The European legislator has included the fulfilment service provider (FSP) in European product safety legislation as a new responsible economic operator (EO) in e-commerce for instances where no other EO is based in the European Union. As a matter of coherency, this adjusted personal scope of product safety law will likely be mirrored in a revised product liability directive. This article explores to what extent the aims and expectations of European legislator with respect to these legal changes (law in the books) align with the perceptions of FSPs and legal advisors in the field (law in action). This is done by means of a legal analysis of the goals and envisioned effects of these changes as well as a semi-structured interview study on how FSPs and legal advisors in the field perceive this new role, responsibility, and liability. The findings provide indications that product safety law currently in force might not (yet) lead to the desired effects. The findings also make us question the extent to which victim compensation is actually improved by the proposed adjustment of the personal scope of the product liability directive.

In comparison to other high-risk industrial sectors, human rights due diligence (HRDD) in the arms sector remains unclear and underdeveloped. This article elucidates how supply chain regulations can provide pertinent guidance for clarifying and elaborating the standards and requirements of the HRDD obligations of arms companies. Part I reaffirms the importance of independent HRDD obligations for arms companies due to the significant human rights risks posed by arms exports. Part II contextualises the limitations in the development of HRDD in the arms industry by examining the corporate policies of major arms companies. Part III explicates why supply chain regulations for conflict minerals are suitable guidance for clarifying and elaborating the HRDD obligations of arms companies. Part IV details five elements of an HRDD framework for arms companies that are essential for comprehensively identifying, evaluating and addressing the human rights risks of arms exports. Part V offers concluding remarks.

The development of medical artificial intelligence is dependent on the availability of vast quantities of data, a considerable proportion of which is medical data containing sensitive information pertaining to the health and well-being of patients. The use of such data is subject to extensive legal regulation and is further hindered by financial and organisational constraints, which can result in limitations on accessibility. One potential solution to this problem is the use of synthetic data. This article examines the potential for their use in light of cybersecurity requirements derived from horizontal and sectoral EU legislation. The outcome of this analysis is that EU legislation does not contain specific regulations on the use of synthetic data. Consequently, it cannot be concluded that there is any prohibition on their use. Moreover, while the Medical Device Regulation (MDR) contains some general requirements for cybersecurity, these are further specified by the provisions of the AI Act. It is important to note, however, that the AI Act will not apply to Class I medical devices, which are subject only to the MDR. Furthermore, only indirect obligations within the scope under consideration can be derived from the horizontal regulations, which will apply in a limited number of cases.

The Artificial Intelligence Act (AI Act) of the European Union (EU) claims to be based on a risk-based approach to avoid over-regulation and to respect the principle of legislative proportionality. This paper argues that risk-based regulation is indeed the right approach to AI regulation. At the same time, however, the paper shows that important provisions of the AI Act do not follow a truly risk-based approach. Yet, this is nothing that cannot be fixed. The AI Act provides for sufficient tools to support future-proof legislation and to implement it in line with a genuine risk-based approach. Against this background, the paper analyses how the AI Act should be applied and implemented according to its original intention of a risk-based approach, and what lessons legislators around the world can learn from the AI Act in regulating AI.

The analysis of liability aspects facing Artificial Intelligence (‘AI’)-generated outputs under copyright and related rights has been overlooked compared to other issues connected to the development and use of AI. This study fills this gap by exploring pertinent questions under international, EU and UK law. Specifically, the study tackles actionable reproduction, allocation of liability, and availability of defences. The analysis ultimately shows that, while it is clear that each case will need to be decided on its own merits, the generative AI output phase raises several profiles of liability under copyright law. If the goal of policymakers and relevant stakeholders is to ensure the balanced and sustainable development of AI, then the issues related to the generation and dissemination of AI outputs need to be given ample attention and a greater role in the debate than what has been the case so far, whether it is in the context of risk assessment and compliance, licensing initiatives, or in contentious scenarios.

Since limiting judicial independence in Hungary and Poland, the politics of the rule of law crisis have been examined by various scholars discussing conflicts within and between EU and domestic institutions. The rule of law is no longer a purely national affair – it is of high political salience both for the Member States and the EU polity. The question addressed here is: how has the rule of law crisis reshaped the EU’s modes of governance? We argue that to safeguard this common value, the EU is evolving into a regulatory polity (3.0). This development marks a shift from Majone’s EU regulatory state’s focus on regulating markets (1.0) and regulation in core state powers in times of crises (2.0) to regulation on the core values of the polity (3.0). The article shows that in a context of growing dissensus over the rule of law, EU institutional actors have sought to strengthen “rulemaking,” “rule monitoring” and “rule enforcement” through a regulatory approach anchored in a market logic. It also shows that shifting from the traditional regulatory state 1.0 to regulation in core state powers 2.0, the regulatory polity 3.0 strengthens the EU’s institutional capacity to act when the rule of law is under strain through depoliticised “rule monitoring” and politicised “rulemaking“ and “rule enforcement“ as illustrated in the cases of Hungary and Poland discussed in this article.

