The Brussels pattern is so predictable it no longer surprises. The EU adopted the AI Act in 2024. It has been operational for months. The enforcement apparatus is already showing the strain of actually applying a 180-page regulation to a technology ecosystem that moves faster than civil service hiring timelines. So what is the response? Propose another one.

The new product liability framework is pitched as necessary cover—someone has to pay when an AI system breaks something or someone. On the surface this sounds reasonable. In practice, it is bureaucratic theater that solves for appearance while the underlying problem, enforcement capability, remains untouched.

Here is what is actually happening: The AI Act creates obligations. Companies must document, audit, classify risk levels, maintain compliance files. The directive language is dense. The implementation varies wildly across member states because member states interpret Brussels directives differently depending on what their legal traditions allow. Enforcement has already begun to fragment. Germany reads the rules one way. France another. Portugal has not yet stated how it will enforce either.

Now add product liability on top of that pile. The logic is: if your AI system causes harm, you are liable. This sounds protective. What it actually does is create a liability surface without first establishing a shared understanding of what "harm" means across jurisdictions, what "causation" looks like when an algorithm is involved, or which national court handles the claim. Companies will respond by documenting everything obsessively, pushing compliance costs down supply chains, and pricing products higher across the continent. The consumer pays. The system complexity deepens. Enforcement still does not happen.

This is the EU's true regulatory theology: when something is hard to enforce, add a layer. When the first layer fails, add another. The AI Act is not yet mature enough to know if it works. But Brussels cannot wait for that knowledge because regulatory authority requires visible action. A new product liability framework is visible. It is also a confession that the first framework was incomplete, which is an admission Brussels cannot make directly.

The outcome is predictable. Companies will comply with whichever interpretation is strictest to avoid liability exposure. Smaller firms will exit the market or consolidate upward. Enforcement will remain spotty because member states have different fiscal capacities and political will. The innovation that the regulation was theoretically meant to responsibly manage will either stall or move to jurisdictions with clearer rules and faster implementation.

The people who suffer are not the large tech platforms. They have compliance teams. They are the smaller vendors, the startups, the European companies trying to compete in a market where the regulatory framework is both expensive and incoherent. And the customers, who will pay more for less choice.

This is not incompetence. It is competence in the service of a system that confuses rule-making with governance. Brussels is excellent at generating text. It is mediocre at enforcement. Adding more text will not fix that.