All walkthroughs · Paper briefs

Delays to Frontier AI in the EU and UK

John Lidiard, Oleksandra Vereschak, Tom Gibbs, Markus Anderljung
GovAI (Centre for the Governance of AI) technical report, June 2026

Paper · Brief and rating · Dashboard entry

About 21 minutes · Download MP3

AI-generated walkthrough with synthesised voices: a host explains the paper and a discussant questions it. It covers claims, methods, key assumptions, citations and use so far, decision relevance, and what an evaluator should check. Every direct quotation was checked word for word against its source. Public sources only. Not an Unjournal evaluation or decision.

Transcript

Host
This is a walkthrough of Delays to Frontier AI in the EU and UK, a technical report by John Lidiard, Oleksandra Vereschak, Tom Gibbs and Markus Anderljung, published by the Centre for the Governance of AI, usually called GovAI, in June twenty twenty-six. It is an AI-generated walkthrough with two voices, a host and a discussant, and it is not an Unjournal evaluation or decision. The report asks two questions. How often have the big American AI companies delayed or withheld new large language models from the European Union and the United Kingdom, relative to their United States launch? And when they did, was regulation the cause? The authors build a dataset of three hundred and seventy-five releases by Meta, Google, OpenAI and Anthropic, from June twenty eighteen to May twenty twenty-six, and code a likely cause for every delay or non-release.
Discussant
Before the numbers, define the object. A large language model, or LLM, is the kind of text-generating model behind ChatGPT or Claude. But what counts as one release here?
Host
A release is a model made available in a particular way. The same model can appear several times: once for the application programming interface, or API, which developers call from their own software; once in the consumer web or mobile app; once as an open-source download of the model weights; and again when a new input type, such as images or voice, is switched on. The report's example is Claude three point five Haiku, which appears four times: API and consumer app, each with text-only and then text-plus-image input. Private releases, meaning invite-only or waitlist access, are excluded, as are models that do not produce text at all, such as video generators.
Discussant
And the headline results?
Host
Relative to the United States, about eleven percent of releases were delayed or never released in the EU, and about seven percent in the UK. Split up: in the UK about three percent were delayed, with a median delay of fifteen days, and about four percent never arrived. In the EU about four percent were delayed, with a median of fifty-three days, and about seven percent never arrived. The authors also ask about the single most capable model at each point in time, using Epoch AI's Capabilities Index, which combines many benchmark scores into one general-capability scale. Fourteen models in the dataset held the top spot at some point since March twenty twenty-three. Only one was delayed: the web-app release of Claude three Opus reached the EU seventy-one days late, though API access was simultaneous with the US. The UK never waited for the top model.
Discussant
So the frontier itself mostly reached Europe on time. Which companies account for the delays?
Host
Mostly Meta. About twenty-six percent of Meta's releases were delayed or withheld in the EU and about fifteen percent in the UK. Google is around eleven percent in the EU and nine in the UK, mostly API releases of PaLM two and early Gemini models in twenty twenty-three and twenty twenty-four. OpenAI has the lowest EU share, about four percent, and no outright non-releases anywhere; its delays are mostly under a month. Anthropic has no UK delays at all, and its EU cases are all the Claude two and Claude three web-app launches in twenty twenty-three and twenty twenty-four. Over time the share falls: in the EU from about twenty-eight percent of releases in twenty twenty-three to about eight percent in twenty twenty-five, and in the UK from about eighteen to about four. Meta goes the other way, reaching about eighty-eight percent of its EU releases in twenty twenty-five. And in the first five months of twenty twenty-six there were no public releases delayed or withheld at all.
Discussant
Now the causal part. How do they decide whether regulation caused a delay?
Host
By reading public sources case by case: company blogs, release notes, archived frequently-asked-questions pages, social media posts, press coverage and regulator statements. Each case gets a label, regulatory factors or other factors, plus a confidence rating of low, medium or high. The main inferential device is the pattern of which countries were left out. The authors write that "if it is only the EU that is left out of a global rollout, then we interpret this as a strong signal of EU-specific factors." Conversely, if the EU and UK wait alongside many other countries, they read that as a staged global rollout. The headline attribution is this: "Of the 68 examples of delays and non-releases in the dataset, we tentatively attribute regulatory factors as the primary, though not sole, cause of 56." Nine are put down to other factors, such as limited computing capacity, language support or product readiness, and three are labeled unclear.
Discussant
Which regulation?
Host
Data protection, almost entirely. That means the General Data Protection Regulation, or GDPR, in the EU, and its retained twin, the UK GDPR, alongside the Data Protection Act. The report says data protection is the only type of regulation it judges to have caused delays in this dataset. It looked at competition law, copyright, online safety rules and the EU AI Act and found no strong evidence that any of them blocked releases. On the AI Act it adds a timing caveat: the general-purpose AI provisions applied from August twenty twenty-five, so they cover only ten months of data, and the AI Office's enforcement powers start on the second of August twenty twenty-six, after the data end.
Discussant
Through what mechanisms does GDPR delay a model launch?
Host
