ReadingResearchRadarInvestment framework
Sign in / Sign up
← Back to reading
News4 min read·2026-10-21DisconfirmAI Editorial

LessWrong author Michael Z: Ireland's cross-border GDPR cases take a median 6.2 years while strong AGI is forecast at 4.5 — the EU AI Act will keep arriving late if enforced the same way

Michael Z compiled data on 69 GDPR investigations with final decisions by Ireland's Data Protection Commission and found that the cross-border cohort takes a median of at least 6.2 years; Metaculus forecasts a median 4.5 years for strong AGI. He argues that the EU AI Act requires the same investigation, drafting, and response steps, so if enforcement speed holds, AGI will likely arrive before cases close — meaning catastrophic-risk regulation must operate before a model ships.

ImportanceMaterialEvidenceE3 inspectableWrite-upStandard

Original publication time 2026-09-28 11:48 GMT+8

Michael Z raises a concrete time-mismatch problem on LessWrong: the speed at which Ireland's Data Protection Commission (DPC) handles cross-border GDPR cases is roughly comparable to the forecast timeline for AGI's arrival. If the EU AI Act is enforced the same way, oversight will keep arriving one model generation too late.

The DPC serves as the observation window because under the GDPR, cross-border enforcement is led from the country where a company has its EU headquarters, and most big tech firms (OpenAI and Anthropic included) have theirs in Dublin. Michael Z compiled 69 investigations with published or announced final decisions from August 2019 through September 2026, measuring each from formal commencement to final decision. Of 61 concluded cases, the median took 1.9 years, but more than half were against Irish public bodies and domestic firms. The 15 cases that ended in fines of €1 million or more, all against large platforms, took a median of 4.4 years.

More critical is the distribution of unresolved cases. Of 27 cross-border investigations open at the end of 2020, 13 were still open as of September 25, 2026, and one had been discontinued. Treating unfinished cases as censored observations using the Kaplan-Meier method, the median for that cohort comes out to at least 6.2 years. LinkedIn's behavioral advertising case took 6.2 years from inquiry to decision; Google's real-time bidding inquiry has been open 7.3 years; and Google's location-data inquiry ended with a €403 million fine announced on September 21, 2026, 6.6 years after it opened.

Sign in / Sign up
ReadingResearchRadarInvestment framework

Michael Z cross-compares this duration with Metaculus's AGI forecasts. As of September 25, 2026, 1,843 forecasters put the median arrival of strong AGI (a single system that passes an adversarial Turing test, assembles a model car, and aces exam and coding benchmarks) at March 2031 — 4.5 years out — with a 25% chance by April 2028. The median forecast for weakly general AI is September 2027, just one year away.

His core inference: if an AI Act investigation opened today took as long as the median cross-border case (6.2 years), forecasters would give weakly general AI an 84% chance of existing before it concluded and strong AGI a 59% chance. Google's real-time bidding inquiry is already at 7.3 years, where those probabilities reach 86% and 64%.

Why does he think the AI Act won't be faster? The author examined the procedural histories of 14 of the 15 fined cross-border cases and found that more than four-fifths of the time was consumed by investigating, drafting a decision, and allowing the company to respond — not by cross-border coordination. The EU AI Act requires the Commission to complete the same steps before issuing a fine, and its procedural rules adopted in July 2026 give the Commission five years from a violation to impose a fine (up to ten years if investigative steps keep restarting the clock).

Michael Z also acknowledges a structural difference: the AI Act is enforced directly by the European Commission's AI Office, so its cases won't require back-and-forth between national regulators the way cross-border GDPR cases do. He cites the Digital Services Act (DSA) and Digital Markets Act (DMA) as a comparison — the Commission's fastest decisions took 13 months, but most DSA cases remain open, and frontier labs ship new models faster than that.

The article's policy conclusion concerns the choice of enforcement tools. The author ranks four strategies by their protection against catastrophic risk: investigate-then-fine (weakest, because AGI will likely arrive first); emergency pauses and orders (X gave a High Court undertaking in August 2024 to stop training Grok on European users' public posts collected that summer, but the DPC opened a formal inquiry eight months later); clear-cut reporting duties (a data protection officer appointment case took just 81 days, but scope is narrow); and pre-release approval (strongest, but no formal precedent, and it requires global coordination).

On pre-release approval, the author cites the DPC's own account: its voluntary pre-launch supervision delayed or stopped nine of about 180 AI products between 2021 and 2025. He proposes that the AI Act's two-week compute-threshold notice be paired with a fixed review period analogous to EU merger control, giving the AI Office a defined window to review a model before it ships. But he also notes that doing this well requires a well-resourced agency, and the AI Office may be under-resourced for its mandate.

Finally, the author preserves his own epistemic boundaries. In the appendix he concedes that anchoring on data protection may have been a worse starting point than the DSA or DMA, since those are enforced directly by the Commission like the AI Act. Metaculus forecasts are highly uncertain; the 6.2-year median depends on how unresolved cases are handled (if the eight cases with no recent status report are censored — treated as having an unknown closing date — the median falls to 5.4 years and the probability that strong AGI arrives first drops from 59% to 56%). His conclusion is conditional: if AGI forecasts are anywhere close, enforcement that depends on investigations will keep arriving model generations too late.

Sources

  • 原始出处lesswrong.com↗
Continue researching →