Source-linked AI summary
MARLA: A Conceptual Scaffold for Regulatory Learning under the EU AI Act
Alessio Buscemi, Tom Deckenbrunnen, Imane Hmiddou, Marco Billi, Livio Rubino, Silvia Rizzuto Ferruzza, Daniele Pagani, Antonino Rotolo
TL;DR
The paper addresses the gap between evidence produced by technical implementation and the governance knowledge needed for consistent EU AI Act application. It proposes MARLA, a non-prescriptive five-stage cycle across Local, National and European levels, and illustrates its use through two piloted case studies and a prospective upward-learning pathway. The paper concludes that MARLA makes regulatory learning visible and navigable, while its cases demonstrate use rather than improved outcomes.
Problem
EU AI Act implementation requires technical and legal communities to translate evolving legal requirements into consistent socio-technical practices, but existing frameworks do not provide a shared full-cycle account.
Method
The paper develops MARLA, a conceptual five-stage scaffold—Map, Assess, Report, Learn and Adapt—operating across Local, National and European governance levels.
Results
Two piloted case studies and a prospective illustration show how MARLA locates learning within Local practice and traces its transmission toward National and European governance.
Takeaways & Limitations
MARLA provides technical and legal stakeholders with a shared process architecture for making regulatory learning visible, navigable and connected to harmonisation and adaptation.
Takeaways & Limitations
The case studies illustrate MARLA’s use but do not establish that applying it improves outcomes, which would require a controlled comparison.
Abstract
from arXiv · showhide
The EU AI Act positions regulation as part of the infrastructure for safe, trustworthy and market-ready innovation. Realising this ambition requires regulatory learning: the evidence generated during implementation must be translated into governance and legal knowledge that supports consistent interpretation, effective oversight, and adaptation as technologies evolve. Yet the actors who produce this evidence and those who rely on it operate in different professional worlds. This paper proposes MARLA (Map, Assess, Report, Learn, Adapt), a conceptual scaffold organising regulatory learning as a five-stage cycle centred on the implementation of legal requirements into socio-technical practices, situated at the Local, National and European levels of the AI Act's governance architecture. Deliberately non-prescriptive, MARLA gives technical and legal stakeholders a shared vocabulary in which each of the first three stages generates its own documentable form of regulatory learning. We illustrate the scaffold with two piloted case studies and a prospective National-to-European illustration.
1. Introduction
The EU AI Act’s harmonised application depends on translating legal requirements into socio-technical practices through sustained interaction between technical and legal expertise. MARLA addresses this regulatory-learning gap with a non-prescriptive cycle spanning implementation, assessment, reporting, learning and adaptation.
- The implementation challenge: Divergent operationalisation of identical obligations can produce different regulatory outcomes, undermining harmonisation at its source.Consistent interpretation and application require coherent administrative and technical practices across Member States.
- The implementation challenge: Technical teams generate implementation evidence while lawyers and regulators must interpret it, but the two communities use different vocabularies and professional standards.This structural separation makes communication necessary for uniform application.
- Why cyclical learning matters: Rapidly changing capabilities, risks and deployment contexts make compliance processes iterative and complicate stable regulatory classification.Regulatory learning must address questions such as what counts as an AI system and when a change is substantial.
- MARLA’s contribution: MARLA maps regulatory learning from translating legal requirements into testable specifications through assessment and reporting to updated guidance, standards or regulation.The scaffold operates across Local, National and European governance levels.
- MARLA’s contribution: MARLA deliberately avoids prescribing how requirements should be mapped, tested or reported, offering instead an organisational and communicative structure for collaboration.The first three stages each generate a distinct form of learning that should be documented separately from compliance output.
2. Background
Existing AI governance instruments generate partial regulatory-learning pathways, but no shared architecture connects legal interpretation, assessment, reporting, collective learning and adaptation across governance levels. MARLA is positioned as that coordinative process architecture, with sandboxes as one important but non-exclusive setting.