The report identifies three. First, the lawful basis for training on personal data. Training needs a legal ground such as consent or legitimate interest, and reusing, say, people's Facebook and Instagram posts for training is contested. Second, stricter rules for special-category data under Article nine: information revealing health, ethnicity, religion and so on. Images, voice and live video are more likely to reveal those traits, and the Court of Justice has held that processing liable to indirectly reveal them falls under Article nine. The authors use this to explain why image and voice features were hit harder than text. Third, documentation: before higher-risk processing a provider must complete a data protection impact assessment. The cleanest case in the whole dataset is Google's Bard chatbot in twenty twenty-three. The Irish Data Protection Commission, which is the lead EU regulator for many American tech firms, stopped the planned EU launch because Google had not provided that assessment. Bard launched in the EU about two months after the US, once Google added transparency information, user controls and a data-collection opt-out.
Discussant
Same law, so why is the EU worse than the UK?
Host
Two reasons are offered. EU enforcement looks more assertive, with Italy's data protection authority temporarily banning ChatGPT in twenty twenty-three as the salient example. And the EU takes longer to settle a position, because data protection is enforced by national authorities coordinated through the European Data Protection Board. The Meta case illustrates this. In June twenty twenty-four both the UK Information Commissioner's Office and the Irish regulator asked Meta to pause training on local user data. The UK office stated a position in about three months, and Meta's text-only assistant reached the UK fourteen days after the US. In the EU, the Board took months to issue an opinion that each national authority then had to apply, and Meta's assistant arrived in March twenty twenty-five, using a model not trained on EU users' data. Meta also restricted EU users from its open-source multimodal Llama models through its licence terms, while the UK could use them.
Discussant
There is a subtler Google story too, about the free API tier.
Host
Yes. Until twenty twenty-four Google offered some PaLM and Gemini models only on a free API tier whose terms let Google use prompts and responses to improve its products. That use likely conflicts with GDPR's purpose-limitation principle, so Europe got paid-tier access only, and several free-only models never reached the UK or EU before they were retired. The authors describe this as regulation making a release "commercially undesirable rather than legally prohibited." Once Google applied paid-tier data terms to European free users, the next free release arrived with a twenty-two day lag.
Discussant
How confident are the authors in these attributions overall?
Host
Not very, and they say so. The authors write: "We have high confidence about the reasons for only five instances of a delay or non-release, due to a lack of strong public evidence about their causes." Most labels are low or medium. They also flag that company statements are evidence with an agenda: "In some cases it may be strategically valuable to cite regulation as the cause, to increase public pressure on regulators towards more permissive enforcement." And in the limitations section: "The weakest part of our analysis is our assessment of the causes of non-releases and delays."
Discussant
Let me press on the denominator before we get to uptake. If one corporate decision, like Meta's licence exclusion for its multimodal models, generates four rows, then the counts of delays are counts of rows, not decisions.
Host
That is right as far as the report shows. The Llama three point two Vision exclusion appears as four open-source rows plus a consumer-app row; the Llama four Scout and Maverick exclusion appears as four more; the Anthropic EU web-app story covers six rows, from Claude two through the three Claude three models. On my reading of the case table, the fifty-six regulatory cases reduce to roughly twenty distinct corporate decisions. The table also lists fewer model rows than sixty-eight, so the count appears to treat a UK delay and an EU delay of the same release as separate cases; the report does not spell this out. The headline eleven percent is therefore sensitive to how finely releases are split, and the split is not uniform across firms: a company that ships many variants on many surfaces gets more rows, both delayed and undelayed.
Discussant
Second, the counterfactual. The design compares the EU and UK with the US. What about other jurisdictions with no GDPR?
Host
The authors say systematic tracking of other countries was out of scope. They use the pattern of excluded countries where it is readily available, but there is no control group. Some cases show why that matters. Meta's Llama three assistant launched in a handful of countries, so the UK and EU were excluded alongside most of the world; the authors still code it as regulatory, with medium confidence, citing the pending Irish consultation. Bard's first launch excluded Canada as well as Europe. A comparison set, say Canada, Switzerland, Japan, South Korea and Brazil, coded the same way, would let a reader estimate the excess delay attributable to European rules rather than to staged rollouts in general.
Discussant
Third, the welfare side. Days of delay are not costs.
Host
The report does not try to value the delays, and it does not try to value what the data protection rules buy. It frames itself as input for regulators weighing objectives against the risk of models being withheld, but it measures only one side. It also cannot say whether LLMs are treated worse than other digital products. In the authors' words: "Since we could not find a systematic review of release data for these services, we cannot tell if delays and non-releases are more severe for LLMs relative to other comparable products." For an economist the natural next step is usage-weighted delay, for example days of delay multiplied by some measure of the model's market share or capability margin over the best available substitute. On that measure, most delays look small, because a slightly older model from the same or another firm was usually available.
