Not since 2018 and the “New Deal for Consumers” package has the European Union (EU) seemed so close to stepping up the enforcement of consumer protection rules. The European Commission is expected to unveil a new “consumer enforcement package” by the end of the year, which should include revisions of the Regulation on Consumer Protection Cooperation, the Directive on Consumer Alternative Dispute Resolution and the Regulation on EU Online Dispute Resolution. In parallel, the Representative Actions Directive came into force recently. This paper examines these different initiatives and assesses whether these evolutions can truly be the first steps towards a brighter future for the enforcement of consumer protection rules in the EU or whether they are likely to remain a series of missed opportunities.

The purpose of this contribution is to briefly present the content of the EU–US Data Privacy Framework recently adopted by the European Commission and then to assess whether it meets the expectations expressed by the Court of Justice of the European Union in its Schrems II judgment and related case law.

This early-stage research article intends to explore the regulatory and liability requirements of a not yet fully developed subset of consumer Internet of Things (IoT) objects: the mixed-functions IoT devices. These objects could be wearables or not but could perform an e-health function, such as measuring your heartbeat, as well as consumer functions, such as displaying chat notifications. I argue that these mixed-functions devices will play an important role within smart homes as they will interact with new medical IoT devices to carry on rehabilitation and other medical functions at home. That is why it is important to start mapping down all the regulatory and liability requirements that might interest mixed-functions IoT device developers for them to understand which thread to follow in this regulatory and liability requirements maze.

The proposed Artificial Intelligence Act (AI Act) is the first comprehensive attempt to regulate artificial intelligence (AI) in a major jurisdiction. This article analyses Article 9, the key risk management provision in the AI Act. It gives an overview of the regulatory concept behind the norm, determines its purpose and scope of application, offers a comprehensive interpretation of the specific risk management requirements and outlines ways in which the requirements can be enforced. This article can help providers of high-risk systems to comply with the requirements set out in Article 9. In addition, it can inform revisions of the current draft of the AI Act and efforts to develop harmonised standards on AI risk management.

By establishing a common data governance mechanism across the EU, the Regulation on the European Health Data Space (EHDS) aims to enhance the reuse of electronic health data for secondary use (e.g. public health, policy-making, scientific research) purposes and realise associated benefits. However, the EHDS requires health data holders to make available vast amount of personal and non-personal electronic health data, including electronic health data subject to intellectual property (IP) rights, for secondary use, which may pose risks for stakeholders (patients, healthcare providers and manufacturers alike). This paper highlights some conceptual legal problems which need to be addressed in order to provide clearer regulatory requirements to ensure effective and consistent implementation of key data minimisation measures (anonymisation or pseudonymisation) and data management safeguards (secure processing environments). The paper concludes that the EHDS has been drafted ambiguously (for example, its definition of “electronic health data” or the list of “minimum categories of electronic data for secondary use”), which could lead to inconsistent data management practices and may impair the rights and legitimate interests of data subjects and rights holders. To address legal uncertainties, prevent fragmentation and mitigate/eliminate risks, the EHDS requires closely coordinated implementation and legislative fine-tuning.

Due to its severity, the COVID-19 pandemic is one of the greatest crises to have tested the European Union’s (EU) ability to take effective action. The restrictive measures adopted by the Member States to curb its spread affected in particular the free movement of people and partly of goods. This prompted the EU to take action inter alia to maintain essential travel, protect supply chains, enhance contact tracing and facilitate the coordinated resumption of travel. Building on the notion of “output legitimacy”, this paper assesses the EU’s success in responding to the COVID-19 pandemic in transport by looking at the four main initiatives between the end of 2020 and June 2022, namely: (1) the EU Digital COVID Certificates; (2) cross-border contact tracing through Passenger Locator Forms; (3) the “Green Lanes” for freight transport; and (4) the coordinated approach to facilitating safe and free movement. These initiatives are measured against the EU’s legal competence, economic interests, political pressure and the added value of EU action. While recognising the small set of cases, the results show that, although legal competence is a decisive factor for success, EU initiatives can achieve equivalent effect even in its absence, provided other conditions are met.

