The aim of this article and the ensuing Special Issue is to assess, après fifteen years, the effects on the EU legal and political system of the overhaul of executive delegated powers inaugurated by the Lisbon Treaty. It identifies core parameters – i.e. (institutional) balance of powers, (democratic) legitimacy, control and accountability, effectiveness of EU policy implementation – considered by the contributions to this Special Issue to map and examine, both constitutionally and normatively, the EU system of delegated powers in law and practice. It also puts forward seven overarching reflections revealing some of the core issues and challenges posed by the current stage of development of the post-Lisbon EU system of delegated powers.

Fifteen years following the entry into force of the Lisbon Treaty, this article seeks to analyse its impact on EU executive rulemaking. It delves into the constitutional concerns arising from the architecture of Articles 290 and 291 Treaty on the Functioning of the European Union (TFEU), in particular relating to the institutional balance, the concept of implementation, the distinction between delegated and implementing acts and the legitimacy of the control mechanisms envisaged in the TFEU. The article argues that there is a need for reform and integration of Articles 290 and 291 TFEU in one Article dedicated to EU executive rulemaking, going beyond mere considerations of institutional balance. Such a reform entails a return to the essence of comitology as a general mechanism for consultation in and control of rulemaking, allowing Member States to deliberate with the Commission with a veto right for both the Parliament and the Council, embracing the idea of executive subsidiarity. It requires also to go beyond the old comitology mechanisms based on a pure interinstitutional perspective by connecting to Article 11 TEU (Treaty on European Union) and recognising the need for participatory engagement so as to enhance the legitimacy of EU executive rulemaking.

The delegation of powers to the European Commission, facilitating the adoption of non-legislative acts to implement centrally provisions of European legislation, has long been an essential part of administrative governance in the European Union. However, the established practice of delegating legslative and implementing powers to the European Commission has increased over the last decade, at the same time in the context of the various crises that the EU has had to confront during this period. The crisis context has generally demonstrated that executive institutions often emergency politics, and the amplified use of delegated powers in such circumstances raises questions about the capacity of legislative institutions to carry out their usual control and scrutiny functions. The concern here is whether – at times when the established mechanisms of control need to be carried out in times of crisis, under greater time pressure – there is the risk of legislative institutions (that had originally delegated powers to the Commission) are being sidelined, with the detrimental effects that this may have on the democratic accountability of the whole process. Against this background of normative question-marks, this article examines empirically to what extent the scrutiny of the Commission’s adoption of delegated powers has fundamentally changed during times of emergency. In particular, it provides an analysis of the use of delegated powers by the European Commission in the context of the EU’s response to the Covid-19 pandemic in order to establish whether the Council and the European Parliament managed to enable the usual control mechanisms effectively. By way of conclusion, the article discusses the implications of the findings for the wider discussion and the future use of emergency governance in the European Union.

European electricity regulation has evolved to include a novel category of binding sectoral rules known as terms, conditions, and methodologies (TCMs). These are created within a regulatory framework outlined in delegated Commission regulations by private electricity firms and approved by technocratic agencies, most notably the EU Agency for the Cooperation of Energy Regulators (ACER). Despite their technical nature, TCMs have significant economic impact. This prompts frequent appeals of ACER’s TCM decisions, questioning ACER’s role and the overall institutional equilibrium of the TCM procedure. ACER’s TCM decisions are subject to dual-level legal review – internal by ACER’s Board of Appeal and external by European Courts. This paper uses two case studies to examine how dual-level legal review impacts the institutional balance of the TCM procedure. We find that the two levels of review engage poorly, so that contrary to expectations, legal review creates uncertainty rather than clarity, allowing for considerable pragmatism. These findings show the importance of considering legal review when studying sectoral governance. Policy implications are also significant, as the identified issues inhibit innovation and problem-solving, the raison d’etre of the TCMs.

Within the area of electricity market regulation, a practice has emerged in which the chain of delegation has gone beyond the European Commission, resulting in double delegation. During 2015–2017, the European Commission adopted implementing regulations requiring detailed European terms, conditions and methodologies (TCMs) for electricity markets and system operation to be jointly adopted by national energy regulators. Should the latter fail to agree within a predefined time limit, rule-making would move to the Agency for the Cooperation of Energy Regulators. This rule-making procedure entails that, depending on the dynamic within the procedure, different actors would adopt the TCMs. This article examines how double-delegated rule-making unfolds in a novel and emerging practice, evolving beneath implementing acts. By analysing the factors behind whether TCMs are adopted jointly by national agencies or not, the study investigates whether this form of delegated rule-making in a network setting delivers decisions or whether rule-making by a European Union agency is needed.

