The European legislator has included the fulfilment service provider (FSP) in European product safety legislation as a new responsible economic operator (EO) in e-commerce for instances where no other EO is based in the European Union. As a matter of coherency, this adjusted personal scope of product safety law will likely be mirrored in a revised product liability directive. This article explores to what extent the aims and expectations of European legislator with respect to these legal changes (law in the books) align with the perceptions of FSPs and legal advisors in the field (law in action). This is done by means of a legal analysis of the goals and envisioned effects of these changes as well as a semi-structured interview study on how FSPs and legal advisors in the field perceive this new role, responsibility, and liability. The findings provide indications that product safety law currently in force might not (yet) lead to the desired effects. The findings also make us question the extent to which victim compensation is actually improved by the proposed adjustment of the personal scope of the product liability directive.

In comparison to other high-risk industrial sectors, human rights due diligence (HRDD) in the arms sector remains unclear and underdeveloped. This article elucidates how supply chain regulations can provide pertinent guidance for clarifying and elaborating the standards and requirements of the HRDD obligations of arms companies. Part I reaffirms the importance of independent HRDD obligations for arms companies due to the significant human rights risks posed by arms exports. Part II contextualises the limitations in the development of HRDD in the arms industry by examining the corporate policies of major arms companies. Part III explicates why supply chain regulations for conflict minerals are suitable guidance for clarifying and elaborating the HRDD obligations of arms companies. Part IV details five elements of an HRDD framework for arms companies that are essential for comprehensively identifying, evaluating and addressing the human rights risks of arms exports. Part V offers concluding remarks.

The development of medical artificial intelligence is dependent on the availability of vast quantities of data, a considerable proportion of which is medical data containing sensitive information pertaining to the health and well-being of patients. The use of such data is subject to extensive legal regulation and is further hindered by financial and organisational constraints, which can result in limitations on accessibility. One potential solution to this problem is the use of synthetic data. This article examines the potential for their use in light of cybersecurity requirements derived from horizontal and sectoral EU legislation. The outcome of this analysis is that EU legislation does not contain specific regulations on the use of synthetic data. Consequently, it cannot be concluded that there is any prohibition on their use. Moreover, while the Medical Device Regulation (MDR) contains some general requirements for cybersecurity, these are further specified by the provisions of the AI Act. It is important to note, however, that the AI Act will not apply to Class I medical devices, which are subject only to the MDR. Furthermore, only indirect obligations within the scope under consideration can be derived from the horizontal regulations, which will apply in a limited number of cases.

The Artificial Intelligence Act (AI Act) of the European Union (EU) claims to be based on a risk-based approach to avoid over-regulation and to respect the principle of legislative proportionality. This paper argues that risk-based regulation is indeed the right approach to AI regulation. At the same time, however, the paper shows that important provisions of the AI Act do not follow a truly risk-based approach. Yet, this is nothing that cannot be fixed. The AI Act provides for sufficient tools to support future-proof legislation and to implement it in line with a genuine risk-based approach. Against this background, the paper analyses how the AI Act should be applied and implemented according to its original intention of a risk-based approach, and what lessons legislators around the world can learn from the AI Act in regulating AI.

The analysis of liability aspects facing Artificial Intelligence (‘AI’)-generated outputs under copyright and related rights has been overlooked compared to other issues connected to the development and use of AI. This study fills this gap by exploring pertinent questions under international, EU and UK law. Specifically, the study tackles actionable reproduction, allocation of liability, and availability of defences. The analysis ultimately shows that, while it is clear that each case will need to be decided on its own merits, the generative AI output phase raises several profiles of liability under copyright law. If the goal of policymakers and relevant stakeholders is to ensure the balanced and sustainable development of AI, then the issues related to the generation and dissemination of AI outputs need to be given ample attention and a greater role in the debate than what has been the case so far, whether it is in the context of risk assessment and compliance, licensing initiatives, or in contentious scenarios.

This paper explores the necessary adaptations to the theory of administrative discretion when using AI systems. Regulatory frameworks in the EU, US, and Spain do not prohibit the application of AI in discretionary decision-making. Particularly, AI systems can be used when discretionary power involves correlations. However, to meet Rule of Law conditions, it is essential to establish adaptations and boundaries in areas such as duty of care, reason-giving, and judicial review. These conditions should focus on the impact of decisions on the affected individuals.

