The implementation of the General Data Protection Regulation (GDPR) in the EU, rather than the regulation itself, is holding back technological innovation. The EU’s data protection governance architecture is complex, leading to contradictory interpretations among Member States. This situation is prompting companies of all kinds to halt the deployment of transformative projects in the EU. The case of Meta is paradigmatic: both the UK and the EU broadly have the same regulation (GDPR), but the UK swiftly determined that Meta could train its generative AI model using first-party public data under the legal basis of legitimate interest, while in the EU, the European Data Protection Board (EDPB) took months to issue an Opinion that national authorities must still interpret and implement individually, leading to legal uncertainty. Similarly, the case of Deepseek has demonstrated how some national data protection authorities, such as the Italian Garante, have moved to ban the AI model outright, while others have opted for investigations. This fragmented enforcement landscape exacerbates regulatory uncertainty and hampers EU’s competitiveness, particularly for startups, which lack the resources to navigate an unpredictable compliance framework. For the EU to remain competitive in the global AI race, strengthening the EDPB’s role is essential.

Emergency law serves the dual purpose of granting public authorities the powers to respond to emergencies whilst simultaneously limiting the use of such powers so as to prevent their abuse. To this end, it is crucial that emergency law clearly outlines its own scope by delimiting the grounds that permit the invocation of emergency powers. This article argues that defining those grounds requires distinguishing emergency from normalcy and disentangling it from the broader notion of crisis. Accordingly, the contribution investigates the extent to which a definition of emergency can be accommodated within EU constitutional law. To do so, it draws on examples from European emergency law, understood as encompassing both EU Member States’ laws and the European Convention on Human Rights (“ECHR”). The article shows that the vague emergency terminology employed in the EU Treaties hinders the identification of a horizontal definition of emergency and risks casting doubt on the constitutional legitimacy of emergency responses by the Union and its Member States.

Some fishing vessels breach maritime laws by operating with their mandatory tracking systems (Automatic Identification System (AIS)) switched off. Marine insurers act as enablers of this practice since these vessels cannot operate without insurance. This article explores why insurers in England take on the risk of insuring them and assesses how the insurers are operating against the regulatory framework in doing so. It identifies the solutions that could raise standards in marine insurance and lead to increased legal compliance by the insured vessels. This would consequently enhance maritime safety, while increasing transparency in fisheries across all oceans. Importantly, by discouraging vessels from going dark, any illegal activities underlying the non-transmission of AIS data, such as human, drug or weapon trafficking, illegal fishing or sanctions evasion, would also be curbed.

Since the eighteenth century, animal breeding has significantly evolved, culminating in the use of gene editing (GE) technologies like CRISPR-Cas9. These technologies offer unprecedented capabilities to modify animal genomes, potentially revolutionising breeding practices by achieving desired traits much faster compared to traditional selective breeding (SB). Because breeding programmes focussed on productivity traits have often compromised animal welfare, this article provides an analysis of the ethical issues underpinning the use of GE in animal breeding, and the current laws regulating such practices. In doing so, this article critically examines the European Union (EU)’s regulatory framework for SB and GE in farm animals, highlighting significant gaps and inconsistencies. Specifically, the use of GE animals is currently regulated under the EU’s GMO legislation, while SB is more loosely regulated, posing substantial risks to animal welfare. The authors advocate for a regulatory framework that prioritises animal welfare goals and proposes reforms to enhance animal protection objectives by ensuring a more consistent and humane approach to farm animal breeding.

This article considers the application of the precautionary principle as understood in EU law to EU decision-making on geoengineering, in particular solar geoengineering. It finds that the situation is riddled with more complexities than first appears; (i) the principle is used to argue against research, even though more research is usually itself seen as precautionary response; (ii) the risks of research are claimed to lie in its political impact, whereas the principle is traditionally applied to direct physical risks; (iii) while there are legitimate precautionary arguments against geoengineering, it is itself put forward as a precautionary measure and there are precautionary arguments in favour too. Drawing on case law and scholarship we conclude that the precautionary principle can nevertheless be applied and will lead to a procedural requirement to do comprehensive reviews of relevant scientific knowledge before decision-making. This leaves wide – but not unbounded – discretion but may still be valuable in providing a frame for reasoned public debate. We also apply our findings to the recent expert reports on Solar Radiation Modification and show that they have failed to apply precaution correctly.

The EU AI Act seeks to balance the need for societal protection against the potential risks of AI systems, with the goal of fostering innovation. However, the Act’s ex-ante risk-based approach might lead to regulatory obsolescence (already materialised in 2021 with the spread of LLMs and the consequent reopening of the regulatory process), as well as to over or under-inclusion of AI applications in risks’ categories. The paper deals with the latter outcome by exploring how AI uses in law and rulemaking hide risks not covered by the EU AI Act. It is then analysed as to how the Act lacks flexibility on amending its provisions, and the way forward. The latter is tackled without utopian and not really feasible proposals for a new act and risk-based approach, but focusing on codes of conduct and national interventions on AI uses by public authorities.

