Finding the “Golden Ratio” between Digital Regulation and Innovation

Balancing regulatory simplification, tech sovereignty, and global competitiveness to foster European champions

With Kaisa Olkkonen, Senior Advisor at Kreab Worldwide, former CEO of SSH Communications Security and senior executive at Nokia; and Margot Dor, Senior Advisor at Kreab Worldwide, former head of Public Affairs at the European Telecommunications Standards Institute (ETSI)

As we move deeper into the 2024–2029 European political mandate, the European Union is undergoing what many call a digital pivot. The focus is shifting from drafting flagship regulations like the AI Act and the Data Act toward a more challenging phase: implementation and alignment.

Today, European companies – from agile AI startups to industrial giants – face a paradox. On the one hand, there is a clear ask from industry for regulatory simplification and support for innovation and growth. On the other, the cumulative omnibus and simplification proposals, paired with new proposals, risks bringing about the opposite of the desired effect: a streamlined regulatory environment conducive to innovation, growth, and competitiveness.

In this expert interview, we sit down with two of Kreab’s Digital & Technology senior advisors to untangle this complexity. Kaisa Olkkonen, a former Nokia executive and cybersecurity CEO, brings a sharp industrial perspective on how regulation hits the bottom line, particularly in the case of SMEs. Margot Dor, an insider of the standardization and regulation world and former Head of Public Affairs at ETSI, explores how technical standards and the upcoming “European Product Act” (which will update the New Legislative Framework, the Market Surveillance Regulation, and the Standardisation Regulation) may shape the future of the Single Market.

We dive into the upcoming review of existing legislative frameworks, against the backdrop of Europe’s efforts in the “Digital Omnibus” packages that promise to streamline AI, data flows, and privacy. Is Europe finally simplifying its digital rulebook and thereby unlocking its long sought-after competitiveness in digital, or are we just rearranging the maze?

Part 1: The Macro View – Complexity vs. Certainty

Interviewer: Margot, you’ve recently written about standardization as a tool for competitiveness. Kaisa, you have seen this from both the private sector and policy sides. Is the current push for “simplification” through these new packages actually delivering relief to companies, or just adding another layer of transitional complexity and uncertainty?

Kaisa Olkkonen: The target of simplification is definitely supported by all, but I do see many companies waiting for more information on the details of the simplification packages, so in that sense the process creates a temporary layer of additional uncertainty. CSRD is one example: many companies were proactively preparing for reporting according to CSRD and investing in defining the double materiality and building their reporting capabilities. Now they are waiting for information on whether they will fall under the reporting requirements and at the same time considering what the return on the already made investments will be. Should they still actually report according to CSRD as the investments are more or less done?

Margot Dor: As mentioned by Kaisa, it’s difficult to disagree with the objective to simplify and update, but the devil is in the details. Uncertainty about rights and obligations or product classification, or iffy temporality, for example, add a layer of complexity and discourage investment. It must also be mentioned that many in the EU have expressed worries about the potential downgrading of existing legislations, the policy underlying them, and the values underlying policy: consumer protection, privacy, etc.

Interviewer: For an SME trying to innovate in the AI space, is “legal clarity” becoming a luxury they can no longer afford? How do we prevent regulatory burden from becoming an entry barrier?

Kaisa Olkkonen: Legal clarity is for sure a basic requirement for any good regulation. And it is also the only way to ensure that the interests meant to be protected by regulation are actually protected, for example, privacy or cybersecurity. Firstly, clarity requires that when any regulation is drafted, all links and interdependencies to other pieces of regulation are clarified so that no contradiction is created, even when the regulations in question fall into different fields of responsibility inside the regulator organizations. Secondly, especially among SMEs, very costly and scary sanctions create entry barriers: it is difficult to take risks and be creative if a fine can bring your business to bankruptcy. If compliance is a risk one is not able to manage, you may well decide not to take that risk and therefore lose a business opportunity. The good news is that AI is also capable of helping here: there are AI tools helping companies to understand regulation touching them. Maybe along the way this makes it affordable to all companies to get a proper legal understanding.

Margot Dor: If “legal clarity” becomes a luxury, somebody is not doing the right job. To prevent the regulatory framework from discouraging market entry, I tend to think that a less baroque framework would help. Especially in the digital space that has blurred frontiers between players which used to operate on separate markets. Think for example of smart metering for energy consumption. This is particularly true when a specific market/product/service is ruled by both framework and sectoral legislation. This said, “regulatory burdens that prevent innovation or scale-up” is also the preferred narrative of actors who would prefer to operate like free foxes in a free hen house. The EU has built up clout with some forward-looking pieces of legislation (what was described as “the Brussels effect”), and this balance between simplifying for more efficiency while asserting EU values must be preserved.

Part 2: The “European Product Act”

Interviewer: The review of the New Legislative Framework (NLF) is often seen as a dry, technical exercise, but it’s the backbone of the Single Market. With the push for Digital Product Passports and Digital CE marking, how can we ensure these tools actually facilitate market surveillance rather than just creating a digital paper trail for companies?

Kaisa Olkkonen: The key is to ensure the clarity of the regulation and to avoid overlapping requirements unnecessarily increasing the regulatory burden. At its best, these new digital ways of working enable much more timely and accurate information on products in European markets. This benefits both consumers and enforcement officials. Digital solutions are often also more efficient from the companies´ point of view. Further, data in digital format may create added value by driving innovation in new business models, products and services. This requires, naturally, that rules on access to this data are clear. The regulator has to carefully collect information on practical implications of this digital shift by engaging in an open dialogue with relevant interest groups. In this dialogue innovation opportunities for utilizing the data should also be constantly considered.