This article analyses how emergency legislation has affected law-making and regulatory quality principles (RQPs) before, during and after the COVID-19 pandemic (2019–2021) from stakeholders’ perspectives. It takes Slovakia as a case study, as this country was considered a high performer in the adoption of RQPs before the crisis, while empirical findings suggest a subsequent decline in their use. We argue that formal RQPs are not deeply embedded and are vulnerable to crises. In doing so, we conceptually distinguish between standard (fully following the RQPs), emergency (modified to accommodate crisis) and non-standard law-making (violating formal rules and the RQPs). In the transition from a crisis to a post-crisis context, the deployment of both emergency and non-standard law-making has become relatively permanent without proper justification having been provided. This reinforces the notion that RQPs and governance legitimacy became less important for the executive than in the pre-crisis period and emergency and non-standard regulatory law-making became institutionalised as new norms of swift law-making. All of these factors prevent stakeholders from being informed and from engaging in deliberation, which jeopardises the legitimacy of post-crisis law-making governance.

The Hague District Court in the Netherlands faced a novel tort law issue in 2021 in Milieudefensie et al v Royal Dutch Shell plc – namely, whether Shell is liable in tort for the reduction costs of carbon dioxide produced in the end use of energy-carrying Shell products. The civil lawsuit aims to make Shell (re)search for adequate substitutes so as to enable Shell’s customers to reduce their consumption of energy-carrying Shell products. It is argued here that Shell’s liability should be assessed within Guido Calabresi’s “cheapest cost avoider” framework.

French whistleblower legislation establishes a unified legal regime for the treatment of reports and for the protection of whistleblowers. Drawing on French whistleblower law, recently amended by the transposition of Directive 2019/1937 of 23 October 2019, this article examines whether the specific features of whistleblowing in relation to public health and environmental risks are adequately addressed by this unified regime. The article identifies four key factors for the effective handling of whistleblowing relating to public health and the environment: (1) the possibility of protecting whistleblowers who report facts gathered outside the workplace; (2) the possibility of protecting legal persons as whistleblowers; (3) the possibility of carrying out in-depth investigations to characterise the reality of the risks reported; and (4) the possibility of archiving whistleblowing in order to detect weak signals of risks over the long term. In these four areas, the article provides a nuanced diagnosis of the situation in French law and offers suggestions for improvement.

The proposal for a European Health Data Space aims at creating a common space where individuals may control their health data in a trusted and secure way. The objective is not only improving healthcare delivery, but also enhancing the opportunities to use health data for research and innovation. To achieve these results, the proposal implements a mandatory self-certification scheme for European health records systems as well as for wellness devices and applications, setting up essential requirements related to interoperability and security. Although this is the first intervention that sets a horizontal framework that is mandatory for all Member States, the security requirements that are included in the legislative proposal are not sufficiently detailed and comprehensive. Given that cyberthreats are increasing and security incidents affecting health data may potentially have an impact on the lives of patients, it is important that cybersecurity measures are adopted and implemented in the most effective way. The paper will analyse the European Health Data Space proposal pointing to the open issues and doubts that may be emerging and it will compare them with the proposed Cyber Resilience Act, identifying the issues that may be solved thanks to this horizontal regulation and the ones that instead remain open.

