**This is an AI-powered machine translation of the original text in Portuguese

In 2026, the Legal Wings Institute's Digital Markets Hub hosted a webinar featuring Brian Scarpelli, Senior Global Policy Counsel at ACT | The App Association, to discuss the findings of the study The Hidden Cost of AI Regulation. The event brought together Brazilian researchers and experts to analyze the economic impacts of European digital regulations—especially the AI Act, the Digital Markets Act (DMA), and the GDPR—on micro, small, and medium-sized enterprises (SMEs), and to reflect on the lessons for the Brazilian regulatory context.

The debate focused on the study The Hidden Cost of AI Regulations, produced by ACT | The App Association and conducted by Technometrica Market Intelligence. The report analyzes how different regulatory approaches impact the adoption and development of AI by micro, small, and medium-sized enterprises in the United States, the European Union, and the United Kingdom, highlighting economic effects associated with regulatory delays and barriers.

1. Initial Exposure – Methodology and Key Findings

Brian Scarpelli presented ACT as a global trade association representing small and medium-sized technology companies—bringing together entrepreneurs, innovators, and independent developers operating in the global digital ecosystem, in both consumer and enterprise contexts, with a diversity of business models.

a) Methodology

The study was conducted between 2024 and 2025, based on two separate samples: one focused on companies located in European Union member states and the United Kingdom, and the other focused on companies in the United States.

In total, more than 1,000 micro, small, and medium-sized enterprises (SMEs) in the technology sector were surveyed, ranging from individual founders and micro-enterprises (with fewer than 10 employees) to medium-sized companies.

The sample included two distinct profiles:

(i) AI users: companies that have adopted and integrated AI tools into their operations, workflows, or products;

(ii) AI developers: companies that build models, applications, or services based on artificial intelligence.

b) Results

Among the main results highlighted:

• Adoption of AI: In the EU/UK, 50% of technology SMEs say they are actively using AI, while in the United States the percentage is 62%.
• Integration into workflows: when considering the full integration of AI into core workflows, the gap widens: 32% of companies in the EU/UK report AI being fully incorporated into workflows, compared to 45% in the US.
• Importance attributed to AIDespite differences in adoption and integration, AI is perceived as relevant in both contexts—73% of companies in the EU/UK say that AI is important for business, compared to 83% in the US.
• Costs and losses associated with delays: Companies in the EU/UK report average annual losses of between US$584,000 and US$2 million per company attributed to delays (including models and launches). At the same time, US companies report greater cost savings with AI (10.7%) than European companies (8.9%).
• Regulation as a driver of delays and product adjustments: Six out of ten companies in the EU/UK reported delays in accessing cutting-edge AI models; nearly 60% of European developers reported delays in launches, and more than a third said they had to remove or reduce features to comply with regulatory requirements.

To make the impact of delays tangible, the study combined two metrics: (a) annual revenue at risk, i.e., the revenue that the company fails to earn due to delays in accessing or launching AI models and features; and (b) AI savings that were not achieved, corresponding to efficiency gains and cost reductions that did not materialize because the AI solution could not be implemented on schedule. In the first case, the estimated average loss for all EU and UK technology SMEs ranges from €162,000 to €325,000 per company per year, reaching €561,000 to €1.13 million among companies directly affected by AI-related customer losses (29% of the sample). In the second case, a three-month delay implies around €409,000 in uncaptured savings, rising to €1.64 million in the case of a twelve-month delay. Combining lost revenue and frustrated savings, the estimated average total annual impact ranges from €571,000 to €1.97 million per company, reaching €975,000 to €2.77 million among companies directly affected.

2. Ex Ante Regulation and Cumulative Effects

Scarpelli argued that European regulatory architecture is predominantly structured under an ex ante model, i.e., based on the imposition of obligations before products reach the market, based on anticipated risks. According to him, the AI Act, as the world's first comprehensive AI law, establishes prerequisites, conformity assessments, technical requirements, and audits that generate substantial compliance costs, falling disproportionately on small businesses.

