Much of EU regulation is written in open language. That openness does not disappear at enforcement. It is filled in by authorities, by courts, and, earliest of all, by market convention. The operative rule is often not the text.
Much EU regulation is written in deliberately open language: “appropriate technical and organisational measures,” “legitimate interest,” “high risk,” “substantial modification.” Open standards let a framework survive technological change and political compromise. The cost is that the text alone does not tell a company what is actually required. The obligation is stated; its content is not.
An open term does not remove an obligation. It relocates the decision about what the obligation means, to whoever fills the gap first.
Three actors fill it, in sequence and with different authority: enforcement bodies through decisions and guidance, courts through rulings, and, earliest and most quietly, the market itself, through convention. Vendors, consultants, and large first movers establish “what everyone does,” and that convention becomes the de facto standard others are measured against long before a court weighs in.
“Consent” and “legitimate interest” were left as standards, not rules. What filled the gap was not primarily a regulator’s definition; it was an industry: consent-management vendors, a cookie-banner pattern copied across millions of sites, and a compliance convention that often bears little relationship to the regulation’s stated aim of giving individuals control. The banner became the operative rule, even where it serves no one.
The AI Act’s “substantial modification” and “high risk,” and the DSA’s proportionality language, are open in the same way. The market will converge on conventions before the case law arrives, and those conventions, not the annexes, will be what most companies actually comply with. Reading the text is necessary and not sufficient. The operative question is who is filling the open terms, and whether the emerging convention fits your situation or was set by companies with very different exposure.