But there is at least one area where he would like to push back. Reynders would like to see more AI technologies such as the text-generation models that power chatbots released as open source software, enabling other entities to build upon them. “We have seen huge investments from big tech like Microsoft—I don’t know how much, but certainly more than $10 billion,” Reynders says. “But is it possible to have an open market? Is it possible to see startups and many other companies taking part? To do that, open source is maybe an important element.”

Meta has not launched its new social media app Threads in the EU, due to unspecified regulatory concerns, and Google this week finally launched its chatbot Bard in Europe after months of working on regulatory compliance. While Reynders hasn’t talked with Meta about its situation—he jokes that “maybe with my services, they will be on board”—he says the EU wants to have all major services available to its citizens.

But having Bard and Threads in full compliance with GDPR is first priority for the EU, he says. He recognizes that user-supplied data helps tech companies train the AI systems that are increasingly central to all platforms, but he says there must be transparency about that process and limits on holding on to data.

Reynders has proposed legislation that would allow people harmed by AI systems to win compensation from technology developers. He says European lawmakers want to first pass the AI Act’s comprehensive regulations on AI systems, but that the liability proposal can’t wait long, because EU parliamentary elections next June could reshape the bloc’s priorities.

He also plans to urge tech companies to voluntarily comply with yet-to-be-passed rules such as the AI Act, which likely won’t take effect for a couple of years. For instance, images and videos generated with AI should have watermarks reflecting their origins, Reynders says. He also believes chatbots should be barred from answering questions on certain sensitive topics, and that hidden uses of AI in society should be disclosed to users.

Reynders’ US visit coincides with a joint win for EU and US officials. They finalized the third—and they hope, final—agreement allowing companies to store EU citizens’ data on US servers. Reynders says the deal deliberately does not force companies to store data in the EU, where cloud storage capacity is relatively limited. “Store your data locally if it's needed for your business,” he says. “But if you need to transfer, we try very hard to be sure that the protection is traveling with the data, but that you have the opportunity to transfer the data.”

Two previous transfer agreements have been rejected by the EU’s top court for failing to adequately protect against US authorities prying into the data. Both those challenges were lodged by Austrian privacy activist Max Schrems, and the cases are known as Schrems I and II. Reynders this week bemoaned that some groups had built a business model around bringing cases to the EU Court of Justice. Schrems’ nonprofit organization NYOB, short for none of your business, then demanded an apology for what it described as false allegations.