smartnuts … the world on the cabaret-style dissecting table

When Lawyers Get Lazy: PwC’s Data Act Hiccup

W

Sometimes satire writes itself. The European Union’s Data Act, a landmark piece of legislation on data access and portability, is Regulation (EU) 2023/2854, which has been adopted on 13 December 2023, published in the Official Journal of the EU on 22 December 2023 and fully applicable since 12 September 2025. That number 2023/2854 matters. It tells compliance officers which obligations to implement and which fine print to read. Yet two recent posts from PwC Germany proudly announce that the “Data Act” is Regulation (EU) 2023/2084. One might shrug if the articles were musings on pop culture; they are supposed to be legal guidance for PwC’s clients.

PwC’s English article of 25 September 2025 (sreenshot) and its German twin of 2 October 2025 (screenshot) both trumpet the wrong citation. Ironically, the footnotes in the same articles link to the correct Official Journal entry for Regulation (EU) 2023/2854 … almost as if a helpful intern (or a begrudging AI) whispered the truth, only to be ignored. In reality, Regulation (EU) 2023/2084 is a different act altogether and has nothing to do with Data Act topics. The Data Act sits comfortably in Regulation (EU) 2023/2854, regulating raw data sharing, FRAND terms and switching fees.

When your trusted adviser can’t copy‑paste a number, the trust part evaporates. As smartnuts wryly observes, artificial intelligence now assembles board packs and writes market analysis in the time it takes to brew a coffee. Maybe PwC’s articles were an experiment: give the firm’s new AI a regulatory summary and see what happens. The result? A hallucinated regulation number and a collective facepalm.

Why does this gaffe deserve mockery? Because it undermines the notion that high‑priced legal advice is synonymous with rigour. PwC positions itself as a steward of compliance; its clients pay for confidence. Yet its authors – qualified lawyers! – confused some bird-flu-driven import list with the flagship Data Act. That is not an unfortunate typo; it is the textual equivalent of showing up to court with the wrong statute. If the article were a university paper, it would earn a red pen. Published under a Big Four brand, it becomes a cautionary tale.

Here’s where the irony bites. The smartnuts essay “Dear Consultants, AI Ate Your Pyramid” warns that AI is coming for the consulting industry’s billable hours and that clients will soon ask if a deliverable was produced by an “AI intern”. The article skewers the idea that a roomful of analysts Googling all night justifies seven‑figure fees. When PwC’s human lawyers mis‑number a regulation, the suspicion that a bot wrote the piece becomes a punchline. Maybe the firm’s AI decided “2084” looked prettier. Maybe the human editors let autopilot run. Either way, the result proves smartnuts’ thesis: the pyramid starts to wobble when machines (or distracted humans) handle research.

Sarcasm aside, there is a genuine lesson here. AI can be a powerful drafting tool, an assistant that summarises dense EU law. But professionals must still verify citations, cross‑check references and think critically. When used lazily, AI hallucinates. When used wisely, it frees experts to add value. For a firm like PwC, the choice is clear: either ensure that AI or junior staff produce flawless work, or prepare to be the subject of more sardonic blog posts.

In the meantime, dear readers, double‑check your sources. The Data Act is Regulation (EU) 2023/2854. Don’t let anyone convince you otherwise.

About the author

Michael Bunzel

Michael Bunzel (aka maschasan) is a lawyer and engineer currently living in Germany. He has been working in the field of Cybersecurity and related laws and regulations for over 25 years now.

Mike took on various roles and functions in the context of Information Security, Cybersecurity, and SCADA/Shopfloor Security at a German car manufacturer in southern Germany for more than fifteen years - currently in the R&D resort, with focus on E/E-systems in the context of automotive cybersecurity and related regulations in different markets (e.g. UN, EU, China, Korea, India, US, and others).

Mike has worked with global organizations across dozens of countries, cultures and languages, well-travelled in EMEIA, APAC and the Americas.

All articles in this blog do NOT reflect the opinion of his employer, but are all an expression of his personal view of things.

By Michael Bunzel
smartnuts … the world on the cabaret-style dissecting table

Get in touch

Tags

Meist gesehene Beiträge