You’re too focused on the “regulate” part. It’s a lot easier to see it as a framework. It spells out what you need to anticipate the spirit of the law and what’s considerate good or bad practice.
If you actually read it, you will also realise it’s entirely comprised of “common sense”. Like, you wouldn’t want to do the stuff it says are not to be done anyway. Remember, corps can’t be trusted because they have a business to run. So that’s why when humans can be exposed to risky AI applications, the EU says the model provider needs to be transparent and demonstrate they’re capable of operating a model safely.