The proposal for a European Health Data Space aims at creating a common space where individuals may control their health data in a trusted and secure way. The objective is not only improving healthcare delivery, but also enhancing the opportunities to use health data for research and innovation. To achieve these results, the proposal implements a mandatory self-certification scheme for European health records systems as well as for wellness devices and applications, setting up essential requirements related to interoperability and security. Although this is the first intervention that sets a horizontal framework that is mandatory for all Member States, the security requirements that are included in the legislative proposal are not sufficiently detailed and comprehensive. Given that cyberthreats are increasing and security incidents affecting health data may potentially have an impact on the lives of patients, it is important that cybersecurity measures are adopted and implemented in the most effective way. The paper will analyse the European Health Data Space proposal pointing to the open issues and doubts that may be emerging and it will compare them with the proposed Cyber Resilience Act, identifying the issues that may be solved thanks to this horizontal regulation and the ones that instead remain open.

The development of the precautionary principle by the EU Courts has often been interpreted by scholars as inconsistent with another trend in EU risk regulation: one that is evidence-based and relies on impact assessment. This article argues that the two trends – precaution and regulatory impact assessment – are not mutually exclusive. Together they may, in fact, act as a procedural safeguard against discretionary decisions that have an impact on fundamental rights, especially under conditions of epistemic uncertainty. The article illustrates this claim by looking at the decisions to close schools in Ireland during the pandemic.

Cybersecurity of medical devices has become a concrete concern for regulators and policymakers in the European Union and United States. Following the COVID-19 pandemic, there has been an increase in cyber-attacks on critical healthcare infrastructures and their IT systems, which have suffered service disruptions and put patients’ health and safety at risk. The increase in cyberattacks on healthcare infrastructure, including medical devices, exacerbated by the growing digitalisation of healthcare services in the EU and the US, has led legislators and regulatory bodies to pay more attention to cybersecurity. Cybersecurity of AI-based medical devices requires the assessment of three areas subject to evolving regulatory approaches: medical devices, Artificial Intelligence (AI), and cybersecurity. Although they may appear distinguished in regulatory matters, the existence of AI-based medical devices and their possible cyber vulnerabilities makes clear that the three are intertwined and deserve closer attention from a regulatory point of view. Few scholars have devoted attention to AI and cybersecurity together. Even less, in our understanding, few comprehensive and EU/US comparative pieces of literature reflect on this specific issue. This paper aims to fill this gap and address the main implications of different regulatory approaches toward AI medical device cybersecurity in the EU and the US. The research stems from the assumption that regulation of medical devices in the EU has been historically inspired by regulatory trends in the US, although with the different cultural, societal, and legal traditions that made them adapt to the specificities of the territory. The paper observes that the US is a rule-based system reflecting a “command-and-control” approach, while the EU system is a principle-based one. While they share the main characteristic of being risk-regulation-based systems, their differences impact how AI-enhanced cybersecurity is regulated.

The delegation of powers to the European Commission, facilitating the adoption of non-legislative acts to implement centrally provisions of European legislation, has long been an essential part of administrative governance in the European Union. However, the established practice of delegating legslative and implementing powers to the European Commission has increased over the last decade, at the same time in the context of the various crises that the EU has had to confront during this period. The crisis context has generally demonstrated that executive institutions often emergency politics, and the amplified use of delegated powers in such circumstances raises questions about the capacity of legislative institutions to carry out their usual control and scrutiny functions. The concern here is whether – at times when the established mechanisms of control need to be carried out in times of crisis, under greater time pressure – there is the risk of legislative institutions (that had originally delegated powers to the Commission) are being sidelined, with the detrimental effects that this may have on the democratic accountability of the whole process. Against this background of normative question-marks, this article examines empirically to what extent the scrutiny of the Commission’s adoption of delegated powers has fundamentally changed during times of emergency. In particular, it provides an analysis of the use of delegated powers by the European Commission in the context of the EU’s response to the Covid-19 pandemic in order to establish whether the Council and the European Parliament managed to enable the usual control mechanisms effectively. By way of conclusion, the article discusses the implications of the findings for the wider discussion and the future use of emergency governance in the European Union.