Drawing on the findings from the contributions to this Special Issue, this article maintains that, fifteen years after Lisbon, a debate on the law and politics of delegated rulemaking in the European Union (EU) is as relevant as ever. That is because the functional and procedural integration of the Member States in the EU multilevel and multi-jurisdictional legal system, supplanted by unprecedented challenges for supranational crisis management in the recent years, often led to unpredictable and often controversial configurations of delegated rulemaking. One may thus conclude that, fifteen years later, the constitutional framework put in place in the Lisbon Treaty has not been able to effectively constrain the normative development that evolved from delegated rulemaking, which often followed a different path. Hence the Lisbon Treaty provides only a partial blueprint for delegated rulemaking, leaving out rulemaking by EU agencies, regulatory frameworks and private parties, as well as increasingly composite and hybrid cooperation formulas involving EU and national executive actors. The future of EU delegated rulemaking will very much depend on the capacity to reach consensus on important meta-principles and political conceptions, such as democratisation and parliamentarisation, shaping the normative spaces generated within the sui generis dynamic European model of governance.

Cybersecurity of medical devices has become a concrete concern for regulators and policymakers in the European Union and United States. Following the COVID-19 pandemic, there has been an increase in cyber-attacks on critical healthcare infrastructures and their IT systems, which have suffered service disruptions and put patients’ health and safety at risk. The increase in cyberattacks on healthcare infrastructure, including medical devices, exacerbated by the growing digitalisation of healthcare services in the EU and the US, has led legislators and regulatory bodies to pay more attention to cybersecurity. Cybersecurity of AI-based medical devices requires the assessment of three areas subject to evolving regulatory approaches: medical devices, Artificial Intelligence (AI), and cybersecurity. Although they may appear distinguished in regulatory matters, the existence of AI-based medical devices and their possible cyber vulnerabilities makes clear that the three are intertwined and deserve closer attention from a regulatory point of view. Few scholars have devoted attention to AI and cybersecurity together. Even less, in our understanding, few comprehensive and EU/US comparative pieces of literature reflect on this specific issue. This paper aims to fill this gap and address the main implications of different regulatory approaches toward AI medical device cybersecurity in the EU and the US. The research stems from the assumption that regulation of medical devices in the EU has been historically inspired by regulatory trends in the US, although with the different cultural, societal, and legal traditions that made them adapt to the specificities of the territory. The paper observes that the US is a rule-based system reflecting a “command-and-control” approach, while the EU system is a principle-based one. While they share the main characteristic of being risk-regulation-based systems, their differences impact how AI-enhanced cybersecurity is regulated.

The Internet of Medical Things (IoMT) devices, as well as the Internet of Things phenomenon itself, are gaining a new group of customers every day, for whom it is almost a matter of course to use a wide range of devices, such as Internet-connected complex life support equipment or “smart” watches monitoring basic life parameters. With the growing popularity of such devices, however, questions about the safety of their users begin to arise, because almost in proportion to the number of benefits associated with the use of these products, the number of risks associated with them increases – eg improper functioning of Internet-connected life support equipment, in addition to threatening the life or health of its user, may affect the physical security of the product itself, the security of both personal and technical (eg non-personal) data processed by the specific product, or finally the cyber-security of the product. While the issues related to the protection of personal data and privacy, in general, have been discussed many times by the doctrine, the issues related to the protection of users of these devices under consumer law have not been considered much.

In this context, the question arises whether the current legal regulations provide an adequate and sufficient level of protection for IoMT users. In particular, whether the average IoMT user can actually exercise their rights under the provisions of consumer law and whether the protection afforded to him – both in terms of the scope of their rights and the scope of obligations and liability of manufacturers and suppliers of these devices – is not only illusory? In order to answer the above questions, the author will evaluate the prevailing market practices – still focused around the doctrine of “caveat emptor” or “let the buyer beware” – and compare them with these regulations and juxtapose them with relevant legal regulations. However, given the lack of geographical borders in the field of cyber security and privacy, the author will not only analyse EU cyber security legislation, but also US legislation in a comparative legal analysis. The choice of jurisdictions to be compared is also related to the size and importance of both the US and the EU for the global IoMT market. It should be noted that the United States has a dominant position in the IoMT, while the European Union is estimated to have the second largest IoMT market globally. At the same time, however, there are differences in legal systems between the two economic areas. An analysis carried out in this way will make it possible not only to answer the question posed above, but also to possibly identify those areas of regulation that need to be changed or adapted to the realities of IoMT.