Increasing interest from stakeholders has brought new focus on risk governance and risk regulation, such as the regulator’s execution of duty and tangible results on safety and environmental protection in oil and gas industry. One recent example, from 2019, is the Office of the Auditor General Norway’s (OAG) investigation of the Petroleum Safety Authority’s (PSA) follow-up on health, safety and the environment in the petroleum industry, where the regulatory regime in Norway resting on functional requirements was questioned. Simplistically speaking, there are two current traditions or main schools in regulatory regimes: use of functional requirements associated with co-regulation and use of normative requirements associated with prescriptive regulation. In this paper, we introduce a generic model from an attribute perspective on contrasting, gauging or evaluating the two different regulatory regimes. Furthermore, this approach may explain the controversy regarding the favouring of functional or prescriptive regulatory regimes by the different players in the industry. Our case is based on regulations relating to offshore oil and gas operations, in particular focusing on the Norwegian sector. We use the OAG’s investigation of the PSA and the public reaction as our material because this material is proposed to provide a thorough and valid description of how the effects of the Norwegian regulatory regime are perceived from the outside. We believe that the generic concept presented here is applicable when performing investigations in other industries involved in hazardous activities.

Regulatory impact assessment (RIA) is an appraisal tool to bring evidence to bear on regulatory decisions. A key property of RIA is that is corrects errors in reasoning by pushing regulators towards deliberative thinking to override intuitive judgments. However, the steps for regulatory analysis suggested by international organisations and governmental handbooks do not handle two sources of bias and barriers that are well documented in the literature on behavioural insights. First, bias enters the process via knowledge production during the analytical process of assessment. Second, bias affects knowledge utilisation when regulators “read” or utilise the results of RIA. We explore these two pathways by focusing on drivers of behaviour rather than lists of biases. The conclusions reflect on the limitations of current practice and its possible improvement, making suggestions for an RIA architecture that is fully informed by behavioural analysis.

Until robots and humans mostly worked in fast-paced and yet separate environments, occupational health and safety (OHS) rules could address workers’ safety largely independently from robotic conduct. This is no longer the case: collaborative robots (cobots) working alongside humans warrant the design of policies ensuring the safety of both humans and robots at once, within shared spaces and upon delivery of cooperative workflows. Within the European Union (EU), the applicable regulatory framework stands at the intersection between international industry standards and legislation at the EU as well as Member State level. Not only do current standards and laws fail to satisfactorily attend to the physical and mental health challenges prompted by human–robot interaction (HRI), but they exhibit important gaps in relation to smart cobots (“SmaCobs”) more specifically. In fact, SmaCobs combine the black-box unforeseeability afforded by machine learning with more general HRI-associated risks, towards increasingly complex, mobile and interconnected operational interfaces and production chains. Against this backdrop, based on productivity and health motivations, we urge the encoding of the enforcement of OHS policies directly into SmaCobs. First, SmaCobs could harness the sophistication of quantum computing to adapt a tangled normative architecture in a responsive manner to the contingent needs of each situation. Second, entrusting them with OHS enforcement vis-à-vis both themselves and humans may paradoxically prove safer as well as more cost-effective than for humans to do so. This scenario raises profound legal, ethical and somewhat philosophical concerns around SmaCobs’ legal personality, the apportionment of liability and algorithmic explainability. The first systematic proposal to tackle such questions is henceforth formulated. For the EU, we propose that this is achieved through a new binding OHS Regulation aimed at the SmaCobs age.

This paper provides an analysis of the legal and policy foundations of the different approaches adopted by the European Union (EU) in relation to the 2015/2016 and 2022 refugee “crises”. Its main objective is to show how a risk-based biopolitical framework can bridge the gap between EU institutional narratives and the critique of Europe’s racialised governance schemes. The two “crises” have been largely shaped by a perceived need to manage risk, yet this has produced very different institutional responses, in ways that concealed their racialised dimension. Analysing how risk has been understood in the two contexts, the paper shows how their legal and policy foundations (re-)produce a racialised differential scheme. Amidst ongoing debates on reforming EU migration and asylum law, the paper also shows how the current proposals further consolidate this scheme.