Discussant
And sample scope. Four American frontier firms.
Host
The authors note the bias runs in a particular direction: "Our analysis may also have underestimated regulatory barriers by focusing on frontier AI companies, which, among other things, have more developed legal teams." Smaller firms, non-US developers and companies building products on top of models, Apple being their example, may face larger barriers. They also exclude trusted-access programs, where a model is released to vetted organizations only. That matters for twenty twenty-six, where the report notes European access was constrained by such programs and by US export controls that led Anthropic to withdraw some models. They write: "It may be that US national security concerns, rather than European regulation, prove the more important barrier to European access to frontier AI in the coming years."
Discussant
How has the report been used and cited so far?
Host
Mainly in specialist and general tech-policy press. MLex, the regulatory news service, ran a piece at the end of June twenty twenty-six with a headline saying GDPR, not the AI Act, delayed frontier AI in Europe. Euronews covered it in early July, with editions in French and Arabic, and quoted John Lidiard saying policymakers should treat delays to model access as a factor when designing and implementing AI rules. The Euronews piece also lists the Digital Markets Act and the AI Act among commonly cited reasons for delays, which goes beyond what the report concludes; the report finds no strong evidence for either. A copy of the PDF is hosted by the Italian tech-policy outlet Key4biz, and the report is indexed by at least one AI-regulation tracking site. I could not find it in OpenAlex, the open scholarly index, as of early October twenty twenty-six, so there are no tracked scholarly citations, and I did not find it cited in an official policy document. That is a search result, not proof of no use; a June report would rarely show up in formal citations within four months.
Discussant
Where could it influence decisions?
Host
Three places. First, the EU's Digital Omnibus package, which includes proposals to clarify how GDPR applies to AI training, including legitimate interest. The report's evidence points at data protection, and at slow clarification of it, as the binding constraint, which is directly relevant to that fight. Second, the AI Office as it starts enforcing the general-purpose AI obligations; the report provides a pre-enforcement baseline that a later extension can compare against. Third, UK regulators and ministers, since the report reads the UK's single regulator and quicker positions as reducing delay. For labs, it is a public record of their own release behaviour. For funders of governance research, the useful item is the dataset and its extension past August twenty twenty-six.
Discussant
Why might it be a good candidate for an Unjournal evaluation?
Host
The causal claim is policy-relevant and contested, the report has not been peer reviewed, and the coding is checkable. The report links its release dataset, and the case-by-case reasoning sits in footnotes that cite archived pages. An evaluator can rebuild the counts, recode causes and check the legal reasoning. That fits evaluation better than a purely conceptual paper. The ideal team pairs an empirical economist who works on regulation with a European data protection lawyer, because half the argument is about how Article nine and purpose limitation apply in practice.
Discussant
Give me the evaluator's checklist.
Host
First, collapse rows into independent decisions and recompute the headline shares; report both. Second, recode a random sample of cases blind to the authors' labels and report agreement; the report does not describe a second coder or an agreement statistic. Third, check the data pipeline: releases up to October twenty twenty-five were identified by human reviewers, while later ones were first identified by an AI agent, Claude Cowork, and then reviewed by humans. An evaluator should check completeness in that later window, since it drives the claim of zero delays in early twenty twenty-six. Fourth, build a comparison set of non-GDPR countries. Fifth, check dates against archived pages, especially where a delay of a few days could come from time zones or staged rollouts, as in the one-day GPT three point five case that the report itself attributes to payment setup. Sixth, examine the coding rules, such as treating paid-only or web-only access as simultaneous. Seventh, look at the Meta cases closely, since Meta supplies most of the regulatory attributions and also ran a public campaign against EU regulation, which the report cites as an example of the claims it is testing.
Discussant
Anything about the authors that a reader should weigh?
Host
The author biographies note that Markus Anderljung served as one of the vice-chairs drafting the EU's Code of Practice for general-purpose AI. That is relevant expertise, and it is also a reason to want the AI Act conclusion checked by someone outside that process. The AI Act conclusion is also the most fragile in substance: with only ten months of the provisions in force and none of the enforcement period covered, a finding of no strong evidence is mostly a finding of too little time.
Discussant
Summing up?
Host
The report documents, release by release, how often four American firms held back models from Europe between twenty eighteen and May twenty twenty-six. The descriptive facts are fairly solid: delays were uncommon, concentrated in Meta and in image and voice features, mostly a few weeks to a few months, rarely affected the single best model, and declined over time. The causal attribution to data protection is plausible and well documented in a few cases, such as Bard and Meta's training pause, but most labels rest on inference from patterns and from company statements with incentives attached. The most useful follow-ups are a decision-level recount, a comparison group of other countries, a welfare-weighted measure of delay, and an extension past the start of AI Act enforcement in August twenty twenty-six.

Sources