Abstract

The PHP2SHELL cybersecurity problem

On 21 October 2026, two critical security vulnerabilities in PHP sent an urgent warning across the technology industry. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, could potentially allow attackers to execute malicious code remotely, without authentication, or access sensitive information stored in server memory.

The vulnerabilities were serious, and both received a severity rating of 9.2 under the Common Vulnerability Scoring System, and the PHP development team urged users to install security updates immediately.

The technical response was clear for organisations operating PHP-based applications; vulnerable systems needed to be identified, patched and investigated.

However, the legal position was less straightforward, which happens to be the subject of this article.

Subscribe now

Did the discovery of these vulnerabilities mean that organisations had suffered a data breach? Were they legally required to notify regulators? Could businesses “potentially” face liability simply because they had operated affected software? These questions highlight an important distinction that is frequently overlooked in cybersecurity discussions.

Our position is that a critical vulnerability is not automatically a confirmed data breach, but the absence of a confirmed breach does not necessarily establish that an organisation’s systems were never compromised.

The difficulty balancing these two possibilities lies in understanding the difference between what is technically possible, what can be established through forensic investigation, and what the law requires organisations to report.

We believe the PHP2Shell incident exposes a deeper problem in modern cybersecurity governance. Organisations are increasingly expected to make rapid legal decisions based on technical evidence that may be incomplete, difficult to interpret or unavailable.

We will address these issues below.

What PHP2Shell actually exposed

PHP is one of the foundational technologies behind modern web applications.1 It supports content management systems, online businesses, customer portals and numerous services that people rely on daily.

The October 2026 vulnerabilities were particularly concerning because they affected PHP’s underlying runtime environment.

According to the PHP project’s official security advisory, CVE-2026-109618 concerned memory corruption during out-of-memory error handling. CVE-2026-109619 involved internal references that could continue pointing to memory after that memory had been freed. Both flaws could potentially allow attackers to manipulate the PHP runtime in ways that developers had never intended.

The vulnerabilities were not simply oversights in individual websites, but rather they concerned the software environment on which those websites depended.

It is important to note that organisation could have implemented secure application code, authentication controls and ordinary vulnerability testing while remaining exposed through the underlying PHP installation.2

The PHP project identified particular risks involving Apache’s mod_php integration, where a demonstrated attack could occur before application code began executing. Other PHP environments were also affected.

Security updates were released in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Nonetheless, the discovery of a vulnerable installation does not establish that an attacker successfully exploited it.

Let us consider some possibilities:

1. A business running an affected version may have been exposed to serious risk without experiencing any unauthorised access.

2. Another organisation may have experienced repeated exploitation attempts without those attempts succeeding.

3. A third organisation may have suffered a successful compromise that resulted in unauthorised access to personal information.

Although the underlying vulnerability is identical, the legal consequences may be substantially different.

That is why the first responsibility in any incident investigation is to establish what actually happened.

Vulnerability, compromise and data breach require different legal enquiries

Cybersecurity incidents often unfold faster than organisations can accurately describe them. During the earliest stages of an investigation, words such as vulnerability, attack, intrusion and breach are sometimes used interchangeably.

They should not be.

A vulnerability is a weakness that could be exploited. An attempted attack is evidence that someone tried to exploit a weakness. A successful compromise indicates that an attacker obtained unauthorised access or otherwise affected a system’s security. A personal data breach involves a security incident that compromises the confidentiality, integrity or availability of personal information.3

We need to distinguish them because reporting obligations are generally tied to defined events and consequences, not simply the existence of dangerous software.

Subscribe now

For now, let us consider a hypothetical financial services company that discovers it has been operating an affected PHP version. Its security team immediately installs the relevant update. At this stage, the company knows that its systems were vulnerable. It does not necessarily know that an intrusion occurred.

Suppose investigators subsequently identify suspicious requests directed at the affected servers. That evidence may justify a more detailed investigation. However, suspicious requests alone do not establish successful exploitation.

Now imagine that investigators discover evidence of unauthorised code execution and access to authentication credentials. The position changes immediately because the organisation must examine, e.g., what those credentials permitted, whether personal information was accessed and what consequences may follow.

Importantly, personal data breaches are not limited to stolen databases.

Under Article 4(12) of the EU General Data Protection Regulation (GDPR), a breach can involve unauthorised access, disclosure, alteration, loss, destruction or unavailability of personal data.

An attacker does not necessarily need to download a customer database for a personal data breach to occur. The key question is what happened to the information and whether the relevant legal definition has been satisfied.4

An academic study examined more than 12,000 cyber events and distinguished data breaches from broader security incidents and privacy violations.5

A technical security incident may create serious operational consequences without involving personal data. Conversely, an unauthorised disclosure of personal information may constitute a data breach even where no sophisticated cyberattack occurred.

This legal classification must follow the evidence, rather than the severity of the vulnerability alone.

The most difficult problem is when the evidence cannot tell the whole story

The PHP2Shell incident raises an unusually important cyber-forensic concern.

Some of the exploitation techniques involved internal PHP operations that could occur before application-level security controls or logging mechanisms became active.

Others concerned memory management and the handling of information across requests.

This creates a difficult investigative problem.

Organisations frequently depend on application logs, authentication records, database activity and network monitoring to reconstruct suspected attacks.6 Be that as it may, an application cannot ordinarily record an event that occurs before its own logging mechanisms begin operating.

Similarly, accessing information directly from process memory may not produce the same evidence as downloading records through an application or database.

Subscribe now

Such activity is not necessarily invisible. Web server logs, network telemetry, endpoint monitoring and other forensic records may still reveal suspicious behaviour.

Nevertheless, an organisation cannot assume that the absence of suspicious application logs establishes the absence of exploitation.

This is where we believe PHP2Shell introduces an important new dimension to cybersecurity law.

An organisation’s ability to establish that no breach occurred depends partly on whether its systems were capable of detecting the relevant attack.

A company might state that investigators found no evidence of unauthorised access.

That statement may be accurate, but its meaning changes if investigators later discover that relevant logs were never collected, critical records were overwritten or the monitoring system could not observe the affected part of the PHP runtime.

The company may have found no evidence because the available evidence was insufficient.

There is a significant difference between establishing that an event did not occur and being unable to establish whether it occurred.

Forensic research supports this concern.

In a recent finding, the authors examined the quality of information generated during incident investigations. Their research identified challenges in the collection and quality of incident-response data, demonstrating why the information available after an incident may be insufficient for reliable analysis.

PHP2Shell makes that problem particularly relevant.

Where exploitation may occur outside ordinary application visibility, the quality of monitoring becomes inseparable from the reliability of legal conclusions.

We would describe this as the forensic visibility gap: the distance between what an attacker may have done and what an organisation’s systems are capable of proving.

A European court has already confronted part of this problem

A particularly relevant judicial decision is VB v Natsionalna agentsia za prihodite, Case C-340/21, decided by the Court of Justice of the European Union on 14 December 2023.7

The case arose from a major cyberattack against a EU member state National Revenue Agency.

In July 2019, personal information relating to millions of individuals was unlawfully accessed and published online.

Affected individuals brought proceedings seeking compensation for the anxiety and fear that their information could be misused.

One important question concerned whether the fact that hackers had successfully accessed personal information automatically proved that the agency’s security measures were inadequate.

The Court held that it did not.

A successful cyberattack does not, by itself, establish that an organisation failed to implement appropriate technical and organisational security measures under the GDPR.

However, the Court also made clear that, in proceedings seeking compensation under article 82, the data controller bears the burden of demonstrating that its security measures were appropriate.

The Court further recognised that a genuine, well-founded fear of future misuse of personal information can constitute non-material damage.

The judgment therefore draws an important distinction between the occurrence of a breach, the adequacy of an organisation’s security measures and the harm suffered by affected individuals.

These issues appear to be connected, but they are not identical.

Regarding the PHP2Shell incident, the implication as significant and we should recognise it as such.

Even where a breach is established, liability does not necessarily arise simply because hackers succeeded. The relevant security standards, circumstances, causation and applicable legal requirements still require examination.

Equally, an organisation cannot rely solely on the involvement of cyber criminals to escape responsibility. It must be able to demonstrate the reasonableness of its security arrangements.

When does the legal reporting clock begin?

Perhaps the greatest difficulty in cyber incident reporting is deciding when uncertainty becomes sufficient knowledge.

Under article 33 of the GDPR, organisations must generally notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms.

Where a breach is likely to result in a high risk to individuals, article 34 may also require notification to those affected.

What does it mean to become aware?

The European Data Protection Board’s Guidelines 9/2022 explain that awareness arises when an organisation has a reasonable degree of certainty that a security incident has occurred and personal data has been compromised.

This does not mean every vulnerability automatically starts the notification clock, nor does it mean an organisation may postpone reporting until investigators have established every detail.

An initial investigation may be necessary to determine whether a personal data breach occurred.

Once the relevant threshold is reached, however, uncertainty about the full extent of the incident will not ordinarily justify postponing notification.

The GDPR allows information to be provided in phases when complete details are not immediately available. This approach reflects the reality of cyber investigations.

From experience, organisations often discover incidents gradually. A security alert may lead to evidence of unauthorised server access. Further investigation may identify compromised credentials. Investigators may subsequently establish that personal information was affected.

Subscribe now

The law must accommodate that progression without allowing organisations to delay reasonable investigation indefinitely.

In one journal article, the authors argued that breach notification should not operate merely as a reputational penalty.8 Its central value also lies in coordinating action to reduce the harm suffered by affected individuals.

That remains a compelling principle. The purpose of notification should not simply to announce that something went wrong, but rather to ensure that regulators and affected individuals receive information when it can meaningfully support oversight, protection and appropriate responses.

One incident, several legal reporting standards

There is no single international reporting threshold applicable to every cybersecurity incident. Different legal frameworks might protect different interests.

Under the GDPR, the main concern is the protection of personal data and the risks created for individuals.

The EU’s NIS2 Directive addresses critical cybersecurity incidents affecting organisations within its scope. Its reporting framework includes an early warning within 24 hours, an incident notification within 72 hours and a final report generally within one month after the incident notification. The applicable duties must be assessed under the relevant national implementation.9

The EU Cyber Resilience Act introduces another important distinction.

Since 11 September 2026, manufacturers within its scope have been required to report actively exploited vulnerabilities and severe incidents affecting the security of qualifying digital products.10

Its reporting obligations are not limited to incidents involving personal information. They concern product security and vulnerability management.

The obligations applicable to qualifying open-source software stewards begin later, on 11 December 2027.

In the United States, certain public companies must generally disclose material cybersecurity incidents under the Securities and Exchange Commission’s rules within four business days after determining materiality. That determination must not be unreasonably delayed.11

The SEC framework focuses on information material to investors, which may include significant business disruption even where no personal data has been stolen.

Australia’s Notifiable Data Breaches scheme uses another test.

Under that framework, notification generally becomes necessary where an eligible data breach is likely to result in serious harm to affected individuals.12 Organisations must also promptly assess suspected eligible breaches, taking reasonable steps to complete that assessment within 30 days.

The implications are quite clear for everyone.

A single PHP2Shell exploitation incident could trigger different duties across jurisdictions, depending on the organisation’s role, the systems affected, the consequences and the applicable legislation.

A reportable cybersecurity incident is not always a personal data breach, and a personal data breach does not automatically establish civil liability.

What the courts tell us about liability

Two important cases help illustrate why cybersecurity law requires some in-depth discussion.

The United Kingdom: WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12

In this case, a Morrisons employee, Andrew Skelton, deliberately disclosed payroll information after developing a personal grievance against his employer.

He had been entrusted with employee information for a legitimate work-related purpose but later published it online.

Thousands of affected employees brought legal proceedings against Morrisons.

The central issue before the UK Supreme Court was whether the company was vicariously liable for the employee’s wrongful conduct.

The Court concluded that Morrisons was not vicariously liable because the employee had acted in pursuit of a personal vendetta rather than in the ordinary course of his employment.

The judgment did not establish that organisations are generally free from responsibility for misconduct involving employee data. Rather, it clarified the limits of vicarious liability in the circumstances of that case.

The ruling tells us that the existence of a data breach does not answer every question about who is legally responsible for it. Responsibility requires analysis of the relevant legal duty, the conduct involved and the connection between that conduct and the alleged defendant.

Read the UK Supreme Court judgment here.

The United States: Remijas v Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015)

In 2013, hackers compromised payment card information belonging to customers of the American retailer Neiman Marcus.

Approximately 350,000 payment cards were potentially exposed, and around 9,200 were known to have been used fraudulently.

Affected customers brought proceedings alleging various forms of harm, including expenses incurred in responding to the compromise and the risk of future fraud.

The United States Court of Appeals for the Seventh Circuit held that the plaintiffs had sufficiently established standing to pursue their claims.

Subscribe now

The decision did not necessarily determine that Neiman Marcus was ultimately liable, but it concerned whether the alleged injuries were sufficient to permit the litigation to proceed.

It nevertheless demonstrates how evidence of an actual compromise can change the legal assessment of future harm.

How relevant is this ruling to PHP2Shell?

A theoretical possibility of credential theft is different from forensic evidence establishing that attackers obtained sensitive information.

The two situations may produce very different legal consequences.

Read the Seventh Circuit judgment.

Taken together, these cases show why we must distinguish the occurrence of a breach from inadequate security, liability and legally recognised harm. They do not prescribe when PHP2Shell incidents must be reported; rather, they clarify the questions that may arise after the technical facts have been established.

An attack may begin before the public warning

A further development makes the October 2026 PHP disclosure especially important.

On 21 October, Amazon Threat Intelligence reported detecting an attempted PHP2Shell exploit against its MadPot honeypot infrastructure on 17 October.

That was four days before the public disclosure.

Amazon also identified further exploitation attempts around the time the vulnerabilities became public.13

The observations did not establish whether those attempts would have succeeded against real-world production systems.

Nevertheless, they challenge a common assumption.

Organisations frequently begin vulnerability investigations from the date an official advisory is published, but an attacker may have discovered or attempted to exploit the weakness earlier.

Forensic investigations should therefore consider credible evidence of earlier exploitation when establishing the period of possible exposure.

This creates what we might call two competing timelines:

1. The first concerns when malicious activity could have occurred.

2. The second concerns when an organisation became sufficiently aware of a legally relevant incident to trigger notification obligations.

Those dates may be separated by days, weeks or longer.

A reporting deadline cannot simply be calculated from the vulnerability’s publication date; mor should an organisation assume that an investigation need only examine activity occurring after that announcement.

Understanding both timelines is essential.

A new standard of cybersecurity accountability: can organisations prove what they know?

We believe the strongest lesson from PHP2Shell case is not simply that organisations need better patch management, but they also need better ways to establish the truth after an incident.

For years, cybersecurity governance has concentrated heavily on preventing attacks through firewalls, encryption, authentication, vulnerability scanning and software updates.14

Those measures remain indispensable. However, incident reporting introduces another responsibility: organisations must be capable of investigating foreseeable security failures and explaining the basis for their decisions.

This requires attention to forensic readiness.

An organisation should understand what its monitoring systems record, how long relevant evidence is retained, which infrastructure components fall outside its visibility and whether third-party providers can supply essential technical information.

It should also be able to explain important gaps in that evidence.

This does not mean organisations must maintain perfect monitoring systems or store every possible record indefinitely (it would be great if they could, of course!). Security and privacy considerations require proportionate decisions about collection and retention.

However, an organisation cannot confidently rely on the absence of evidence without understanding what evidence its systems could realistically have produced.

The aforementioned point has broader relevance beyond PHP.

Software environments are becoming more complex and attacks increasingly target dependencies, cloud infrastructure and runtime processes. Conventional application records may provide only a partial picture.15

Legal advisers should therefore ask questions that go beyond whether investigators discovered signs of intrusion/hacking.

For example, what sources were examined? What information was unavailable? Could the monitoring system detect the suspected method of attack? Were findings independently tested? What reasonable alternative explanations remain?

These are technical questions, but their answers may determine the defensibility of legal conclusions. They also influence whether a statement to a regulator, investor or affected customer accurately reflects the organisation’s knowledge.

Why patching alone cannot respond to legal enquiry

Installing security updates is an essential part of responding to PHP2Shell, but a patch addresses the vulnerability going forward. It does not establish whether an attacker exploited it before the update was installed.