In the case of the Digital Markets Act (DMA), he pointed out that regulating platforms designated as “gatekeepers” could lead to restrictions or delays in the availability of AI features in the European market, since incorporating these tools increases regulatory compliance risks. The GDPR, although older, was also pointed out as an additional source of friction, especially because consent and purpose limitation rules make it difficult to train and implement AI systems that rely on personal data.

In the United Kingdom, it has been observed that the local GDPR and the Digital Markets, Competition, and Consumers Act (DMCCA) replicate some of these concerns, albeit with greater operational flexibility.

According to the speaker, the common feature among these instruments is their ex ante preventive nature, in contrast to the predominantly ex post US model, which holds agents liable only after concrete damage has been demonstrated.

3. Recommendations from ACT | The App Association

Based on the survey results, ACT presented recommendations aimed at building AI governance that learns from European and North American experiences. According to the speaker, there is an opportunity for policymakers to use the available evidence to structure a balanced model that avoids unnecessary delays and preserves the innovative capacity of micro, small, and medium-sized enterprises (SMEs).

The first recommendation is to ensure timely access to advanced AI models, with clear deadlines in regulatory review processes and mechanisms such as “safe harbors” or fast tracks for small businesses, preventing regulatory uncertainty from acting as a barrier to the adoption of new technologies in practice. Next, it advocates the application of rules proportional to the capacity and risk of companies, so that SMEs are not subject to the same compliance requirements as large corporations. Proportionality, according to the presentation, is essential for regulation to protect consumers without making new entrants unviable.

It is also recommended to expand regulatory sandboxes and supervised testing environments, allowing experimentation before the full impact of regulatory obligations, especially in a dynamic sector such as AI. Finally, it is argued that AI regulation should not be treated in isolation, but integrated into a broader digital economy strategy, with startups and SMEs at the center of public policy.

4. Debate – Competition, Market Dynamics, and Lessons for Brazil

a) Juliano Maranhão

During the debate, Juliano Maranhão questioned whether, although the study focuses on the AI Act, the impacts reported by companies would not reflect broader effects of European digital regulation. He pointed out that the DMA has been in force for longer and mentioned a recent study by the CCIA (“Costs to U.S. Companies from EU Digital Services Regulation”) indicating that the DMA may generate compliance costs even higher than those of the AI Act.

Brian Scarpelli confirmed that, although the survey focuses on the AI Act, the effects perceived by companies are part of a broader digital regulatory environment. He acknowledged that the DMA also has significant impacts and agreed with the importance of the CCIA study. He argued that regulations such as the DMA, even though aimed at large platforms, end up affecting micro, small, and medium-sized businesses that depend on these environments to distribute their products.

According to him, there is a symbiotic relationship between platforms and developers: platforms provide infrastructure, security, and trust mechanisms, while developers generate content and economic activity. Regulatory interventions aimed, for example, at increasing interoperability can limit platform functionality and, consequently, have indirect effects on smaller companies.

Juliano Maranhão also raised a second issue related to competitive dynamics in AI markets. He mentioned a recent study produced by Legal Wings ("Competition in AI Markets"), which questions assumptions made by European and British authorities that AI markets would tend to replicate the concentrated structure observed in traditional digital markets. Based on data from Sensor Tower on downloads and revenues from AI applications, he pointed out that the competitive dynamics seem more diverse: although US companies lead in subscription revenues, they do not lead in number of downloads, with prominent positions occupied by Asian companies and, to a lesser extent, European and Latin American companies. In this context, he questioned whether stricter regulations could alter this dynamic, favoring established companies, since compliance costs tend to be more easily absorbed by those who already have consolidated revenues.

In response, Brian Scarpelli considered the framework presented to be pertinent and stated that new regulations could potentially alter this dynamic. He emphasized, however, that his general position remains in favor of a lighter regulatory approach, as he believes that it tends to reduce barriers to entry. He also noted that broad and uniform ex ante interventions in markets still in formation, as in the European case, are based on the expectation of stimulating investment and innovation, but do not always produce the expected results.

b) Bianca Mollicone

Bianca Mollicone questioned Brian Scarpelli about the so-called “Digital Omnibus” recently launched by the European Union, an initiative aimed at simplifying and coordinating multiple digital regulations—such as the AI Act, the DMA, the DSA, and the GDPR. She highlighted concerns that combining these rules could create cumulative burdens, especially for micro, small, and medium-sized enterprises (SMEs), and asked if there was evidence that this “regulatory stacking” creates friction that policymakers often underestimate. In the Brazilian context, he asked what safeguards could mitigate any losses in competitiveness if the country adopts a model similar to the European one, and, alternatively, what minimum guarantees would be essential if Brazil prioritizes competitiveness.

