Dalla self-regulation alla over-regulation in ambito digitale: come (e perché) di un necessario cambio di prospettiva

di Edoardo C. Raffiotta

SOMMARIO: 1. Introduzione. – 2. La proliferazione delle norme nel quadro normativo europeo: cybersecurity, privacy, AI, servizi digitali. – 3. Gli effetti dell’over-regulation sul diritto pubblico europeo. – 3.1. Alcune non trascurabili problematiche, in punto di diritto. – 3.2. (segue): le criticità dell’over-regulation nel diritto pubblico. – 3.3. (segue): over-regulation e mercato. – 4. Possibili cause dell’over-regulation. – 5. L’over-regulation come (strano) tentativo dell’UE di acquisire un ruolo in ambito tecnologico. – 6. Non solo di regolamentazione vive un sistema digitale affidabile.

The "A Europe Fit for the Digital Age" strategy defined by the European Commission is increasingly characterized by copious regulatory output that regulates the impact of the new generation of technologies, most recently with the AI Act aimed at regulating artificial intelligence. This phenomenon seems to describe an over-regulation that will imply not easy coordination of the obligations foreseen, on the one hand, with the regulations on the protection, enhancement, and security of data - personal and non-personal - (GDPR, Data Act, Data Governance Act, NIS, etc.; on the other hand, with those directed to regulate the role of service providers (including gatekeepers and platforms) (Digital Markets Act, Digital Services Act, European Digital Identity, etc.). This intersection and, to some extent, an overlap of the AI Act with other European regulations will impose a - not always smooth - coordination that could jeopardize the competitiveness of European companies.