This is particularly important where credible evidence suggests exploitation attempts preceded public disclosure. An organisation may have fully patched its infrastructure and still need to examine earlier activity. At the same time, investigators face a practical challenge.

Restarting affected services, rebuilding systems or replacing compromised infrastructure may remove key evidence.

Security teams therefore need procedures that support rapid remedies while preserving relevant records where reasonably possible.

This strategy requires coordination between technical investigators, legal advisers, management and external service providers. It also requires safe documentation.

Subscribe now

Ideally, organisations should be able to explain when a vulnerability was identified, how its exposure was assessed, why particular investigative steps were taken and what evidence supported the resulting reporting decision.

Research examines the broader value of breach-notification obligations where the authors identify accountability, transparency and incentives for improved cybersecurity among their important benefits, while questioning how far individuals can realistically protect themselves after receiving notifications.

Their analysis reinforces a point that deserves wider recognition.

Cybersecurity reporting should not become an administrative exercise in which organisations merely satisfy a deadline (or a ‘tickbox’ task). Its value should depend on the accuracy of the information disclosed and the actions that follow.

What can we learn from the PHP2Shell incident?

The October 2026 PHP vulnerabilities will understandably be remembered as a major technical security event.

They exposed weaknesses in a widely deployed software runtime, prompted urgent remedies and demonstrated the speed with which attackers may attempt to exploit newly disclosed flaws.

They also reveal how difficult it can be to translate technical uncertainty into sound legal decisions.

A vulnerable system is not necessarily a compromised system. Likewise, a compromised system does not necessarily establish that personal data was affected. Similarly, a confirmed personal data breach does not automatically establish negligence, compensation or liability, and the absence of detected malicious activity does not always prove that no intrusion occurred.

Each question requires its own evidence and legal assessment.

The challenge for organisations is not to eliminate uncertainty entirely; that may be impossible to achieve. However, they should investigate reasonably, recognise the limitations of available evidence and make timely decisions under the legal frameworks that apply.

Leave a comment

We believe future cybersecurity accountability will increasingly depend on an organisation’s ability to demonstrate not only the precautions it took to prevent an incident, but also the quality of its investigation when those precautions were tested.

A critical vulnerability is not automatically a confirmed data breach, but where an organisation cannot determine whether a breach occurred, the more important question may be “why” it cannot establish the facts.

That is the key legal issue PHP2Shell brings into focus, and it may become one of the defining questions in the next stage of global cybersecurity law.

Legal and technical information reflects developments available as of 24 October 2026. The judicial decisions discussed illustrate different legal principles and do not concern PHP2Shell itself. Reporting obligations and liability depend on the relevant jurisdiction and the specific facts of each incident.

The development of smart glasses regulations and its legal significance

On 13 October 2026, the European Data Protection Board (EDPB) adopted Statement 1/2026 on smart glasses. The statement addresses eyewear equipped with cameras, microphones and connected services, including artificial intelligence. Such devices can assist communication, translation and navigation, but can also collect information about people who do not realise they are being recorded.

Subscribe now

The statement explains how existing data protection obligations apply to these activities and identifies practical safeguards for manufacturers, service providers and users.1

The statement is a preliminary, non-binding regulatory guidance. It neither creates a new offence nor imposes a general prohibition on smart glasses. Its importance is nevertheless substantial because it sets out the collective position of European data protection regulators and gives organisations a clear indication of compliance concerns.

This legal report also considers the EU General Data Protection Regulation (GDPR) in the context on smart glasses.2 Please note that national privacy, employment and criminal laws may impose additional restrictions, including where the GDPR does not apply.

Why smart glasses require particular attention

The principal concern is the gap between the wearer’s ability to collect information and a bystander’s ability to recognise or challenge that collection.

Read more

Abstract

An introduction

The language of imperialism is increasingly used to describe the global digital economy.

Data imperialism lies in a visible asymmetry where people and institutions generate data and depend on digital services, while a small number of firms control many of the infrastructures through which data are stored, analysed and converted into commercial and political advantage.

For governments in low-income states, the problem is that public administration, commerce and social life may become dependent on privately governed systems whose infrastructure, pricing, rules of access and technical standards are set elsewhere.1

Our technical article asks when that dependence should be understood as a new imperial relation and what law can do about it. We use “algorithmic dependency” to describe a condition in which a polity’s practical ability to make and implement choices is materially constrained by its reliance on external data infrastructure, computational capacity, AI models or platforms.

Dependency is not established by foreign ownership alone. It arises where exit is prohibitively costly, local alternatives and expertise are weak, data and learning effects accumulate outside the jurisdiction, or decisions affecting the community are embedded in systems it cannot effectively inspect or contest.2

Read more

Executive summary

Introduction and background

On 6 October 2026, the United States Financial Crimes Enforcement Network (FinCEN) formally withdrew its 2023 proposal to introduce enhanced reporting and recordkeeping requirements for transactions involving convertible virtual currency (CVC) mixing.1 The withdrawal, published in the Federal Register at 91 FR 63513, also removes FinCEN’s earlier finding that international cryptocurrency mixing constituted a class of transactions of primary money laundering concern.2

The decision represents an important development in the regulation of digital assets in the United States. It it indicative of a change in regulatory priorities, particularly regarding the balance between preventing financial crime, protecting financial privacy and avoiding unnecessary compliance burdens on financial institutions.

Subscribe now

Importantly, the withdrawal does not legalise money laundering or exempt cryptocurrency businesses from existing financial crime laws. Rather, it ends a proposed additional reporting regime that had not entered into force.

Our legal report examines the background to the proposal, the legal basis for FinCEN’s action, the reasons for its withdrawal and the implications for financial institutions, cryptocurrency businesses and the wider digital asset industry.

Background to the 2023 Proposal

On 23 October 2023, FinCEN published a proposed rule identifying international CVC mixing as a class of transactions of primary money laundering concern under section 311 of the USA PATRIOT Act.3

Convertible virtual currency (CVC) mixing generally involves combining, transferring or restructuring cryptocurrency transactions to make it more difficult to identify their original source, destination or amount. Although these techniques can protect legitimate financial privacy, they can also be used to conceal proceeds from fraud, ransomware attacks and other criminal activities.

FinCEN’s original proposal was motivated by concerns that criminal organisations, terrorist groups and state-sponsored cybercriminals were exploiting cryptocurrency mixing services to move illicit funds without being easily detected.

FinCEN specifically identified risks involving North Korean-linked cybercriminals, Russian-associated ransomware groups and illicit online marketplaces.

Under the proposed requirements, covered financial institutions, including cryptocurrency exchanges where applicable, would have been required to report transactions they knew, suspected or had reason to suspect involved CVC mixing within or involving a jurisdiction outside the United States.

Leave a comment

The proposed reports would have contained substantial information, including transaction amounts, cryptocurrency types, wallet addresses, transaction hashes, internet protocol addresses and customer identification details.

Reports would generally have been required within 30 calendar days of detecting a covered transaction.

The proposal also adopted a broad definition of cryptocurrency mixing, covering activities such as pooling digital assets, dividing transactions, using temporary wallet addresses and exchanging between different digital assets.

It nevertheless contained an exception for certain internal processes used by regulated financial institutions that preserved transaction records.

Despite this exception, the definition raised concerns that legitimate cryptocurrency activity could be captured by the proposed requirements.

Legal framework: section 311 of the USA PATRIOT Act

FinCEN’s original proposal relied on section 311 of the USA PATRIOT Act, codified at 31 U.S.C. § 5318A.

This provision authorises the United States Treasury to introduce special measures where reasonable grounds exist to conclude that certain foreign jurisdictions, financial institutions, accounts or classes of transactions present a primary money laundering concern.

The law provides five possible special measures, ranging from enhanced recordkeeping and reporting requirements to restrictions involving certain foreign banking relationships.

Read more

Executive summary

The development and significance of the Law Society’s report

The Law Society’s report, published on 5 October 2026, is a foresight study examining how agentic AI may affect consumers, legal professionals and judicial decision-making. Its central insight is that change is likely to occur incrementally rather than through a single decision to “automate justice”.1

An AI system may initially summarise case files, subsequently identify authorities and organise arguments, and eventually shape the framework within which a legal decision is reached.

At each stage, the human decision-maker may remain formally responsible while practical dependence on the technology steadily increases.

Subscribe now

The legitimacy of adjudication depends not only upon who signs a judgment, but upon the independence and quality of the reasoning that precedes it. Section 3 of the Constitutional Reform Act 2005 requires those responsible for the administration of justice to uphold judicial independence.2

Read more

Case Summary

Thomson Reuters v ROSS Intelligence: a locus classicus

On 29 September 2026, the US Court of Appeals for the Third Circuit handed copyright owners their most important appellate victory yet in the litigation over artificial-intelligence training.

In Thomson Reuters Enterprise Centre GmbH v. ROSS Intelligence Inc., No. 25-2153, the court unanimously affirmed partial summary judgment for Thomson Reuters and West Publishing.1

This is the first federal appellate decision squarely to adjudicate a fair-use defence directed at AI training.

Read more

Abstract

The standard of professional care

The relevant object of negligence law is the quality of the service a reasonably competent lawyer would have provided in the circumstances of a particular retainer. What changes as tools improve is the range of methods through which that service can reasonably be delivered.1

The U.S. law of professional competence sets a classical foundation. In Smith v Lewis, the California Supreme Court held that counsel should discover rules readily ascertainable by standard research and undertake reasonable research even where the law is unsettled.2 The reference to “standard” techniques identifies an historically contingent means of inquiry.

Read more

Report Summary

This report includes important updates and news in technology law from Canada, European Union, China, the United States and the United Kingdom. Access the latest opportunities, including remote jobs in technology law, internships, and call for papers.

Lead Story

Canada and the European Union: A surveillance Bill becomes a European concern

A group of European civil society organisations asked European officials to challenge Canada’s proposed Lawful Access Act, known as Bill C 22. The organisations want its provisions on technical access and data retention removed or narrowed. They also want European officials to raise the issue during digital trade discussions with Canada. Canada’s Parliament records the bill as having passed the House of Commons and awaiting further consideration in the Senate. The proposal remains under consideration.

Read more

Report Summary

This briefing report includes important updates and news in technology law from the United States, India, Canada and the European Union. Access the latest opportunities, including remote jobs in technology law, grants, and call for papers.

Lead Story

United Kingdom announces social media ban for children under 16

The United Kingdom government has announced plans to prevent social media platforms from offering their services to children under 16. The proposal covers user to user platforms whose main purpose is social interaction and which combine user posts with recommendation systems.

The government has identified services such as Instagram, YouTube, TikTok, Snapchat, Facebook, and X as examples that may fall within the regime. Messaging services such as WhatsApp and Signal are not intended to be included.

The announcement goes beyond account access. Livestreaming and communication from strangers would be restricted for children under 16 across a wider group of online services, including gaming services.

Read more

Report Summary

This briefing report includes important updates and news in technology law from the United States, Canada, the Vatican, Costa Rica and the European Union. Access the latest opportunities, including remote jobs in technology law, conferences and events.

Lead Story

The Vatican Warns Against Leaving AI to Market Power

On 25 May 2026, Pope Leo XIV signed his first encyclical Magnifica Humanitas. This appears to be a radical policy intervention marking the 135th anniversary of Rerum Novarum, Pope Leo XIII’s historic letter on workers’ rights during the industrial revolution.

Magnifica Humanitas approaches AI primarily as a tool and says its purpose is to protect human dignity.

The encyclical asserts that AI must serve humanity rather than allow markets and private platforms to determine its direction. To emphasise the moral continuity with the industrial era, Pope Leo compares today’s concentration of data and computing power to the nineteenth‑century concentration of capital and factories.

Read more

This week’s briefing report informs us that technology law sanctions are becoming less forgiving. This briefing report encompasses cybercrime policing, AI in legal practice, predictive government, student AI bans, data transfers, and prediction markets ban.

Newsletter Edition 98

🔥 This edition includes important updates and news in technology law from the Middle East and North Africa (MENA), Argentina, Germany, the UK, and the US. Access the latest opportunities, including remote jobs in technology law, free courses, events, and scholarships.

This Week in Technology Law:

Lead Story

Operation Ramz Cybercrime Crackdown

The Middle East and North Africa (MENA)

Between October 2025 and February 2026, thirteen countries joined forces under Interpol’s Operation Ramz. This four‑month campaign focused on phishing‑as‑a‑service platforms, malware distributors and online scam networks, culminating in 201 arrests and the identification of another 382 suspects.

Subscribe now

Investigators seized 53 servers and shared nearly 8,000 pieces of intelligence across participating jurisdictions.

The operation identified 3,867 victims and uncovered infrastructure in Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia and the United Arab Emirates.

By pooling resources and intelligence form the MENA countries,

• Police dismantled a phishing‑as‑a‑service operation in Algeria, confiscating servers, computers and mobile devices.

• Moroccan officers seized hard drives containing banking data and phishing software.

• In Oman, a server hidden in a private residence contained sensitive information and was taken offline.

• Qatar uncovered compromised devices whose owners were unaware their computers were being used to propagate malware.

• Perhaps the most alarming discovery occurred in Jordan where fifteen people running financial‑investment scams were themselves victims of human trafficking. They had been lured from Asia with bogus job offers, had their passports taken and were forced to participate; investigators arrested two suspected organisers.

Operation Ramz demonstrates the value of transnational cooperation in addressing cybercrime.

Cybercrime schemes often span jurisdictions, making unilateral enforcement ineffective. Shared intelligence and simultaneous raids increase the likelihood of arrests, preserve evidence and disrupt infrastructure.

The operation also raises complex legal questions. Courts will have to determine how data was collected, whether warrants justified server seizures, and whether evidence from private cybersecurity firms is admissible.

Human‑trafficking victims forced into fraud present further challenges; prosecutors must reconcile their criminal involvement with the duress under which they acted.

Interpol emphasised that cybercrime is borderless and only an equally borderless response can work.

Leave a comment

As phishing kits, malware and social‑engineering scams proliferate, law‑enforcement agencies worldwide will need to build on this model of collaboration.

Operation Ramz also highlights the importance of transparency; victims deserve to know how evidence was collected and how their data may have been compromised.

Legal frameworks must evolve to balance the need for international cooperation with privacy, due process and the rights of those compelled into criminality.

The success of Operation Ramz shows what coordinated action can achieve, but also clarifies the necessity of clear legal standards for digital evidence and human rights considerations.

Technology Law: Updates and Developments

Argentina’s AI Social Digital Twin

Argentina’s government announced a “social digital twin” to model the impact of welfare programmes and other policies.

The Ministry of Human Capital said the project will use large‑scale datasets to simulate scenarios involving poverty, subsidies and labour trends in order to inform policymaking.

President Javier Milei promoted the initiative on social media as a paradigm shift towards data‑driven governance, claiming it would transform information into predictive capacity and strategic design for public policy.

According to officials, the system will draw on data from state agencies and private sources, correlating variables to identify problems and forecast the likely effects of interventions.

The announcement triggered immediate scrutiny. Opposition lawmakers filed formal requests in Congress seeking details about the project’s legal basis, the scope of data collection and the safeguards for personal information.

Subscribe now

The promotional video announcing the Gemelo Digital was quickly mocked for basic language errors. At 0:35, one graphic read “MULTIPLES FUENTES”, omitting the required accent in “múltiples.” At 0:54, a full-screen claim called it the “PRIMER SISTEMA QUE AYUDA PREDICIR EL FUTURO,” missing “a” before the verb and misspelling “predecir” as “predicir.”

Critics noted that the promotional materials were vague and raised concerns about potential involvement by Palantir Technologies, a data‑analytics company whose founder Peter Thiel had recently visited Argentina and met with the president.

Digital‑rights groups argued that merging welfare, health, judicial and education records into a single model could lead to profiling and discriminatory decision‑making. They demanded clarity on which datasets would be used, how they would be anonymised, and whether individuals could consent or opt out.

The government insisted that only aggregated and anonymised data would be processed and said the initiative is still at an early stage.

Without a transparent regulatory framework, simulation tools that promise efficiency could morph into pervasive surveillance. Argentina’s social digital twin encapsulates both the promise of AI‑assisted policy design and the perils of insufficient data‑governance.

Moving forward, public debate should focus on ensuring that predictive governance remains accountable governance, with clear procurement rules, independent audits and enforceable rights for individuals affected by algorithmic decisions.