The development of medical artificial intelligence is dependent on the availability of vast quantities of data, a considerable proportion of which is medical data containing sensitive information pertaining to the health and well-being of patients. The use of such data is subject to extensive legal regulation and is further hindered by financial and organisational constraints, which can result in limitations on accessibility. One potential solution to this problem is the use of synthetic data. This article examines the potential for their use in light of cybersecurity requirements derived from horizontal and sectoral EU legislation. The outcome of this analysis is that EU legislation does not contain specific regulations on the use of synthetic data. Consequently, it cannot be concluded that there is any prohibition on their use. Moreover, while the Medical Device Regulation (MDR) contains some general requirements for cybersecurity, these are further specified by the provisions of the AI Act. It is important to note, however, that the AI Act will not apply to Class I medical devices, which are subject only to the MDR. Furthermore, only indirect obligations within the scope under consideration can be derived from the horizontal regulations, which will apply in a limited number of cases.

This early-stage research article intends to explore the regulatory and liability requirements of a not yet fully developed subset of consumer Internet of Things (IoT) objects: the mixed-functions IoT devices. These objects could be wearables or not but could perform an e-health function, such as measuring your heartbeat, as well as consumer functions, such as displaying chat notifications. I argue that these mixed-functions devices will play an important role within smart homes as they will interact with new medical IoT devices to carry on rehabilitation and other medical functions at home. That is why it is important to start mapping down all the regulatory and liability requirements that might interest mixed-functions IoT device developers for them to understand which thread to follow in this regulatory and liability requirements maze.

By establishing a common data governance mechanism across the EU, the Regulation on the European Health Data Space (EHDS) aims to enhance the reuse of electronic health data for secondary use (e.g. public health, policy-making, scientific research) purposes and realise associated benefits. However, the EHDS requires health data holders to make available vast amount of personal and non-personal electronic health data, including electronic health data subject to intellectual property (IP) rights, for secondary use, which may pose risks for stakeholders (patients, healthcare providers and manufacturers alike). This paper highlights some conceptual legal problems which need to be addressed in order to provide clearer regulatory requirements to ensure effective and consistent implementation of key data minimisation measures (anonymisation or pseudonymisation) and data management safeguards (secure processing environments). The paper concludes that the EHDS has been drafted ambiguously (for example, its definition of “electronic health data” or the list of “minimum categories of electronic data for secondary use”), which could lead to inconsistent data management practices and may impair the rights and legitimate interests of data subjects and rights holders. To address legal uncertainties, prevent fragmentation and mitigate/eliminate risks, the EHDS requires closely coordinated implementation and legislative fine-tuning.

The proposal for a European Health Data Space aims at creating a common space where individuals may control their health data in a trusted and secure way. The objective is not only improving healthcare delivery, but also enhancing the opportunities to use health data for research and innovation. To achieve these results, the proposal implements a mandatory self-certification scheme for European health records systems as well as for wellness devices and applications, setting up essential requirements related to interoperability and security. Although this is the first intervention that sets a horizontal framework that is mandatory for all Member States, the security requirements that are included in the legislative proposal are not sufficiently detailed and comprehensive. Given that cyberthreats are increasing and security incidents affecting health data may potentially have an impact on the lives of patients, it is important that cybersecurity measures are adopted and implemented in the most effective way. The paper will analyse the European Health Data Space proposal pointing to the open issues and doubts that may be emerging and it will compare them with the proposed Cyber Resilience Act, identifying the issues that may be solved thanks to this horizontal regulation and the ones that instead remain open.

Regulatory impact assessment (RIA) is an appraisal tool to bring evidence to bear on regulatory decisions. A key property of RIA is that is corrects errors in reasoning by pushing regulators towards deliberative thinking to override intuitive judgments. However, the steps for regulatory analysis suggested by international organisations and governmental handbooks do not handle two sources of bias and barriers that are well documented in the literature on behavioural insights. First, bias enters the process via knowledge production during the analytical process of assessment. Second, bias affects knowledge utilisation when regulators “read” or utilise the results of RIA. We explore these two pathways by focusing on drivers of behaviour rather than lists of biases. The conclusions reflect on the limitations of current practice and its possible improvement, making suggestions for an RIA architecture that is fully informed by behavioural analysis.