- Fragmented implementation: AI Act compliance requires obligations to become test specifications or socio-technical procedures executed and documented by actors with complementary legal and technical expertise.Fragmented assessment and legal review leave the points of intersection without a shared picture linking assessment to reporting, learning and adaptation.
- Existing frameworks: Prior cyclical frameworks and AI-specific models identify iterative functions, learning arenas or governance levels, but do not provide an operational end-to-end sequence for the AI Act.Their partial coverage motivates a requirement-driven scaffold.
- Regulatory sandboxes: Financial sandbox experience shows that experimentation does not automatically produce system-wide regulatory learning.Objectives, retention of negative results, comparable reporting and institutional routes into supervision or rule revision are needed.
- MARLA’s position: MARLA fills the coordinative gap by connecting legal interpretation, operational assessment, structured reporting, collective learning and adaptation across Local, National and European levels.It complements rather than replaces substantive methods.
- Regulatory sandboxes: Sandboxes are an AI Act instrument for regulatory learning, but post-market monitoring, incident reporting, market surveillance, real-world testing and Board coordination also generate regulatory information flows.The missing element is a common framework that makes connections among these mechanisms visible.
3. The MARLA Model
MARLA is a requirement-driven, five-stage cycle that makes regulatory learning visible across socio-technical practice and governance levels. Its stages generate distinct learning while supporting communication among actors operating at different speeds and institutional positions.
- The MARLA Cycle: MARLA begins with the legal obligation and links a system’s domain, intended use and risk classification to the requirements that must be operationalised.Its core object is implementation of legal requirements into socio-technical practices, including testing.
- Mapping: Mapping translates applicable legal requirements into testable specifications, metrics and socio-technical practices through legal-technical collaboration.It can reveal regulatory overlaps, methodological gaps, best practices and choices between quantitative benchmarks and structured expert judgment.
- Assessment: Assessment executes mapped procedures and produces compliance evidence about system behaviour and socio-technical processes such as human oversight and transparency.The resulting evidence can feed high-risk-system technical documentation under Article 11 and Annex IV.
- Assessment: Assessment generates separate learning about whether legal requirements can be meaningfully operationalised and which testing configurations, methods or thresholds remain inadequate.This learning is distinct from the compliance evidence itself.
- Reporting: Reporting transforms mapping and assessment results into comparable, aggregable and actionable information through legally distinct forms such as monitoring, incident reporting and database registration.Reporting formats and levels of detail also become objects of regulatory learning.
- Learning and multi-level coordination: Learning consolidates and disseminates insights, while MARLA’s dual governance and socio-technical readings let regulators and assessors use the same cycle as a shared reference.The model makes different speeds across Local, National and European levels visible but does not resolve their asynchrony.
4. Case Studies
The three applications show how MARLA structures regulatory learning across Local, National and European levels, while generating distinct evidence for supervision, regulatory functions and policy-making. The pilots illustrate the scaffold's descriptive value rather than empirically validating improved outcomes.
- Case-study design: MARLA is applied through two pilots and one prospective illustration spanning Local, Local-to-National, and National-to-European governance levels.The applications include a bank bias evaluation, a compliance-tech sandbox assessment, and a prospective illustration grounded in the EUSAiR experience.
- Local level: The bank case found inconsistent safety-guardrail activation across semantically analogous community-specific inputs despite no overt discrimination.Eleven category-specific reports were shared with technical and customer-service teams, and guardrail inconsistencies became a distinct object of learning.
- Local level: The bank expanded bias testing from seven to eleven demographic categories and adapted its testing suite to capture safety-mechanism behaviour.The categories emerged from regulatory requirements, operational experience, and the system's user base; the revised protocol included a calibration phase.
- Local-to-National level: The sandbox case reported multilingual benchmarking and jailbreaking results with and without safety guardrails, distinguishing baseline vulnerability from deployed protection.Learning included the need to test every intended language, the presence of jailbreaking vulnerability, and insufficient evidence to adopt the European LLM without deeper evaluation.
- Local-to-National level: Sandbox evidence exposed resource and expertise constraints: testing costs fell on the start-up, limiting scale and generalisability, while GDPR expertise was absent during assessment.The proposed response includes shared infrastructure or cost-sharing, mechanisms to bridge domain and technical expertise, and reusable with/without-guardrails reporting.