UC Berkeley Law Bans Students From Using AI

The University of California, Berkeley Law School unveiled a sweeping rule governing students’ use of AI. Effective this summer, the AI policy prohibits students from using AI to conceptualise, outline, draft, revise, translate or edit any work submitted for credit.

It also forbids students from uploading assignments, readings, slides or class recordings into generative systems.

AI may be used solely for identifying sources such as cases, statutes or secondary materials, and students remain fully responsible for the accuracy of their research. Citations to nonexistent sources create a presumption of prohibited use.

Exceptions exist for courses specifically designed to teach AI fluency or where instructors obtain written approval to deviate from the default ban. Chris Hoofnagle, Faculty Director of the Berkeley Center for Law & Technology, explained that the AI policy aims to preserve cognitive skills central to legal education rather than to vilify AI.

Subscribe now

Previous guidelines permitted certain AI‑assisted corrections, but the rapid expansion of generative AI models prompted a reassessment.

The ban covers activities like brainstorming topics, proposing paper structures, drafting summaries of legal rules, identifying repetitive passages, polishing grammar, generating exam outlines and translating work.

The AI policy acknowledges that lawyers must eventually be conversant with AI. Many law firms already use generative tools for discovery and research.

However, UC Berkeley Law contends that students must first learn to think critically before leveraging automation; good lawyering requires “cognitive skills necessary to strategically deploy the technology”.

The school’s strict position has sparked online conversations. Supporters argue that it will protect academic integrity and prevent “AI slop,” while critics worry it may leave graduates less prepared for AI‑rich practices.

The policy’s carve‑outs may mitigate some concerns by allowing experimentation under faculty supervision.

Other law schools will watch closely to see whether such restrictions become a broader trend in legal education.

SRA Referrals for AI‑Generated Authorities

On 14 May 2026, His Honour Judge Grimshaw referred two solicitors, Kossar Qureshi and Mahmood Hussain, to the SRA after they submitted documents containing AI‑generated citations.

Hussain, a consultant at AML Legal in the West Midlands, told the court that a paralegal had helped prepare the materials; he acknowledged that he should have verified the research.

Qureshi, director of the firm, signed off on the email filing the bundle. The case, Rodney v Gee’z Micro Bar & Pitstop, involved an application for permission to appeal. The supporting documents contained incorrect case citations that appeared to have been generated by AI.

Judge Grimshaw said the growing use of AI and false authorities threatens the integrity of the justice system and called for judges to adopt a robust approach.

He described the behaviour as inexcusable and said admonishment alone would be insufficient. The skeleton argument looked as though it had been generated by AI, with phrases like “Relevance: your client was a litigant in person,” suggesting automated drafting.

Hussain accepted responsibility for the oversight and admitted that summaries from electronic research tools should have been checked before submission. Qureshi conceded she did not draft or supervise the original documents but acknowledged the seriousness of the lapse. The judge noted failures both by the individual solicitors and by firm management.

The risks of incorporating AI into legal practice without robust quality control will always exist.

Submitting fabricated authorities undermines trust in court processes and may lead to sanctions.

Regulators (such as the SRA) will need to balance accountability for lawyers with the recognition that many research tools now integrate AI.

Firms should implement protocols requiring cross‑checking of AI outputs and transparent disclosures when generative tools are used.

Leave a comment

The SRA’s investigation may prompt further guidance on acceptable uses of AI in court submissions and stricter penalties for negligence.

Bar Standards Board Guidance on AI and Other Technologies

The Bar Standards Board (BSB) issued comprehensive guidance on the adoption and use of artificial intelligence and other technologies to ensure barristers meet ethical and practice‑management obligations.

The document, effective 18 May 2026, acknowledges that AI can improve practice management and client service but emphasises the need for preparation.

It organises responsibilities by stages:

• general ethical considerations,

• competence and training,

• procurement,

• management procedures,

• duties when using AI and oversight of AI used by others.

Under “general ethical considerations,” the guidance reminds barristers of core duties to provide competent service (Core Duty 7), act in the best interests of clients (Core Duty 2), and maintain honesty and integrity (Core Duty 3).

It states that practitioners must maintain a sufficient understanding of AI to detect errors, preserve legal professional privilege and ensure accuracy when using AI tools.

Transparency is critical; barristers must disclose their use of AI when it materially affects the nature of services and ensure they do not mislead clients or the court. Because using AI amounts to outsourcing, lawyers remain personally responsible for any inaccuracies introduced by the tools.

The guidance emphasises competence and training. Barristers should obtain ongoing education on AI to understand benefits, risks and evolving legal standards.

When procuring AI systems, law chambers must establish governance frameworks, ensure confidentiality and data‑processing responsibilities are met, and adjust data policies accordingly.

The document advises record‑keeping, including maintaining AI audit logs and prompt histories, and adopting an AI policy covering acceptable uses and governance.

The BSB’s approach recognises that AI adoption is inevitable but must align with professional duties. This guidance may inform similar policies across the legal sector.

Barristers who disregard these standards risk disciplinary action, especially as courts and regulators become more attentive to AI‑related errors. Ultimately, the guidance encourages practitioners to view AI as a tool that requires careful management, rather than a substitute for professional judgment.

Minnesota’s Ban on Prediction Markets

Minnesota enacted the United States’ first law expressly banning online prediction‑market platforms, a move that sets up a conflict with federal regulators.

The Bill makes it a crime to host or advertise a system allowing wagers on future outcomes—ranging from sports and elections to entertainment and world events.

It extends the prohibition to services that help people circumvent location restrictions, such as virtual private networks.

Sites like Kalshi and Polymarket must cease operating in Minnesota or face felony charges when the law takes effect in August.

Lawmakers crafted the ban to protect residents, especially minors, from gambling risks. Representative Emma Greenman, who sponsored the measure, argued that the state should decide how to regulate wagering to safeguard public safety.

The law includes exceptions for event contracts used as insurance or for trading commodities and securities.

Subscribe now

Critics contend that the prohibition is overly broad and will drive prediction‑market activity offshore or into unregulated spaces. The

Commodity Futures Trading Commission (CFTC) has already filed a federal lawsuit seeking to block the law, asserting exclusive jurisdiction over prediction markets.

CFTC Chairman Michael Selig argued that the state ban turns lawful operators and participants into felons overnight and undermines legitimate hedging activities used by farmers and businesses.

According to the National Conference of State Legislatures, at least 14 other states are considering similar measures.

We should predict a protracted battle over whether states or federal agencies should regulate prediction markets. Most trading on these platforms relates to sports betting, which will further blur the distinction between financial instruments and gambling.

Minnesota’s law may thus become a test case for the future of event‑based trading and the scope of federal pre‑emption.

Case Note

Case: Munich Higher Regional Court, Decision of May 11, 2026
Citation: Case No. 21 U 3882/25 e, 21st Civil Division | REWIS RS 2026, 2815

Facts and Dispute

A Facebook and Instagram user sued the operator of the social networks (now Meta Platforms) in the Ingolstadt Regional Court, alleging that from 16 July 2020 onward his personal data had been unlawfully transferred to the United States and shared with U.S. authorities.

He sought damages, injunctive relief, a declaratory judgment, disclosure of information and reimbursement of legal costs. The trial court dismissed the action, and the plaintiff appealed to the Munich Higher Regional Court.

The appellate court issued an order indicating its intention to dismiss the appeal under § 522(2) of the German Code of Civil Procedure because the appeal had no prospect of success.

Legal Issue and Court’s Analysis

The primary issue was whether transfers of user data from the EU to the U.S. violated the General Data Protection Regulation (GDPR) in light of the Court of Justice of the European Union’s Schrems II decision, which invalidated the EU–U.S. Privacy Shield.

The plaintiff argued that the defendant lacked a legal basis for transfers after July 2020 and that standard contractual clauses were insufficient.

The court noted that although Article 45 GDPR was unavailable after the Schrems II ruling, Article 46 GDPR (standard contractual clauses) provided a valid basis for transfer, and Article 49 GDPR could also justify transfers where necessary for contract performance.

Subscribe now

The court emphasised that the defendant used both the 2010 and 2021 standard contractual clauses and adopted supplementary measures such as encryption and minimisation.

The plaintiff failed to contest these measures during the trial.

The court observed that an adequacy decision under the EU–U.S. Data Privacy Framework entered into force on 10 July 2023, rendering data transfers to the U.S. lawful.

It added that the defendant also could rely on the exception for transfers necessary to perform the contract because Facebook and Instagram are global services whose architecture requires data to flow between continents.

The plaintiff did not challenge this technical necessity.

Decision and Reasoning

The appellate court held that the appeal lacked merit. It concluded there was no violation of Article 82 GDPR and no infringement of the right to privacy.

Data transfers after July 2020 were valid under Article 46 GDPR and, from July 2023 onward, under Article 45 GDPR.

Supplementary safeguards and standard contractual clauses ensured appropriate protection.

The court found the claim for injunctive relief unfounded because there was no risk of repetition and transfers were now lawful. It rejected the request to enjoin processing “without consent” as too vague and lacking specificity.

The court held that the request for information under Article 15 GDPR was satisfied through a self‑service tool and that the plaintiff had not identified missing data.

Lacking a principal claim, the court also rejected claims for damages and reimbursement of legal fees.

The plaintiff was advised to withdraw the appeal to reduce court fees.

Significance

This decision clarifies that after the Schrems II judgment and before the new adequacy decision, data transfers to the U.S. could rely on standard contractual clauses supplemented by technical and organisational measures.

It confirms that once an adequacy decision is in place, transfers become lawful under Article 45 GDPR. The court also emphasised the necessity exception in Article 49 GDPR for global social‑media services, recognising that infrastructure and user connections require transatlantic data flows.

Procedurally, the case illustrates how German appellate courts may summarily dismiss appeals without oral hearings when there is no prospect of success and encourages plaintiffs to withdraw to avoid costs.

Latest Opportunities

Remote jobs in technology law

1. Senior Patent Counsel (Remote US), Unified Patents: Unified Patents is again growing its legal department, and seeks to add an experienced, registered patent attorney (find out more).

2. TKYC Analyst (Remote Canada/US), Avantia: An AI-first legal and compliance services provider. As a Transaction KYC Analyst, you will work alongside asset managers’ legal, compliance, and investment teams to help bring complex private equity deals to completion (find out more).

3. Regulatory Counsel (Remote Türkiye), Binance: A leading global blockchain ecosystem behind the world’s largest cryptocurrency exchange by trading volume and registered users. Assist with legal and regulatory matters related to financial products and services in the FinTech, crypto, and blockchain sectors (find out more).

Subscribe now

4. Product Manager (Remote Japan), BoostDraft: BoostDraft is a software engineering company that develops IDEs for documents. Currently seeking Lawyers who draft relatively standardised but long documents, such as contracts (find out more).

5. Counsel, Applied Legal Research (Remote Singapore), Centari: Centari is hiring a transactional lawyer for its Applied Legal Research team to help develop AI tools for corporate legal work, combining expertise in corporate transactions, legal analysis and generative AI product development (find out more).

Conferences, fellowships, events and calls for papers.

6. Call for Papers on the Right to Freedom of Expression in the Digital Era: Platforms, Deepfakes, Social Media, and the Public Sphere; XVIII International Natural Law Conference: The Conference will address the status of freedom of expression in a world increasingly shaped by digital platforms, AI, synthetic media, and new forms of public and private governance. (find out more).

7. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words (find out more).

8. AI, Justice and the Rule of Law (Free Course): UNESCO and the University of Oxford are offering a free self‑paced online course launched on 27 April 2026 to equip judges, lawyers and students with an understanding of how AI interacts with human rights and legal reasoning (find out more).

Final Summary

This briefing report notes that Interpol’s Operation Ramz marked a watershed moment for cross-border digital crime enforcement with more than 200 arrests, hundreds of suspects identified and victims rescued across 13 countries.

It also highlights Argentina’s reform to develop a Social Digital Twin to simulate policy outcomes using AI, while cautioning that regulators must ensure privacy, transparency and accountability.

This briefing report also scrutinises Pinsent Masons’ self-referral to the SRA after a court exposed AI-driven errors in legal submissions.

Another signpost comes from UC Berkeley Law, which imposed a strict ban on AI for coursework to preserve analytical skills amid concerns over AI hallucinations and loss of independent reasoning.

This week’s case note analyses a Munich Higher Regional Court decision upholding cross-border data transfers under the EU–U.S. Data Privacy Framework, demonstrating deference to established safeguards and rejecting claims for damages.

Leave your comments to join the conversation.

Leave a comment

This weekly briefing covers various updates and argues that technology law is no longer dealing with distant risks. AI is now appearing in cyber exploits, clinical harm, scholarly misconduct, public administration, copyright disputes, and national policy programmes. The uncomfortable lesson is that institutions are adopting AI faster than they are building credible accountability around it. Regulators, courts, publishing houses, governments, and companies are all reacting, but their responses remain uneven, fragmented, and often delayed. This edition examines why AI governance must now be treated as a practical legal discipline rather than mere public-relations “lip service.”

Newsletter Edition 97

🔥 This edition includes important technology law news and updates from the EU, Italy, Malta, the US and the UK. View the latest opportunities, including free courses, events, scholarships, and remote jobs in technology law.

Major news in Technology Law this week:

Lead Story

Google’s AI‑Powered Exploits and Cybersecurity Law

Google’s confirmation that criminals used an AI model to develop a zero‑day exploit that bypassed two‑factor authentication shows that machine‑generated offensive tools now present real‑world threats, forcing lawmakers to revisit cybercrime laws and impose duties of care on AI developers.

Google’s Global Threat Intelligence Group (GTIG) released a report describing a world-first incident of this kind.

Subscribe now

Criminals allegedly used a large language model to create a zero‑day vulnerability exploit that bypassed two‑factor authentication in an open‑source administration tool.

The Python script bore tell‑tale signs of generative AI, copious educational docstrings, a hallucinated CVSS score, and a clean, textbook style, and Google concluded that the attacker likely leveraged an AI model to discover and weaponise the vulnerability.

Google worked with the affected vendor to prevent mass exploitation, but the incident illustrates how threat actors are already using AI to automate vulnerability discovery, develop exploits and improve defence evasion.

Attackers’ use of AI

The report identifies Chinese and North Korean state‑sponsored groups actively using AI for vulnerability research and exploitation.

A China‑linked group used persona‑driven jailbreak techniques to get an AI model to act as a senior security auditor when probing embedded devices, while the North Korean group APT45 repeatedly prodded AI models to analyse CVEs and validate proof‑of‑concept exploits.

Clearly, AI is not limited to automating computational tasks; adversaries are now deliberately applying AI to accelerate the discovery and weaponisation of vulnerabilities within its ecosystem.

The threat is shifting from human‑crafted exploits to AI‑augmented campaigns with faster turnaround times and deeper target scopes.

Cybersecurity law challenges

The emergence of AI‑assisted exploits raises thorny questions for cybercrime statutes.

Laws such as the Computer Misuse Act 1990 in the UK and the Computer Fraud and Abuse Act 1986 (CFAA) in the United States criminalise unauthorised access and malicious hacking, but both rely on the premise that attacks are carried out by humans.

When AI systems autonomously discover or propose vulnerabilities, the line between tool and perpetrator blurs.

If an attacker prompts an AI to “find flaws in WebAdmin v3.2,” is the AI merely a tool or an accomplice? The CFAA, for instance, prohibits “knowingly and intentionally” accessing a protected computer without authorisation.

Does a user who pastes AI‑generated exploit code into a command shell meet this mens rea? Attribution also becomes more complex because AI‑generated scripts may lack markers that investigators use to link exploits to specific operators.

Liability for AI developers

Google’s report shows that the exploited model was likely not Gemini, but the fact remains that an AI provider trained a model capable of generating harmful code.

Under US law, Section 230 of the Communications Decency Act protects platforms from liability for user‑generated content, but this safe harbour does not plainly apply to generative code.

AI vendors should be subject to strict liability regimes akin to product liability: if a product (the AI model) is unreasonably dangerous, its manufacturer should bear responsibility.

Developers of high‑risk AI systems must also conduct security testing and impose safeguards to prevent malicious misuse.

A White House executive order on AI called for risk assessments of models above a certain compute threshold, while the EU AI Act requires providers of high‑risk AI systems to implement risk management, transparency and human oversight. The zero‑day incident underscores the need for such obligations.

Duties of care and responsible disclosure

Google’s swift collaboration with the vendor to patch the vulnerability reflects responsible disclosure practices. However, not all AI‑enabled attackers will alert vendors.

