Fifteen years following the entry into force of the Lisbon Treaty, this article seeks to analyse its impact on EU executive rulemaking. It delves into the constitutional concerns arising from the architecture of Articles 290 and 291 Treaty on the Functioning of the European Union (TFEU), in particular relating to the institutional balance, the concept of implementation, the distinction between delegated and implementing acts and the legitimacy of the control mechanisms envisaged in the TFEU. The article argues that there is a need for reform and integration of Articles 290 and 291 TFEU in one Article dedicated to EU executive rulemaking, going beyond mere considerations of institutional balance. Such a reform entails a return to the essence of comitology as a general mechanism for consultation in and control of rulemaking, allowing Member States to deliberate with the Commission with a veto right for both the Parliament and the Council, embracing the idea of executive subsidiarity. It requires also to go beyond the old comitology mechanisms based on a pure interinstitutional perspective by connecting to Article 11 TEU (Treaty on European Union) and recognising the need for participatory engagement so as to enhance the legitimacy of EU executive rulemaking.

The Internet of Medical Things (IoMT) devices, as well as the Internet of Things phenomenon itself, are gaining a new group of customers every day, for whom it is almost a matter of course to use a wide range of devices, such as Internet-connected complex life support equipment or “smart” watches monitoring basic life parameters. With the growing popularity of such devices, however, questions about the safety of their users begin to arise, because almost in proportion to the number of benefits associated with the use of these products, the number of risks associated with them increases – eg improper functioning of Internet-connected life support equipment, in addition to threatening the life or health of its user, may affect the physical security of the product itself, the security of both personal and technical (eg non-personal) data processed by the specific product, or finally the cyber-security of the product. While the issues related to the protection of personal data and privacy, in general, have been discussed many times by the doctrine, the issues related to the protection of users of these devices under consumer law have not been considered much.

In this context, the question arises whether the current legal regulations provide an adequate and sufficient level of protection for IoMT users. In particular, whether the average IoMT user can actually exercise their rights under the provisions of consumer law and whether the protection afforded to him – both in terms of the scope of their rights and the scope of obligations and liability of manufacturers and suppliers of these devices – is not only illusory? In order to answer the above questions, the author will evaluate the prevailing market practices – still focused around the doctrine of “caveat emptor” or “let the buyer beware” – and compare them with these regulations and juxtapose them with relevant legal regulations. However, given the lack of geographical borders in the field of cyber security and privacy, the author will not only analyse EU cyber security legislation, but also US legislation in a comparative legal analysis. The choice of jurisdictions to be compared is also related to the size and importance of both the US and the EU for the global IoMT market. It should be noted that the United States has a dominant position in the IoMT, while the European Union is estimated to have the second largest IoMT market globally. At the same time, however, there are differences in legal systems between the two economic areas. An analysis carried out in this way will make it possible not only to answer the question posed above, but also to possibly identify those areas of regulation that need to be changed or adapted to the realities of IoMT.

Scientific consensus links dietary choices to health outcomes, highlighting the urgency to prioritise healthy food production in food systems. At the EU level, however, defining healthy food and integrating it into food governance remains a challenge, particularly regarding the inclusion of health-related characteristics in food safety assessments. While the EU primarily relies on the risk analysis principle to address food safety concerns, the process still exhibits weaknesses that hinder its direct impact on fostering a healthier food production landscape. This review demonstrates how the risk analysis process, particularly scientific opinions in risk assessment and external factors (economic and political) in risk management, impact food governance and the healthiness of food systems. We find that while external factors play a crucial role in risk management decisions by incorporating non-food safety considerations, they often stem from an imbalance of power favouring major industry and political stakeholders. This imbalance disproportionately influences decision-making, often overshadowing nutritional and health aspects. To address these challenges, we recommend directing research towards filling knowledge gaps and exploring minority scientific findings, and separating external factors from risk management’s decision-making process, to ensure that food governance prioritises public health and healthy food production.

Legal scholarship in the realm of international economic law has a blind spot: the practice of international trade. Cargo and container shipping is the blood and guts of international trade, and it is fuelled by bunker oil – a hydrocarbon mixture of the dirtiest petroleum-based products. Worryingly, there is empirical evidence of bunkers being intentionally contaminated with waste oils. This fraudulent contamination violates numerous international, national, and EU rules on waste management and poses immense risks to the health of planet and people alike. These same acts of fraud are also extremely profitable, and they facilitate the smooth functioning of our global economy. The fraud is itself not just incentivised in the tight-margins reality of international trade, but it is facilitated by the lack of proper legislation and the vulnerability of the existing means of enforcement in the areas where there is legislation to comply with. Economic operators often use falsified documents to market fuel oil that should be considered as waste. Systematic wrongdoing of this kind is detrimental to the environment and risks eroding the rule of law in both its formal and substantive conceptualisations.

