Drawing on the findings from the contributions to this Special Issue, this article maintains that, fifteen years after Lisbon, a debate on the law and politics of delegated rulemaking in the European Union (EU) is as relevant as ever. That is because the functional and procedural integration of the Member States in the EU multilevel and multi-jurisdictional legal system, supplanted by unprecedented challenges for supranational crisis management in the recent years, often led to unpredictable and often controversial configurations of delegated rulemaking. One may thus conclude that, fifteen years later, the constitutional framework put in place in the Lisbon Treaty has not been able to effectively constrain the normative development that evolved from delegated rulemaking, which often followed a different path. Hence the Lisbon Treaty provides only a partial blueprint for delegated rulemaking, leaving out rulemaking by EU agencies, regulatory frameworks and private parties, as well as increasingly composite and hybrid cooperation formulas involving EU and national executive actors. The future of EU delegated rulemaking will very much depend on the capacity to reach consensus on important meta-principles and political conceptions, such as democratisation and parliamentarisation, shaping the normative spaces generated within the sui generis dynamic European model of governance.

The 2022–2023 Qatargate scandal – which entailed the widespread undermining of Union democracy by members of the European Parliament acting on behalf of third countries – has rocked the European Union to its core. The proposal by the Commission aimed at establishing transparency and accountability surrounding such activities cannot therefore come at a more appropriate time. But does the proposal live up to its objectives? Here, this piece casts doubt on whether that is the case, with this piece exploring Qatargate as an example, as well as the content, constitutionality, and criticism of the proposal. This Article also makes comparisons to Union-based representation activities and the Commission’s approach to antidumping, and shines light on the Commission’s treatment of third-country actors and representatives thereof.

The COVID-19 pandemic has clearly demonstrated that international cooperation to combat pandemics is insufficient. The World Health Organization has, therefore, recently reformed the International Health Regulations based on the experience of the COVID 19-pandemic. The World Health Assembly also plans to adopt a new Pandemic Agreement to further strengthen international cooperation. However, negotiations have not yet been successful, and this year’s World Health Assembly agreed to extend the negotiations for the Pandemic Agreement by one year. Reason enough to analyse and critically evaluate the reform efforts in detail, and to give an outlook on the future of international pandemic law.

Small claim. Regulation 861/2007 (European Small Claims Procedure Regulation). Unfair term in terms of service agreement. Breach of contract through shadowbanning. Infringement on Articles 12 and 17 of Regulation 2022/2065 (Digital Services Act).

European electricity regulation has evolved to include a novel category of binding sectoral rules known as terms, conditions, and methodologies (TCMs). These are created within a regulatory framework outlined in delegated Commission regulations by private electricity firms and approved by technocratic agencies, most notably the EU Agency for the Cooperation of Energy Regulators (ACER). Despite their technical nature, TCMs have significant economic impact. This prompts frequent appeals of ACER’s TCM decisions, questioning ACER’s role and the overall institutional equilibrium of the TCM procedure. ACER’s TCM decisions are subject to dual-level legal review – internal by ACER’s Board of Appeal and external by European Courts. This paper uses two case studies to examine how dual-level legal review impacts the institutional balance of the TCM procedure. We find that the two levels of review engage poorly, so that contrary to expectations, legal review creates uncertainty rather than clarity, allowing for considerable pragmatism. These findings show the importance of considering legal review when studying sectoral governance. Policy implications are also significant, as the identified issues inhibit innovation and problem-solving, the raison d’etre of the TCMs.

The new EU Markets in Crypto-Assets Regulation (“MiCA”) emphasises the prevention of market abuse as one of its five main objectives. This paper critically analyzes MiCA’s provisions on market abuse (Title VI), applying the new rules to the primary categories of crypto-asset market integrity risks to provide a coherent interpretation. In doing so, we consider both the pre-existing legal framework for protecting market integrity, chiefly the Market Abuse Regulation (“MAR”), and the unique features of crypto-asset markets. We find that by largely replicating MAR, MiCA presents “new wine in old bottles” challenges, as crypto-assets introduce novel issues that the legislator attempts to address with a subset of existing tools. The extent to which “decentralized finance” (DeFi) activities will incur liability under MiCA’s anti-market abuse provisions remains unclear, particularly regarding various blockchain network participants. Furthermore, classifying MEV strategies as market abuse may prove difficult. The absence of certain safe-harbor provisions present in MAR, such as those for self-insiders and buy-back and stabilisation schemes, may create uncertainty and potentially chill legitimate market behavior under MiCA.

