AI regulatory enforcement: same as GDPR or worse?