The creation of a more sustainable economy is one of the main targets of the European Green Deal and the new Circular Economy Action Plan. Technological innovation is needed, among other things, to render materials, products, and production processes more sustainable. Given the goals of the European Green Deal, the regulatory concept of “Safe and Sustainable by Design” is increasingly receiving attention. The concept is (arguably) a precautionary and preventative measure that is implemented at the early stages of the design of a technology. Therefore, it is often described as a tool for lowering the risks that follow from efforts to create a more circular economy. The concept was included in the European Chemicals Strategy of the European Commission. The aim of the strategy is to accelerate progress towards the discovery of more sustainable chemicals and towards a toxicity-free environment. In this paper, we will explore the benefits and disadvantages of integrating the “Safe and Sustainable by Design” concept into the regulation of technology. As a form of regulation by technology, this concept can enhance sustainability. We will first describe the origins of the concept and its current use. Then, we will analyse its implications for the circular economy.

Public and political controversies over Investor–State Dispute Settlement (ISDS) have prompted reform processes in international investment law, at bilateral, regional and multilateral levels, with different actors shaping the future of international investment governance. In its essence, the options for the ISDS reform reflect the diverging perspectives on the rule of law in international law. Ultimately, they present a choice about who should control power over States’ action in issues of public importance – the States who have created the system, or international investment tribunals who have shaped the legal development of the system. This paper considers the application of the rule of law as a normative meta-principle to international investment law and its dispute settlement, and it sheds light on different perspectives of this concept, as they shape the ongoing ISDS reform(s).

Since its inception, the inter-state dispute settlement system of the World Trade Organisation has generally been praised for effectively protecting the rule of law in international trade relations. While the relatively recent dismantling of this system does not necessarily mean the end of the WTO nor of the binding nature of its rules, the current crisis may be a good opportunity to reconsider the role of the rule of law in international trade relations and the ways in which it could further be accommodated. One suggestion, occasionally raised in the past, would be strengthening the enforcement of WTO rules by opening it to private action, either before national courts or through international adjudication. After all, the latter has been widely available to foreign investors covered by thousands of international investment agreements in force for decades. This contribution recalls the reasons behind the current lack of private enforcement of WTO law and argues that developments in international trade relations and experiences with investor-state dispute settlement are likely to work against rather than in favor of its introduction in the foreseeable future. Increased transparency and institutionalisation of non-state actors’ role in trade enforcement is therefore recommended instead.

Digitalisation has changed traders’ possibilities of influencing the autonomy of consumer choice in the digital environment. The digital market of the European Union involves a wide spectrum of commercial practices – such as dark and addictive patterns, target advertising and personalisation – that nudge consumers to take decisions that are not in their favour. One of the main aims of the Unfair Commercial Practices Directive 2005 is to protect the freedom of consumer decision-making. However, currently, the Directive’s capacity to safeguard consumer choice in the digital environment is not sufficiently effective. Through the lens of law prohibiting unfair commercial practices, this article analyses the means available to consumer courts to strengthen consumer decision-making autonomy in the digital environment. The article argues that regulation of prohibition of unfair commercial practices regarding the digital environment should be modernised by obliging – in certain circumstances – national courts ex officio to assess violations of fair commercial practices and by reversing the burden of argumentation and proof.

The proposal for a European Health Data Space aims at creating a common space where individuals may control their health data in a trusted and secure way. The objective is not only improving healthcare delivery, but also enhancing the opportunities to use health data for research and innovation. To achieve these results, the proposal implements a mandatory self-certification scheme for European health records systems as well as for wellness devices and applications, setting up essential requirements related to interoperability and security. Although this is the first intervention that sets a horizontal framework that is mandatory for all Member States, the security requirements that are included in the legislative proposal are not sufficiently detailed and comprehensive. Given that cyberthreats are increasing and security incidents affecting health data may potentially have an impact on the lives of patients, it is important that cybersecurity measures are adopted and implemented in the most effective way. The paper will analyse the European Health Data Space proposal pointing to the open issues and doubts that may be emerging and it will compare them with the proposed Cyber Resilience Act, identifying the issues that may be solved thanks to this horizontal regulation and the ones that instead remain open.