Trade and sustainable development (TSD) chapters in international trade agreements include labour provisions with a view to prevent a “race to the bottom” and reaffirm the existing international labour commitments. When properly formulated and implemented, these provisions could have positive normative impacts on the international and domestic rule of law. This article provides a critical analysis of the evolution of labour standards in international trade agreements, particularly focusing on the European Union’s (EU) approach, in comparison with the approach in the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP). More specifically, it considers ways in which trade agreements contribute to the improvement of labour standards in domestic legal systems. While EU trade agreements embrace minimum standards under international labour law rather than higher standards that apply in the EU legal order, the article argues that there is at least a normative shift towards a more efficient implementation of labour rights through EU agreements, which could make a limited contribution to the rule of law.

The European legislator has included the fulfilment service provider (FSP) in European product safety legislation as a new responsible economic operator (EO) in e-commerce for instances where no other EO is based in the European Union. As a matter of coherency, this adjusted personal scope of product safety law will likely be mirrored in a revised product liability directive. This article explores to what extent the aims and expectations of European legislator with respect to these legal changes (law in the books) align with the perceptions of FSPs and legal advisors in the field (law in action). This is done by means of a legal analysis of the goals and envisioned effects of these changes as well as a semi-structured interview study on how FSPs and legal advisors in the field perceive this new role, responsibility, and liability. The findings provide indications that product safety law currently in force might not (yet) lead to the desired effects. The findings also make us question the extent to which victim compensation is actually improved by the proposed adjustment of the personal scope of the product liability directive.

In comparison to other high-risk industrial sectors, human rights due diligence (HRDD) in the arms sector remains unclear and underdeveloped. This article elucidates how supply chain regulations can provide pertinent guidance for clarifying and elaborating the standards and requirements of the HRDD obligations of arms companies. Part I reaffirms the importance of independent HRDD obligations for arms companies due to the significant human rights risks posed by arms exports. Part II contextualises the limitations in the development of HRDD in the arms industry by examining the corporate policies of major arms companies. Part III explicates why supply chain regulations for conflict minerals are suitable guidance for clarifying and elaborating the HRDD obligations of arms companies. Part IV details five elements of an HRDD framework for arms companies that are essential for comprehensively identifying, evaluating and addressing the human rights risks of arms exports. Part V offers concluding remarks.

The development of medical artificial intelligence is dependent on the availability of vast quantities of data, a considerable proportion of which is medical data containing sensitive information pertaining to the health and well-being of patients. The use of such data is subject to extensive legal regulation and is further hindered by financial and organisational constraints, which can result in limitations on accessibility. One potential solution to this problem is the use of synthetic data. This article examines the potential for their use in light of cybersecurity requirements derived from horizontal and sectoral EU legislation. The outcome of this analysis is that EU legislation does not contain specific regulations on the use of synthetic data. Consequently, it cannot be concluded that there is any prohibition on their use. Moreover, while the Medical Device Regulation (MDR) contains some general requirements for cybersecurity, these are further specified by the provisions of the AI Act. It is important to note, however, that the AI Act will not apply to Class I medical devices, which are subject only to the MDR. Furthermore, only indirect obligations within the scope under consideration can be derived from the horizontal regulations, which will apply in a limited number of cases.

The Artificial Intelligence Act (AI Act) of the European Union (EU) claims to be based on a risk-based approach to avoid over-regulation and to respect the principle of legislative proportionality. This paper argues that risk-based regulation is indeed the right approach to AI regulation. At the same time, however, the paper shows that important provisions of the AI Act do not follow a truly risk-based approach. Yet, this is nothing that cannot be fixed. The AI Act provides for sufficient tools to support future-proof legislation and to implement it in line with a genuine risk-based approach. Against this background, the paper analyses how the AI Act should be applied and implemented according to its original intention of a risk-based approach, and what lessons legislators around the world can learn from the AI Act in regulating AI.

The analysis of liability aspects facing Artificial Intelligence (‘AI’)-generated outputs under copyright and related rights has been overlooked compared to other issues connected to the development and use of AI. This study fills this gap by exploring pertinent questions under international, EU and UK law. Specifically, the study tackles actionable reproduction, allocation of liability, and availability of defences. The analysis ultimately shows that, while it is clear that each case will need to be decided on its own merits, the generative AI output phase raises several profiles of liability under copyright law. If the goal of policymakers and relevant stakeholders is to ensure the balanced and sustainable development of AI, then the issues related to the generation and dissemination of AI outputs need to be given ample attention and a greater role in the debate than what has been the case so far, whether it is in the context of risk assessment and compliance, licensing initiatives, or in contentious scenarios.