Legislators may consider imposing a legal duty of care on AI developers to monitor for harmful outputs and restrict high‑risk functionalities. This could mean rate‑limiting vulnerability‑discovery prompts, refusing to generate exploit code, or watermarking outputs for traceability.

Of course, over‑regulation could stifle legitimate cybersecurity research and hinder the development of defensive AI tools. Lawmakers, therefore, face the delicate task of balancing innovation with security.

One suggestion is to adopt safe‑harbour provisions for researchers who use AI for defensive purposes and to prohibit only certain misuse categories, such as automated exploitation or large‑scale enumeration.

Under US federal law, the CFAA remains the primary statute for prosecuting hacking, but there is growing recognition that it is ill‑equipped for AI‑driven exploits.

Legislative proposals in Congress include modernising the CFAA to explicitly cover AI‑generated malicious code and clarifying that intent can be inferred when a user knowingly deploys AI outputs to breach security.

Separately, the Digital Millennium Copyright Act of 1998 (DMCA) prohibits circumventing technological protection measures, which could apply to AI scripts that bypass two‑factor authentication. The DMCA’s safe‑harbour for research might shield some AI‑driven vulnerability testing.

Leave a comment

Internationally, the Budapest Convention on Cybercrime sets common standards but predates generative AI; its ongoing Protocol 2 negotiation may need to incorporate AI‑specific obligations.

Future directions

Given the novelty of AI‑assisted exploits, legal frameworks are still catching up. Ongoing discussions around AI liability, cyberwarfare norms, and responsible AI will likely incorporate lessons from this incident.

Technology Law

Can AI Be Criminally Liable?

Read more

a year ago · 12 likes · 8 comments · Technology Law

Expect regulators to require AI developers to implement usage monitoring, impose mandatory reporting of harmful outputs, and share threat intelligence with government agencies.

Meanwhile, courts will confront cases testing whether a person can be held liable for crimes committed using AI. These questions will shape the next decade of cybersecurity law.

Technology Law Tracker

1. AI addiction – first clinical case treated

In early May, addiction specialists in Venice treated a 20‑year‑old woman who developed a behavioural dependency on an AI chatbot. Local media reported that she was so immersed in conversations with the algorithm that she spoke almost exclusively to the bot and withdrew from real‑world interactions.

The addiction service of the Ulss 3 health authority took her into care, marking the first such case in Italy.

According to Dr Laura Suardi, head of Serd, the AI’s adaptive design, learning the user’s preferences and giving increasingly personalised responses, reinforced a pseudo‑friendship that was “the tip of the iceberg” of a wider problem.

She explained that limiting usage alone is ineffective; treatment requires psychological and psychiatric support and involves the patient’s family.

AI systems can indeed cause psychological harm, raising questions about their regulation under medical and consumer protection laws. Medical definition of addiction: Behavioural addictions, such as internet gaming or gambling disorder, are recognised in the Diagnostic and Statistical Manual of Mental Disorders (DSM‑5).

They involve compulsive engagement despite negative consequences. While “AI addiction” is not yet a formal diagnosis, the Venice case suggests that interacting with a conversational AI can satisfy criteria for behavioural addiction: impaired control, craving, and continuation despite harm.

Clinicians must therefore determine whether existing diagnostic categories suffice or whether a new classification is needed.

Healthcare providers owe patients a duty to diagnose and treat mental disorders. When an AI system causes harm, questions arise about whether the system's provider could be liable.

Under the EU Product Liability Directive, producers are strictly liable for defects that cause physical injury. Psychological harm is less clearly covered, but consumer protection laws could apply if the AI marketed itself as a well‑being tool and failed to warn users of addictive risks.

Italy’s consumer code prohibits unfair commercial practices and could be used to hold developers accountable for designing interfaces that are addictive.

2. arXiv’s one‑year ban for AI‑generated hallucinations in publications

Researchers and students widely rely on arXiv to circulate preprints.

On 15 May 2026, Thomas Dietterich, chair of arXiv’s computer science section, announced a new enforcement policy: if a submission contains clear evidence that the authors did not check language‑model output, such as hallucinated references or leftover prompts, the entire author team faces a one‑year ban, after which any subsequent submission must first be accepted by a peer‑reviewed journal.

Dietterich explained that arXiv’s code of conduct already states that authors are fully responsible for their content regardless of how it was generated; the new penalty gives that principle teeth.

Examples of “incontrovertible evidence” include:

1. Fake citations, meta‑comments such as “here is a 200‑word summary, would you like me to make any changes?” and

2. Tables containing placeholder data with instructions to the author.

Any such slip makes the entire paper untrustworthy, hence the one‑strike rule.

ArXiv’s policy responds to an explosion of AI‑generated content in scientific publishing. According to a recent study, fabricated citations have risen 12-fold since 2023; in early 2026, one in 277 papers contained at least one fake reference.

Subscribe now

The surge correlates with widespread use of language models. Such errors propagate through citations and risk infecting downstream research.

ArXiv’s volunteer moderation system is not equipped to detect AI‑generated slop at scale, so the ban targets the most egregious cases.

Researchers may worry that using AI tools could expose them to penalties. Importantly, the policy does not ban AI outright. It acknowledges that authors may use AI for drafting or editing, provided they verify the output.

The key issue is scientific integrity. Authors must represent that they have reviewed and stand behind their work.

This resonates with AI misuse in legal practice, where US and UK judges have sanctioned lawyers for citing hallucinated cases.

In legal scholarship, mis‑citations could mislead courts and policymakers.

The arXiv penalty could therefore serve as a model for law journals and courts: a clear sanction deters irresponsible AI use without stifling legitimate assistance.

3. OpenAI offers ChatGPT Plus to Malta residents for free

On 17 May 2026, Malta announced a groundbreaking partnership with OpenAI. Every citizen and resident will receive a year of ChatGPT Plus free of charge after completing an AI literacy course.

The programme, dubbed AI for All, is delivered by the University of Malta and aims to teach participants what AI is, what it can and cannot do and how to use it responsibly.

Once they finish the online course, participants receive twelve months of ChatGPT Plus at no cost, including Maltese citizens living abroad.

The Malta Digital Innovation Authority manages access, and the scheme scales as more people complete the course. Government officials said the initiative is designed to transform an unfamiliar technology into practical assistance for families, students and workers.

The partnership comes amid litigation. In March 2026, Elon Musk sued OpenAI and Sam Altman, alleging breach of the company’s founding mission. It can be speculated that offering free subscriptions helps build goodwill.

We covered the ongoing OpenAI case of Elon Musk v. Sam Altman in our previous weekly briefing lead story.

Technology Law

Weekly Briefing: Elon Musk v. Altman in Court, Meta Ads Scam, Cyber-slavery in Cambodia, Attorney in Trouble for Using Fake AI Sources

Read more

6 months ago · 17 likes · 2 comments · Technology Law

Regardless of motivations, Malta’s programme could become a template for other countries.

If successful, it may inform how countries integrate AI into education and public services.

Conversely, if data breaches or misuse occur, it could prompt calls for stronger AI governance. For now, the scheme emphasises education and responsible adoption.

Case of the Week

Parties: Meta Platforms Ireland (Fair compensation)
Court: Judgment of the Court in Case C-797/23 (CJEU)

Facts and dispute

The dispute arose from Italian legislation implementing the EU Copyright in the Digital Single Market Directive (Directive 2019/790).

The law created a system requiring online service providers to pay publishers fair remuneration for using press publications on the internet.

Under this system, service providers must negotiate payments with publishers, provide relevant usage and revenue data, and refrain from reducing content visibility during negotiations. The Italian Communications Regulatory Authority (AGCOM) can set remuneration criteria, resolve disputes, and impose penalties.

Meta Platforms Ireland (Facebook’s European subsidiary) challenged AGCOM’s implementation of the law before an Italian administrative court. Meta argued that the Italian rules exceeded what EU law allows, infringing its freedom to conduct a business and misapplying the directive.

The Italian court referred questions to the Court of Justice of the European Union (CJEU) under the preliminary ruling procedure, asking whether the Italian system is compatible with EU law.

Legal issue and question

The core issue before the court was whether EU member states may impose a compulsory remuneration scheme on platforms for the online use of press publications and require negotiations without restricting content visibility.

Does such a system go beyond the rights and obligations established by the directive?

Meta argued that requiring payment irrespective of consent conflicts with Article 15 of Directive 2019/790, which grants publishers a related right to authorise or prohibit online use. It also claimed that mandatory negotiation and data‑sharing obligations unjustifiably restrict business freedom.

Decision

On 12 May 2026, the CJEU ruled that member states may enact systems that entitle publishers to fair remuneration for the use of their publications online, provided the payment is linked to authorisation.

Publishers must have the option to refuse authorisation or grant it free of charge, and no payment may be required when a platform does not use the publication.

The Court held that obligations to negotiate, to supply usage data and to avoid reducing visibility are permissible because they support a fair marketplace for copyright and help publishers recoup their investments.

While these obligations restrict the freedom to conduct a business, the Court found the limits justified and proportionate to the objectives of intellectual property protection and media pluralism.

Wider implications

The ruling affirms that EU law allows member states to strengthen publishers’ rights beyond the minimum floor set by the directive, as long as those measures respect the core rights — namely the ability to authorise use.

It clarifies that platforms cannot be required to pay when they do not host or index press content, and that publishers may choose to license content for free.

The decision supports the CJEU’s willingness to balance property rights with business freedoms. AGCOM’s authority to set remuneration criteria, decide disputes and impose penalties is validated.

Platforms operating in Italy and other EU countries may need to negotiate with publishers and share usage data. The case is particularly relevant for news aggregators, search engines and social networks.

What about platforms like Substack?

The ruling does not automatically apply to platforms hosting user‑generated newsletters. If a platform like Substack merely hosts content uploaded by publishers themselves, it is usually authorised.

The fair compensation requirement matters only when a platform uses third‑party press publications without permission, such as by displaying previews, recommendations or summaries that reproduce substantial extracts.

Leave a comment

In such cases, Substack may need to negotiate payments under national transpositions of the directive. For ordinary linking or short excerpts, fair use exceptions may apply.

Writers posting their own newsletters remain unaffected; they are for the publisher and the authorising party.

Other Developments in Technology Law

1. The European Union ratifies the Council of Europe Framework Convention on Artificial Intelligence

On 15 May 2026, during the 135th Session of the Council of Europe’s Committee of Ministers in Chișinău, the European Union ratified the Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law.

The convention, adopted in 2024, is the first legally binding international treaty on AI.

It provides a legal framework covering the entire lifecycle of AI systems and aims to ensure that AI use is consistent with human rights, democracy and the rule of law. It promotes responsible innovation, is technology‑neutral and is open to non‑European countries.

As of now, signatories include the EU, the UK, the United States and several other non‑member states.

The convention will enter into force once five signatories, including three Council of Europe members, ratify it.

2. Automated Vehicles Act 2024 (Commencement No. 2) Regulations 2026

The UK government is gradually bringing the Automated Vehicles Act 2024 into force. The Commencement No. 2 Regulations 2026, signed on 20 April 2026, bring Part 5 of the Act (permits for automated passenger services) into effect on 15 May 2026.

Part 5 creates a permit scheme for services using automated vehicles, such as taxis, private hire cars, shuttles, and buses.

Operators must obtain permits before running such services, and future regulations will detail safety requirements, passenger protections and information sharing. Sections 84 and 89, which relate to civil sanctions, have not yet commenced.

Will this permit regime apply to Full Self‑Driving services, such as Tesla’s proposed robotaxi fleet? Not immediately. A vehicle must first be recognised as an authorised automated system under UK law.

Subscribe now

Operators would then need a permit under Part 5, satisfy safety and passenger‑protection rules and ensure that the infrastructure communicates with the vehicle.

Because the regulations are tailored to passenger services operating on defined routes and under specific conditions, widespread robotaxi services will require additional approvals. The current commencement is therefore a step toward regulatory readiness, but not a green light for full self‑driving deployment.

3. HMRC to use AI for tax fraud detection

On 14 May 2026, the UK’s HM Revenue and Customs (HMRC) awarded a £175 million, ten‑year contract to London‑based AI company Quantexa to overhaul its data infrastructure and detect tax fraud.

The contract marks a deliberate move away from reliance on American surveillance company Palantir and demonstrates the government’s desire for sovereign AI.

Quantexa’s platform will unify HMRC datasets, use graph analytics to identify patterns of tax fraud and evasion, and support customer service operations.

Quantexa founder Vishal Marria stressed that automated decisions would still require human oversight and that HMRC data would remain inside the tax authority’s environment.

Linking fragmented tax datasets could help HMRC spot hidden networks of companies and individuals, close the £46.8 billion tax gap and improve response times to taxpayers.

However, using AI in tax enforcement raises questions under the GDPR.

Automated processing of financial data constitutes profiling, and Article 22 grants individuals the right not to be subject to decisions based solely on automated processing.

HMRC asserts that humans will verify AI‑flagged cases, which may fall under the GDPR’s legitimate interests exception (Recital 47), which allows data processing for fraud prevention.

However, there remain concerns about false positives and algorithmic transparency. Misclassification could lead to withheld refunds or penalties, placing burdens on taxpayers to contest AI‑generated suspicions.

Public law principles of fairness require HMRC to provide reasons for decisions and allow appeals. The Information Commissioner’s Office may scrutinise the deployment to ensure compliance.

The contract is part of the UK’s Sovereign AI initiative, funded with £500 million to support domestic AI champions. It follows criticism that government data contracts with Palantir have exported control of sensitive information.

Subscribe now

Quantexa, a British company with early roots in anti‑money‑laundering, demonstrates that the UK aims to build its own AI infrastructure.

If successful, the deal may set a precedent for other departments, from healthcare to border control, to adopt domestic AI solutions. If the project fails or produces high false‑positive rates, sceptics will argue that only established giants can handle public‑sector data problems.

Latest Opportunities

Remote jobs in technology law

1. TKYC Analyst (Remote Canada/US), Avantia: An AI-first legal and compliance services provider. As a Transaction KYC Analyst, you will work alongside asset managers’ legal, compliance, and investment teams to help bring complex private equity deals to completion (find out more).

2. Regulatory Counsel (Remote Türkiye), Binance: A leading global blockchain ecosystem behind the world’s largest cryptocurrency exchange by trading volume and registered users. Assist with legal and regulatory matters related to financial products and services in the FinTech, crypto, and blockchain sectors (find out more).

3. Product Manager (Remote Japan), BoostDraft: BoostDraft is a software engineering company that develops IDEs for documents. Currently seeking Lawyers who draft relatively standardised but long documents, such as contracts (find out more).

4. Counsel, Applied Legal Research (Remote Singapore), Centari: Centari is hiring a transactional lawyer for its Applied Legal Research team to help develop AI tools for corporate legal work, combining expertise in corporate transactions, legal analysis and generative AI product development (find out more).

5. Legal Expert (Remote UK), YO IT: A remote‑based legal expert role advertised by a UK consultancy seeks professionals with expertise in technology law and digital regulation (find out more).

Conferences, fellowships, events and calls for papers.

6. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words. (find out more).

7. Free Microsoft Virtual Training Day: Protect Sensitive Information in the AI Era with Microsoft Purview (4 and 5 June 2026): Explore how Microsoft Purview identifies and labels sensitive data, enforces DLP policies across endpoints and cloud apps, and helps detect insider risks with Adaptive Protection. The session also covers Purview DSPM for deeper visibility into data exposure and AI interactions. Complete the training to receive 50% off the Information Security Administrator Associate exam. (find out more).

8. AI, Justice and the Rule of Law (Free Course): UNESCO and the University of Oxford are offering a free self‑paced online course launched on 27 April 2026 to equip judges, lawyers and students with an understanding of how AI interacts with human rights and legal reasoning (find out more).

Final Summary

AI regulation is quickly moving from abstract principles to concrete legal obligations. Google’s revelation of an AI‑generated zero‑day exploit shows that malicious actors are already weaponising generative AI models.

The AI addiction case reminds us that AI systems can harm psychological health, forcing lawmakers to consider mental‑health impacts when regulating digital services.

ArXiv’s one‑year ban for hallucinated references demonstrates that professional communities are willing to impose severe penalties to maintain trust.

Government initiatives, whether Malta’s national ChatGPT rollout or HMRC’s sovereign AI contract, illustrate that public‑sector adoption is accelerating despite unresolved questions about privacy, liability and fairness.