The development of the precautionary principle by the EU Courts has often been interpreted by scholars as inconsistent with another trend in EU risk regulation: one that is evidence-based and relies on impact assessment. This article argues that the two trends – precaution and regulatory impact assessment – are not mutually exclusive. Together they may, in fact, act as a procedural safeguard against discretionary decisions that have an impact on fundamental rights, especially under conditions of epistemic uncertainty. The article illustrates this claim by looking at the decisions to close schools in Ireland during the pandemic.

Cybersecurity of medical devices has become a concrete concern for regulators and policymakers in the European Union and United States. Following the COVID-19 pandemic, there has been an increase in cyber-attacks on critical healthcare infrastructures and their IT systems, which have suffered service disruptions and put patients’ health and safety at risk. The increase in cyberattacks on healthcare infrastructure, including medical devices, exacerbated by the growing digitalisation of healthcare services in the EU and the US, has led legislators and regulatory bodies to pay more attention to cybersecurity. Cybersecurity of AI-based medical devices requires the assessment of three areas subject to evolving regulatory approaches: medical devices, Artificial Intelligence (AI), and cybersecurity. Although they may appear distinguished in regulatory matters, the existence of AI-based medical devices and their possible cyber vulnerabilities makes clear that the three are intertwined and deserve closer attention from a regulatory point of view. Few scholars have devoted attention to AI and cybersecurity together. Even less, in our understanding, few comprehensive and EU/US comparative pieces of literature reflect on this specific issue. This paper aims to fill this gap and address the main implications of different regulatory approaches toward AI medical device cybersecurity in the EU and the US. The research stems from the assumption that regulation of medical devices in the EU has been historically inspired by regulatory trends in the US, although with the different cultural, societal, and legal traditions that made them adapt to the specificities of the territory. The paper observes that the US is a rule-based system reflecting a “command-and-control” approach, while the EU system is a principle-based one. While they share the main characteristic of being risk-regulation-based systems, their differences impact how AI-enhanced cybersecurity is regulated.

The delegation of powers to the European Commission, facilitating the adoption of non-legislative acts to implement centrally provisions of European legislation, has long been an essential part of administrative governance in the European Union. However, the established practice of delegating legslative and implementing powers to the European Commission has increased over the last decade, at the same time in the context of the various crises that the EU has had to confront during this period. The crisis context has generally demonstrated that executive institutions often emergency politics, and the amplified use of delegated powers in such circumstances raises questions about the capacity of legislative institutions to carry out their usual control and scrutiny functions. The concern here is whether – at times when the established mechanisms of control need to be carried out in times of crisis, under greater time pressure – there is the risk of legislative institutions (that had originally delegated powers to the Commission) are being sidelined, with the detrimental effects that this may have on the democratic accountability of the whole process. Against this background of normative question-marks, this article examines empirically to what extent the scrutiny of the Commission’s adoption of delegated powers has fundamentally changed during times of emergency. In particular, it provides an analysis of the use of delegated powers by the European Commission in the context of the EU’s response to the Covid-19 pandemic in order to establish whether the Council and the European Parliament managed to enable the usual control mechanisms effectively. By way of conclusion, the article discusses the implications of the findings for the wider discussion and the future use of emergency governance in the European Union.

Regulatory impact assessment (RIA) is an appraisal tool to bring evidence to bear on regulatory decisions. A key property of RIA is that is corrects errors in reasoning by pushing regulators towards deliberative thinking to override intuitive judgments. However, the steps for regulatory analysis suggested by international organisations and governmental handbooks do not handle two sources of bias and barriers that are well documented in the literature on behavioural insights. First, bias enters the process via knowledge production during the analytical process of assessment. Second, bias affects knowledge utilisation when regulators “read” or utilise the results of RIA. We explore these two pathways by focusing on drivers of behaviour rather than lists of biases. The conclusions reflect on the limitations of current practice and its possible improvement, making suggestions for an RIA architecture that is fully informed by behavioural analysis.