The key requirement for GMO authorisation is the submission of analytical methods for the detection, identification and quantification (DIQ), which has proven challenging in the case of New Genomic Techniques (NGTs). Currently available non-analytical approaches, such as blockchain traceability and probabilistic analysis, while potentially useful for monitoring, are insufficient for authorisation purposes. The lack of reliable DIQ methods hinders the authorisation of NGT products and raises concerns for both organic and conventional agriculture, where the presence of NGT products goes undetected. Therefore, the existing GMO regulatory framework requires reevaluation to address the challenges posed by NGTs while ensuring compliance with the broader EU food law framework.

This article conceptualises regulatory sandboxes in the food area, considering them as unique spaces with varying degrees of openness. Through an analysis of closed, semi-open and open spaces, it illustrates the regulatory landscape surrounding regulatory sandboxes of novel foods in the EU, particularly focusing on the concept of “placing on the market.” The article contends that the degree of openness of regulatory sandboxes impacts the application of the precautionary principle within these spaces. It explores scenarios where the sandbox tests various aspects of novel foods under EU soft and hard law. The characteristics of the regulatory sandbox (open, semi-open, closed) changes corresponding to what the regulatory sandbox tests in relation to a novel food, eg, a sensory characteristics or safety or other data points, such as effectiveness of labelling. This article contributes to the ongoing discourse on innovation-friendly laws surrounding regulatory frameworks applicable to novel foods in the EU.

While the European Union was recently affected by four major and multifaceted crises which gave rise to litigation, the response of the European Court of Justice to these events has remained understudied. From a close reading of the procedural features, the legal reasoning and timing of four key judgments concerning measures adopted in the wake of the Eurozone crisis, the migration crisis, Brexit, and the COVID-19 pandemic, this article sketches a broader narrative about the Court’s response to crises which transcends the specificities of the legal issues and the context of each case. The findings suggest that the Court is likely to adjudicate a crisis case by applying the expedited procedure depending on political developments, assign a larger chamber, carefully justify its reasoning with references to settled case-law, conduct a context-sensitive balancing exercise, and deliver a decision at a politically relevant time.

The swift proliferation of connected devices in the Internal Market brought attention to their weak cybersecurity standard, reflected by widespread and oftentimes unpatched vulnerabilities and successful cyberattacks. Attacks on cyber-physical systems have a critical impact not only on the Union’s economy but also on consumers’ health, safety, and fundamental rights. Against the background of the failure of the cybersecurity market of connected devices, the 10 December 2024 entered into force Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act, CRA). After casting light on the three regulatory foundational choices underpinning this EU legal act in the field of cybersecurity (ie, horizontal approach, risk-based approach, product safety approach), the article investigates the extent to which the CRA enhances the protection of fundamental rights, as claimed in the Explanatory Memorandum of the Commission’s proposal.

The rapid advancement of quantum computing presents unparalleled opportunities and challenges for the legal field. This article investigates the key legal implications of quantum computing, focusing on intellectual property, data security, regulation, and ethical considerations. The unique characteristics of quantum algorithms and hardware pose significant challenges for the existing patent system, necessitating a clear and consistent framework for protecting quantum innovations while fostering collaboration. The threat of quantum computing to current encryption methods highlights the urgent need for forward-looking data protection policies and the adoption of post-quantum cryptography. As quantum technologies continue to evolve, policymakers must work closely with stakeholders to develop adaptive, principles-based regulations that strike a balance between promoting innovation and mitigating risks. Moreover, the societal and ethical impacts of quantum computing cannot be overlooked; prioritising applications that deliver significant social good and establishing robust ethical guidelines will be crucial. Preparing the legal workforce for the quantum era requires a concerted effort to develop quantum literacy and expertise. By adopting a proactive, interdisciplinary approach, the legal community can play a vital role in shaping the quantum future, ensuring that this transformative technology upholds the rule of law, protects individual rights, and promotes the greater good of society.

The Digital Markets Act (DMA) is a rare bird in competition policy. Indeed, it is a hybrid framework incorporating the institutional setting of a regulatory tool as well as the conduct already targeted by antitrust authorities in proceedings against digital platforms. From a policy perspective, the DMA seeks to prevent some anticompetitive practices. To this end, the EU legislator has construed an intricate set of provisions pursuing different policy goals. After setting out these goals in relation to the proclaimed legal interests protected by the DMA (ie, contestability and fairness), the paper uncovers the policy goals underlying each of the provisions. Relying on the first round of compliance reports issued by gatekeepers in March and October 2024, the analysis aims at providing adequate pathways to measure the DMA’s success, based on the explicit legal interests and implict policy goals fleshed out by the regulation. The paper maps out market scenarios where policymakers can assert that the DMA’s enforcement has been effective.

Understanding the interactions between law, technology and society writ large is a very important task for legal analysis. However, the relationship between these areas can be very complex, resulting in a complex web of interactions and feedbacks. Fortunately, Science and Technology Studies (‘STS’) offers a varied toolkit which can help us to understand how these fields overlap.