The coming years will require careful balancing of innovation with the protection of rights. Now is the time for informed, inclusive debate and for building institutions capable of governing AI responsibly.

Leave your comments to join the conversation.

Leave a comment

The Honest Truth about Digital IDs

The subject of digital identity (“Digital ID”) resonates with everyone because, at some point, we have all had to prove who we are, and we will eventually need to do so more often as public life and commerce migrate into electronic systems that demand confidence in our credentials.

We need to journey through the current state of digital ID in the European Union and the United Kingdom, as they are actively developing this infrastructure. Indeed, the subject is controversial because it sits at the junction of personal autonomy, privacy, government authority and commercial convenience, but it needs to be addressed objectively.

The European Union has spent years developing a framework for digital ID wallets that emphasises user control and cross‑border compatibility, while the United Kingdom is proposing a national digital ID scheme that has triggered a widespread public debate.

In this newsletter edition, we will look at the legal frameworks, the promises of convenience and efficiency, the technical and governance innovations such as zero‑knowledge proofs, and the deep concerns about surveillance and cultural acceptance.

The European Union: The Right to a Digital Identity

The European Union laid the foundation for digital IDs with Regulation (EU) No 910/2014 on electronic identification and trust services, commonly referred to as the eIDAS Regulation. In April 2026, the Regulation was amended by Regulation (EU) 2024/1183, which created what is now known as the European Digital Identity Framework.

The legal framework establishes that everyone in the EU has the right to a digital identity under their sole control, enabling them to exercise their rights in the digital environment and participate in the digital economy. It also sets out the requirements for qualified trust service providers.

At the centre of this framework are the European Digital Identity Wallets.

These wallets allow natural (individuals) and legal persons (e.g., companies) to access services across Member States while ensuring the protection of personal data and privacy through secure digital identification.

This is an ambitious project on the surface. A common identity infrastructure that spans national boundaries, yet remains under the control of the individual, hopefully.

The official European Commission description of the Digital Identity Wallet emphasises its functionality.

The wallet is intended to enable users to access:

Read more

Technology law is entering a more confrontational phase. Governments are no longer treating AI as a neutral productivity tool but as a system capable of influencing constitutional rights, criminal investigations, healthcare, public trust, and democratic authority itself. This edition examines the EU’s decision to delay parts of the AI Act while expanding prohibitions, Canada’s findings against OpenAI’s data practices, the constitutional implications of geofence warrants before the U.S. Supreme Court, and the growing normalisation of AI within policing and surveillance institutions. Greece’s proposal to constitutionalise AI oversight and the UAE’s expansion into AI-driven legal services.

Share this newsletter

Newsletter Edition 95

🔥 This edition includes many important technology law news and updates from the EU, U.S., Canada, U.A.E, Greece and other jurisdictions. Also, keep reading to view the latest opportunities, including free courses, events, scholarships, and a list of remote tech lawyer jobs.

Lead Story

EU leaders agree to amend the EU AI Act: Deal reached on the AI Omnibus Regulation

On 7 May 2026, the Council of the European Union and the European Parliament announced a provisional political agreement to amend the EU AI Act.

The amendments, negotiated as part of a digital omnibus package, do not alter the AI Act's underlying structure but adjust the timelines for certain obligations and tighten prohibitions on specific AI practices.

Key elements of the provisional agreement

• Deferred application of high‑risk obligations. Under the current AI Act, high‑risk obligations for use cases listed in Annex III, such as biometric identification, critical infrastructure, education, employment, law enforcement and border management, would apply from 2 August 2026. The provisional agreement pushes these obligations to 2 December 2027, giving additional time for implementation. AI components that are safety parts of sectoral products (Annex I) will now be enforced from 2 August 2028, rather than 2 August 2027. These dates are fixed regardless of the availability of harmonised standards.

• Watermarking and generative AI output detection. A new deadline of 2 December 2026 will apply to generative AI providers obligated to detect and watermark AI‑generated content. This postponement aims to align with the development of technical tools and standards while ensuring that generative systems remain traceable.

• Prohibition of “nudifier” apps and AI‑generated child sexual abuse material (CSAM). The agreement explicitly bans AI systems that generate non‑consensual intimate imagery or CSAM. Providers must comply with this prohibition by 2 December 2026. The ban addresses concerns over tools that digitally remove clothing or synthesise exploitative images without consent.

• Registration and transparency requirements. Providers of “exempted” AI systems — systems originally classified as high‑risk but deemed low risk through derogations — must continue to register their models in the EU’s public database, albeit with simplified information requirements. Meanwhile, high‑risk providers still need to conduct conformity assessments, maintain documentation and provide risk management systems.

• Bias detection using sensitive data. The amendment broadens the scope for using sensitive personal data (for example, data revealing racial or ethnic origin) to detect and correct biases in AI systems, but processing must be strictly necessary and limited to addressing specific bias types. This reflects the EU’s recognition that accurate bias detection sometimes requires access to sensitive attributes.

• Other clarifications. The omnibus removes overlapping obligations for AI embedded in machinery products, narrows the concept of “safety components” and centralises enforcement of certain general-purpose AI systems under the EU AI Office. It also reduces the volume of information required for registration and tasks the Commission with issuing guidance on classification.

What are the implications of these changes?

The provisional agreement preserves the EU’s risk‑based framework while giving organisations more time to prepare for high‑risk obligations and generative AI watermarking.

Subscribe now

The explicit ban on “nudifier” tools and AI‑generated CSAM shows regulators taking a firm stance on preventing abuse.

The deferral should not be seen as a reprieve; organisations developing or deploying AI must continue building compliance programmes and documenting risk management.

Once finalised and formally adopted, these amendments will mark the first major adjustment to the world’s most comprehensive AI regulation.

Technology Law Tracker

1. Department of War releases UFO and UAP files: what does space law say

On 8 May 2026, the U.S. Department of War (DoW) published more than 160 previously classified files related to unidentified anomalous phenomena (UAP) and unidentified flying objects (UFOs).

The release follows President Donald Trump’s directive to increase transparency about UAPs and directs the DoW, in collaboration with the Office of the Director of National Intelligence, to declassify unresolved cases.

The files include photographs, videos and transcripts of Apollo missions. Notably, they capture, among other things, an alleged 1947 report of “flying discs” and transcripts from Apollo 12 and 17, where astronauts observed bright particles and unusual phenomena.

The DoW emphasised that these cases remain unresolved because they lack sufficient data for definitive conclusions, and it invited private‑sector researchers to examine the materials.

Although some commentators and enthusiasts hoped that the release would confirm extraterrestrial life, the files provide no conclusive evidence of alien technology.

Critics have suggested the release may deflect attention from terrestrial military spending or other policy issues.

Nonetheless, the disclosure presents a useful moment to revisit international space and technology law.

Space law context

The Outer Space Treaty of 1967, the foundation of international space law, outlines several principles relevant to UAP disclosures. It stipulates that the exploration and use of outer space must benefit all countries; outer space and celestial bodies cannot be appropriated by states; and activities must be conducted for peaceful purposes.

States are responsible for national space activities and liable for damage caused by their space objects. The treaty also emphasises the need to avoid harmful contamination and to recognise astronauts as envoys of mankind.

If future evidence shows that UAPs originate from human technology (for example, secret military spacecraft), questions could arise about compliance with the treaty’s prohibition of weapons of mass destruction in orbit and the requirement that celestial bodies be used exclusively for peaceful purposes.

Conversely, if extraterrestrial origin were ever substantiated, states would need to consider how the “province of all mankind” principle applies to contact with non‑state entities.

The release, therefore, encourages jurists to think beyond speculation and to consider whether existing frameworks adequately regulate unknown phenomena.

Transparency and governance

The DoW’s release also highlights how governments balance national security with public interest. The files were previously withheld due to classification. Transparency advocates argue that withholding information can fuel conspiracy theories and undermine trust.

Declassifying unresolved phenomena carries its own risks: adversaries could infer U.S. surveillance capabilities, or citizens could misinterpret ambiguous data. Future disclosures may require international coordination to ensure that released information aligns with obligations under space treaties and fosters collaborative research rather than unilateral narratives.

2. Greece proposes a constitutional amendment on AI

Greece, historically known as the birthplace of democracy, has proposed a constitutional amendment that would explicitly mention artificial intelligence.

Prime Minister Kyriakos Mitsotakis explained that the amendment aims to ensure that AI serves human freedom and social prosperity, while mitigating risks. He emphasised that AI should not undermine individual rights, democratic processes or equal access to public services.

Leave a comment

Why a constitutional amendment?

For years, governments, including the EU, have approached AI regulation through the lens of consumer protection, including mandating transparency disclosures, creating risk categories and imposing fines for non‑compliance.

Greece’s proposal goes further by positioning AI as a matter of constitutional order. This reflects an emerging consensus that AI is not just a consumer product but a public governance tool.

AI systems influence elections, policing, welfare administration, tax systems and border control. When AI begins to impact state power, fundamental constitutional principles (dignity, proportionality, equality and due process) become relevant.

Constitutions are designed to restrain power and protect individuals; in the digital age, this restraint must cover both government use and private platforms that operate as gatekeepers of information.

Details of the proposal

Although the exact text of the amendment has not been finalised, it will likely include a clause stating that AI must respect human dignity and fundamental rights and that Parliament may regulate AI to protect democratic order.

Greece is already experimenting with AI in border surveillance, tax administration and other public services.

Lawmakers hope that embedding AI principles into the constitution will provide a foundation for future legislation and judicial interpretation.

Global implications

If adopted, Greece’s constitution would be among the first to explicitly address AI. It could influence discussions within the EU and beyond.

For example, the EU’s AI Act regulates AI through ordinary legislation; a constitutional clause adds an additional layer of protection that cannot be easily amended.

3. Joint investigation into OpenAI’s data processing practices

Canada’s privacy regulators have been at the forefront of scrutinising large AI models. On 25 April 2026, the Office of the Privacy Commissioner of Canada (OPC), along with the privacy commissioners of Québec, British Columbia and Alberta, released a joint report on their investigation into OpenAI’s data practices.

The investigation began with a complaint regarding ChatGPT’s handling of personal information during training and in user interactions.

Key findings

OPC concluded that OpenAI’s initial training of ChatGPT contravened Canadian privacy law. OpenAI collected and used personal information from publicly accessible websites without valid consent and did not provide sufficient transparency about its practices.

According to the report, OpenAI lacked a legal basis under federal and provincial laws for processing personal data. The investigation also criticised OpenAI for failing to adequately address accuracy and accountability issues, such as providing users with incorrect or biased information.

Subscribe now

OpenAI cooperated with the investigation and implemented several measures throughout the investigation. These include limiting the use of personal information in training, removing sensitive data from datasets, publishing a blog post about privacy practices, retiring older models such as GPT‑3.5 and 4, and improving procedures for individuals to challenge inaccurate outputs.

OpenAI also committed to implementing additional measures in the coming months, such as better consent mechanisms and data retention policies.

The Privacy Commissioner of Canada found the complaint well‑founded but conditionally resolved because the corrective measures addressed the primary concerns.

Québec’s commissioner emphasised that implied consent is inadequate when the collection or use of information is outside individuals’ reasonable expectations, involves sensitive data or creates a meaningful risk of harm. The regulators concluded that modern privacy laws need to catch up with generative AI models and called for legislative reform.

What do AI developers need to do?

Training AI models on public data does not automatically exempt organisations from privacy obligations. Consent must be meaningful, and individuals should have mechanisms to verify, correct or delete their data from training datasets.

Organisations operating in multiple jurisdictions face a patchwork of privacy laws; Canada’s case shows that provincial commissioners can jointly investigate AI developers and impose compliance commitments.

Developers should build privacy into their designs, minimising data collection and ensuring explicit consent where required.

Case of the Week

Litigants: United States v. Chatrie
Citation: 136 F. 4th 100 (4th Cir. 2025), cert. granted, 2026 WL 120676 (U.S. Jan. 16, 2026) (No. 25-112)

Facts and dispute

On 8 July 2019, a bank in Richmond, Virginia, was robbed. As part of their investigation, police obtained a “geofence warrant” compelling Google to provide information on all devices that had been within a 150‑metre radius of the bank around the time of the robbery.

Google responded with anonymised location data for dozens of devices. Investigators then asked Google to expand the time frame and requested more specific data on nine accounts (Step 2), followed by subscriber information for three accounts (Step 3) that matched suspect movements. Police identified Okello Chatrie as one of the device owners and charged him with robbery.

Subscribe now

Chatrie moved to suppress the evidence, arguing that the geofence warrant violated the Fourth Amendment. The U.S. District Court for the Eastern District of Virginia agreed that the warrant was overly broad because it gathered data on many innocent individuals and allowed investigators to narrow results without judicial oversight.

However, the court declined to suppress the evidence due to the “good faith” exception.

On appeal, a divided panel of the Fourth Circuit held that Chatrie lacked a reasonable expectation of privacy in his location data because he voluntarily carried a smartphone and had location services enabled. The full Fourth Circuit was evenly split en banc, leaving the panel decision intact.

Legal issues and questions before the Supreme Court

The central question was whether geofence warrants, which compel companies to disclose location data for all devices in a defined area during a specified time, satisfy the Fourth Amendment’s probable cause and particularity requirements.

Traditionally, warrants must specify the person or place to be searched and the items to be seized. In the Chatrie case, the warrant targeted an area and time period rather than a particular suspect. It could be argued that it functioned more like a general warrant by casting a digital dragnet over dozens of individuals. Supporters may counter that geofence warrants are a necessary investigative tool in the digital era and that anonymisation, combined with judicial oversight, minimises intrusions.

It is anticipated that the court may issue a narrow ruling focusing on whether additional judicial oversight is needed during the multi‑step narrowing process rather than banning geofence warrants outright.

The multi‑step process—where investigators request anonymised data, then expand or narrow the time frame, and finally seek subscriber information—may be seen to lack separate warrants or judicial review after the initial authorisation.

The Court may address whether each step constitutes a separate search requiring independent probable cause and whether general warrants are permissible in the digital context.

Decision and potential impacts

At the time of writing, the Supreme Court has not issued its decision. If the Court upholds the warrant, law enforcement agencies will continue to use geofence warrants with minimal changes.

However, if the Court rejects the warrant as unconstitutional, it could limit or eliminate the use of geofence warrants nationwide. This would require law enforcement to develop alternative investigative methods and may lead to new privacy protections for location data.

Leave a comment

A narrow decision might require courts to oversee each step of a geofence search, ensuring that investigators cannot unilaterally narrow or expand data sets without additional warrants.

Such a ruling could also impact other general data warrants, such as those for cell‑site location information or IP addresses. Regardless of the outcome, Chatrie will likely shape the future of digital privacy law and clarify how constitutional protections apply to novel surveillance techniques.

Other Developments in Technology Law

1. Ashley MacIsaac sues Google over AI Overview mix‑up

Canadian fiddle virtuoso Ashley MacIsaac filed a defamation lawsuit against Google after the company’s AI Overview product falsely asserted that he had been convicted of sexual crimes.

According to the statement of claim, AI Overview summarised search results by saying MacIsaac had committed sex crimes and was convicted of sexual assault; the information was entirely false and not present in the sources that the AI summarised. MacIsaac learned of the defamatory statement when a concert venue cancelled a performance and later discovered that the AI system repeated the false allegations across various queries.

The lawsuit seeks at least USD 1.5 million in damages. MacIsaac’s lawyers argue that Google should be held liable for the statements generated by its AI because the system functions as a publisher and presents its outputs as factual summaries.

Google responded that AI Overviews are dynamic and automatically generated. Google eventually removed the erroneous summary and said it uses such incidents to improve its models.

The case raises questions about whether AI companies can be liable for defamation when their models produce false statements based on training data.

It also illustrates how AI summarisation tools can amplify inaccuracies and cause reputational harm. Courts will somehow need to consider whether existing defamation law applies to machine‑generated speech and whether AI providers have a duty to pre‑screen outputs for accuracy.

2. UAE’s AI‑powered legal platform Legaline launches

Dubai‑based Legaline, launched on 6 May 2026, touts itself as the first full‑cycle AI‑native legal services platform in the United Arab Emirates. The company developed its own AI stack using in‑house machine‑learning and neural‑network engineering and built a corpus of more than 60 000 searchable legal passages.