By establishing a common data governance mechanism across the EU, the Regulation on the European Health Data Space (EHDS) aims to enhance the reuse of electronic health data for secondary use (e.g. public health, policy-making, scientific research) purposes and realise associated benefits. However, the EHDS requires health data holders to make available vast amount of personal and non-personal electronic health data, including electronic health data subject to intellectual property (IP) rights, for secondary use, which may pose risks for stakeholders (patients, healthcare providers and manufacturers alike). This paper highlights some conceptual legal problems which need to be addressed in order to provide clearer regulatory requirements to ensure effective and consistent implementation of key data minimisation measures (anonymisation or pseudonymisation) and data management safeguards (secure processing environments). The paper concludes that the EHDS has been drafted ambiguously (for example, its definition of “electronic health data” or the list of “minimum categories of electronic data for secondary use”), which could lead to inconsistent data management practices and may impair the rights and legitimate interests of data subjects and rights holders. To address legal uncertainties, prevent fragmentation and mitigate/eliminate risks, the EHDS requires closely coordinated implementation and legislative fine-tuning.

This paper explores the necessary adaptations to the theory of administrative discretion when using AI systems. Regulatory frameworks in the EU, US, and Spain do not prohibit the application of AI in discretionary decision-making. Particularly, AI systems can be used when discretionary power involves correlations. However, to meet Rule of Law conditions, it is essential to establish adaptations and boundaries in areas such as duty of care, reason-giving, and judicial review. These conditions should focus on the impact of decisions on the affected individuals.

This paper introduces a unique phenomenon with a distinctive Chinese regulatory approach. Since 1994, the Consumer Rights Protection Law has afforded consumers the right to seek punitive damages in instances of fraudulent practices. This has given rise to a special profession with Chinese characteristics: professional consumers. Their status as enigmatic figures is a consequence of the fluctuating stance of public authorities. Thirty years of consistent inconsistency has been a rarity in China’s legislative history. The year 2024 marks the 30th anniversary of the enactment of the CRPL, China’s Consumer Rights Protection Law and the birth of its implementing regulation. It is an opportune moment to reassess the regulatory system that enabled this group and reconstruct it for the future. This paper presents a comprehensive regulatory review of the emergence, growth, and projected decline of professional consumers. It examines the reasons for this long-standing regulatory inconsistency through a detailed investigation of China’s legal system. It concludes by projecting two upcoming legal positions. The first is the transformation under the state’s co-governance strategy. The second is the displacement by procuratorial public interest litigation. Although seemingly contradictory, these two positions exemplify a distinctive Chinese approach to the co-governance strategy, which is characterized by the preponderance of public authority.

Over the last fifteen years, the European Union has built up its regulatory response to the rule of law crisis. That framework seeks to address rule of law-related undesirable events depending on whether or not they have already occurred. As risk prevention has a limited role in the EU’s rule of law policy, undesirable events are mostly dealt with in the context of crisis management. Evaluation, reaction and conditionality mechanisms are all affected by issues relating to operability and legitimacy which reduce their overall performance. The resulting moderate efficiency of crisis management tools may still be improved by making use of the upgraded rule of law mechanisms in a systemic way.

While the private sector is leading the way in digital transformation, the public sector is perceived as missing the opportunity. The way forward in this transformation is pointed out as adopting data-driven technologies as drivers of public policies. This will undoubtedly transform the regulatory process. To better understand how these technologies would intervene in the policy cycle and the effect of this transformation on regulation, this paper studies the work of the Organisation for Economic Co-operation and Development on the matter. Adopting the public policy cycle as an analytical lens and illuminated by the insights of Critical Data Studies, this paper deepens the understanding of how these technologies could change the policy cycle and bring together steps previously conceived as subsequential stages. This transformation can trigger a real disruption of the regulatory process as we currently know it.

On 5 March 2024 the European Court of Justice (CJEU) issued a landmark decision on access to harmonised standards that grant presumption of conformity with legal requirements. The CJEU ruled that such standards should be made available free of charge because, once incorporated in EU legislation, they form part of EU law. While the decision was positively received in the scholarly community, it is expected to carry profound consequences for European standards organisations, who hold copyrights over harmonised standards and rely on their sales to finance their standardisation activities. The judgment may also affect the European Commission, whom the Advocate General and the CJEU placed at the centre of European standardisation due to its role in transforming harmonised standards into EU law. This case note engages with the ruling and aims to shed light onto its possible implications for the European standardisation system.

This article explores the use of laws to unduly silence critics of corporate human rights abuses. It considers the hypothesis that state and business elites align their interests, fuelling the employment of regulations to excessively impede naming and shaming activities. This article draws on socio-legal and critical legal studies to demonstrate how laws, while typically perceived as protective, can also serve to empower corporations and suppress dissent. It reviews examples of such collusion and calls for further case studies to better understand the interplay between business interests and regulatory practices.