In this article, I first providing a brief primer regarding STS and its core ideas. The article then considers some high-level legal discussions (particularly those relating to the concept of technology neutral law, and of Lawrence Lessig’s four modalities of regulation) and considers how STS may help to compliment or expand upon those debates. The article then examines how STS may assist with some current legal discussions, focusing on issues that arise from certain types of automated decision-making, as governed by the GDPR, Article 22. Finally, I provide some starting points for those wishing to incorporate STS into their own work, including some of STS’s limitations for law. I conclude that STS can be a very powerful tool for legal scholars, which can help to reinforce existing approaches and to produce analyses which reflect a fuller range of legal, technical and social nuances.

The European Union’s REACH (Registration, Evaluation, Authorisation and Restriction of Chemicals) Regulation aims to ensure high levels of human health and environmental protection, while also promoting alternatives to animal testing. REACH permits animal testing as a last resort only and imposes the 3Rs principle (Replacement, Reduction, and Refinement of animal testing). Nevertheless, the current regulatory practices still heavily rely on animal-based methods. This study underscores the scientific limitations of animal models and highlights the ethical and methodological burdens associated with their use. It synthesises the challenges and opportunities associated with integrating New Approach Methodologies (NAMs) into regulatory toxicity testing under REACH, as highlighted by various scientific experts. Key challenges identified include contradictory and inadequate legislative frameworks, slow and restrictive validation processes, low acceptance of NAMs by regulatory authorities, and legislative amendments expected to increase animal testing. To create a more flexible regulatory environment and advance the adoption of NAMs, there is a need for legislative reforms and increased collaboration between academia, industry and regulatory bodies. In this context, it is also necessary that more legal scholars begin to show interest in this field to help tackle the multidisciplinary challenges to non-animal testing for regulatory purposes. This article provides an introduction to the field of regulatory toxicology with a focus on the REACH framework from a legal perspective.

This article discusses the EU supply chain legislation, by virtue of the recently adopted Corporate Sustainability Due Diligence Directive (CSDDD) which aims to reduce negative sustainability impacts in global supply chains with regard to a list of human rights and environmental standards specified in its Annex I of the CSDDD.

We argue that the CSDDD marks a fundamental change on the EU level, from disclosure duties to mandating prevention of, and compensation for, adverse sustainability impacts in supply chains.

We further find that the CSDDD is a legal transplant combining the principles laid down in the OECD Guidelines for Multinational Enterprises on Responsible Business and those of the UN Guiding Principles on Business and Human Rights, along with elements of French supply chain legislation from 2017 (which relies on a private enforcement model) and the German supply chain law from 2021 (which is based on a public enforcement model). Like all legal transplants, the resulting legal text generally prompts questions about consistency and specifically raises doubts as to whether combining all of the components of a private and a public enforcement model is proportionate for the purpose of the CSDDD which is to ensure that companies take effective steps to counter violations of human rights and environmental standards in global supply chains. The scope provisions (including smaller in-scope EU firms while leaving non-EU peers of a similar size aside) paired with significant high compliance burden provide grounds to argue that the CSDDD impacts on the competitiveness of these smaller in-scope EU companies, and thus the EU economy at large.

The paper offers a comprehensive overview of Hungary’s emergency law and its misuse over the four years since its introduction in March 2020. Hungary serves as a clear example of how a “state of danger” – initially intended as an exceptional legal measure – can become normalised through repeated declarations. The populist government’s continuous use of emergency powers has led to unchecked lawmaking and the manipulation of legal frameworks to advance populist agendas. The article argues that while Hungary’s detailed emergency provisions in the Fundamental Law were intended to serve as a form of constitutional risk management, after four years of living in a permanent “state of danger”, the scholarly debate has shifted to whether this very risk management has itself become the risk. According to emergency law theory, managing constitutional risks is equally vital in the emergency legal order. Yet in Hungary, both the black letter of the law and the constitutional practices observed during and after the COVID-19 pandemic – along with the Ninth Amendment to the Fundamental Law, which introduced a new emergency regime in 2021 – reveal that constitutional risk management has ultimately failed. This is manifest in the erosion of the separation of powers, the weakening of judicial review, and the shrinking of human rights protections. The article substantiates its argument by examining the related constitutional framework and constitutional practice in Hungary between 2020 and 2024.

This article analyses the constitutional framework regulating states of emergency in Poland and addresses key issues related to their interpretation and implementation. The first part discusses the conditions for declaring martial law, a state of an extraordinary situation, and a state of natural disaster, as well as the specific rules for the operation of public authorities in such emergencies. The next part analyses the practice, revealing the consistent reluctance of Polish authorities to invoke states of emergency, even in circumstances that seem to justify such measures. Consequently, a state of emergency under the 1997 Constitution was declared in Poland only once – in 2021, in response to a migration crisis on the border with Belarus. No constitutional emergency was declared during the COVID-19 pandemic, despite the introduction of far-reaching restrictions on individual rights and freedoms. The article argues that state authorities can abuse emergency regulations, either through their unjustified application or by deliberately circumventing them.