Regulatory impact assessment (RIA) is an appraisal tool to bring evidence to bear on regulatory decisions. A key property of RIA is that is corrects errors in reasoning by pushing regulators towards deliberative thinking to override intuitive judgments. However, the steps for regulatory analysis suggested by international organisations and governmental handbooks do not handle two sources of bias and barriers that are well documented in the literature on behavioural insights. First, bias enters the process via knowledge production during the analytical process of assessment. Second, bias affects knowledge utilisation when regulators “read” or utilise the results of RIA. We explore these two pathways by focusing on drivers of behaviour rather than lists of biases. The conclusions reflect on the limitations of current practice and its possible improvement, making suggestions for an RIA architecture that is fully informed by behavioural analysis.

This article analyses the mechanisms of prioritisation and hierarchisation of risk contained under influential soft law frameworks on value chain due diligence. It identifies the main stages of the due diligence process where prioritisation may be required and clarifies the criteria that may be used by corporations for prioritisation decisions. The article contributes to the development of the literature concerning prioritisation mechanisms under value chain due diligence norms, highlighting, from a compliance perspective, how corporations are expected to prioritise both their evaluations to identify and assess adverse impacts as well as their actions to address specific impacts identified and assessed. In doing so, it showcases the challenges present when comparing the significance of adverse impacts pertaining to different policy fields and their implications in a prioritisation context. It then compares the solutions found in these soft law frameworks concerning prioritisation to the ones contained in European laws and legislative proposals on the subject. The analysis reveals the different approaches used by legislators and reflects on their repercussions for prioritisation mechanisms, suggesting the reinforcement and clarification of prioritisation requirements in accordance with international frameworks of reference.

Equivalence is an essential discipline for liberalising trade between States whose sanitary and phytosanitary (SPS) measures are based on divergent regulatory approaches. During the Uruguay Round negotiations, “equivalence” under the SPS Agreement was regarded by negotiators as being “of great importance”, and it was even considered to establish a right for exporting States. In practice, the discipline has remained ineffective, with only thirty-six equivalence recognition decisions made since 1995. This article argues that the underperformance of equivalence as an obligation is structural in nature: in effect, the SPS Agreement establishes a conditional right of importing Members to refuse equivalence requests. As such, exporting Members only gain equivalence protection where they either demonstrate that their measures (1) meet the importing Member’s appropriate level of protection or (2) achieve the same level of protection as parties to recognition agreements. Finally, the need for fostering regulatory trust between domestic SPS regulatory agencies is underscored as a prerequisite for achieving broader equivalence recognition.

This article explores the proposed amendments to the AI Act, which introduce the concept of “groups of persons”. The inclusion of this notion has the potential to broaden the traditional individual-centric approach in data protection. The analysis explores the context and the challenges posed by the rapid evolution of technology, with an emphasis on the role of artificial intelligence (AI) systems. It discusses both the potential benefits and challenges of recognising groups of people, including issues such as discrimination prevention, public trust and redress mechanisms. The analysis also identifies key challenges, including the lack of a clear definition for “group”, the difficulty in explaining AI architecture concerning groups and the need for well-defined redress mechanisms. The article also puts forward recommendations aimed at addressing these challenges in order to enhance the effectiveness and clarity of the proposed amendments.

The European Union (EU) increasingly develops and implements policies infused with salient and sometimes conflicting values – for instance, in migration and criminal law cooperation. However, policy implementation studies have not frequently considered how such complex value trade-offs may affect practical implementation within Member States. This article therefore quantitatively and temporally examines the practical implementation of an EU flagship criminal law measure: the simplified extradition system known as the European Arrest Warrant (EAW). Using data on EAWs decided upon by the Dutch Amsterdam District Court, we test the impact of value trade-offs by examining whether (newly introduced) safeguards for the protection of requested persons adversely affect system efficiency (measured through case turnover times). The results suggest that the design of legal tests and adjustments made to the EAW system over time through the Court of Justice of the European Union affect the balance between fundamental rights protection and efficiency in the practical implementation of the EAW.

The recent commercial release of a new generation of chatbot systems, particularly those leveraging Transformer-based large language models (LLMs) such as ChatGPT, has caught the world by surprise and sparked debate about their potential consequences for society. While concerns about the existential threat posed by these technologies are often discussed, it is crucial to shift our focus towards the more immediate risks associated with their deployment. Such risks are further compounded by the lack of proactive measures addressing users’ literacy and the for-profit model via which these chatbots are distributed. Drawing on research in computer science and other fields, this paper looks at the immediate risks triggered by these products and reflects on the role of law within a broader policy directed at steering generative artificial intelligence technology towards the common good. It also reviews the relevant amendments proposed by the European Parliament to the European Commission’s proposal for an AI Act.

