Former ECB chief demands GDPR cuts and AI Act pause at Brussels conference

Mario Draghi delivered a forceful plea for "radical simplification" of the General Data Protection Regulation and a temporary pause on implementing parts of the AI Act during a high-profile Brussels conference on September 16, 2025. The former European Central Bank president and Italian prime minister spoke at an event hosted by Commission President Ursula von der Leyen, marking exactly one year since publishing his landmark report on European competitiveness.

According to the former economist, Europe requires "new speed, scale and intensity" to compete effectively with China and the United States, particularly in artificial intelligence and related technologies. Draghi pressed the European Commission to deliver "results within months and not years," signaling growing impatience with the bloc's regulatory approach to innovation.

The Italian politician targeted the GDPR specifically, arguing that the regulation creates excessive legal uncertainty for AI developers attempting to train models using vast datasets. Since Italy's privacy watchdog launched a probe into OpenAI's ChatGPT in 2023, regulators across the European Union have opened numerous investigations into generative AI tools. However, relatively few of these GDPR probes have reached conclusions, as authorities struggle to apply existing privacy rules to cutting-edge technologies.

"Training AI models requires vast amounts of public web data," Draghi explained, according to the conference materials. "Yet legal uncertainty over its use creates costly delays, slowing deployment in Europe." Research supports his assessment. According to Draghi's speech, GDPR has raised the cost of data by approximately 20% for EU firms compared with their US counterparts.

The Commission has proposed modest changes to date, including reducing GDPR record-keeping requirements for companies with fewer than 750 employees. Draghi characterized these efforts as insufficient, demanding broader structural reforms that would cover not just the primary regulation but also "the heavy gold-plating by Member States" responsible for enforcing rules on locally established companies.

Beyond privacy rules, Draghi turned his attention to the AI Act itself. The former prime minister called for the next implementation stage to be "paused until we better understand the drawbacks" - referring specifically to provisions applying to "high risk" uses of artificial intelligence in areas like critical infrastructure and healthcare.

Industry groups and several member states have advocated for "stopping the clock" on AI Act implementation for several months, citing delays in compliance tools, structures and standards. Draghi's remarks will likely reinforce these calls as the Commission considers how to apply its digital simplification agenda to European AI legislation.

European privacy authorities have increasingly grappled with AI governance challenges, with France's CNIL publishing comprehensive AI development guidelines in July 2025. Academic research has demonstrated that large language models qualify as personal data under EU privacy law, creating additional compliance complexities for AI developers operating in European markets.

Von der Leyen highlighted the Commission's AI initiatives over the past year before Draghi's speech, including AI Gigafactories designed to establish powerful training hubs. She referenced existing plans for a digital simplification package scheduled for presentation by year's end. However, Draghi urged greater ambition, noting that artificial intelligence "cannot be the sole focus for support" and depends on "at least four other technologies" - cloud computing, supercomputing, cybersecurity and connectivity.

The former central banker emphasized data's central role in enabling AI development, noting that generative AI models require massive amounts of information for training purposes. The Commission must tackle obstacles to accessing data, he argued, while accusing the GDPR of creating unnecessary hurdles for European AI developers.

Industry responses to European AI regulation have varied significantly. Meta declined to sign the General-Purpose AI Code of Practice, citing legal uncertainties, while Google, Microsoft, OpenAI and Anthropic committed to voluntary compliance frameworks. The varied approaches reflect broader industry concerns about regulatory complexity and implementation challenges.

Current digital simplification discussions have focused primarily on reducing administrative burdens rather than fundamental regulatory restructuring. The Commission has engaged in talks with industry representatives over recent months to discuss how digital laws should be applied, but has yet to present comprehensive next steps for implementation.

Draghi's intervention occurs as European data protection authorities attempt to coordinate AI governance frameworks. The European Data Protection Board has initiated collaboration with the EU AI Office to align privacy and artificial intelligence regulations, recognizing the complex intersection between data protection and emerging technologies.

The former prime minister's critique extends beyond specific regulations to encompass Europe's broader approach to innovation. Natural gas prices in the EU remain nearly four times higher than in the United States, while industrial power prices average more than double US levels. Unless this gap narrows, Draghi warned, the transition to a high-tech economy will stall across European markets.

