New AI law paper: Legal scope isn't determined by inferential capability

A new academic paper from Nicola Fabiano, published on arXiv (2608.10601), tackles a critical blind spot in European digital regulation: the relationship between the EU AI Act and the GDPR when it comes to inference. The AI Act defines an AI system through its inferential capability (Article 3(1)), making that capability central to determining what falls under the regulation. The GDPR, by contrast, never defines inference but regulates it protectively—its obligations kick in when inference processes personal data or affects a person, irrespective of whether the system qualifies as AI. The paper argues these two legal perimeters are not concentric, and this mismatch has become operationally urgent with agentic architectures that chain multiple inference steps together.

The author proposes a two-level framework separating inference's constitutive function (defining what counts as AI) from its protective function (governing effects on individuals). The protective function operates through three pathways—identificatory, attributive, and decisional—while composition acts as a cross-cutting architectural dimension alongside reach, persistence, and reviewability. Three new concepts support the analysis: inferential threshold, inferential reach, and inferential chain, the last mapped onto the chain of legal imputation. The paper then addresses Regulation (EU) 2026/1744, which left the constitutive criterion untouched but introduced a provision on outputs influencing future inputs without any aggregation rule. To close this gap, Fabiano proposes a compositional-effects test that identifies the decision unit under Article 22 GDPR, allocates the burden of proof, and mandates documentation duties calibrated to inference chains. The core thesis: inferential capability does not determine legal scope, and its absence does not grant immunity.