Webit 2026: Can regulation keep up with general purpose AI? - Massimo Buonomo

This talk addresses the urgent need for robust regulatory frameworks to keep pace with the rapid evolution of general-purpose artificial intelligence (AI). The speaker, Massimo Buonanno from the European Commission, explores the structural mismatches between the exponential growth of AI technologies, such as ChatGPT, and the linear progression of regulatory efforts like the EU AI Act. He emphasizes the global implications of delayed regulations, citing issues like deep fakes in elections, AI in hiring, and the challenges faced by autonomous vehicles. The session also highlights specific challenges within Bulgaria's AI governance, including the need for effective auditing and compliance mechanisms in public procurement and the potential economic impact of AI on the workforce. Buonanno advocates for a proactive approach to AI oversight, suggesting that Bulgaria can gain a competitive advantage by reskilling its workforce and adapting its economic strategies.

Ladies and gentlemen, the future of artificial intelligence will not be shaped by technology alone. It will also be shaped by trust, by governance, and by the rules that determine how intelligence is developed, deployed, and held [music] accountable. As general-purpose AI begins to transform industries, economies, and public life, one question becomes increasingly important. Can institutions evolve as fast as technology? Our next speaker is helping shape one of

the most consequential regulatory frameworks of the AI era. A framework that may influence not only Europe, but the future of AI governance around the world. Please welcome Massimo Buonanno from the European Commission with his keynote, Can regulation keep up with general-purpose AI? >> Hello everybody. It's a pleasure for me to be here. And today we're going to talk about an issue that not many people are really

looking into details because it has a an impact on the life of countries, but at the same time, people are not really paying attention to it. So, we're going to talk about the regulation and how AI. There are many issues at stake. Um we're going to see many issues that are addressing the court cases, global cases, and I'm I want to talk the reality here in Bulgaria

and how the AI governance frameworks are being addressed. First of all, societies are governing intelligence itself. What does that mean? The speed is exponential. Technology evolves through rapid iteration and deployment cycles. ChatGPT reached 100 million users in just two months. Deployment is global. The growth is exponential. What about regulation? Regulation is the other way around because it took 3 years for the EU AI Act to be

issued. National enforcement structure is still being built and the growth is linear. So, the result is a structural mismatch in speed, not simply a temporary delay. Now, we're going to see 10 global cases where regulation is lagging. we've seen technology moves very fast, faster than institutions. ChatGPT adoption versus regulatory timelines was different because there were 100 million users in two months and government had zero frameworks for

foundational models at at that time. In Italy, ChatGPT was banned for a few year for a few weeks, but it exposed the national regulators to a problem because there's a a real borderless AI system. And that is why regulation doesn't keep up with the evolvement of technology. Then there is a problem of deep fakes in elections as we've seen it in India, in Slovakia, in the US.

And by the time the authorities investigate, millions have already used it. So, in fact, enforcement is too slow. And then there's copyright versus foundational models. And this is a serious issue that is happening. Not sure what this is. This goes the way back. And then there's a problem of AI-generated code and cybersecurity. The same model that helps student uh code can use can help criminals automate fuzzing.

So, how do we regulate capability versus when this has a beneficial but also a harmful use? And then EU AI Act foundational models are very important because this uh GPT-4 does does form the public debate with the EU AI Act while that was still drafted. And then there's a problem for young people, AI in hiring because companies screen CVs and you still you don't even know about

it. So, applicants don't know that the algorithms are evaluating you. And this is traditional employment laws assume human decision makers, while this is not the case these days. And then there's a problem with the autonomous vehicles. We've seen it with Waymo and Tesla using increasingly autonomous systems, but if there's a problem, who is responsible for that? Then there's a the problem associated with open-source AI debate because

powerful models refer are released and they allow innovation to accelerate and research to become more democratic. That would be a positive thing. But there's also a dangerous side because a company that can release a model globally in one day and regulators may even spend years addressing this risk. So, this is a problem that is coming up very often. And then let's come to Bulgaria, your country. There

are some six critical cases that I want to address to. First of all, the EU AI Act. There is there enforcement about the EU AI Act? Rules are enforced, but institutions are still being built. Who audits the those institutions? Who issues penalties because there are severe penalties? Also, there is a Sofia AI procurement. The municipality of Sofia is using AI to review public procurement. But who is

responsible for that if the AI system makes a mistake? There are some AI hiring tools being used. If most of you make an application, AI filters 90% of your applications. You don't even know, but that happens. Who's responsible for that? If you have not been selected, then there is also deep fakes in elections that happened even in Slovakia where a fake video came 48 hours before the

vote. Now, you can say that that was discovered, but that influenced the people. That is a serious issue. There are some very interesting institutions here in Bulgaria like Insait, but there is also the AI strategy problem for the national strategy being built while the GPT-4, for instance, was not even a model. Who's responsible for that? Then, I looked at Bulgarian companies under the microscope, but uh because

there's a limited time, I would jump exactly to the biggest problem for Bulgaria, the outsourcing revolution from labor to AI control tower. This is the biggest problem. Why? Because AI is a great opportunity for you guys, remember that 10% of Bulgarian GDP is in the AIC uh ICT sector, information technology. So, 105 uh 100 uh thousand professionals are employed in that. Now, the problem is what happens

if Bulgaria sells only raw labor hours? Let's assume, for instance, a a use case where a German client is paying a million dollars to use 50 agents, okay? Now, all of a sudden the company says, "Why do I have to pay for 50 people when AI AI can handle 70% of these cases? I'm going to fire them." clients get cut to 25, revenues drop to 500,000, and

there is a serious impact on the economy of Bulgaria. How can you face this problem? With the AI governance model. Why? Because Bulgaria can handle 70% of baseline volume out automatically. You would have a redeployment of these people. 20 AI supervisors would monitor outputs in real time. There would be a regulatory escalation teams who handle compliance seriously. And then the drop in the revenues would be to

from a million to 750,000. Labor costs would drop 60%, but margins would expand. So, in fact, what happens is that these days Bulgaria is selling only raw labor hours. In the future, if you guys take an AI oversight and compliance approach by creating a AI governance hub, you would have a competitive advantage. These days you are sort of outdated. You can improve that and improve revenues as

well. That happens only improve and reskill your employees. macro math. The today's model is stagnation model. Defensive posture. Companies compete purely on human labor versus AI, you lose. If you use the adaptive model with the aggressive reskilling, you pivot to AI oversight and compliance services. You increase revenues, you growth in GDP. While today's the margins are severely compressed and contract loss is in place. But these are

structural pathways, not forecasts. Therefore, the approach to naturalize the workforce shrinkage, which is happening these days, now, is if you have a reskilling of the employees where AI handles 70% with the 20 supervisors managing volumes of 500,000 tickets. At the same time, there is also an human in the loop compliance approach and AI data annotation. Now, the time is over. There should be more to talk about,

but I hope that was interesting for you guys.