Do EU rules already cover AI assistants that steer what people see and buy?
A new Ada Lovelace Institute briefing finds that existing EU consumer, data, platform, AI and competition rules reach parts of the problem, but unclear scope, limited enforcement and missing usage data leave important gaps.
The short version
- What happened
- The 22 October briefing maps advanced AI assistants against EU consumer, data-protection, platform, AI and competition rules; it concludes that the rulebook partially covers risks to autonomy, democracy and markets.
- Who it affects
- People increasingly ask one assistant to explain news, compare services or make purchases. The immediate protection question is whether commercial influence, personalisation and defaults are visible and contestable.
- What remains unproven
- The briefing is legal and policy analysis rather than an empirical study with participants, a sample or a causal design.
Keep in mind
The briefing is legal and policy analysis rather than an empirical study with participants, a sample or a causal design.
It does not conclude that a named assistant has breached EU law, and several recommendations concern rules or guidance that do not yet exist.
Provider-reported user numbers are global or incomplete for several assistants, so legal thresholds and population exposure cannot be established consistently from public data.
The Institute cites early warning evidence, but says evidence of causal harms and relevant enforcement or case law remains limited.
Multi-source analysis · 4 linked sources. Primary analysed source date: 22 October 2026.
Read the full report · 5 min The evidence, methods, implications and limitations
One interface can sit between a person and much of the internet
The Ada Lovelace Institute's new policy briefing argues that advanced AI assistants can become a 'universal digital intermediary': one conversational layer through which people seek news, advice, products and services. That creates a different policy problem from a chatbot answering an isolated question. Personalisation, memory and a human-like conversational style can make recommendations more persuasive, while the provider may also control which information, advertiser or affiliated service appears first.
The briefing groups the possible effects into three routes. For individuals, an assistant may shape choices without making the commercial or personalised logic visible. At population scale, repeated framing could affect public debate. In markets, an assistant integrated into a dominant platform could favour its owner's products or selected partners. The concern is amplified when a person cannot compare the underlying sources, inspect the ranking process or carry their history to a competing service. These are risk pathways, not findings that every assistant produces those outcomes.[1]
The rules overlap, but their boundaries do not line up neatly
The report finds useful starting points across the EU rulebook. Consumer law can reach misleading or unfair commercial practices. The GDPR applies when providers process personal data. The AI Act prohibits some manipulative systems and adds transparency and systemic-risk duties. The Digital Services Act can impose risk-management obligations on designated very large platforms or search engines, while the Digital Markets Act restricts practices by designated gatekeepers, including some self-preferencing and tying behaviour.
Coverage still depends on legal classifications and thresholds. It is not settled whether a general assistant should be treated as a virtual assistant, search engine, intermediary service or a system related to an already designated platform. Some duties apply only to providers with particular scale or to models with systemic risk. Providers also publish limited EU-specific user and usage data, making it harder for regulators and the public to test whether a threshold is met or a suspected harm is widespread.[1][2][3][4]
The distinction that matters
Three routes from assistant design to EU regulation
The briefing maps distinct harms to different parts of the digital rulebook; no single law covers the whole chain.
Autonomy
Personalised framing, advertising or dark patterns shape an individual choice
Consumer law, GDPR and parts of the AI Act may apply
Democracy
Personalised information affects opinion formation at scale
DSA systemic-risk and AI Act duties may apply, depending on scope
Markets
A dominant assistant favours its own or affiliated services
DMA and EU competition law may constrain tying or self-preferencing
What would change for users, providers and regulators
The institute recommends that the EU's planned Digital Fairness Act specify and prohibit assistant-specific dark patterns, require paid recommendations to be unmistakably disclosed and make personalised advertising off by default. It also calls for clearer DSA scope, active monitoring of illegal tying, disclosure when affiliated third parties are favoured, incident reporting and use of regulators' powers to obtain data and inspect risk assessments.
For people, the practical test is whether they can tell when a response is an advertisement, why one option was recommended and how to change or leave the default assistant. For businesses, the issue is whether access to customers depends on undisclosed ranking or an integrated rival. The assessment would become firmer with enforcement decisions, assistant-level EU usage data, independent audits and studies that measure how particular designs change real choices. Until then, the briefing is a detailed map of legal uncertainty—not a verdict against a provider or proof of causal harm.[1]