The Berlaymont, Brussels. Two challenges define Europe's AI era | Author: Christopher O. de Andrés
Europe has already won the regulatory race on artificial intelligence. The harder question - and the one receiving far less serious attention - is whether it can win the implementation race. Those are not the same competition. And confusing them may prove to be the most consequential institutional error of the AI era.
The European Union AI Act entered into force in August 2024 and represents, by any measure, a landmark achievement. It is the world's first comprehensive horizontal legal framework for artificial intelligence, establishing a risk-based architecture that distinguishes between prohibited practices, high-risk systems and minimal-risk applications. By August 2nd, 2026, many of its core obligations become enforceable, introducing binding requirements for transparency, risk management, human oversight, data governance and the protection of fundamental rights.
The regulatory architecture is now largely in place. Yet the question receiving far less attention is whether Europe's public institutions are prepared to make that architecture work in practice. Much of today's debate focuses on compliance. Compliance matters. But compliance is not strategy. The decisive challenge is institutional: whether governments possess the organisational capacity to transform an ambitious regulatory framework into coordinated action across multiple levels of administration.
That is the governance gap.
The European Union AI Act entered into force in August 2024 and represents, by any measure, a landmark achievement. It is the world's first comprehensive horizontal legal framework for artificial intelligence, establishing a risk-based architecture that distinguishes between prohibited practices, high-risk systems and minimal-risk applications. By August 2nd, 2026, many of its core obligations become enforceable, introducing binding requirements for transparency, risk management, human oversight, data governance and the protection of fundamental rights.
The regulatory architecture is now largely in place. Yet the question receiving far less attention is whether Europe's public institutions are prepared to make that architecture work in practice. Much of today's debate focuses on compliance. Compliance matters. But compliance is not strategy. The decisive challenge is institutional: whether governments possess the organisational capacity to transform an ambitious regulatory framework into coordinated action across multiple levels of administration.
That is the governance gap.
The enforcement gap nobody is naming.
The evidence points to a broader structural challenge. As of June 2026, the designation of national competent authorities responsible for supervising and enforcing the AI Act remains incomplete across several Member States. What practitioners increasingly describe as the enforcement gap is not primarily a legal problem. It is an institutional readiness problem.
The reason is straightforward. Translating a sophisticated supranational regulatory framework into operational capability across 27 Member States, hundreds of regional administrations and thousands of public organisations is fundamentally different from drafting legislation. Europe has encountered similar implementation cycles before. The GDPR entered into force in 2016, yet consistent enforcement required several years of institutional maturation. The European AI Office has already signalled a more proactive supervisory posture, but regulatory ambition alone cannot accelerate organisational readiness. Ultimately, enforcement depends less on legislation than on institutional capability.
The evidence points to a broader structural challenge. As of June 2026, the designation of national competent authorities responsible for supervising and enforcing the AI Act remains incomplete across several Member States. What practitioners increasingly describe as the enforcement gap is not primarily a legal problem. It is an institutional readiness problem.
The reason is straightforward. Translating a sophisticated supranational regulatory framework into operational capability across 27 Member States, hundreds of regional administrations and thousands of public organisations is fundamentally different from drafting legislation. Europe has encountered similar implementation cycles before. The GDPR entered into force in 2016, yet consistent enforcement required several years of institutional maturation. The European AI Office has already signalled a more proactive supervisory posture, but regulatory ambition alone cannot accelerate organisational readiness. Ultimately, enforcement depends less on legislation than on institutional capability.
Why implementation is not a technical problem.
AI governance is often presented as a compliance exercise centred on system classification, technical documentation, conformity assessments and registration requirements. These obligations are demanding and resource-intensive. They are also the most visible part of implementation.
The more difficult challenge lies elsewhere.
Every public organisation deploying artificial intelligence must reconcile fundamentally different ways of understanding risk and responsibility. Engineers optimise technical performance. Lawyers minimise legal exposure. Cybersecurity specialists focus on resilience and vulnerabilities. Executives pursue operational priorities. Political leaders are concerned with legitimacy, public trust and democratic accountability.
Each perspective is entirely rational within its own professional environment. Governance succeeds only when these different perspectives are translated into decisions that every part of the organisation can understand, support and implement.
Most governance frameworks quietly assume that this translation capability already exists. Very few institutions deliberately build it.
AI governance is often presented as a compliance exercise centred on system classification, technical documentation, conformity assessments and registration requirements. These obligations are demanding and resource-intensive. They are also the most visible part of implementation.
The more difficult challenge lies elsewhere.
Every public organisation deploying artificial intelligence must reconcile fundamentally different ways of understanding risk and responsibility. Engineers optimise technical performance. Lawyers minimise legal exposure. Cybersecurity specialists focus on resilience and vulnerabilities. Executives pursue operational priorities. Political leaders are concerned with legitimacy, public trust and democratic accountability.
Each perspective is entirely rational within its own professional environment. Governance succeeds only when these different perspectives are translated into decisions that every part of the organisation can understand, support and implement.
Most governance frameworks quietly assume that this translation capability already exists. Very few institutions deliberately build it.
The multilevel governance challenge.
Implementation looks different at every level of government.
At supranational level, the European AI Office is assuming responsibility for supervising general-purpose AI models and coordinating implementation across the Union. The institutional architecture is becoming increasingly defined.
At national level, Member States remain at different stages of establishing competent authorities, developing regulatory sandboxes and building the human, financial and technical capacity required for effective supervision. Progress reflects different administrative traditions as much as different levels of institutional preparedness.