On 9 March 2023, the Court of Justice (Second Chamber) delivered a preliminary ruling about the coordination of two European Union measures against air pollution: the Industrial Emissions Directive and the Ambient Air Quality Directive. Upon assessment, the Court reinforced the mandatory nature of the air quality limit values vis-à-vis possible derogations foreseen in the Industrial Emissions Directive. In this case, both AG Kokott and the Second Chamber affirmed the primacy of the air quality standards. However, this Case Note finds that slightly different reasoning between the AG Opinion and the final Judgment reveals differing underlying approaches. Whilst the AG focuses on air quality plans and leaves more room for discretion to national authorities, the final Judgment anchors the coordination of the two Directives to strict and objective pollution limit values, further strengthening the Ambient Air Quality Directive as an effective instrument of environmental protection litigation.

Responding to the need to make democratic governance more anticipatory, during recent decades parliaments have increasingly made efforts to involve elected legislators directly in addressing future risks and envisioning long-term developments. At the level of general democratic-institutional principles, engaging legislators in national-level foresight is expected to enhance the general legitimacy of future-regarding policymaking almost automatically by broadening the scope of democratic actors involved in policy work. However, even the basic mechanisms through which the impact of legislature-based foresight activities could traverse to policymaking remain largely uncharted and unknown. To develop a preliminary framework for detecting and comparing such mechanisms, we draw from the experiences of the most institutionalised and influential legislature-based foresight unit, the Committee for the Future in the Finnish Eduskunta. We extract three general mechanisms through which parliamentary future committees could make a valuable contribution to national-level strategic foresight: (1) they can improve the quality of future-regarding policymaking by broadening and consolidating national foresight “ecosystems”; (2) they can strengthen the transparency and accountability of the foresight work of political executives; and (3) they can enhance the legitimacy of anticipatory governance by connecting broader democratic publics to foresight work through more inclusive participatory processes.

The World Trade Organization’s (WTO) Agreement on Sanitary and Phytosanitary Measures (SPS Agreement) disciplines WTO Members’ health regulations to prevent their misuse for protectionist purposes. In doing so, its obligations reflect several elements of the rule of law, including legal certainty, non-arbitrariness and non-discrimination, as well as a recognition of the rights of individuals. Through its obligations of non-discrimination, transparency and scientific justification and the scope it leaves for Members to prioritise the protection of health over trade liberalisation, the SPS Agreement can be regarded as entailing a rule-of-law approach. However, cognisant of the limits to the rule of law when transposed to the international level, it is important to avoid an overly “judicialised” approach to the disciplines of the SPS Agreement, and in particular its reliance on scientific justification to prevent arbitrariness in sanitary and phytosanitary regulation. Otherwise, there is a risk of intruding too far into the regulatory autonomy of States, weakening the “compliance pull” of the agreement and thus inadvertently undermining the rule of law in this area. An approach that instead recognises the inherent subjectivity and uncertainty in science and respects Members’ divergent priorities in health regulation would go further in engendering support for the rules-based system of international trade.

Quantum computing is a form of computing based on the principles of quantum mechanics. Quantum computing promises to revolutionise society through technological solutions to previously unsolvable problems or by enhancing the capacities of current computational technologies. Additionally, quantum computing has the potential to revolutionise the humanities and social sciences. We denote the study of these changes as “quantum humanities”, whose study focuses on the potential of quantum computing. This paper proposes a research programme for quantum humanities, which includes the application of quantum algorithms to humanities research, reflection on the methods and techniques of quantum computing and evaluation of its potential societal implications. Moreover, we argue that, foundationally, quantum mechanics has serious implications for the ways in which data and information are used to produce seemingly objective technologies. Thus, quantum computing is a nexus for the study of knowledge itself. This research programme aims to define the field of quantum humanities and to establish it as a meaningful part of the humanities and social sciences.

Water stress is a growing concern in Europe, partly due to the changing climate context. Despite the cross-cutting impacts that water availability has on different areas under the competence of the European Union (EU), there is not currently a comprehensive and systematic legal framework addressing this issue. The purpose of this article is therefore to examine the EU legislation that concerns the measures aimed at mitigating these risks. To this purpose, it is first examined how droughts and water scarcity are framed within EU legal acts. Based on such an overview, the analysis is directed to the mechanisms developed at the EU level for monitoring, identifying and forecasting water stress risks, as well as the legal provisions relating to the planning tools. The remainder of the article is devoted to the regulation of preventative measures for water scarcity and drought risk reduction, following the water hierarchy resulting from COM(2007) 414.