Legaline is designed for the complex UAE legal environment, covering federal laws, seven emirate‑level systems, the Dubai International Financial Centre (DIFC), the Abu Dhabi Global Market (ADGM) and more than 40 free zones. Its AI supports research across 33 jurisdictions and offers real‑time translation among English, Russian and Arabic.

The platform combines multiple tools: a public AI information assistant called “Baby Legal Bot” that helps users understand regulatory jurisdictions; an AI research assistant for lawyers with inline citations; an AI deliberation tool called “Brainstorm” that uses different foundation models to generate analytical diversity; and an automated document drafting module generating commercial documents within seconds while including references to current laws.

Subscribe now

Legaline also integrates an end‑to‑end workflow where clients post tasks, lawyers bid through a closed auction, negotiation and signing occur in an in‑app chat, and payment is held in escrow until completion. The company emphasises that its AI tools are trained exclusively on primary UAE legal sources and that user data is not used to train models.

3. Kash Patel and the normalisation of AI in law enforcement

FBI Director Kash Patel has become a prominent advocate for AI in law enforcement. In a recent interview, he claimed that AI was not used at the FBI until the current administration and that he is now “using it everywhere.”

Patel credited AI with stopping a potential school shooting in North Carolina and another in New York by quickly analysing tips and triaging threats. He also said AI has enabled the FBI’s National Threat Operations Center to sift through thousands of weekly tips and to “pop fingerprints immediately” in its criminal databases.

According to Patel, the FBI has embedded major tech companies into its infrastructure to build AI tools and modernise its systems.

While Patel portrays AI as a force multiplier, his comments illustrate a broader trend which is the rapid integration of AI into law enforcement without broad public deliberation.

The ability to triage tips and match fingerprints quickly can help prevent crimes, but it also raises concerns about due process, bias, accountability and transparency. When AI tools screen large volumes of data, there is a risk of false positives that can lead to unwarranted scrutiny.

Many predictive policing systems have been shown to reflect and magnify existing biases in data.

Critics worry that normalising AI in law enforcement could entrench opaque surveillance techniques and reduce human oversight.

Technology Law

Predictive Policing Is Making Marginalised Communities Live Under Permanent Suspicion

Predictive policing has turned suspicion into a routine administrative category that follows people long before any conduct occurs, and it is astonishing how easily this practice has been accepted as a normal feature of public safety. The idea that an algorithm can pre-assign risk to entire neighbourhoods and individuals has been absorbed into policing …

Read more

a year ago · 16 likes · 7 comments · Technology Law

The U.S. legal framework has not kept pace with AI’s proliferation in policing. Unlike sectors such as healthcare or finance, law enforcement often employs AI without sector‑specific regulation. Chatrie v. United States, discussed above, indicates how new surveillance methods challenge constitutional protections.

Democratic institutions must examine whether traditional oversight mechanisms suffice. Questions include: should AI‑generated leads be subject to judicial review before action is taken? How can agencies ensure that training data does not encode racial or socio‑economic bias? How should AI vendors be vetted for law enforcement use? Policy makers must engage with these issues to avoid normalising AI surveillance without legal safeguards.

Latest Opportunities

Remote jobs for lawyers

1. Enterprise Account Executive DACH, Legal Tech, €80k base + 100% OTE (Remote Germany): DACH region Enterprise Account Executive to lead enterprise sales strategy, contract negotiations, and customer growth (find out more).

2. Counsel, Applied Legal Research (Remote Singapore): Centari is hiring a transactional lawyer for its Applied Legal Research team to help develop AI tools for corporate legal work, combining expertise in corporate transactions, legal analysis and generative AI product development (find out more).

3. Legal Expert (Remote UK): A remote‑based legal expert role advertised by a UK consultancy seeks professionals with expertise in technology law and digital regulation (find out more).

4. Junior/Mid AI Legal Specialist, EverAI (Remote UK): This role is aimed at lawyers or legal specialists interested in AI governance and product support (find out more).

Conferences, fellowships, scholarships, and calls for papers

5. Full scholarship (PhD & Postdoc): AI, medical law and ethics (The University of Amsterdam, Netherlands): Two fully funded PhD positions and one postdoctoral role in AI, medical law and ethics. Projects cover generative AI in healthcare and fairness in medical AI. Applications closes 18 May 2026, with a September 2026 start (find out more - PhD and Postdoc).

6. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words. (find out more).

7. Free Microsoft Virtual Training Day: Introduction to Azure (18 May 2026): Microsoft’s free virtual event offers a foundational overview of cloud concepts, core Azure services across compute, networking, storage and identity and demonstrates AI tools. Participants who complete the session receive a 50 percent discount on the Azure Fundamentals certification exam (find out more).

8. AI, Justice and the Rule of Law (Free Course): UNESCO and the University of Oxford are offering a free self‑paced online course launched on 27 April 2026 to equip judges, lawyers and students with an understanding of how AI interacts with human rights and legal reasoning (find out more).

This edition of weekly briefing highlight a growing problem between innovation and regulation.

Europe is attempting to reform its AI Act to balance technological progress with fundamental rights, while Greece proposes embedding AI principles into its constitution. Canada’s regulators are reprimanding AI developers that privacy obligations apply even when data is publicly available.

AI is gradually becoming pervasive, but we must insist that it serves human dignity, accountability and the rule of law.

Leave your comments to join the conversation.

Leave a comment

Disclaimer

This newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the authors alone.

This week’s briefing report examines the Musk v. Altman dispute over AI governance and organisational restructuring; regulatory failures exposed by South Africa’s withdrawal of its AI policy; Cambodia’s aggressive cybercrime response to cyber-slavery; and rising sanctions for AI-generated legal errors, revealing systemic weaknesses in oversight, incentives, and professional responsibility.

Share this newsletter

Newsletter Edition 94

🔥 This edition includes many important technology law news and updates. Also, keep reading to view the latest opportunities, including free courses, events, and a list of remote tech lawyer jobs.

Lead Story

Elon Musk v. Altman: the case so far

The courtroom battle between Elon Musk and OpenAI’s co‑founder, Sam Altman, has captivated observers of AI and corporate governance. Elon, who invested tens of millions of dollars in the early days of OpenAI, claims that the organisation betrayed its charitable mission by spinning out a for‑profit arm and selling equity to investors.

At stake is not only the fate of a generative‑AI powerhouse, but also questions about donor intent and the governance of technology nonprofits.

Background and legal claims

Elon co‑founded OpenAI in 2015 as a nonprofit research lab, pledged to develop artificial intelligence for the benefit of humanity. Elon Musk and other donors, including Peter Thiel and Reid Hoffman, contributed funds with the understanding that OpenAI would remain non‑profit and open.

As computing demands grew, the board created a for‑profit subsidiary in 2019 and allowed investors to purchase capped equity. The restructure attracted billions of dollars from Microsoft and other investors, enabling OpenAI to build large language models such as GPT‑4.

Elon alleges the shift to a for‑profit entity violated the original charter and seeks the removal of Altman and unwinding of the structure. OpenAI counters that Musk knew about the plan and that the restructure was necessary to fund the expensive research.

Leave a comment

What are the economic stakes?

The case could impact OpenAI’s valuation, which climbed to roughly $80 billion after recent funding rounds. A judgment in Elon Musk's favour could force the organisation to revert to a nonprofit model or return donor funds, potentially derailing its initial public offering.

It has been noted that the cost of training cutting‑edge AI models can exceed hundreds of millions of dollars, making purely charitable funding impractical. This case reinforces the tension between mission and commercialisation.

While Elon Musk contends that AI safety requires nonprofit stewardship, Altman argues that the investment structure allowed them to compete with corporations such as Google and Meta.

What happened in court?

During the first week of the trial, the judge repeatedly emphasised that the case was about alleged deception. Elon Musk’s team attempted to argue that unrestricted AI posed an existential threat, but the judge directed them to focus on whether Musk had been misled about the restructure.

Elon testified that he discovered the for‑profit arm only after the fact and that he never consented to it.

Under cross‑examination, however, lawyers presented emails suggesting Elon was aware of the new structure. Elon also admitted that his new company, xAI, uses OpenAI models and described his company as socially beneficial.

The defence argued that Musk left the board before the restructure and that he previously praised hybrid models similar to those adopted by competitor Anthropic.

Wider implications

The trial has become a proxy battle over AI governance. It is natural to worry that a sweeping verdict could discourage philanthropy in cutting‑edge science/tech if donors can later unwind corporate decisions.

On the other hand, nonprofit advocates argue that donors have a right to ensure their contributions are used as promised.

The case also surfaces conflicts of interest: Elon Musk now heads xAI, a competing AI company, and has indicated he would invest personally if OpenAI remains nonprofit.

This trial could open the door to similar claims by other donors and test whether creative corporate structures, such as capped‑profit entities, can satisfy charitable obligations.

Subscribe now

What happens next?

The trial is expected to last several weeks (or months), with testimony from Altman, board members, and experts on charitable law. Even if Elon prevails, it is unlikely the court will unwind the entire restructuring, as investors, including Microsoft, may negotiate settlements.

If Altman’s camp wins, it could strengthen hybrid models for AI research and solidify OpenAI’s path to a public offering.

Regardless of the outcome, the case will shape conversations about governance of AI labs and the responsibilities of tech philanthropists.

Technology Law Tracker: Other Significant Updates

1. Meta: a playground for scammers?

A class‑action complaint filed by the Consumer Federation of America (CFA) accuses Meta Platforms of turning its social media advertising system into what plaintiffs call a “pillar of the global fraud economy.”

The lawsuit, filed under Washington, D.C.’s consumer protection law, alleges that between 2021 and 2023, consumers lost at least 2.7 billion US dollars to scams on platforms like Facebook and Instagram.

Internal documents cited in the complaint purportedly show that Meta managers knew that a significant percentage of advertising revenue came from scam or high‑risk advertisers and that the company charged those advertisers higher rates rather than banning them.

The CFA claims Meta calculated that more than one-third of scam victims interacted with ads on its platforms and that the company collected around 16 billion US dollars from scam and banned‑goods ads during the period.

The lawsuit alleges that Meta publicly promoted its anti‑scam efforts while privately deeming certain advertisers “high value accounts” and granting them special leniency; such accounts could accumulate hundreds of strikes before being removed, whereas small advertisers were blocked after eight violations.

The plaintiffs argue that Meta’s advertising policies created a perverse incentive by profiting from fraud while diminishing consumer trust.

Leave a comment

They seek damages, punitive damages, and an injunction to reform the company’s advertising practices. Meta has not publicly commented on the details, but the case highlights the legal risks for online platforms whose revenue models rely heavily on targeted ads.

Regulators and consumer advocates view the complaint as a test of how consumer protection laws apply to digital advertising and of social media companies' responsibilities to police fraud.

2. The South African government withdraws its AI policy because of AI-generated content

South Africa’s government withdrew its draft national AI policy after journalists discovered that parts of the document were generated by AI and cited fake research.

The draft AI Policy included references to nonexistent journals and misattributed articles, revealing a failure of human oversight.

Communications minister Solly Malatsi acknowledged that unverified citations compromised the policy’s integrity and said that those responsible would face consequences.

The AI policy aimed to establish a National AI Commission, an ethics board and a regulatory authority, while offering tax incentives and grants to promote AI development. However, the reliance on AI‑generated text raised questions about authenticity and transparency.

The incident is worrying, exposing how easily generative AI content can produce plausible, but false references and how governments must verify sources before publishing.

Policy development agencies should emphasise information integrity, accountability, and human oversight. AI hallucinations can quickly undermine trust in governance and highlight the risk of embedding errors into future regulations.

The government has promised to revise the policy with proper vetting, setting an important lesson for policymakers: AI tools can assist research, but cannot replace careful human scrutiny.

3. Cambodia targets scam compounds with new cybercrime law

Cambodia’s parliament approved a cybercrime law aimed at dismantling scam compounds that have enslaved tens of thousands of people and lured victims worldwide with romance scams and bogus cryptocurrency schemes.

Authorities estimate that up to 150,000 people have been forced to work in these compounds, which are often run by transnational organised crime syndicates.

The new law makes online scams punishable by prison terms of two to five years and fines up to 125,000 US dollars; for operations involving multiple victims or gangs, the penalties rise to 10 years and 250,000 US dollars; ringleaders who traffic or torture workers face up to 20 years and fines up to 500,000 US dollars.

Subscribe now

The U.S. Department of Justice reports that scam centers across Southeast Asia coerce workers into conducting fake investment schemes, often operating through encrypted messaging apps and websites.

The DOJ’s Scam Center Strike Force recently charged Chinese nationals who managed a cryptocurrency fraud compound and seized a Telegram channel that recruited victims. U.S. officials estimate the strike force has frozen more than $ 700 million in funds linked to scams.

Cambodia’s law complements these international efforts by criminalising scam operations, providing legal tools to prosecute traffickers, and mandating support for victims. We hope the legislation will deter abuses and restore Cambodia’s reputation, though effective enforcement and cooperation with foreign partners will be essential, of course.

Case of the Week

Litigants: Couvrette v. Wisnovsky et al
Citation: No. 1:2021cv00157 - Document 227 (D. Or. 2026)

Background

Couvrette v Wisnovsky originated as a dispute among members of an Oregon family that owns Valley View Winery. The plaintiffs accused their relatives of breaching fiduciary duties and mismanaging trust assets.

As litigation progressed, plaintiffs’ counsel used generative‑AI tools to draft three summary judgment briefs. These filings included 15 nonexistent case citations and eight fabricated quotations, leading the court to sanction the lawyers for misusing AI.

Sanctions and fee awards

In a December 2025 order, U.S. Magistrate Judge Clarke held that the misrepresentations amounted to a failure to comply with the court’s local rules and the attorneys’ duty of candor.

The judge imposed a $15,500 penalty on pro hac vice counsel Michael Brigandi for the false citations and ordered defendants to file a motion detailing reasonable attorney’s fees and costs.

Clarke emphasised that lawyers cannot delegate their professional responsibility to verify the accuracy of citations to artificial intelligence and described the errors as part of a pattern of disregard for procedural rules. The court also vacated the withdrawal of local counsel Michael Murphy and instructed him to show cause why he should not be sanctioned.

In March 2026, the court granted the defendants’ motion for fees and costs. The court records show that the judge awarded approximately 94,704 US dollars in attorney fees and costs: 80,498.72 US dollars against Brigandi and 14,205.66 US dollars against Murphy.

The order further required Murphy to file the opinion with any future pro hac vice motions and noted that he failed to meaningfully participate as local counsel.

Combined with the earlier penalty, the monetary sanctions exceed 110,000 US dollars, making it one of the most significant AI‑related content hallucination sanction orders in U.S. courts.

Legal issue

The key legal question was whether the attorneys violated professional rules by submitting briefs with fabricated authorities and whether local counsel sufficiently supervised pro hac vice counsel.

The court held that attorneys cannot rely on AI tools without verifying their output and that local counsel must review all filings prepared by out‑of‑state lawyers. The court treated the attempt to file corrected briefs as part of the misconduct, not a cure, and dismissed the plaintiffs’ claims with prejudice.

The significance of this case

Couvrette v Wisnovsky exposes the ethical risks of generative AI in legal practice. Courts are increasingly sanctioning lawyers for citing hallucinated cases, reminding practitioners that AI may assist research but cannot replace professional judgment.

The case also highlights local counsel's responsibility to supervise filings; they cannot serve merely as names on a docket.

The significant monetary sanctions show that courts will impose meaningful penalties to deter misuse and protect the integrity of judicial proceedings. AI‑assisted tools will become commonplace; lawyers must implement robust verification processes and maintain accountability to avoid similar embarrassing outcomes.

Other Developments in Technology Law

1. A decade of the GDPR

Last week marked the 10th anniversary of the General Data Protection Regulation (GDPR), adopted on 27 April 2016. The GDPR codified clear rights for individuals, such as access, erasure, and data portability, and established the European Data Protection Board (EDPB) to coordinate cross-border enforcement.

Over the past ten years, national data protection authorities have used the regulation’s “one‑stop shop” mechanism to cooperate on large‑scale cases. The EDPB notes that the GDPR now interacts with the Digital Services Act, Digital Markets Act and AI Act, providing a foundation for a broader digital regulatory ecosystem.

2. Microsoft’s Legal Agent enters Word

On 30 April 2026, Microsoft introduced a “Legal Agent” for Word through its Frontier early‑access program. Unlike general chatbots, the Legal Agent follows structured workflows tailored to how lawyers work.

