The changing role of the European Commission in standard-setting for the AI Act

Standards play a critical role in implementing the European Artificial Intelligence (AI) Act, enabling companies to demonstrate compliance with its requirements. To achieve its regulatory goals, the European Commission (EC) has delegated rulemaking to European Standardisation Organisations (ESOs). This delegation, therefore, places the success of the AI Act in the hands of private actors, who constitute the majority of standardisation experts. While companies seek to minimise compliance costs, the EC aims to ensure that standards are delivered on time and are sufficiently detailed to enable conformity assessments. The crucial role of standards is further outlined in the recent proposal for the Digital Omnibus on AI regulation, which cites delays in the AI Act standardisation as one of the challenges to address, and proposes amending the AI Act. Although the EC’s control over the process has previously been described as limited, a more active role has recently been observed in the standardisation for the AI Act. Therefore, this paper examines why and how the EC is increasing its role within the standard-setting processes in support of the AI Act. I argue that through the AI Act, the EC increases its role in standardisation to ensure that standardisation outcomes meet the AI Act’s regulatory goals. The empirical analysis is based on semi-structured interviews and on document analysis of EC and CEN/Cenelec reports, public documents, media reports on AI standardisation, and documents obtained through Freedom of Information Requests. The case of EC’s increased participation in standardisation illustrates the EC’s increased control over private governance bodies. Using process tracing, the paper traces the causal mechanism for the EC’s evolving role in steering standard-setting. The mechanism is informed by the functionalist theory of delegation, with state capabilities and policy capacity frameworks specifying the activities through which the EC’s engagement in standard-setting increased. The combination of interinstitutional resource-allocation conditions and epistemic learning led to the EC’s behaviour change, resulting in increased standardisation activities. The findings challenge the interpretations of the limited role of regulators in private governance settings and document a case of the EC’s attempt to actively steer the standardisation process and outcomes. The analysis of the EC’s increasing role can inform the revision of Standardisation Regulation 1025/2012, regulating the relationship between the EC and ESOs, as well as approaches to standardisation of other digital regulations under the EU’s Fit for Digital Age package, such as the Digital Services, Cyber Resilience, Data, and Data Governance Acts.