Cell and gene therapies derive from a substantial manipulation of cells or the application of gene editing techniques. They are promising products because they enable therapy personalisation, are potentially helpful for treating rare or resistant diseases, and may become useful in future epidemics. Because of this strategic worth, the infrastructure needed for manufacturing these therapies is turning into a subdomain within the domain of critical infrastructures (CIs), understood as the structures whose operation is key for the integrity and security of a nation. This paper analyses why cell and gene therapy infrastructure can be considered as an emergent CI domain, stressing three aspects: automated manufacturing equipment; software solutions (including the growing adoption of artificial intelligence and cloud technology); and human expertise. These complex manufacturing systems, which are becoming increasingly automated and digitalised, may be surrounded by new risks and vulnerability points, which requires adequate regulatory solutions and governance initiatives. A comprehensive approach is therefore advanced here, where therapy manufacture has medical and technological relevance, but is equally crucial from the viewpoint of nations’ public health and internal stability.

This article examines the regulatory landscape of financial data access within the European Union, emphasising the implications and effectiveness of recent legislative initiatives. It provides an in-depth analysis of the Financial Data Access Regulation (FIDA) proposal and its relationship with existing laws, focusing on the possibilities for data access and utilisation in the context of Open Finance. The discussion evaluates the regulatory framework for automated decision-making (ADM) in European financial law, highlighting its strengths and identifying areas for improvement. By exploring the intersections of tech resilience, financial regulation, and data protection, the article aims to clarify the practical implications of current and proposed rules, emphasising effective practices and areas needing further legislative attention.

Digital assets have burst onto global markets as a new class of assets for investment, trade and finance. Their growing popularity and economic relevance have been, however, accompanied by legal uncertainties and regulatory concerns. Together with domestic and regional responses, a strong case for international harmonisation is to be made. This Paper explores the emergence of principles and best practices on proprietary rights, insolvency and enforcement as a crucial process of international legal harmonisation of rules for digital assets.

If the consumer is insured under the group insurance contract and becomes a party to that contract, the consumer shall enjoy the protection envisaged under the Unfair Terms Directive. As a result, the consumer shall be allowed to get acquainted with the terms of the contract, otherwise the consumer is entitled to rely on protection against unfair terms even if they relate to the insurance cover (author’s summary).

This paper examines the impact that the finally approved Artificial Intelligence Act (AIA) will have on European public authorities when developing, acquiring and using AI systems. It argues that, despite the initial disappointment that the Act may cause when approaching it from an administrative law perspective, and despite the fact that some of the solutions that have been finally chosen are questionable, it represents a remarkable step forward, duly addressing many of the problems raised in the literature in relation to the automation of administrative decisions and the use of AI systems by public authorities.

The expansion of EU regulatory governance in the financial sector since the end of the global financial crisis 2008 has given rise to the need to examine regulatory consistency in the volumes of financial regulation that may have cross-cutting implications. In this light, this article examines the effectiveness of the Regulation of ESG infomediaries through the lens of “functional regulatory consistency” with other infomediary regulations, for credit rating agencies and stock market benchmarks. It argues that this lens most aptly reveals the three key weaknesses of the regulatory regime for ESG infomediaries. These relate to sub-optimal coverage of scope, over-inclusiveness in the application of regulatory standards and under-inclusiveness where appropriate governance is not provided. the sub-optimal coverage of scope raises the question of whether ESG stock market index providers should indeed be regulated as ESG infomediaries or as stock market benchmarks more generally falling within the Benchmarks Regulation 2016. Over-inclusiveness and under-inclusiveness in the regulatory provision reflects blind spots in applying functional regulatory consistency, where it is inappropriate due to distinguishing features in business models, market structures or market relations.

Following the contemporary debate surrounding two alternative perspectives on compliance – enforcement and management – this article suggests an analysis through the lens of the rule of law crisis. Specifically, the financial and techno-managerial strategy developed by the EU for the indirect protection of the rule of law relies on mechanisms that combine characteristics from both the enforcement and management approaches. This article will identify these mechanisms, namely the European Semester, the Conditionality regulation, the European Structural Investment Funds and the Recovery and Resilience Facility, in order to determine their nature, features, and tools for ensuring compliance with the rule of law. The hypothesis of this article relies on the idea that the EU’s tools are characterised by a mismatch between the causes of the identified problems and the chosen solutions. Considering that the deployment of the above measures has not re-established compliance, the EU strategy toes between inducing rule conformity on the one hand and deterring rule of law violations on the other. However, it seems that only the former can restore the rule of law, as the latter is considered ill-equipped to reverse or at least halt instances of backsliding. This mismatch explains why the Justice Scoreboard, the Framework, and the Review Cycle with its Annual Report have not made any difference, and more generally, why management strategies are unfit for dealing with deliberate backsliding.1