Microsoft explains that legal documents require precise clause analysis, redlining and adherence to internal policies. To meet these needs, the agent uses deterministic insertion layers rather than free‑form text generation.

Subscribe now

It can review contracts against playbooks, suggest redlines with tracked changes and provide citations for each recommendation. The legal agent operates within the Microsoft 365 security and compliance framework.

3. Swiss competition authority investigates search advertising pacts

The Swiss Competition Commission (ComCo) opened two investigations on 30 April 2026 into potential coordination in search engine advertising. The probe examines whether travel companies and online casino operators agreed not to bid on each other’s brand names in keyword auctions on platforms like Google and Bing.

Such agreements could distort competition by limiting the visibility of competitors’ offers and making it harder for consumers to compare prices. Reuters reports that ComCo is questioning three travel firms and nearly all online casinos in Switzerland and will consult search engines as part of the investigation. If ComCo finds an unlawful agreement, companies could face fines and injunctive orders.

4. Crime and Policing Act 2026 brings digital protections in the UK

The United Kingdom’s Crime and Policing Act 2026 has received Royal Assent and introduces a suite of measures to address digital harms and modern crimes.

Technology Law

Predictive Policing Is Making Marginalised Communities Live Under Permanent Suspicion

Predictive policing has turned suspicion into a routine administrative category that follows people long before any conduct occurs, and it is astonishing how easily this practice has been accepted as a normal feature of public safety. The idea that an algorithm can pre-assign risk to entire neighbourhoods and individuals has been absorbed into policing …

Read more

a year ago · 16 likes · 7 comments · Technology Law

Among its provisions, the Act criminalises the manufacture and distribution of “nudification tools” that use AI to simulate clothing removal from images.

It makes it an offence to take or share screenshots of intimate images without consent and requires online platforms to remove non‑consensual intimate images within 48 hours of notification. Courts can order deletion of such images.

The Crime and Policing Act also extends offences related to paedophile manuals to include instructions on generating child sexual abuse material with AI and holds website moderators and administrators liable for hosting this content.

Beyond online harms, the Act gives police new powers to compel drug testing and seize stolen goods via warrantless entry and expands data‑sharing with the Driver and Vehicle Licensing Agency.

It introduces “respect orders” to tackle antisocial behaviour and creates specific offences for assaulting retail workers.

Latest Opportunities

Jobs, conferences, fellowships, and calls for papers

1. Legal Expert (Remote UK): A remote‑based legal expert role advertised by a UK consultancy seeks professionals with expertise in technology law and digital regulation (find out more).

2. Junior/Mid AI Legal Specialist, EverAI (Remote UK): This role is aimed at lawyers or legal specialists interested in AI governance and product support (find out more).

3. AdTech Lawyer, Axiom (Remote US): Axiom is hiring an AdTech Lawyer to advise on digital advertising agreements, data sharing, campaign data flows, and marketing compliance (find out more).

4. Smart Contract Legal Architect, Loti AI (Remote US): Loti AI is hiring for a legal engineering role focused on likeness rights, on-chain rights enforcement, Solidity, and digital identity. This may interest lawyers who combine intellectual property, technology law, and smart contract literacy (find out more).

5. Business Teacher, Postsecondary AI Training, Alignerr (Remote Australia): This opportunity appears to involve teaching business for AI training, with some connections to other disciplines such as privacy and data protection (find out more).

6. Lawyer, Global Licensing, Coins.ph (Remote Hong Kong): Coins.ph is hiring a lawyer to lead licensing work across payments, remittance, e-money, and virtual asset services. The listing seeks experience with financial regulation, licensing applications, regulators, external counsel, and multiple jurisdictions (find out more).

7. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words. (find out more).

8. Free Microsoft Virtual Training Day: Introduction to Azure (18 May 2026): Microsoft’s free virtual event offers a foundational overview of cloud concepts, core Azure services across compute, networking, storage and identity and demonstrates AI tools. Participants who complete the session receive a 50 percent discount on the Azure Fundamentals certification exam (find out more).

9. AI, Justice and the Rule of Law (Free Course): UNESCO and the University of Oxford are offering a free self‑paced online course launched on 27 April 2026 to equip judges, lawyers and students with an understanding of how AI interacts with human rights and legal reasoning (find out more).

This newsletter briefing highlights a world where law struggles to keep pace with technological ingenuity. From billion‑dollar disputes over AI governance to class actions against social platforms and sanctions for AI‑generated errors, courts and regulators are grappling with new challenges.

Responsible development demands integrity, transparency and deliberate oversight.

Post your comments to join the conversation.

Leave a comment

Disclaimer

This newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the authors alone.

Abstract

Why Regulatory Sandboxes Are Becoming Strategic Tools for Early Stage Tech Startups

Regulation is not the enemy of early-stage technology companies. Regulation is a legal framework. Smart founders understand this earlier than most lawyers.

Startups often describe regulation as a barrier to entry. Venture capitalists regularly frame compliance as a cost. Public debate frequently portrays regulation as an obstacle to innovation. That story feels intuitive, but it is also incomplete.

Regulatory sandboxes demonstrate something different. They show that regulation can operate as a strategic asset when a company understands how to use it.

Read more

Technology law is entering a period in which institutional responsibility cannot be deferred to innovation narratives or voluntary guidelines. Governments are writing treaties on AI governance, prosecutors are testing the limits of liability for chatbot outputs, courts are treating online gaming assets as property, and regulators are scrutinising algorithmic markets. Legal practice itself is also changing as firms integrate AI into core workflows. This briefing examines these developments and considers what they reveal about accountability, authority, and risk in our digital systems.

Share

Newsletter Edition 92

Lead Story

The European Parliament has approved the EU’s signature of the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law.

This is a significant milestone because the Council of Europe describes the convention as the first international legally binding treaty in AI governance.

This treaty is designed to make sure that activities across the AI lifecycle remain consistent with

• Human rights

• Democracy, and

• The rule of law.

Parliament gave its consent to the EU’s signature with 455 votes in favour, 101 against, and 74 abstentions. The next step is for the Council to conclude the agreement.

The treaty applies to AI-related activities carried out by public authorities and private actors acting on their behalf. Private sector actors are also expected to address AI-related risks in line with the convention’s objectives, either by directly applying the convention’s obligations or by providing equivalent protection.

The Parliament’s own explanation states that the EU AI Act and other EU laws already provide a higher and more detailed level of protection within the EU internal market. The treaty establishes a broader international baseline for transparency, documentation, risk management, oversight, fundamental rights, democratic safeguards, and rule-of-law values.

The text of the treaty is built around the idea that AI systems should not be treated only as products, software, or business tools, while recognising that they can affect dignity, autonomy, equality, privacy, public institutions, and democratic participation.

The treaty, therefore, requires states to adopt or maintain legislative, administrative, or other measures to give effect to its provisions. Those measures may be specific to particular sectors or horizontal across technologies.

This matters because international AI governance is often discussed as if it is only about voluntary principles. This treaty takes a firmer route by providing contracting states with a common legal framework for AI risks without requiring every country to adopt the EU AI Act. That is important for states that want human rights-based AI governance, but do not have the same regulatory position as the EU.

Lawyers advising public bodies, technology sellers, and regulated businesses will need to ensure compliance. Procurement, due diligence, contract drafting, and AI governance policies will need to ascertain whether the use of AI affects rights, public accountability, and democratic values. AI policy documentation may become more important because transparency and oversight cannot work without reliable records.

Technology Law

Council of Europe Sets New Standards for Online Safety and Empowerment

The Council of Europe’s new recommendation on online safety presents an ambitious attempt to reconcile freedom of expression with the governance of digital platforms. The document proposes stronger expectations on states and platforms while insisting on human rights safeguards. Additionally, the framework raises difficult questions about regulatory reac…

Read more

7 months ago · 15 likes · 2 comments · Technology Law

Regulators will also have a clearer basis for cooperation. AI systems cross borders, and many of the companies developing or deploying them operate globally. This uniform treaty framework will help regulators discuss risk, compliance, and institutional responsibility using shared concepts. That does not remove national differences, but it gives regulators a firmer starting point.

Subscribe now

Companies should not treat the convention as a distant public law instrument. Any business building AI tools for government, justice, education, healthcare, public services, security, finance, or civic participation should assume that human rights review will become a more visible part of the buying and supervision process. Strong internal records, testing, escalation procedures, and clear accountability lines will become easier to defend than vague statements about responsible AI.

The EU’s support for the Framework Convention positions AI governance within an international legal framework grounded in human rights, democracy, and the rule of law.

Technology Law Tracker: Other Relevant Updates

1. Freshfields and Anthropic partner on developing legal AI tools

Freshfields and Anthropic have agreed to work together on new AI applications for legal services. It was reported that Freshfields will collaborate with Anthropic’s legal team to develop tools for legal and market research, contract review, document drafting, and automation of internal business services workflows. Freshfields will also receive early access to future Anthropic models and products, although no financial terms were disclosed.

The development also comes at a time when courts are paying closer attention to AI errors in legal documents. Recently, there has been a rise in AI-generated inaccuracies in court filings, including inaccurate citations and other errors.

Legal AI is judged not only by speed, but also by reliability, auditability, and professional accountability. A tool that drafts faster but imposes verification burdens may save time in one place while creating risk in another.

2. OpenAI and ChatGPT investigated after deadly shooting

Florida Attorney General James Uthmeier has launched a criminal investigation into OpenAI and ChatGPT after a 2025 shooting at Florida State University that killed two people and injured six others.

The suspect was charged with multiple counts of murder and attempted murder, and the state is examining whether OpenAI bears criminal responsibility for ChatGPT’s alleged role in the incident. The Office of Statewide Prosecution has subpoenaed OpenAI for information and records.

Uthmeier said at a press briefing that the chatbot advised the shooter on the type of gun to use, ammunition compatibility, and whether a gun would be useful at short range.

OpenAI’s position, as reported by Reuters, is that the shooting was a tragedy, but that the company had no responsibility. The company also said it identified an account believed to be associated with the suspect and shared information with law enforcement.

It added that ChatGPT provided factual responses based on broadly available public information and did not encourage or promote illegal or harmful activity.

This investigation examines how prosecutors may view AI systems that produce information later linked to violent conduct. Criminal law usually focuses on human intent, conduct, causation, and knowledge.

Can AI be guilty of a crime? Read our newsletter on this delicate matter.

Technology Law

Can AI Be Criminally Liable?

Around the world, prosecutors are circling, and in some cases, people are already being charged for what their AI systems did. World legal systems are catching up with reckless automation, and the consequences are real: injury, death, and yes, prison time. In this article, we explore how criminal liability is entering the AI age, what cases are already …

Read more

a year ago · 12 likes · 8 comments · Technology Law

Applying those ideas to a chatbot raises difficult issues. An AI system can generate a harmful answer without having human intent. A company can design safety layers, but users may still ask dangerous questions in ways that are not always easy to detect.

The case also highlights the difference between public information and actionable assistance. Many facts about weapons, chemicals, cyber tools, and other dangerous subjects exist online. The legal question is whether an AI system changes the risk by making such information easier to access, combine, personalise, or apply. That question will remain central to AI safety discussions.

Which liabilities exist against LLMs offering misleading advice?

Technology Law

Can You Sue ChatGPT or Google Gemini for Providing Wrong Advice?

AI chatbots are everywhere. They answer questions, give tips, and sometimes issue wrong advice. From dangerous health advice to fake consumer product review, things go wrong more often than people think. When they do, the primary question is who takes the blame. This post looks at real examples of when AI provides misleading advice, how companies try to…

Read more

a year ago · 13 likes · 11 comments · Technology Law

Companies offering general-purpose AI tools should treat this development as a warning that safety design will be examined after serious harm occurs. It will not be enough to say that a user misused an AI system. Prosecutors, regulators, victims, and the public will ask what safeguards existed, how they were tested, what the company knew about foreseeable misuse, and how the system responded to high-risk prompts.

This is also a reminder that AI governance needs incident response planning. Companies should be prepared to preserve records, cooperate with lawful investigations, review model behaviour, and communicate carefully. The legal outcome remains uncertain, but the governance lesson is already clear.

3. UK courts and regulators consider clearer rules for AI-generated legal documents

The UK Civil Justice Council has been consulting on whether new procedural rules are needed for the use of AI in preparing court documents, including pleadings, witness statements, and expert reports.

Judicial concern about AI hallucinations, including false authorities, inaccurate case references, and wasted court resources. It also refers to recent cases in which AI-generated or AI-assisted legal material caused problems before the courts.

The judiciary is also examining other questions about AI, legal professional privilege, and confidentiality. In a speech on legal professional privilege in the age of AI, the Chancellor of the High Court noted that public AI systems may raise confidentiality concerns.

The speech discussed a tribunal decision holding that uploading confidential documents to an open-source AI tool such as ChatGPT can place that information in the public domain, breach client confidentiality, and waive privilege.

This matters for every lawyer, not only litigators. AI can help draft, summarise, translate, and organise material, but it cannot remove professional responsibility. Courts are likely to focus less on whether AI was used and more on whether the final document is accurate, honest, properly verified, and consistent with duties owed to the court.

Legal professionals should have a clear verification process. They should know which AI tools are approved for use in their jurisdiction, which data must not be entered, how outputs are checked, and how errors are recorded. Litigants-in-person may also need clearer public guidance because AI tools can make legal arguments look more polished without making them legally sound.

Case of the Week

Case: R v Lakeman
Citation: [2026] EWCA Crim 4

Facts

R v Lakeman concerned virtual gold pieces in the online game Old School RuneScape. The gold pieces were recorded in a ledger maintained by Jagex, the game’s developer and publisher. The terms and conditions stated that the gold pieces could be redeemed only inside the game, and Jagex could delete them or anything purchased with them. Sale or gifting in the real world was prohibited.

The defendant was an employee of Jagex. He was accused of hacking into player accounts, transferring a large number of gold pieces to accounts under his control, and selling them for real-world currency. The alleged theft involved around 705 billion gold pieces, valued at £543,123.

Subscribe now

Legal issue

The legal issue was whether virtual in-game currency could constitute property capable of being stolen under section 4 of the Theft Act 1968 (UK). This was not a simple question because the gold pieces existed inside a game environment, were subject to contractual restrictions, and could be modified or deleted by the game operator.

The defence argument was helped by the fact that the game rules did not allow real-world trading. Jagex also retained significant control over the game environment. The prosecution’s case depended on persuading the court that those features did not render the gold pieces property for the purposes of theft.

Decision

The Court of Appeal held that the gold pieces were property capable of being stolen for the purposes of section 4 of the Theft Act 1968. The court stressed that the definition of property in criminal law differs from that in private law. The court also discussed other related issues in digital asset property, including the idea that digital assets can be functional things distinct from the underlying code.

The court adopted a wider approach to property for theft purposes. The court considered whether the thing was freely bought and sold and capable of dishonest dealing that deprives the owner of its benefit. It allowed the prosecution’s appeal on the preliminary issue and held that the virtual gold pieces were property capable of theft.

The relevance of this judgment

Digital assets now carry real social and economic value. Games, virtual worlds, blockchain, digital collectables, token-based platforms, and online marketplaces all involve items that may be controlled by code, governed by terms, and valued by users. Criminal law cannot avoid these assets simply because they are intangible or platform-based.

The decision is especially important for gaming companies. Terms and conditions may say that in-game assets cannot be sold outside the game, but that does not necessarily prevent a court from treating those assets as property in a criminal context. Platform operators should therefore think carefully about account security, internal access controls, employee permissions, audit trails, and user protection.

Is crypto personal property? Read our newsletter to find out more:

Technology Law

What the Property (Digital Assets etc) Act 2025 Means for Your Cryptoassets

English law has spent more than a decade pretending that digital value could be economically real yet legally peripheral, and the Property (Digital Assets etc) Act 2025 exposes how unsustainable that posture had become. Treating cryptoassets as something to be tolerated rather than classified produced uncertainty that benefitted speculation while underm…

Read more

a year ago · 11 likes · 5 comments · Technology Law

The court’s reasoning adds to a growing body of judicial reasoning about how law should treat digital things that have practical utility, scarcity, control, and market value. It does not answer every private law question about ownership, transfer, insolvency, or platform liability, but it gives courts and lawyers another important reference point.