While the private sector is leading the way in digital transformation, the public sector is perceived as missing the opportunity. The way forward in this transformation is pointed out as adopting data-driven technologies as drivers of public policies. This will undoubtedly transform the regulatory process. To better understand how these technologies would intervene in the policy cycle and the effect of this transformation on regulation, this paper studies the work of the Organisation for Economic Co-operation and Development on the matter. Adopting the public policy cycle as an analytical lens and illuminated by the insights of Critical Data Studies, this paper deepens the understanding of how these technologies could change the policy cycle and bring together steps previously conceived as subsequential stages. This transformation can trigger a real disruption of the regulatory process as we currently know it.

On 5 March 2024 the European Court of Justice (CJEU) issued a landmark decision on access to harmonised standards that grant presumption of conformity with legal requirements. The CJEU ruled that such standards should be made available free of charge because, once incorporated in EU legislation, they form part of EU law. While the decision was positively received in the scholarly community, it is expected to carry profound consequences for European standards organisations, who hold copyrights over harmonised standards and rely on their sales to finance their standardisation activities. The judgment may also affect the European Commission, whom the Advocate General and the CJEU placed at the centre of European standardisation due to its role in transforming harmonised standards into EU law. This case note engages with the ruling and aims to shed light onto its possible implications for the European standardisation system.

This article explores the use of laws to unduly silence critics of corporate human rights abuses. It considers the hypothesis that state and business elites align their interests, fuelling the employment of regulations to excessively impede naming and shaming activities. This article draws on socio-legal and critical legal studies to demonstrate how laws, while typically perceived as protective, can also serve to empower corporations and suppress dissent. It reviews examples of such collusion and calls for further case studies to better understand the interplay between business interests and regulatory practices.

This early-stage research article intends to explore the regulatory and liability requirements of a not yet fully developed subset of consumer Internet of Things (IoT) objects: the mixed-functions IoT devices. These objects could be wearables or not but could perform an e-health function, such as measuring your heartbeat, as well as consumer functions, such as displaying chat notifications. I argue that these mixed-functions devices will play an important role within smart homes as they will interact with new medical IoT devices to carry on rehabilitation and other medical functions at home. That is why it is important to start mapping down all the regulatory and liability requirements that might interest mixed-functions IoT device developers for them to understand which thread to follow in this regulatory and liability requirements maze.

This contribution examines the legal intricacies surrounding law enforcement data collection practices in Bulgaria within the framework of the Law Enforcement Directive 2016/680 (LED) and relevant Court of Justice of the European Union (CJEU) rulings, particularly cases C-205/21 and C-80/23. The analysis underscores challenges in interpreting the concept of “strict necessity” and ensuring compliance with its provisions, in particular, Art. 10. Key findings reveal ambiguities in the LED’s application, particularly concerning judicial review and the scope of data collection. The subsequent Case C-80/23 further seeks clarification on the strict necessity standard and the scope of judicial review in the collection of biometric and genetic data. The outcome of both cases has broader implications for EU member states, highlighting the need for legislative alignment and underscoring the complexities and challenges in balancing effective law enforcement with the protection of fundamental rights.

As part of its risk management system, aiming at the mitigation of so-called systemic risks on very large online platforms and very large online search engines (VLOPSEs), the DSA introduces data access rights for independent researchers. With this instrument, the legislator hopes to enable the production of evidence concerning possible threats to society and democracy that might be linked to these platforms or search engines. After an overview of the functioning of the risk management system in the DSA that is characterised by a collaborative governance framework and a learning-based approach, the article will explore the role of the researchers inside this framework. It thereby focuses on the legal significance the researchers’ evidence could have for the risk mitigation obligations imposed on the VLOPSEs in the DSA by interpreting the provisions of the DSA.

The EU’s policies in the field of technology broadly defined are increasingly marked by a concern over strategic autonomy, and Europe’s place in the world. Regulatory interventions are framed in terms of “digital sovereignty,” with the Commission seeking to ensure that external dependencies are reduced with the aim of increasing the EU’s resilience to geopolitical instability and external shocks. Using the case study of semiconductors, the chips that power modern electronic devices, this article explores how technology policy in the EU sits at the economy–security nexus, in which economic goals and security goals are interdependent and inseparable. Focusing on the life cycle of the semiconductor supply chain from the control over natural resources through to the cybersecurity requirements placed on the finished products, this article demonstrates the increasing security logic embedded within a burgeoning industrial technology policy.

