The Chatbot Sits Between Two Laws and Answers to Neither
The EU's chatbot regulatory gap is not an oversight — it is a structural permission for tech firms to pick whichever framework limits their liability most.
A Seam That Was Sewn In, Not Left Open
The chatbot gap Laura Kaun identifies in the EU's regulatory architecture is precise: the AI Act governs models, the DSA governs platforms, and a chatbot is neither cleanly . The gap is not a drafting error that a technical amendment can close. It reflects a foundational choice to let the regulated parties propose the classification system. When the same companies that operate chatbots participated in shaping both frameworks, the seam between them was a predictable negotiating outcome — not an oversight that later embarrassed the drafters.
Functional Regulation Is Already Happening — Elsewhere
The contrast with US state law is sharper than the EU regulatory conversation acknowledges. State chatbot laws now taking effect impose disclosure requirements, self-harm protocols, and audit obligations tied to what a chatbot does — the decisions it influences, the populations it reaches, the outcomes it produces — rather than which technology stack category it inhabits. A chatbot that touches hiring decisions triggers obligations in several US states regardless of whether the company calls it a platform, a model, or an AI-powered assistant. The EU's category-first framework has no equivalent trigger. A company can satisfy the letter of both the AI Act and the DSA while operating a chatbot that makes consequential decisions for millions of users, as long as it correctly manages which hat it is wearing at each compliance checkpoint.
The Federal Framework Arrives Pre-Gapped
The US National AI Legislative Framework does not solve the problem — it imports it. The omission of 'agent' from the Trump administration's framework is not a semantic oversight; agentic AI already runs multi-step financial operations and deploys code into production systems at major companies, and the legislative document Congress will now use as its starting point does not name the category. The Anthropic-Pentagon dispute in February 2026 made the vacuum visible: there was no statute governing what Anthropic was being asked to do, which is why the dispute became a story about Congress rather than corporate defiance. The federal framework released afterward did not fill that vacuum. It formalized it.
The 'Regulation Can't Keep Up' Narrative Serves One Party
The dominant frame around AI regulatory lag — that governments are simply outpaced by technology — obscures who benefits from the lag. The 'regulation can't keep up' story is told by the industry with an interest in the telling, and it works precisely because it is partly true. Frameworks do take time. But the chatbot gap is not a product of regulatory slowness — it is a product of regulatory design. The EU AI Act had years of drafting and stakeholder consultation. The decision to let the model-platform distinction stand was not made under time pressure. It was made with full knowledge of the services the distinction would have to cover. Compliance teams that treat the gap as a temporary ambiguity pending clarification are misreading the incentive structure: the ambiguity is the clarification.
The Classification System Is the Product
Tech firms that helped shape the EU AI Act's category structure now hold a durable compliance asset: the ability to claim whichever classification limits their liability at each stage of enforcement. That asset does not depreciate as the technology evolves — it appreciates, because each new capability (autonomous agents, multi-modal reasoning, agentic deployment) arrives without a classification, giving firms first-mover advantage in defining what it is. The companies that write the next generation of tools have already begun writing the categories those tools will occupy. Regulators who want functional accountability — who want rules that track what chatbots do rather than what they are called — will need to reopen both the AI Act and the DSA simultaneously, against the opposition of entities that have already invested in the current architecture. That fight has not started.
The story so far
The EU AI Act's chatbot gap — a structural seam between model regulation and platform regulation — has given tech firms a durable tool for liability arbitrage. Regulators who accepted the model-platform distinction when drafting both frameworks are now unable to close it without reopening both.
Frequently Asked
- Why did EU regulators create a gap between the AI Act and the DSA in the first place?
- The gap was not accidental — it was the negotiated outcome of a drafting process in which the companies that operate chatbots participated in defining the regulatory categories. The AI Act was built around model-level obligations; the DSA was built around platform-level obligations. Chatbots, which function as both, were never assigned to either because doing so would have forced the industry to accept obligations under one framework with no ability to shift responsibility to the other. The category distinction gave firms optionality that purely functional regulation would have removed.
- What should a product team building a customer-facing AI chat feature do right now given these regulatory gaps?
- Build for the strictest applicable state law, not the most permissive EU classification. Several US states now impose 'not human' disclosure requirements, self-harm escalation protocols, and audit obligations on any chat feature that influences employment, credit, housing, healthcare, or education decisions — regardless of what the company calls the underlying technology. The EU's framework lets you manage classification; these state laws do not. Design your disclosure and escalation architecture against the functional trigger, then verify your EU compliance posture separately.
- What is the strongest argument that the EU AI Act chatbot gap will be fixed quickly?
- The strongest counter is that the EU AI Office has enforcement tools and can issue guidance that narrows the gap without reopening either framework — and that political pressure from member states experiencing visible chatbot harms will force that guidance faster than a legislative rewrite would. That argument is real, but it concedes the point: guidance is not law, it is not binding on non-EU firms in the same way, and it requires the AI Office to take a classification position that the drafting process deliberately avoided taking. The gap closes through political will, not through the framework's internal logic.
Continue reading
The Signal That Wasn't: AI Regulation's Borrowed Urgency
AI regulation spiked in the conversation tracking systems this week — but the underlying chatter was about Iran, not algorithms. The gap reveals that AI governance has no community of its own.
similarAI Governance Has a Language Problem — and Insiders Are Saying It Out Loud
The people who build AI governance frameworks have started admitting the field's core vocabulary is borrowed from compliance, not ethics — and that admission is the story.
similarThe AI Conversation Has Forked and the Forks Don't Intersect
The AI conversation has split into irreconcilable camps — builders celebrating small models while the broader public argues misinformation and military risk.
similarAccountability Arrived for OpenAI. Nobody Agrees What It Changes.
Three simultaneous accountability claims against OpenAI reveal that the institutions it displaced are collecting from a position of negotiating weakness.
similarOne Bluesky Post Linked Palantir's Targeting AI to NHS Data Access
A single post connecting Palantir's Project Maven to NHS data bids circulated where it mattered most — among people already primed to act on it.
similarAI Regulation Is Failing Because It Governs the Wrong Thing
The frameworks nations are building to govern AI address products that can be inspected — not distributed systems that no single actor controls.
Methodology
This story was generated autonomously from 20 source records. An editorial model synthesizes, weights, and cites each source. No human editorial judgment was applied.