AI systems are taken to pose inherently greater systemic or emergent risks that transcend specific application domains. This means technology neutral and risk-based approaches can also diverge under certain circumstances.

3. Implementation and enforcement

Ultimately, how future-proof the AI Act proves to be depends on its implementation and enforcement, supported by the capacity to update the legislation through amendments and flexibility provided by standard-setting. Fundamental challenge for future-proof regulation is to ensure the continued political commitment of legislatures and institutions to the regulation.Footnote ⁶⁵ AI Act’s reliance on standards and guidelines (Article 96) emphasises the role of enforcement bodies in interpreting and implementing its technology neutral provisions. Most notably, the European AI Office is established within the European Commission as a central regulatory body to provide expertise and coordinate harmonised implementation and enforcement of the AI Act across member states (Article 64). Given sufficient resources, the AI Office should strengthen long-term commitment to the regulation, despite concerns about its limited autonomy within the Commission.Footnote ⁶⁶ The AI Office also facilitates the drafting of the GPAI Codes of Practice (Article 56) that details the obligations for general-purpose AI model providers to demonstrate compliance with the AI Act, in collaboration with nearly 1000 stakeholders.Footnote ⁶⁷ The third draft of the Codes of Practice names future-proofness as one of its guiding principles and underlines the importance of a “balance between specific commitments on one hand, and the flexibility to update rapidly in light of technological and industry developments on the other.”Footnote ⁶⁸ Indeed, the GPAI Codes of Practice includes more anticipatory risk assessments practices than the Article 9 despite its voluntary nature. Aside from national authoritiesFootnote ⁶⁹ that are the main enforcers of the regulation, an AI Board, an AI Advisory Forum and a Scientific Panel are also established to bring a wider set of expert stakeholders from EU member states to guide the implementation of the Act (Articles 65–68), potentially aiding regulatory commitment and feasibility.

Importantly, the AI Act can be amended and updated through implementing and delegated acts (Article 97). This procedural flexibility is key to responding to technological change. For instance, new high-risk systems can be added to the list of high-risk AI application areas in Annex III, although only as long as they fall within the scope of the existing areas (Article 7(1)). The European Commission highlights amendments in connection to future-proofness in December 2023 version of AI Act Q&A: “In addition, the AI Act can be amended by delegated and implementing acts, including to update the FLOP threshold (delegated act), to add criteria for classifying the GPAI models as presenting systemic risks Footnote ⁷⁰ (delegated act), to amend modalities to establish regulatory sandboxes and elements of the real-world testing plan (implementing acts).” Footnote ⁷¹ Delegated acts can also be issued to update the definition of AI, conformity assessment procedure and documentation requirements for high-risk and GPAI systems, but this flexibility also has its shortcomings. For example, civil society has criticised that the AI Act’s future-proofness and capacity to respond to emerging risks for fundamental rights is compromised by how it “provides no scope for updating ‘unacceptable’ (Art 5) and limited risk (Art 52 [sic]) lists.”Footnote ⁷² These concerns were partly alleviated in the final regulation, as the Article 112 mandates the Commission to regularly evaluate and review the regulation to the Parliament and Council in light of technological advances. Annually, the need for amendments to the list of high-risk AI systems in Annex III and prohibited practices in Article 5 will be assessed, continuing with high-risk area headings, transparency measures (Article 50) and the governance system every four years.

Overall, the AI Act’s governance framework, shaped by delegating power to enforcement and standardisation bodies in technology neutral fashion appears aligned with its future-proof implementation, even if some have criticised its overlapping and contradictory enforcement structures with other EU legislation.Footnote ⁷³ The reliance on co-regulation is a general tendency in technology neutral regulation that empowers agencies like the European AI Office, regulated industries and courts (ultimately the CJEU) to interpret and apply the rules.Footnote ⁷⁴ This likely aids the feasibility and flexibility of the Act by ensuring its implementation is informed by technical realities of AI. Most importantly, the multiple ways of amending the legislation along with periodic reviews should make the AI Act more future-proof by allowing it to flexibly adapt to rapid AI development. However, the broad capacity of the Commission to propose amendments through delegated acts without renewed legislative process and parliamentary oversight can also be seen as undemocratic, once again highlighting the tension between technology neutrality and democratic governance. Similar to standard-setting, amendments make the AI act more future-proof by increasing its regulatory flexibility but remain democratically problematic. OhmFootnote ⁷⁵ has argued that in many instances we want technology specific laws to ensure more regular democratic oversight and reconsideration of the legislation in parliaments. Sunset clauses that force periodic reassessment of regulation’s effectiveness and relevance in response to technological development could be utilised to this end.Footnote ⁷⁶ This suggests that in some instances technology specific regulation could better ensure democratic ends in future-proof AI regulation.

As seen with all the three aspects of future-proof regulation in the AI Act, technology neutrality can simultaneously both support and undermine future-proofness, as summarised in Table 2. While the principle of technology neutrality is generally valuable starting point for future-proof AI regulation, the two should not be viewed as synonymous or necessarily aligned with each other. This is despite the fact that technology neutrality has been framed as an essential tenet of the AI Act and largely synonymous with future-proofness in the analysed policy documents. Different stakeholders have supported the principle as a pretext for their interests without further defining it.Footnote ⁷⁷ The discourse around the AI Act reflects Reed’sFootnote ⁷⁸ two perspectives by which technology neutrality can enhance future-proofness: (a) improving regulatory longevity or (b) enabling technological innovations. While both policy framings can be components of future-proof regulation, they are motivated by different interests, leading to diverging interpretations. In the documents analysed, the AI industry predictably highlighted the latter perspective on efficient market competition whereas civil society stressed the former view on future-proofing the AI Act itself, especially in safeguarding fundamental rights. EU institutions appeared to balance between both views by leveraging instruments like regulatory sandboxes.

Table 2. Potential positive and negative impacts of technology neutrality on the future-proofness of the AI Act

Yet even when technology neutrality aligns with future-proof regulation, the two can still come into conflict with democratic governance. The vague and flexible provisions of technology neutral legislation delegate power downwards to agencies and industry to interpret the law, at the expense of democratically elected representatives.Footnote ⁷⁹ Given the potentially transformative societal impacts of AI and the associated risks, its regulation should not be purely a technical exercise, but requires greater democratic scope, deliberation and political steering.Footnote ⁸⁰ Therefore, future-proof AI regulation cannot be restricted to paths already laid down by market-driven technological development in an undemocratic fashion. This can be a problem for technology neutral policies, which tend to be reactive and ineffective in changing or steering the technological environment itself, especially under the market and innovation interpretation. Despite its benefits for regulatory flexibility, strict adherence to technology neutrality can thereby obscure the democratic choices and agency central to AI regulation. Regulators can and should stress certain outcomes, such as risks of opaque AI systems to steer AI development towards socially and democratically acceptable directions, potentially violating strict technology neutrality.Footnote ⁸¹ This might entail a step away from the current AI paradigm, characterised by increasingly large and unexplainable neural networks. In essence, achieving the future-proof objectives of technology neutral law may sometimes require technology specific legislation.Footnote ⁸²