This paper explores the necessary adaptations to the theory of administrative discretion when using AI systems. Regulatory frameworks in the EU, US, and Spain do not prohibit the application of AI in discretionary decision-making. Particularly, AI systems can be used when discretionary power involves correlations. However, to meet Rule of Law conditions, it is essential to establish adaptations and boundaries in areas such as duty of care, reason-giving, and judicial review. These conditions should focus on the impact of decisions on the affected individuals.

While the private sector is leading the way in digital transformation, the public sector is perceived as missing the opportunity. The way forward in this transformation is pointed out as adopting data-driven technologies as drivers of public policies. This will undoubtedly transform the regulatory process. To better understand how these technologies would intervene in the policy cycle and the effect of this transformation on regulation, this paper studies the work of the Organisation for Economic Co-operation and Development on the matter. Adopting the public policy cycle as an analytical lens and illuminated by the insights of Critical Data Studies, this paper deepens the understanding of how these technologies could change the policy cycle and bring together steps previously conceived as subsequential stages. This transformation can trigger a real disruption of the regulatory process as we currently know it.

On 5 March 2024 the European Court of Justice (CJEU) issued a landmark decision on access to harmonised standards that grant presumption of conformity with legal requirements. The CJEU ruled that such standards should be made available free of charge because, once incorporated in EU legislation, they form part of EU law. While the decision was positively received in the scholarly community, it is expected to carry profound consequences for European standards organisations, who hold copyrights over harmonised standards and rely on their sales to finance their standardisation activities. The judgment may also affect the European Commission, whom the Advocate General and the CJEU placed at the centre of European standardisation due to its role in transforming harmonised standards into EU law. This case note engages with the ruling and aims to shed light onto its possible implications for the European standardisation system.

This article explores the use of laws to unduly silence critics of corporate human rights abuses. It considers the hypothesis that state and business elites align their interests, fuelling the employment of regulations to excessively impede naming and shaming activities. This article draws on socio-legal and critical legal studies to demonstrate how laws, while typically perceived as protective, can also serve to empower corporations and suppress dissent. It reviews examples of such collusion and calls for further case studies to better understand the interplay between business interests and regulatory practices.

This early-stage research article intends to explore the regulatory and liability requirements of a not yet fully developed subset of consumer Internet of Things (IoT) objects: the mixed-functions IoT devices. These objects could be wearables or not but could perform an e-health function, such as measuring your heartbeat, as well as consumer functions, such as displaying chat notifications. I argue that these mixed-functions devices will play an important role within smart homes as they will interact with new medical IoT devices to carry on rehabilitation and other medical functions at home. That is why it is important to start mapping down all the regulatory and liability requirements that might interest mixed-functions IoT device developers for them to understand which thread to follow in this regulatory and liability requirements maze.

This contribution examines the legal intricacies surrounding law enforcement data collection practices in Bulgaria within the framework of the Law Enforcement Directive 2016/680 (LED) and relevant Court of Justice of the European Union (CJEU) rulings, particularly cases C-205/21 and C-80/23. The analysis underscores challenges in interpreting the concept of “strict necessity” and ensuring compliance with its provisions, in particular, Art. 10. Key findings reveal ambiguities in the LED’s application, particularly concerning judicial review and the scope of data collection. The subsequent Case C-80/23 further seeks clarification on the strict necessity standard and the scope of judicial review in the collection of biometric and genetic data. The outcome of both cases has broader implications for EU member states, highlighting the need for legislative alignment and underscoring the complexities and challenges in balancing effective law enforcement with the protection of fundamental rights.

As part of its risk management system, aiming at the mitigation of so-called systemic risks on very large online platforms and very large online search engines (VLOPSEs), the DSA introduces data access rights for independent researchers. With this instrument, the legislator hopes to enable the production of evidence concerning possible threats to society and democracy that might be linked to these platforms or search engines. After an overview of the functioning of the risk management system in the DSA that is characterised by a collaborative governance framework and a learning-based approach, the article will explore the role of the researchers inside this framework. It thereby focuses on the legal significance the researchers’ evidence could have for the risk mitigation obligations imposed on the VLOPSEs in the DSA by interpreting the provisions of the DSA.

The EU’s policies in the field of technology broadly defined are increasingly marked by a concern over strategic autonomy, and Europe’s place in the world. Regulatory interventions are framed in terms of “digital sovereignty,” with the Commission seeking to ensure that external dependencies are reduced with the aim of increasing the EU’s resilience to geopolitical instability and external shocks. Using the case study of semiconductors, the chips that power modern electronic devices, this article explores how technology policy in the EU sits at the economy–security nexus, in which economic goals and security goals are interdependent and inseparable. Focusing on the life cycle of the semiconductor supply chain from the control over natural resources through to the cybersecurity requirements placed on the finished products, this article demonstrates the increasing security logic embedded within a burgeoning industrial technology policy.