This early-stage research article intends to explore the regulatory and liability requirements of a not yet fully developed subset of consumer Internet of Things (IoT) objects: the mixed-functions IoT devices. These objects could be wearables or not but could perform an e-health function, such as measuring your heartbeat, as well as consumer functions, such as displaying chat notifications. I argue that these mixed-functions devices will play an important role within smart homes as they will interact with new medical IoT devices to carry on rehabilitation and other medical functions at home. That is why it is important to start mapping down all the regulatory and liability requirements that might interest mixed-functions IoT device developers for them to understand which thread to follow in this regulatory and liability requirements maze.

This contribution examines the legal intricacies surrounding law enforcement data collection practices in Bulgaria within the framework of the Law Enforcement Directive 2016/680 (LED) and relevant Court of Justice of the European Union (CJEU) rulings, particularly cases C-205/21 and C-80/23. The analysis underscores challenges in interpreting the concept of “strict necessity” and ensuring compliance with its provisions, in particular, Art. 10. Key findings reveal ambiguities in the LED’s application, particularly concerning judicial review and the scope of data collection. The subsequent Case C-80/23 further seeks clarification on the strict necessity standard and the scope of judicial review in the collection of biometric and genetic data. The outcome of both cases has broader implications for EU member states, highlighting the need for legislative alignment and underscoring the complexities and challenges in balancing effective law enforcement with the protection of fundamental rights.

The EU’s policies in the field of technology broadly defined are increasingly marked by a concern over strategic autonomy, and Europe’s place in the world. Regulatory interventions are framed in terms of “digital sovereignty,” with the Commission seeking to ensure that external dependencies are reduced with the aim of increasing the EU’s resilience to geopolitical instability and external shocks. Using the case study of semiconductors, the chips that power modern electronic devices, this article explores how technology policy in the EU sits at the economy–security nexus, in which economic goals and security goals are interdependent and inseparable. Focusing on the life cycle of the semiconductor supply chain from the control over natural resources through to the cybersecurity requirements placed on the finished products, this article demonstrates the increasing security logic embedded within a burgeoning industrial technology policy.

As part of its risk management system, aiming at the mitigation of so-called systemic risks on very large online platforms and very large online search engines (VLOPSEs), the DSA introduces data access rights for independent researchers. With this instrument, the legislator hopes to enable the production of evidence concerning possible threats to society and democracy that might be linked to these platforms or search engines. After an overview of the functioning of the risk management system in the DSA that is characterised by a collaborative governance framework and a learning-based approach, the article will explore the role of the researchers inside this framework. It thereby focuses on the legal significance the researchers’ evidence could have for the risk mitigation obligations imposed on the VLOPSEs in the DSA by interpreting the provisions of the DSA.

The European Union (EU) has extended the application of the EU emissions trading scheme to international shipping and the International Maritime Organization (IMO), and various countries are working on implementing instruments that put a price on greenhouse gas emissions (GHG) from this sector. Due to these policy developments, GHG emissions from shipping may become subject to multiple pricing instruments in the coming years. In response, stakeholders have voiced concerns over the potential negative impacts that this could have on both the shipping industry and international trade, and called for double pricing to be avoided. Against this background, this article discusses the potential pros and cons of double pricing GHG emissions from shipping and identifies options to reduce its negative impacts. Overall, the article finds that the case to avoid double pricing rests on a balance of competing interests, contextual factors, and instrument design. If policymakers aim to avoid double pricing, regulatory cooperation between policymakers working on shipping decarbonisation and border carbon adjustment mechanisms can provide important lessons on how to do so.

We argue it is efficient/desirable for central banks to operate retail Instant Payments (IP) schemes and infrastructure, considering that (i) payment service providers (PSPs) face a problem of collective action, which limits their capacity to deliver a cheap, fast, open-architecture and interoperable IP scheme; and (ii) this problem may be overcome by a central bank (economically neutral actor) with a dual role of regulator and operator of IP schemes, especially by mandating participation of large PSPs and ensuring that the low cost of infrastructure is passed on to consumers. We corroborate with data from Brazil’s Pix and India’s UPI, where the efficiencies of central bank-led IP schemes also led to social gains through financial inclusion.

Cell and gene therapies derive from a substantial manipulation of cells or the application of gene editing techniques. They are promising products because they enable therapy personalisation, are potentially helpful for treating rare or resistant diseases, and may become useful in future epidemics. Because of this strategic worth, the infrastructure needed for manufacturing these therapies is turning into a subdomain within the domain of critical infrastructures (CIs), understood as the structures whose operation is key for the integrity and security of a nation. This paper analyses why cell and gene therapy infrastructure can be considered as an emergent CI domain, stressing three aspects: automated manufacturing equipment; software solutions (including the growing adoption of artificial intelligence and cloud technology); and human expertise. These complex manufacturing systems, which are becoming increasingly automated and digitalised, may be surrounded by new risks and vulnerability points, which requires adequate regulatory solutions and governance initiatives. A comprehensive approach is therefore advanced here, where therapy manufacture has medical and technological relevance, but is equally crucial from the viewpoint of nations’ public health and internal stability.