Interviewer: The Market Surveillance Regulation is also under the microscope. In an era of borderless e-commerce and third-country imports, how do we strengthen enforcement without turning the EU into a “fortress” that discourages global digital trade flows? Moreover, what is the main objective the review of the Standardisation Regulation (1025) should aim for?

Margot Dor: The objective of revising the Market Surveillance Regulation is to update the product compliance and safety rules as well as the European governance of market surveillance, to adapt to the boom of e-commerce and the quest for a circular economy. We all have in mind examples of products entering the EU market that do not meet EU standards of quality, traceability, or safety.
There seems to be a broad consensus on the necessity to adapt the legal framework and enforcement capacity to address this. Global trade flows, digital or not, cannot mean buying potentially toxic products made in dubious conditions just because it is cheap and convenient. The revision is a work-in-progress so there again, it will be a matter of balance to ensure that the new legislation does not overkill. And indeed, the cohesion between Member States and EU levels is key, as the ambition is to better coordinate and possibly harmonize the rules.
The review of the Standardization Regulation – also part of the Product Act package – comes as geopolitical tensions cast a growing shadow on global trade and competition intensifies. Be it in quantum and post-quantum, cybersecurity, AI, data, standardization is and will be one of the frontlines of this competition. The EU is a market-driven global standards-setter, via the “formal” system (CEN-Cenelec/ISO-IEC) or the ETSI one. So, the review of Regulation 1025 should aim at further strengthening this asset and ensuring that it is “embedded” in the EU strategy for global competitiveness and tech sovereignty. This means not clipping the wings of the EU standardization system, either in the review of the standardisation regulation, but also in other recent legal acts such as the Cybersecurity Act 2 (CSA2).

Part 3: The Digital Omnibuses – AI, Data, and Privacy

Interviewer: We are seeing the rise of “Digital Omnibuses”—packages meant to align the AI Act with existing data flows and privacy rules. Kaisa, from your experience at Nokia and in cybersecurity, how critical is this alignment for ensuring that the AI Act doesn’t clash with the GDPR or the Data Act?

Kaisa Olkkonen: As mentioned earlier, alignment is absolutely critical. There are situations where it is impossible to comply with European and US legislation at the same time. This must not happen inside the EU, it is a question of quality of European legislation. In the worst case you have uncertainty in contents and interpretation of one particular legislation as well as how it aligns with another also unclear legislation. This kind of situation would harm the respect towards regulation in general and slowly start deteriorating the European culture of compliance.

Interviewer: Margot, there is a lot of talk about the European Commission’s proposed ‘Tech Sovereignty Package’, which includes the ‘Cloud and AI Development Act’, a second ‘Chips Act’, and a new open-source strategy. Do you see the Commission moving toward a more “industrial” logic where regulation is used as a tool for sovereignty rather than just consumer protection?

Margot Dor: The explicit intent of the package is indeed for the EU to pivot from a regulatory powerhouse to an innovator and a producer in areas deemed critical for Europe’s technical sovereignty. But I wouldn’t frame the question on the same terms as you. Europe is a free market and in free markets, the goal of regulation is to ensure that all market players (including consumers) can operate in fair and transparent conditions. This might include incentives, protective or corrective measures if a player is over dominant, etc. But it’s not a zero-sum game, and I am convinced that EU legislative ambitions can cater to both the “industrial logic” and consumer protection.
The Tech Sovereignty package has the merit of flagging domains where the EU needs to reduce its dependencies and, in those domains, it proposes measures to boost its research and production capacity. This said, it is a very ambitious roadmap, still stumbling on some definitions, and the very concept of “tech sovereignty” means different things to different people. It will be extremely interesting to see how the highly political concept of sovereignty is being translated into practical and measurable objectives.

Part 4: Strategic Counsel – What Should Boards Do?

Interviewer: We have covered quite some ground in this interview and there is clearly a lot of going matters on the policy front. As you look at the policy landscape for the next 24 months, what is the one “compliance trap” you think most companies are currently overlooking?

Margot Dor: When advising on navigating the intricacies of market access conditions, we have seen some companies dealing with compliance almost as an after-thought. This can be very costly. The issue of compliance should be considered upstream when devising a market entry strategy.

Interviewer: If you could give one piece of advice to a CEO sitting in Silicon Valley, Helsinki, or Sophia Antipolis about how to view the upcoming European Product Act or the ongoing tech sovereignty package and digital omnibus proposals, what would it be? Is it a threat to manage or an opportunity to seize?

Kaisa Olkkonen: In fast-evolving markets my advice would be to ensure your organization has the necessary competences to understand legislative developments, be it with internal experts, or through external support. The second step would be to verify that your operative management has implemented proper compliance milestones to any business process, be it in R&D or in sales and marketing. After this you can proceed fast and efficiently with any strategy you have, or with any products and services you have innovated. It will sure be more costly to your company and shareholders to stop innovating and growing than making sure you are able to comply with the law. Maybe there is even a possibility to create new products or services triggered by changes in the regulation? E.g., the Digital Product Passes already offer various opportunities for value-adding services linking to the initiative.

Margot Dor: Alongside Kaisa’s comment, I’d say that companies must grasp the food chain policy, legislation, standards, conformity, and compliance of each market they target. Indeed, the growing complexity of it requires dedicated resources that will help understand and possibly shape as upstream as possible the policy and regulatory landscape in which the company operates.