On 8 June 2023, the European Commission published a long-awaited proposal for the establishment of an interinstitutional ethics body, meant to restore the public’s faith in the European Union’s administration following the Qatargate corruption scandal. Alas, the Commission’s proposal outlines a body that lacks investigative and sanctioning powers, has minimal administrative capacity and for the most part relies on the institution’s own policing. Put simply, it falls short of the promises made by the Commission’s President in her 2019 political guidelines, and much shorter of what was expected as a remedy to the European Union’s recent ethics-related scandals. In this short piece, we reflect on the Commission’s proposal for an inter-institutional ethics body in light of the overall ethics framework in the Union and provide a brief analysis of the Commission’s missed opportunity and of what could have been.

Grand challenges are shaping twenty-first-century politics. Threats connected to health, climate, demographics and welfare are increasingly intruding on the lives of citizens. Still, governments are often found off-guard, and policymakers need strategies grounded in longer-term perspectives. Strategic foresight (SF) helps us to design and shape policies to prepare to withstand shocks, anticipating and adapting to changes. However, as governments work towards embedding SF into their policymaking processes, the empirical evidence suggests that applications are still piecemeal and predominantly limited to the agenda-settings and policy formulation stages. In this article, we argue that to drive anticipatory governance, foresight needs to be applied at all stages of the policy cycle, including in evaluating policies to draw lessons for future interventions. We maintain that considering SF systemically throughout the policymaking cycle, from agenda setting to evaluation, strengthens anticipatory governance.

Until robots and humans mostly worked in fast-paced and yet separate environments, occupational health and safety (OHS) rules could address workers’ safety largely independently from robotic conduct. This is no longer the case: collaborative robots (cobots) working alongside humans warrant the design of policies ensuring the safety of both humans and robots at once, within shared spaces and upon delivery of cooperative workflows. Within the European Union (EU), the applicable regulatory framework stands at the intersection between international industry standards and legislation at the EU as well as Member State level. Not only do current standards and laws fail to satisfactorily attend to the physical and mental health challenges prompted by human–robot interaction (HRI), but they exhibit important gaps in relation to smart cobots (“SmaCobs”) more specifically. In fact, SmaCobs combine the black-box unforeseeability afforded by machine learning with more general HRI-associated risks, towards increasingly complex, mobile and interconnected operational interfaces and production chains. Against this backdrop, based on productivity and health motivations, we urge the encoding of the enforcement of OHS policies directly into SmaCobs. First, SmaCobs could harness the sophistication of quantum computing to adapt a tangled normative architecture in a responsive manner to the contingent needs of each situation. Second, entrusting them with OHS enforcement vis-à-vis both themselves and humans may paradoxically prove safer as well as more cost-effective than for humans to do so. This scenario raises profound legal, ethical and somewhat philosophical concerns around SmaCobs’ legal personality, the apportionment of liability and algorithmic explainability. The first systematic proposal to tackle such questions is henceforth formulated. For the EU, we propose that this is achieved through a new binding OHS Regulation aimed at the SmaCobs age.

Increasing interest from stakeholders has brought new focus on risk governance and risk regulation, such as the regulator’s execution of duty and tangible results on safety and environmental protection in oil and gas industry. One recent example, from 2019, is the Office of the Auditor General Norway’s (OAG) investigation of the Petroleum Safety Authority’s (PSA) follow-up on health, safety and the environment in the petroleum industry, where the regulatory regime in Norway resting on functional requirements was questioned. Simplistically speaking, there are two current traditions or main schools in regulatory regimes: use of functional requirements associated with co-regulation and use of normative requirements associated with prescriptive regulation. In this paper, we introduce a generic model from an attribute perspective on contrasting, gauging or evaluating the two different regulatory regimes. Furthermore, this approach may explain the controversy regarding the favouring of functional or prescriptive regulatory regimes by the different players in the industry. Our case is based on regulations relating to offshore oil and gas operations, in particular focusing on the Norwegian sector. We use the OAG’s investigation of the PSA and the public reaction as our material because this material is proposed to provide a thorough and valid description of how the effects of the Norwegian regulatory regime are perceived from the outside. We believe that the generic concept presented here is applicable when performing investigations in other industries involved in hazardous activities.