The greatest challenge emerges at regional and local level, where many of the AI Act's highest-risk applications will ultimately be deployed. Public administrations responsible for employment services, social protection, law enforcement and administrative decision-making often combine the greatest operational exposure with the lowest regulatory capacity, while remaining directly accountable for protecting the fundamental rights that the AI Act seeks to safeguard.
Madrid offers an instructive illustration. Its Madrid Capital Digital strategy was not conceived primarily as a technology programme, but as a programme of institutional transformation. Organisational redesign, digital capability across more than 28,000 municipal employees, governance structures for data management and sustained investment in human capacity created the foundations that now make AI implementation considerably more manageable.
Rather than representing an exception, Madrid illustrates what institutional preparation looks like before AI becomes a governance challenge rather than simply a technology project.
Implementation looks different at every level of government.
At supranational level, the European AI Office is assuming responsibility for supervising general-purpose AI models and coordinating implementation across the Union. The institutional architecture is becoming increasingly defined.
At national level, Member States remain at different stages of establishing competent authorities, developing regulatory sandboxes and building the human, financial and technical capacity required for effective supervision. Progress reflects different administrative traditions as much as different levels of institutional preparedness.
The greatest challenge emerges at regional and local level, where many of the AI Act's highest-risk applications will ultimately be deployed. Public administrations responsible for employment services, social protection, law enforcement and administrative decision-making often combine the greatest operational exposure with the lowest regulatory capacity, while remaining directly accountable for protecting the fundamental rights that the AI Act seeks to safeguard.
Madrid offers an instructive illustration. Its Madrid Capital Digital strategy was not conceived primarily as a technology programme, but as a programme of institutional transformation. Organisational redesign, digital capability across more than 28,000 municipal employees, governance structures for data management and sustained investment in human capacity created the foundations that now make AI implementation considerably more manageable.
Rather than representing an exception, Madrid illustrates what institutional preparation looks like before AI becomes a governance challenge rather than simply a technology project.
Strategic Translation: the missing governance capability.
The AI Act is often described primarily as regulation. A more accurate description is institutional architecture. Its purpose is not simply to regulate technology, but to create the conditions under which innovation develops alongside trust, accountability and democratic legitimacy.
Architecture, however, requires builders.
Strategic Translation is the institutional capacity to convert regulatory complexity into coordinated public action — across disciplines, levels of government, and professional cultures that define risk, responsibility and legitimacy in fundamentally different ways. It is not a communication skill. It is not a legal function. It sits at the intersection of political analysis, institutional knowledge and strategic leadership. And it is the capability that most AI governance frameworks assume exists but almost none deliberately build.
The AI Act is often described primarily as regulation. A more accurate description is institutional architecture. Its purpose is not simply to regulate technology, but to create the conditions under which innovation develops alongside trust, accountability and democratic legitimacy.
Architecture, however, requires builders.
Strategic Translation is the institutional capacity to convert regulatory complexity into coordinated public action — across disciplines, levels of government, and professional cultures that define risk, responsibility and legitimacy in fundamentally different ways. It is not a communication skill. It is not a legal function. It sits at the intersection of political analysis, institutional knowledge and strategic leadership. And it is the capability that most AI governance frameworks assume exists but almost none deliberately build.
What the next governance cycle demands.
The period between August 2026 and 2030 will test European governance in ways that drafting the AI Act never could. Europe has already demonstrated that it can design ambitious governance frameworks for emerging technologies. The next phase of leadership will be measured differently.
The organisations - and governments - that lead the AI era will not necessarily be those with the most sophisticated legal frameworks or the most advanced AI systems. They will be those capable of transforming regulatory complexity into institutional capability and institutional capability into coordinated public action.
The AI era will not be defined solely by the quality of regulation or the sophistication of algorithms. It will be defined by the capacity of institutions to close the distance between political ambition and operational reality. Strategic Translation is not a concept. It is a capability. And building it - deliberately, structurally, at every level of European governance - is the work that begins now.
The period between August 2026 and 2030 will test European governance in ways that drafting the AI Act never could. Europe has already demonstrated that it can design ambitious governance frameworks for emerging technologies. The next phase of leadership will be measured differently.
The organisations - and governments - that lead the AI era will not necessarily be those with the most sophisticated legal frameworks or the most advanced AI systems. They will be those capable of transforming regulatory complexity into institutional capability and institutional capability into coordinated public action.
The AI era will not be defined solely by the quality of regulation or the sophistication of algorithms. It will be defined by the capacity of institutions to close the distance between political ambition and operational reality. Strategic Translation is not a concept. It is a capability. And building it - deliberately, structurally, at every level of European governance - is the work that begins now.
---
This is the first in a series of policy analyses on 'Strategic Translation' - exploring how institutions, governments and organisations build the capacity to turn regulatory ambition into coordinated action. The next analysis will examine how the EU–U.S. relationship requires a new kind of institutional fluency to remain operationally relevant in the AI era.
Christopher O. de Andrés analyses how public institutions adapt to geopolitical and technological change. His work focuses on AI governance, strategic communications and transatlantic affairs, drawing on more than twenty-five years of experience across European institutions, international organisations and multinational environments.
This is the first in a series of policy analyses on 'Strategic Translation' - exploring how institutions, governments and organisations build the capacity to turn regulatory ambition into coordinated action. The next analysis will examine how the EU–U.S. relationship requires a new kind of institutional fluency to remain operationally relevant in the AI era.
Christopher O. de Andrés analyses how public institutions adapt to geopolitical and technological change. His work focuses on AI governance, strategic communications and transatlantic affairs, drawing on more than twenty-five years of experience across European institutions, international organisations and multinational environments.