- National-to-European level: At National-to-European level, MARLA treats the sandbox itself as an object of mapping, assessment and adaptation, with SME accessibility as a design constraint.Learning can vary by sandbox type, technological maturity and supply-chain provenance, while successive cycles can revise eligibility, selection procedures, supervisory methods, or implementing acts.
5. Discussion
MARLA frames regulatory learning as a requirement-driven, multi-level cycle that connects local implementation evidence to shared European guidance while remaining deliberately non-prescriptive. The discussion also identifies distinct limits for general-purpose and agentic AI, and for slow adaptation across governance levels.
- MARLA in practice: MARLA’s pilots show how a five-stage cycle can surface implicit learning and transmit local findings toward national and European governance.The BIL case surfaced expanded bias categories, guardrail inconsistency, and testing-configuration observations; Covenance traces Local learning through EUSAiR toward the AI Office.
- Harmonisation: The scaffold links local evidence to collective learning, supporting uniform application of EU law and the effectiveness of Article 114 TFEU’s single-market objectives.Its shared map is intended to reduce divergent operationalisation of identical obligations across Member States.
- Requirement-driven design: MARLA begins with legal requirements, producing regulatory relevance in BIL and exposing a normative gap that technical assessment alone would miss in Covenance.The gap concerns the pending Code of Practice on AI-generated content labelling.
- Responsible innovation: MARLA maps responsible innovation onto anticipation, reflexivity, inclusion, and responsiveness through its stages and interdisciplinary evidence-making.Mapping anticipates implementation problems; Assessment and Reporting expose methods and assumptions; Learning and Adaptation connect evidence to revised guidance, standards, or regulation.
- Scope boundaries: For general-purpose AI, supervision largely bypasses the National level, creating an asymmetry between the three-level high-risk regime and the AI Office’s provider-facing model.The paper notes that the Code of Practice mechanism routes supervision primarily from the AI Office to providers, with only an upward request mechanism for national authorities.
- Emerging technologies: Agentic AI requires MARLA to accommodate capability-sensitive, continuous assessment and traces of goals, plans, tool calls, and human interventions.MARLA identifies institutional routes for turning deployment-level findings into thresholds, classification practice, access controls, monitoring, standards, and guidance, but does not determine the correct threshold of agenticness.
- Limits of the scaffold: MARLA deliberately leaves adequate mapping, assessment, and reporting unspecified, while making slow Local-to-European adaptation visible without resolving it.This non-prescriptive design responds to unsettled thresholds and the risk of premature prescription.
6. Conclusion
The conclusion presents MARLA as a five-stage, three-level model for making regulatory learning visible across legal, technical, and administrative practice. The pilots illustrate its use, while the paper identifies general-purpose AI, agentic AI, and empirical validation as boundaries for further work.
- Contribution: MARLA is a cyclical model organised around five stages and three levels, centred on translating legal requirements into socio-technical practices.It is intended to make the full regulatory-learning process visible and navigable for participants.
- Contribution: Each MARLA stage generates a distinct form of regulatory learning, from operationalisation and applicability to documentation, consolidation, dissemination, and adaptation.Adaptation incorporates learning into updated practices, standards, or regulation.
- Illustrations: Two pilots and a prospective illustration demonstrate MARLA from Local implementation through National coordination toward European harmonisation.The examples cover a Luxembourgish bank’s bias evaluation, an Italian start-up’s sandbox assessment, and an EUSAiR-based route toward harmonised requirements.
- EU law perspective: MARLA frames EU harmonisation as an ongoing governance process requiring continuous interaction among legal norms, administrative practice, and technical expertise.On this account, the model supports the uniform application, effectiveness, and long-term adaptability of EU law.
- Further work: Further work concerns general-purpose AI, agentic AI, and empirical validation of whether practitioners find the framework useful.These areas test MARLA’s treatment of flatter supervisory relationships, capability-sensitive assessment, and practical usability.