Regulation is nothing without enforcement. This particularly holds for the dynamic field of emerging technologies. Hence, this article has two ambitions. First, it explains how the EU’s new Artificial Intelligence Act (AIA) may be implemented and enforced by various institutional bodies, thus clarifying the governance framework of the AIA. Second, it proposes a normative governance model, providing recommendations to ensure uniform and coordinated execution of the AIA and the fulfillment of the legislation. The article explores how the AIA may be implemented by national and EU institutional bodies, encompassing longstanding bodies, such as the European Commission, and those newly established under the AIA, such as the AI Office. It investigates their roles across supranational and national levels, emphasising how EU regulations influence institutional structures and operations. These regulations may not only directly dictate the structural design of institutions but also indirectly request administrative capacities needed to enforce the AIA.

Compared to previous secondary legislation, Article 11 of the Digital Covid Certificates regulations was remarkably explicit in its requirement for Member States to consider scientific evidence when restricting free movement for the certificate holders. However, we argue in this Article that the regulations achieved a partial codification of the existent case law of the CJEU rather than imposing any additional requirements. Namely, the case law had already required Member States to rely on scientific evidence that reflects the international consensus, that is relevant and up to date, and that the evidence had to demonstrate by means of a risk assessment a real risk to the public health. We also discuss these findings in the light of the proportionality and precautionary principles and suggest that understanding the evolution of the EU legal order’s evidentiary requirements is useful in the light of the legislator’s claim of objective and rational policy-making procedures in public health and other crises.

This contribution analyses the EU’s new data acts. Interoperability is a common denominator of the EU’s new data acts. This paper demonstrates that the new data acts provide various approaches or concepts of collaborative governance to regulate interoperability. Although the EU’s new data acts are far from a uniform governance concept, we detected certain institutional arrangements organising the collaboration between private self-regulatory bodies, other private stakeholders and public bodies to lay down rules for interoperability.

Toxic substances and endocrine disruptors are present in consumer goods on the European Union (EU) market, such as in food contact materials like cookware. This article investigates whether a legal recall obligation of such products exists in EU law, and in the absence of such an obligation, how the EU legislature has ensured that such products are disposed of in a manner that does not compromise human health and the environment when they become waste. For this purpose, this Article analyses recall obligations for food contact materials containing persistent organic pollutants, as well as their waste regulations. It focuses on a class of substances with non-stick properties, some of them formerly used in cookware, such as pentadecafluorooctanoic acid (PFOA) and perfluorooctane sulfonic acid (PFOS). We show that there is no single legal recall obligation; rather, many legal obligations are scattered among different provisions of EU law. When read together, they form a complex web of obligations, which may lead to recall measures for most of these products. However, doubts over the feasibility and effectiveness of such recalls remain.

In the European Union (EU), novel foods and Genetically Modified Organisms (GMOs) are subject to long and costly authorisation procedures and post-marketing requirements. The regulatory frameworks applicable to novel foods and GMOs come into effect based on perceived factors of risk. These “risk triggers” are characteristics of novel foods and GMOs which differentiate them from traditional foods, creating a presumption of risk. Within the EU, consumer acceptance of genetically modified foods and novel foods like insects or cultivated meat is shaped by heuristics and biases, mainly focusing on the “novelty” and “unnaturalness” of these products, resulting in a predominantly negative perception. This paper investigates the close connection between cognitive biases identified in consumer perception literature and the implementation of specific risk triggers in the regulation of novel foods and GMOs in the EU. It subsequently raises concerns about the appropriateness of these risk triggers in forming a presumption of risk for these innovative products.

One of the pillars on which product liability law is based is the defence for development risks. According to this defence, the producer is not liable for the damage caused to the injured party if, at the time the product was put into circulation, the state of scientific and technical knowledge did not allow the existence of the defect to be discovered. The Proposal for a Directive drafted by the European Commission and published on 28 September 2022 continues to provide, in Article 10.1.e), the defence for development risks. The Proposal for a Directive refers to this particular issue in Recital 39, which introduces some requirements for the assessment of such defence.

However, despite this recognition, does this defence fit into the digital paradigm, and how can it be applied to damage caused by defects in products with digital elements that incorporate artificial intelligence?

The Covid-19 crisis provided an opportunity for the European Union to offer an alternative regulatory response to the crisis of values by systemically linking European funding to respect for the rule of law. A rule of law conditionality mechanism for spending was introduced in the Recovery and Resilience Facility and in Regulation 2020/2092. It is both positive – in that it encourages Member States to implement reforms and investments aimed at improving the rule of law – and negative – in that it takes the form of financial sanctions. However, the development of the rule of law conditionality is leading to an economisation of the concept of the rule of law, insofar as it mainly concerns those dimensions of the rule of law that are conducive to growth – such as justice systems and the fight against corruption. As a result, it could paradoxically exacerbate the very crisis it is designed to resolve.