The European Union (EU) has extended the application of the EU emissions trading scheme to international shipping and the International Maritime Organization (IMO), and various countries are working on implementing instruments that put a price on greenhouse gas emissions (GHG) from this sector. Due to these policy developments, GHG emissions from shipping may become subject to multiple pricing instruments in the coming years. In response, stakeholders have voiced concerns over the potential negative impacts that this could have on both the shipping industry and international trade, and called for double pricing to be avoided. Against this background, this article discusses the potential pros and cons of double pricing GHG emissions from shipping and identifies options to reduce its negative impacts. Overall, the article finds that the case to avoid double pricing rests on a balance of competing interests, contextual factors, and instrument design. If policymakers aim to avoid double pricing, regulatory cooperation between policymakers working on shipping decarbonisation and border carbon adjustment mechanisms can provide important lessons on how to do so.

Cell and gene therapies derive from a substantial manipulation of cells or the application of gene editing techniques. They are promising products because they enable therapy personalisation, are potentially helpful for treating rare or resistant diseases, and may become useful in future epidemics. Because of this strategic worth, the infrastructure needed for manufacturing these therapies is turning into a subdomain within the domain of critical infrastructures (CIs), understood as the structures whose operation is key for the integrity and security of a nation. This paper analyses why cell and gene therapy infrastructure can be considered as an emergent CI domain, stressing three aspects: automated manufacturing equipment; software solutions (including the growing adoption of artificial intelligence and cloud technology); and human expertise. These complex manufacturing systems, which are becoming increasingly automated and digitalised, may be surrounded by new risks and vulnerability points, which requires adequate regulatory solutions and governance initiatives. A comprehensive approach is therefore advanced here, where therapy manufacture has medical and technological relevance, but is equally crucial from the viewpoint of nations’ public health and internal stability.

This article examines the regulatory landscape of financial data access within the European Union, emphasising the implications and effectiveness of recent legislative initiatives. It provides an in-depth analysis of the Financial Data Access Regulation (FIDA) proposal and its relationship with existing laws, focusing on the possibilities for data access and utilisation in the context of Open Finance. The discussion evaluates the regulatory framework for automated decision-making (ADM) in European financial law, highlighting its strengths and identifying areas for improvement. By exploring the intersections of tech resilience, financial regulation, and data protection, the article aims to clarify the practical implications of current and proposed rules, emphasising effective practices and areas needing further legislative attention.

Digital assets have burst onto global markets as a new class of assets for investment, trade and finance. Their growing popularity and economic relevance have been, however, accompanied by legal uncertainties and regulatory concerns. Together with domestic and regional responses, a strong case for international harmonisation is to be made. This Paper explores the emergence of principles and best practices on proprietary rights, insolvency and enforcement as a crucial process of international legal harmonisation of rules for digital assets.

If the consumer is insured under the group insurance contract and becomes a party to that contract, the consumer shall enjoy the protection envisaged under the Unfair Terms Directive. As a result, the consumer shall be allowed to get acquainted with the terms of the contract, otherwise the consumer is entitled to rely on protection against unfair terms even if they relate to the insurance cover (author’s summary).

This paper examines the impact that the finally approved Artificial Intelligence Act (AIA) will have on European public authorities when developing, acquiring and using AI systems. It argues that, despite the initial disappointment that the Act may cause when approaching it from an administrative law perspective, and despite the fact that some of the solutions that have been finally chosen are questionable, it represents a remarkable step forward, duly addressing many of the problems raised in the literature in relation to the automation of administrative decisions and the use of AI systems by public authorities.

The expansion of EU regulatory governance in the financial sector since the end of the global financial crisis 2008 has given rise to the need to examine regulatory consistency in the volumes of financial regulation that may have cross-cutting implications. In this light, this article examines the effectiveness of the Regulation of ESG infomediaries through the lens of “functional regulatory consistency” with other infomediary regulations, for credit rating agencies and stock market benchmarks. It argues that this lens most aptly reveals the three key weaknesses of the regulatory regime for ESG infomediaries. These relate to sub-optimal coverage of scope, over-inclusiveness in the application of regulatory standards and under-inclusiveness where appropriate governance is not provided. the sub-optimal coverage of scope raises the question of whether ESG stock market index providers should indeed be regulated as ESG infomediaries or as stock market benchmarks more generally falling within the Benchmarks Regulation 2016. Over-inclusiveness and under-inclusiveness in the regulatory provision reflects blind spots in applying functional regulatory consistency, where it is inappropriate due to distinguishing features in business models, market structures or market relations.