Equivalence is an essential discipline for liberalising trade between States whose sanitary and phytosanitary (SPS) measures are based on divergent regulatory approaches. During the Uruguay Round negotiations, “equivalence” under the SPS Agreement was regarded by negotiators as being “of great importance”, and it was even considered to establish a right for exporting States. In practice, the discipline has remained ineffective, with only thirty-six equivalence recognition decisions made since 1995. This article argues that the underperformance of equivalence as an obligation is structural in nature: in effect, the SPS Agreement establishes a conditional right of importing Members to refuse equivalence requests. As such, exporting Members only gain equivalence protection where they either demonstrate that their measures (1) meet the importing Member’s appropriate level of protection or (2) achieve the same level of protection as parties to recognition agreements. Finally, the need for fostering regulatory trust between domestic SPS regulatory agencies is underscored as a prerequisite for achieving broader equivalence recognition.

This paper critically evaluates the European Commission’s proposed AI Act’s approach to risk management and risk acceptability for high-risk artificial intelligence systems that pose risks to fundamental rights and safety. The Act aims to promote “trustworthy” AI with a proportionate regulatory burden. Its provisions on risk acceptability require residual risks from high-risk systems to be reduced or eliminated “as far as possible”, having regard for the “state of the art”. This criterion, especially if interpreted narrowly, is unworkable and promotes neither proportionate regulatory burden nor trustworthiness. By contrast, the Parliament’s most recent draft amendments to the risk management provisions introduce “reasonableness” and cost–benefit analyses and are more transparent regarding the value-laden and contextual nature of risk acceptability judgments. This paper argues that the Parliament’s approach is more workable and better balances the goals of proportionality and trustworthiness. It explains what reasonableness in risk acceptability judgments would entail, drawing on principles from negligence law and European medical devices regulation. It also contends that the approach to risk acceptability judgments needs a firm foundation of civic legitimacy, including detailed guidance or involvement from regulators and meaningful input from affected stakeholders.

This paper explores the possibility of developing a framework to assess the quality of Impact Assessments (IAs) by examining the common elements found in the existent academic literature around this concept, the stocktaking exercises carried out by the European institutions and the opinions of the Regulatory Scrutiny Board. At this intersection, we find that diversity in the interpretation and application of the guidelines is not only acceptable but also necessary in tailoring IAs to the needs they represent. Our findings are relevant because a universal framework that avoids focusing solely on assessing quality not only will provide much-needed coherence in this field but will also raise awareness about the normality of variability in the application of any European Union guidelines, thus reflecting the inherent nature of the IAs.

This article analyses the mechanisms of prioritisation and hierarchisation of risk contained under influential soft law frameworks on value chain due diligence. It identifies the main stages of the due diligence process where prioritisation may be required and clarifies the criteria that may be used by corporations for prioritisation decisions. The article contributes to the development of the literature concerning prioritisation mechanisms under value chain due diligence norms, highlighting, from a compliance perspective, how corporations are expected to prioritise both their evaluations to identify and assess adverse impacts as well as their actions to address specific impacts identified and assessed. In doing so, it showcases the challenges present when comparing the significance of adverse impacts pertaining to different policy fields and their implications in a prioritisation context. It then compares the solutions found in these soft law frameworks concerning prioritisation to the ones contained in European laws and legislative proposals on the subject. The analysis reveals the different approaches used by legislators and reflects on their repercussions for prioritisation mechanisms, suggesting the reinforcement and clarification of prioritisation requirements in accordance with international frameworks of reference.

The recent commercial release of a new generation of chatbot systems, particularly those leveraging Transformer-based large language models (LLMs) such as ChatGPT, has caught the world by surprise and sparked debate about their potential consequences for society. While concerns about the existential threat posed by these technologies are often discussed, it is crucial to shift our focus towards the more immediate risks associated with their deployment. Such risks are further compounded by the lack of proactive measures addressing users’ literacy and the for-profit model via which these chatbots are distributed. Drawing on research in computer science and other fields, this paper looks at the immediate risks triggered by these products and reflects on the role of law within a broader policy directed at steering generative artificial intelligence technology towards the common good. It also reviews the relevant amendments proposed by the European Parliament to the European Commission’s proposal for an AI Act.