Feels like a first step in a long dance performance. Good that EU regulators are already looking at this space (given that nobody else does).
The main risk for them is that the actual risks from use and abuse of AI in various domains will only start showing up later. So early regulatory work might appear silly or misplaced. But that is not a reason to adopt a "wait-and-see" attitude.
There is so much recent precedence in the software domain: the privacy disaster from targeted adtech and the speculative manias of crypto. Once large numbers of users are lulled into certain behaviors under false pretenses it becomes much harder to reverse the social damage.
While privacy is a connected risk here too, there are much wider possibilities for abuse once algorithms are on the loose, processing and influencing without any transparency or accountability. We know that people will try anything that is not explicitly illegal if it gives them financial or political leverage. Gray areas of missing regulation are an open invitation for "creative" thinking and regulatory arbitrage.
The noise "not to suppress innovation" will be enormous. But the concepts and tools for sandboxing and keeping a close eye on developments are there. The idea that the only way to innovate is to move fast and break things is just a transparently self-serving dictum that should be put to rest.
They should keep an eye for oligopolies too. There is no reason to endure more decades of gratuitous "winner-takes-all" dynamics. The technologies are exciting, there are clearly positive scenarios. Let us hope we are smart enough to properly regulate smart algorithms.