The thesis: from rules to advantage
With the application from 2 August 2026 of the transparency obligations of Article 50 of the AI Act, the European regulatory framework brings together GDPR, NIS2, DORA, the Cyber Resilience Act and the Cyber Solidarity Act. It is on this interplay that an article in Agenda Digitale focuses, reporting the view of Kevin Jiang, co-founder and general partner of Mangusta Capital, a fund dedicated to investments in Vertical AI, with a past at Goldman Sachs, Soros Fund Management, Apollo Global Management and SoftBank Vision Fund.
His thesis overturns a widespread judgment: for years American investors considered Europe a continent of too many rules and too little building, reading the GDPR as a brake. With the AI era, the question changes and becomes who controls the data and under what rules: at that point, Jiang argues, the discipline built as an obligation turns into an advantage, because it is the same discipline that everyone needs today.
From perimeter to data
The investor's reasoning is accompanied by a technical shift described in the article: Data Loss Prevention solutions start from the premise that data are inside a perimeter and must be intercepted when they try to leave it. Today, however, a document is born in the cloud, passes through personal devices, is shared with suppliers and pasted into AI tools. When the content crosses the barrier and travels in clear text, nothing remains to protect it.
Hence the idea that the only lasting control is the one that travels with the data itself. The article links this need to the cited rules: Article 32 of the GDPR lists encryption among appropriate measures; NIS2 lists cryptography and access control among risk management measures, with notification windows within 24 hours, 72 hours and one month; DORA requires encryption at rest and in transit, least privilege and control over ICT providers.
On the attack front, the text cites phishing as the most widespread entry vector, around 60% of cases according to ENISA, and the human element in about six out of ten breaches according to Verizon DBIR 2025, with stolen credentials present on 30% of managed devices and 46% of unmanaged ones. If the document remains encrypted even when someone is already inside, the article argues, the door left open matters less.
What remains to be verified
The article also refers to so-called shadow AI, that is, pasting confidential content into public assistants, and recalls that Article 34 of the GDPR can remove the obligation to communicate the breach to data subjects if the exfiltrated data remain encrypted and unintelligible. Jiang's assessments remain an investor's statements, not verified market data: the actual scope of the European advantage and its effects on investments are not quantified in the available material.