Scarpelli responded that the European regulatory simplification exercise is relevant and represents recognition by the European Union itself of the need for coordination and rationalization of the regulatory framework. He agreed with the characterization of “cumulative friction” and stated that there is, in fact, a bifurcation of regulatory paths.

If Brazil chooses to follow an approach similar to that of Europe, he suggested incorporating mechanisms that preserve the scalability of SMEs, such as safe harbors and regulatory sandboxes. He also mentioned that certification structures based on international AI risk management standards (such as those developed by standardization bodies) could be linked to safe harbor regimes, especially for lower-risk cases.

On the other hand, he stated that Brazil already has a robust framework for consumer protection and competition defense, which could be used to address concretely demonstrated damages, without the need for a comprehensive ex ante regime. He argued that broad and anticipatory regulations, especially in markets still in formation, may not produce the expected effect of stimulating innovation and investment.

In the end, when asked to indicate a guiding principle, he defended the idea of shared responsibility throughout the AI value chain, with obligations proportional to the intended use and risk mitigation capacity of each actor. He also emphasized that measures should be calibrated according to actual demonstrated damage, warning that broad prohibitions and overly generic risk categories could hinder potentially beneficial innovations without fully understanding their effects.

c) Cesar Mattos

Cesar Mattos questioned the role of the GDPR in this set of European regulations, noting that, unlike the AI Act and the DMA—still under debate in Brazil—data protection is already a reality in both the European Union and Brazil, through the LGPD. He asked what impact the GDPR would have on innovation and small businesses and whether the US model, without a single federal data protection law but with multiple state laws, could be even more burdensome and fragmented than the European model.

In response, Brian Scarpelli stated that, among the GDPR, DMA, and AI Act, the GDPR probably has the least impact on the friction effects identified in the research, although he acknowledges that comprehensive data protection laws generate significant compliance costs. He pointed out that regulatory fragmentation in the United States—with multiple state regimes—is not an ideal model, as it forces companies operating nationally to comply with different requirements simultaneously, which also imposes complexity and costs. ACT even advocates for the adoption of a single federal privacy law in the country.

On the other hand, Scarpelli emphasized that frameworks such as the GDPR—and, in the Brazilian case, the LGPD—can function as existing structures that are sufficiently flexible to deal with risks associated with the use of AI, especially when it comes to personal data protection. He argued that, before creating new legislation specifically for AI, it would be prudent to assess whether existing consumer protection, competition, and privacy regulations would be capable of addressing concretely demonstrated harms. According to him, this use of existing regulations could avoid unnecessary regulatory overlap.

5. Key Discussions

• The concrete economic impact of European digital regulations on SMEs, especially with regard to delays in accessing and implementing AI.
• The difference between broad ex ante regulatory models and approaches more oriented toward accountability after demonstrated harm (ex post), and their effects on innovation and the entry of new agents.
• The indirect effects of regulations such as the DMA on smaller companies that depend on digital platforms for distribution and scale.
• The risk that cumulative compliance costs will alter the competitive dynamics, favoring incumbents over new entrants.
• Lessons for Brazil, including the possibility of using existing frameworks before adopting a specific and comprehensive AI regime.

Conclusion

The webinar highlighted the complexity of the debate on AI regulation and digital markets, especially in the context of emerging economies. The European experience was presented as a relevant case study, both in terms of institutional advances and observed costs.

The main tension identified does not lie in the dichotomy between “regular or non-regular,” but rather in the institutional design: whether the regulatory architecture accelerates technological absorption capacity or creates cumulative frictions that disproportionately affect smaller innovators.

For Brazil, the debate remains open. The choice between more structured ex ante models or gradual evidence-based approaches involves institutional, economic, and geopolitical trade-offs that require ongoing technical analysis and regulatory prudence.

Access the full panel here: Costs of AI Regulation