This article analyses the mechanisms of prioritisation and hierarchisation of risk contained under influential soft law frameworks on value chain due diligence. It identifies the main stages of the due diligence process where prioritisation may be required and clarifies the criteria that may be used by corporations for prioritisation decisions. The article contributes to the development of the literature concerning prioritisation mechanisms under value chain due diligence norms, highlighting, from a compliance perspective, how corporations are expected to prioritise both their evaluations to identify and assess adverse impacts as well as their actions to address specific impacts identified and assessed. In doing so, it showcases the challenges present when comparing the significance of adverse impacts pertaining to different policy fields and their implications in a prioritisation context. It then compares the solutions found in these soft law frameworks concerning prioritisation to the ones contained in European laws and legislative proposals on the subject. The analysis reveals the different approaches used by legislators and reflects on their repercussions for prioritisation mechanisms, suggesting the reinforcement and clarification of prioritisation requirements in accordance with international frameworks of reference.

Equivalence is an essential discipline for liberalising trade between States whose sanitary and phytosanitary (SPS) measures are based on divergent regulatory approaches. During the Uruguay Round negotiations, “equivalence” under the SPS Agreement was regarded by negotiators as being “of great importance”, and it was even considered to establish a right for exporting States. In practice, the discipline has remained ineffective, with only thirty-six equivalence recognition decisions made since 1995. This article argues that the underperformance of equivalence as an obligation is structural in nature: in effect, the SPS Agreement establishes a conditional right of importing Members to refuse equivalence requests. As such, exporting Members only gain equivalence protection where they either demonstrate that their measures (1) meet the importing Member’s appropriate level of protection or (2) achieve the same level of protection as parties to recognition agreements. Finally, the need for fostering regulatory trust between domestic SPS regulatory agencies is underscored as a prerequisite for achieving broader equivalence recognition.

This article explores the proposed amendments to the AI Act, which introduce the concept of “groups of persons”. The inclusion of this notion has the potential to broaden the traditional individual-centric approach in data protection. The analysis explores the context and the challenges posed by the rapid evolution of technology, with an emphasis on the role of artificial intelligence (AI) systems. It discusses both the potential benefits and challenges of recognising groups of people, including issues such as discrimination prevention, public trust and redress mechanisms. The analysis also identifies key challenges, including the lack of a clear definition for “group”, the difficulty in explaining AI architecture concerning groups and the need for well-defined redress mechanisms. The article also puts forward recommendations aimed at addressing these challenges in order to enhance the effectiveness and clarity of the proposed amendments.

The European Union (EU) increasingly develops and implements policies infused with salient and sometimes conflicting values – for instance, in migration and criminal law cooperation. However, policy implementation studies have not frequently considered how such complex value trade-offs may affect practical implementation within Member States. This article therefore quantitatively and temporally examines the practical implementation of an EU flagship criminal law measure: the simplified extradition system known as the European Arrest Warrant (EAW). Using data on EAWs decided upon by the Dutch Amsterdam District Court, we test the impact of value trade-offs by examining whether (newly introduced) safeguards for the protection of requested persons adversely affect system efficiency (measured through case turnover times). The results suggest that the design of legal tests and adjustments made to the EAW system over time through the Court of Justice of the European Union affect the balance between fundamental rights protection and efficiency in the practical implementation of the EAW.

On 9 March 2023, the Court of Justice (Second Chamber) delivered a preliminary ruling about the coordination of two European Union measures against air pollution: the Industrial Emissions Directive and the Ambient Air Quality Directive. Upon assessment, the Court reinforced the mandatory nature of the air quality limit values vis-à-vis possible derogations foreseen in the Industrial Emissions Directive. In this case, both AG Kokott and the Second Chamber affirmed the primacy of the air quality standards. However, this Case Note finds that slightly different reasoning between the AG Opinion and the final Judgment reveals differing underlying approaches. Whilst the AG focuses on air quality plans and leaves more room for discretion to national authorities, the final Judgment anchors the coordination of the two Directives to strict and objective pollution limit values, further strengthening the Ambient Air Quality Directive as an effective instrument of environmental protection litigation.

The recent commercial release of a new generation of chatbot systems, particularly those leveraging Transformer-based large language models (LLMs) such as ChatGPT, has caught the world by surprise and sparked debate about their potential consequences for society. While concerns about the existential threat posed by these technologies are often discussed, it is crucial to shift our focus towards the more immediate risks associated with their deployment. Such risks are further compounded by the lack of proactive measures addressing users’ literacy and the for-profit model via which these chatbots are distributed. Drawing on research in computer science and other fields, this paper looks at the immediate risks triggered by these products and reflects on the role of law within a broader policy directed at steering generative artificial intelligence technology towards the common good. It also reviews the relevant amendments proposed by the European Parliament to the European Commission’s proposal for an AI Act.