Equivalence is an essential discipline for liberalising trade between States whose sanitary and phytosanitary (SPS) measures are based on divergent regulatory approaches. During the Uruguay Round negotiations, “equivalence” under the SPS Agreement was regarded by negotiators as being “of great importance”, and it was even considered to establish a right for exporting States. In practice, the discipline has remained ineffective, with only thirty-six equivalence recognition decisions made since 1995. This article argues that the underperformance of equivalence as an obligation is structural in nature: in effect, the SPS Agreement establishes a conditional right of importing Members to refuse equivalence requests. As such, exporting Members only gain equivalence protection where they either demonstrate that their measures (1) meet the importing Member’s appropriate level of protection or (2) achieve the same level of protection as parties to recognition agreements. Finally, the need for fostering regulatory trust between domestic SPS regulatory agencies is underscored as a prerequisite for achieving broader equivalence recognition.

This article analyses the mechanisms of prioritisation and hierarchisation of risk contained under influential soft law frameworks on value chain due diligence. It identifies the main stages of the due diligence process where prioritisation may be required and clarifies the criteria that may be used by corporations for prioritisation decisions. The article contributes to the development of the literature concerning prioritisation mechanisms under value chain due diligence norms, highlighting, from a compliance perspective, how corporations are expected to prioritise both their evaluations to identify and assess adverse impacts as well as their actions to address specific impacts identified and assessed. In doing so, it showcases the challenges present when comparing the significance of adverse impacts pertaining to different policy fields and their implications in a prioritisation context. It then compares the solutions found in these soft law frameworks concerning prioritisation to the ones contained in European laws and legislative proposals on the subject. The analysis reveals the different approaches used by legislators and reflects on their repercussions for prioritisation mechanisms, suggesting the reinforcement and clarification of prioritisation requirements in accordance with international frameworks of reference.

This article explains why hyper-engaging dark patterns should be considered unlawful in the European Union even though they are very common online, particularly on content-sharing platforms. A hyper-engaging dark pattern is a digital interface with an addictive design: it makes users spend more time interacting with the service by making use of big data analytics and one or more behavioural trait. Hyper-engaging dark patterns are a form of hypernudge. They exploit the dopamine cycle, reduce users’ autonomy and may have additional detrimental health effects. The Unfair Commercial Practices Directive should be interpreted as prohibiting them either as a form of undue influence or under the general test pursuant to Article 5. Both the Digital Services Act and the Artificial Intelligence Act can play a beneficial but merely complementary role in combatting the diffusion of hyper-engaging dark patterns.

The development of the precautionary principle by the EU Courts has often been interpreted by scholars as inconsistent with another trend in EU risk regulation: one that is evidence-based and relies on impact assessment. This article argues that the two trends – precaution and regulatory impact assessment – are not mutually exclusive. Together they may, in fact, act as a procedural safeguard against discretionary decisions that have an impact on fundamental rights, especially under conditions of epistemic uncertainty. The article illustrates this claim by looking at the decisions to close schools in Ireland during the pandemic.

Digitalisation has changed traders’ possibilities of influencing the autonomy of consumer choice in the digital environment. The digital market of the European Union involves a wide spectrum of commercial practices – such as dark and addictive patterns, target advertising and personalisation – that nudge consumers to take decisions that are not in their favour. One of the main aims of the Unfair Commercial Practices Directive 2005 is to protect the freedom of consumer decision-making. However, currently, the Directive’s capacity to safeguard consumer choice in the digital environment is not sufficiently effective. Through the lens of law prohibiting unfair commercial practices, this article analyses the means available to consumer courts to strengthen consumer decision-making autonomy in the digital environment. The article argues that regulation of prohibition of unfair commercial practices regarding the digital environment should be modernised by obliging – in certain circumstances – national courts ex officio to assess violations of fair commercial practices and by reversing the burden of argumentation and proof.

This article explores the use of laws to unduly silence critics of corporate human rights abuses. It considers the hypothesis that state and business elites align their interests, fuelling the employment of regulations to excessively impede naming and shaming activities. This article draws on socio-legal and critical legal studies to demonstrate how laws, while typically perceived as protective, can also serve to empower corporations and suppress dissent. It reviews examples of such collusion and calls for further case studies to better understand the interplay between business interests and regulatory practices.