The Digital Markets Act (DMA) is designed to ensure fair and contestable digital markets. With one of the key sources of market power of big tech being data, it is not surprising that it is the subject matter of a number of DMA provisions. Article 5(2) prohibits gatekeepers from engaging in forms of accumulation and cross-use of personal data, unless they receive users’ consent, defined by reference to the General Data Protection Regulation (GDPR).

Consent as defined by the GDPR suffers from a number of shortcomings, among other things, relating to whether consent can be truly freely given. The DMA tries to address some of the shortcomings by formulating a version of consent that seemingly goes beyond the GDPR. While a new version of consent may ensure greater effectiveness, it raises questions concerning the interaction and compatibility with the GDPR.

To shed light on this issue, the paper discusses the role and meaning of consent in the DMA vis-à-vis the GDPR and explores how to interpret consent under both the DMA and GDPR in a manner that is consistent with each other and that accounts for the characteristics of digital markets.

International environmental law rarely refers to the rule of law. However, in fostering inter-state cooperation, international environmental agreements oblige parties to prohibit, restrict or control various activities that are harmful to the environment. The application of these constraints at the national level requires the rule of law to be taken into account.

This article offers some general thoughts on the rule of law in international economic law. It begins by briefly defining the rule of law and indicating the legal sources on which it is based. It then shows that the TFEU, confirmed by the case law of the Court of Justice, requires the rule of law to be respected in the conduct of the Union’s commercial policy. However, although the rule of law may be favourable to international trade and investment, it is not indispensable to them. The rule of law is conducive, but not essential, to trade and investment. For businesses, the risks associated with a weak respect for the rule of law represent a cost, which they take into account when setting the price of their products. Finally, it should be remembered that the principles of the rule of law do not apply in the same way in the domestic sphere as in international law. This article is intended as a panoramic introduction to the relationship between the rule of law and international economic law. More specialised studies are published later in this issue, including analyses focusing on trade or investment or national perspectives, such as that of China.

The Internet of Medical Things (IoMT) devices, as well as the Internet of Things phenomenon itself, are gaining a new group of customers every day, for whom it is almost a matter of course to use a wide range of devices, such as Internet-connected complex life support equipment or “smart” watches monitoring basic life parameters. With the growing popularity of such devices, however, questions about the safety of their users begin to arise, because almost in proportion to the number of benefits associated with the use of these products, the number of risks associated with them increases – eg improper functioning of Internet-connected life support equipment, in addition to threatening the life or health of its user, may affect the physical security of the product itself, the security of both personal and technical (eg non-personal) data processed by the specific product, or finally the cyber-security of the product. While the issues related to the protection of personal data and privacy, in general, have been discussed many times by the doctrine, the issues related to the protection of users of these devices under consumer law have not been considered much.

In this context, the question arises whether the current legal regulations provide an adequate and sufficient level of protection for IoMT users. In particular, whether the average IoMT user can actually exercise their rights under the provisions of consumer law and whether the protection afforded to him – both in terms of the scope of their rights and the scope of obligations and liability of manufacturers and suppliers of these devices – is not only illusory? In order to answer the above questions, the author will evaluate the prevailing market practices – still focused around the doctrine of “caveat emptor” or “let the buyer beware” – and compare them with these regulations and juxtapose them with relevant legal regulations. However, given the lack of geographical borders in the field of cyber security and privacy, the author will not only analyse EU cyber security legislation, but also US legislation in a comparative legal analysis. The choice of jurisdictions to be compared is also related to the size and importance of both the US and the EU for the global IoMT market. It should be noted that the United States has a dominant position in the IoMT, while the European Union is estimated to have the second largest IoMT market globally. At the same time, however, there are differences in legal systems between the two economic areas. An analysis carried out in this way will make it possible not only to answer the question posed above, but also to possibly identify those areas of regulation that need to be changed or adapted to the realities of IoMT.

Fifteen years following the entry into force of the Lisbon Treaty, this article seeks to analyse its impact on EU executive rulemaking. It delves into the constitutional concerns arising from the architecture of Articles 290 and 291 Treaty on the Functioning of the European Union (TFEU), in particular relating to the institutional balance, the concept of implementation, the distinction between delegated and implementing acts and the legitimacy of the control mechanisms envisaged in the TFEU. The article argues that there is a need for reform and integration of Articles 290 and 291 TFEU in one Article dedicated to EU executive rulemaking, going beyond mere considerations of institutional balance. Such a reform entails a return to the essence of comitology as a general mechanism for consultation in and control of rulemaking, allowing Member States to deliberate with the Commission with a veto right for both the Parliament and the Council, embracing the idea of executive subsidiarity. It requires also to go beyond the old comitology mechanisms based on a pure interinstitutional perspective by connecting to Article 11 TEU (Treaty on European Union) and recognising the need for participatory engagement so as to enhance the legitimacy of EU executive rulemaking.