To simplify AI regulation, use the GDPR's high-risk criteria

First, the two cumulative criteria proposed by the Commission will inevitably be incomplete, leaving some applications out. That's the tradeoff for simple rules – they miss the mark in a small but significant number of cases. To work properly, simple rules must be supplemented by a general catch-all category for other high-risk applications that would not qualify under the two-criteria test. If you add a catch-all test (which would be necessary in our view), the goal of legal certainty would be largely defeated. Second, the "high risk" criterion will interfere with other legal concepts and thresholds that already apply to AI applications.