Energy considerations become particularly relevant for AI development, as electricity demand by data centers in Europe is projected to rise 70% by 2030. Power already accounts for up to 40% of operating costs for major computing facilities, creating additional economic pressures on European AI development compared to other global markets.

The Commission has launched its Clean Industrial Deal and Action Plan for Affordable Energy, both consistent with Draghi's competitive agenda. However, the main step to date has been relaxing state aid rules to allow member states to subsidize energy prices rather than addressing structural cost drivers.

According to Draghi's analysis, Europe must accelerate investment in grids, interconnectors and clean baseload generation to make a renewables-heavy system function effectively. Currently, half of the cross-border capacity needed by 2030 lacks investment planning, while approved projects require more than ten years for completion, with half that time consumed by permitting processes.

The Grid Package scheduled for year-end and proposed budget increases for cross-border links represent steps forward, but Draghi argued the current system of national coordination for permits and financing cannot support a truly European energy market. Cross-border projects require EU-level planning and execution to achieve necessary scale and speed.

Privacy enforcement challenges compound regulatory complexity, with the EU's GDPR Procedural Regulation potentially creating additional bureaucratic hurdles rather than streamlining cross-border enforcement. Privacy advocacy organization noyb warned in April 2025 that proposed changes could make enforcement procedures "even more complex and slower."

The marketing industry faces particular uncertainty as AI technologies become increasingly integrated into advertising platforms and customer analysis tools. German data protection authorities issued comprehensive AI guidance requiring lawful data sourcing for machine learning applications, while South Korea established its own AI privacy framework to balance innovation with privacy protection.

Draghi's recommendations align with growing industry frustration over regulatory fragmentation across European markets. The incomplete Digital Single Market continues to create compliance burdens for companies attempting to operate seamlessly across all 27 member states, limiting their ability to achieve scale benefits available to competitors in other large economies.

The former prime minister stressed that competitors in the US and China operate with far fewer regulatory constraints, even when acting within legal frameworks. "To carry on as usual is to resign ourselves to falling behind," he argued, demanding new approaches that deliver results within months rather than years.

Implementation of digital simplification measures will test the Commission's ability to balance innovation promotion with regulatory protection. The automotive sector, which employs more than 13 million people across the European value chain, provides a crucial test case for aligning regulation, infrastructure development and supply chain coordination into coherent industrial strategy.

Draghi concluded by emphasizing that Europe's citizens express growing frustration with the EU's slow pace of change. They value clear priorities and action plans but remain disappointed by how gradually the bloc responds to competitive challenges. Success requires moving beyond broad strategies and backloaded timelines toward concrete dates, deliverables and accountability mechanisms.

The Commission faces mounting pressure to demonstrate that European regulatory frameworks can support rather than hinder technological advancement. With China and the United States advancing rapidly in AI and related technologies, European policymakers must determine whether existing approaches serve long-term competitive interests or require fundamental restructuring.

Timeline

• May 6, 2024: German Conference of Data Protection Supervisors publishes first AI privacy guidelines
• August 1, 2024: AI Act enters into force across European Union
• November 6, 2024: European Data Protection Board initiates cooperation with EU AI Office
• April 17, 2025: Privacy organization noyb warns of GDPR procedural regulation problems
• May 15, 2025: Meta faces legal challenge over AI training data use
• June 18, 2025: University research establishes that large language models qualify as personal data
• July 22, 2025: French CNIL publishes comprehensive AI development guidelines
• August 2025: South Korea unveils AI privacy framework
• September 2025: European Commission opens AI transparency consultation
• September 16, 2025: Mario Draghi delivers speech calling for GDPR simplification and AI Act pause
• August 2, 2026: AI Act transparency obligations become applicable

Summary

Who: Mario Draghi, former European Central Bank president and Italian prime minister, addressing a Brussels conference hosted by Commission President Ursula von der Leyen

What: Call for "radical simplification" of GDPR regulations and temporary pause on implementing high-risk AI Act provisions to reduce legal uncertainty and regulatory burdens on European AI developers

When: September 16, 2025, exactly one year after publication of Draghi's landmark European competitiveness report

Where: Brussels conference examining progress on European competitiveness challenges, with implications for EU-wide regulatory policy and digital market development

Why: Europe needs increased speed and intensity to compete with China and the United States in artificial intelligence, requiring removal of regulatory obstacles that create costly delays and legal uncertainty for AI development while maintaining adequate privacy protection