The law is becoming more comfortable with the idea that digital value can be legally meaningful. Users may consider a virtual item valuable even if it exists on a controlled platform. Courts are beginning to take that experience seriously when dishonesty, deprivation, and market value are present.

Other Developments in Technology Law:

1. Investigation into music streaming platforms over alleged undisclosed promotion

The Texas Attorney General has launched an investigation into Spotify, Apple Music, Pandora, Amazon Music, and YouTube Music over alleged payola-type arrangements. The office says it is examining whether streaming services accepted undisclosed payments to promote certain songs, artists, or content through playlists, recommendations, or ranking systems. Civil Investigative Demands have been issued to the companies.

2. UK chatbot offence proposal withdrawn before debate

A proposed amendment to the Crime and Policing Bill, which has now been withdrawn, would have created offences related to AI chatbots that produce illegal or harmful content for children, or that use certain deceptive or exploitative chatbot designs.

The amendment also included duties for risk assessment, mitigation, transparency reporting, and potential criminal penalties. The amendment was withdrawn before debate, so no decision was taken on it.

3. Dutch financial regulator highlights AI risks in capital markets

The Netherlands Authority for the Financial Markets has published a report on AI in capital markets.

The regulator says AI can improve speed and reduce costs, but it can also affect price formation, amplify market vulnerabilities, and create new risks where trading models rely on similar data and objectives. It also warns that false or manipulated information could affect models that rely on news, sentiment, and social media.

Latest Opportunities

Jobs, conferences, fellowships, and calls for papers

1. Junior/Mid AI Legal Specialist, EverAI (Remote UK): This role is aimed at lawyers or legal specialists interested in AI governance and product support (find out more).

2. AdTech Lawyer, Axiom (Remote US): Axiom is hiring an AdTech Lawyer to advise on digital advertising agreements, data sharing, campaign data flows, and marketing compliance (find out more).

3. Smart Contract Legal Architect, Loti AI (Remote US): Loti AI is hiring for a legal engineering role focused on likeness rights, on-chain rights enforcement, Solidity, and digital identity. This may interest lawyers who combine intellectual property, technology law, and smart contract literacy (find out more).

4. Business Teacher, Postsecondary AI Training, Alignerr (Remote Australia):
This opportunity appears to involve teaching business for AI training, with some connections to other disciplines such as privacy and data protection (find out more).

5. Lawyer, Global Licensing, Coins.ph (Remote Hong Kong): Coins.ph is hiring a lawyer to lead licensing work across payments, remittance, e-money, and virtual asset services. The listing seeks experience with financial regulation, licensing applications, regulators, external counsel, and multiple jurisdictions (find out more).

6. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words. (find out more).

Conclusions

The common thread in this briefing is accountability. AI is becoming part of law, finance, public administration, entertainment, and criminal investigation, so legal systems are now asking who takes responsibility when automated systems affect people.

The most useful conversation is whether AI use can be explained, checked, and governed with sufficient care to preserve trust.

Disclaimer

This newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the Technology Law e-Newsletter and do not necessarily reflect the views of any affiliated institution.

Leave a comment

Your weekly briefing report on technology law and regulation, AI governance, fintech policy, and career opportunities.

Share

Newsletter Edition 91

Lead Story

Your AI chats may become evidence in court!

Conversations with AI chatbots may not be treated like “confidential” conversations with a lawyer, doctor, or other protected professional. In a recent case of United States v. Heppner, No. 25-cr-503 (JSR) that brought this issue into sharper view, U.S. District Judge Jed Rakoff ruled in February that Bradley Heppner, the former chair of GWG Holdings, had to hand over 31 documents generated with Anthropic’s Claude in the course of a criminal securities fraud case.

Heppner had used Claude to prepare reports on his case for his lawyers, but the court was not persuaded that those exchanges were protected.

Judge Rakoff’s reasoning is important because he addressed the issue directly. He did not treat AI systems as something unusual or outside existing legal rules. In a written order, the judge explained that conversations with an AI system such as Claude cannot be treated as confidential legal advice. In other words, a person using the chatbot does not have an attorney-client relationship with the AI company (Anthropic).

The judge also looked closely at Anthropic’s privacy policy. That policy explains that the platform may collect the questions users type into the system and the responses the system generates. It may also use that information to improve the model and may disclose it to third parties when required in disputes or legal proceedings.

Because the company reserves the right to access and share that information, the judge concluded that users cannot reasonably expect those conversations to remain private in the legal sense required for attorney-client privilege.

It was reported that on the same day as Rakoff’s ruling, U.S. Magistrate Judge Anthony Patti in Michigan took a different view in Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. 2026), involving a self-represented litigant’s use of ChatGPT.

Patti treated those AI chats as part of the litigant’s own work product rather than a conversation with another person. In other words, chatbots are tools, not persons. That means some AI-generated material may still attract protection depending on who created it, why it was created, and how it was used.

Courts are not building a standalone doctrine of AI confidentiality all at once. They are doing something much more granular and much more consequential. They are applying existing rules on privilege, confidentiality, waiver, and work product to new patterns of behaviour.

Some uses of AI may be treated as internal drafting assistance. Other uses may look like disclosure to a third party. A great deal will depend on the system used, the provider’s terms, the purpose of the interaction, and the extent of lawyer involvement.

Subscribe now

Many people use AI systems as if they were private advisers. That assumption is understandable because the interface feels conversational, personal, and responsive. Legally, that feeling may be meaningless. Employees, founders, claimants, defendants, and ordinary users may all reveal sensitive material to an AI system that does not provide them with the legal protection they believe they have.

The deeper point is that AI use is now starting to alter the evidence record itself. An AI chatbot can help draft a witness outline, summarise internal documents, suggest a line of argument, or produce a statement of claim. Each of those outputs can later matter in disclosure fights, sanctions disputes, or credibility challenges. That is why the discoverability question matters far beyond the privilege doctrine.

Courts are beginning to treat AI chats as legally consequential records, not private thought spaces, and that changes how lawyers, clients, and companies need to use these tools.

Can you sue an LLM? Read our newsletter on the legal challenges of suing ChatGPT and Gemini.

Technology Law

Can You Sue ChatGPT or Google Gemini for Providing Wrong Advice?

AI chatbots are everywhere. They answer questions, give tips, and sometimes issue wrong advice. From dangerous health advice to fake consumer product review, things go wrong more often than people think. When they do, the primary question is who takes the blame. This post looks at real examples of when AI provides misleading advice, how companies try to…

Read more

a year ago · 13 likes · 11 comments · Technology Law

Key Regulation Tracker

1. Australia Federal Court issues AI practice note

The Federal Court of Australia’s new Generative AI Practice Note does not prohibit AI use. It does something more useful. It states that anyone using generative AI in connection with legal proceedings must understand its capabilities, limits, and risks, and that any use must not adversely affect the administration of justice. The Note also makes clear that the court may require disclosure of how AI was used in a proceeding.

The AI Practice Note also mentions that lawyers remain responsible for ensuring pleadings are supportable, authorities cited in submissions exist and support the stated proposition, and cited evidence exists and is likely to be admissible.

Subscribe now

It also requires disclosure where AI has been used to summarise or analyse information relied on by a witness or expert, and warns against entering privileged, confidential, suppressed, or otherwise restricted information into generally accessible tools. Non compliance may lead to adverse costs and other consequences. That is a clear framework other courts will be studying closely.

2. DOJ settles IBM case over anti-discrimination compliance certifications

The U.S. Department of Justice settlement agreement with IBM states that the United States contends IBM knowingly submitted false claims and knowingly made false statements in connection with federal contracts that incorporated anti-discrimination requirements, including Title VII requirements as reflected in federal procurement rules. The settlement amount is USD 17.1 million.

This agreement matters for tech companies because public contracting now carries heavy compliance exposure that goes well beyond cybersecurity representations or data handling promises.

Employment practices, internal governance, and certification processes can all become legal issues once they are baked into government contracts and digital service procurement. Compliance officers and legal teams should treat certification language as an operational commitment, not a box ticking exercise.

Case of the Week

Case: Nippon Life Insurance Company of America v. OpenAI Foundation
Citation: No. 1:26-cv-02448 (N.D. Ill. filed Mar. 4, 2026), United States District Court, Northern District of Illinois.

Facts

The complaint, filed on 4 March 2026, was brought by Nippon Life Insurance Company of America against OpenAI Foundation and OpenAI Group PBC.

According to the complaint, Nippon alleges that ChatGPT provided legal assistance to a user, Graciela Dela Torre, in connection with litigation and post settlement filings, and that this assistance contributed to tortious interference with a settlement agreement, abuse of process, and the unlicensed practice of law under Illinois law. The complaint says ChatGPT gave legal advice, legal analysis, legal research, and drafting help for motions and requests for judicial notice.

Legal Issue

The complaint relied on Illinois authority stating that the practice of law is not limited to courtroom appearances and includes out of court legal services and advice. They argued that ChatGPT is not admitted to practice law in Illinois or elsewhere, yet provides legal services to users who ask for them.

That issue sits at the intersection of several long standing legal concerns.

• One is professional licensing.

• Another is consumer protection.

• A third is court integrity, especially where AI generated legal assistance may influence filings or judicial process without the controls applied to licensed practitioners.

The complaint also raised a crucial question that regulators have not resolved yet: when does general information become personalised legal assistance that the law is willing to regulate?

Judicial Decision

There has not yet been a merits decision. What exists at this stage is the complaint and the claims it advances. The case therefore matters as a filing to follow. The complaint seeks relief that includes an injunction against continuing to provide legal assistance and a finding of unlicensed practice of law, among other remedies.

Courts still have to decide questions of standing, causation, duty, statutory scope, and the practical meaning of “practice of law” in the context of software outputs. Even so, the filing is notable because it states the claim plainly and in terms that another plaintiff, regulator, or bar authority could adapt.

Why stakeholders must take note of this case

• The case tests whether general purpose AI systems can remain legally characterised as neutral tools when they are marketed and used in ways that resemble professional assistance. Liability, regulatory design, product warnings, and system limitations may all depend on where that line is drawn.

• Financial services firms are already using AI in customer interaction, compliance triage, and document support. A court willing to look closely at AI outputs in the legal context may encourage similar scrutiny in regulated financial advice settings where licensing and consumer harm concerns are also acute. Of course, this case is not about financial advice, but the logic of role substitution matters across regulated services.

• Platform operators often describe AI as assistance rather than advice. This case shows why that distinction will not always end the debate. Claimants will look at what the system actually does, how it is presented to users, and what consequences follow. Product labels alone may not carry much weight if the system is doing work users would usually associate with a licensed professional.

• A licensed profession and a general LLM model tool produce very different governance expectations. The former leans toward competence, supervision, ethics, and record-keeping. The other leans toward consumer disclosures, safety testing, and platform moderation. Courts do not have to choose a full regulatory model in one case, but each procedural step is starting to affect the space companies have to design and market AI systems that touch professional decision making.

Latest Policy Insights and Updates

1. The European Commission Launches Age Verification App to Protect Children Online

The European Commission’s new age verification app seeks to facilitate child safety, and also support states in adopting stronger online age checks without building a system that normalises unnecessary data collection.

The European Commission (EC) says the app is ready for deployment, will allow users to prove age when accessing platforms, can be set up using a passport or ID card, works on any device, is anonymous, and is fully open source. Some EU countries are already planning to integrate it into national digital identity wallets.

Subscribe now

Age verification has often produced a false choice between child safety and privacy. The EC is trying to present a third route: age assurance with limited data exposure. Whether that works in practice will depend on design, uptake, interoperability, and whether platforms accept the tool as a sufficient compliance mechanism. The real policy issue is not whether age checks will exist, but rather, whether they can exist without becoming an identity system for ordinary internet use.

2. New Technical Standards Planned for Autonomous Driving in China

China’s Ministry of Industry and Information Technology has also closed consultation on draft mandatory national standards, including draft safety requirements for autonomous driving systems of intelligent and connected vehicles.

The ministry’s notice set 13 April 2026 as the deadline for comments, and the draft standard establishes technical and functional safety requirements for autonomous driving systems.

3. UK Competition Authority Begins Review of Paramount and Warner Bros Discovery Deal

In the United Kingdom, the Competition and Markets Authority has opened a consultation to comment on the anticipated acquisition involving Paramount and Warner Bros. The consultation runs from 13 April to 27 April 2026. The CMA notes that the formal phase 1 investigation has not yet launched and that the invitation to comment is the first part of its information gathering process.

Control of content libraries, streaming reach, advertising inventory, recommendation architecture, and audience data can all carry competition implications that spill well beyond traditional broadcasting. The point is not only who owns what studio, but how concentration affects distribution power in digital media markets that increasingly overlap with platform, advertising, and AI enabled content environments.

4. EU Develops Metadata Standards for the European Health Data Space

The European Commission (EC) has also closed consultation on a draft implementing regulation on minimum metadata elements for the European Health Data Space, including interoperability requirements for dataset descriptions used in the secondary use of electronic health data. Digital Policy Alert says the consultation closed on 12 May 2026 and links the proposal to Article 77(1) of the EHDS Regulation 2025/327.

This is exactly the kind of measure that determines whether data policy succeeds or stalls. Secondary use of health data depends on discoverability, standardisation, interoperability, and trustworthy governance. Metadata rules can decide whether researchers, hospitals, regulators, and innovators can actually find and reuse datasets in legally compliant ways.

Other important developments

1. The EU proposes measures requiring Google to share certain search data with third party search engines under the Digital Markets Act: The European Commission says the draft measures cover ranking, query, click, and view data, with feedback open until 1 May (read here).

2. EU presses Meta over WhatsApp access for rival AI assistants: The European Commission intends to order Meta to reinstate rival AI assistants on WhatsApp after Meta imposed an access fee that regulators say may exclude competitors (read here).

3. European AI Office opens a targeted consultation on measuring the energy consumption and emissions of AI models and systems: The consultation runs from 7 April to 15 May 2026 (read here).

Subscribe now

4. SEC staff issues a statement on certain crypto transaction interfaces: The Division of Trading and Markets says the statement sets out staff views on broker dealer registration requirements for some interfaces used to prepare transactions in crypto asset securities (read here).

5. FTC secures a USD 1.5 million settlement with Publishing.com. The FTC says the online self publishing company misled consumers about likely earnings and must substantiate earnings claims going forward (read here).

6. EDPB advances new guidance on scientific research data processing. Its Guidelines 1/2026 on personal data for scientific research were adopted on 15 April 2026 in a version for public consultation (read here).

7. SEC’s 2025 enforcement results underline continued focus on emerging technology risk. The European Commission highlighted the Cyber and Emerging Technologies Unit, which covers blockchain technology, AI, account takeovers, and cybersecurity (read here).

Latest opportunities

Jobs, conferences, fellowships, and calls for papers

1. DSIT Fellowship Cohort 4: Applications are open for 2026 to 2027 secondments in AI, data, economics, international work, horizon scanning, and science ecosystem roles. Deadline: 6 May 2026 (further details).

2. Allen Institute for AI, Legal Counsel: Applications are due by 30 April 2026. The role calls for technology transactions experience and familiarity with data governance, privacy law, and the EU AI Act (further details).

3. Benchling, Legal Counsel, Product and AI: Benchling is recruiting product and AI counsel in San Francisco to advise on AI governance, privacy, intellectual property, licensing, and product legal issues (further details).

4. Lecturer in Law and Technology, Aston University: Applicants required with expertise in areas such as AI and law, digital regulation, data governance, cyber law, platform regulation, or the legal implications of emerging technologies (further details).

5. GitLab, Legal Counsel, Commercial (Canada, US, Remote): The role includes negotiating complex commercial and technology agreements, including data privacy and AI related contracts (further details).

6. AIDA2J Workshop at ICAIL 2026: Papers, short papers, and demo proposals are invited for the Artificial Intelligence for Access to Justice workshop in Singapore. Submission deadline: 1 May 2026 (further details).

7. PLSC Europe 2026: KU Leuven’s Centre for IT and IP Law is hosting this privacy scholarship workshop in Leuven on 29 and 30 October 2026. Abstract deadline: 15 May 2026 (further details).

Disclaimer

This weekly briefing and newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the author and do not necessarily reflect the views of any affiliated institution.

Leave a comment

/////////////////////END///////////////////////

The Council of Europe’s new recommendation on online safety presents an ambitious attempt to reconcile freedom of expression with the governance of digital platforms. The document proposes stronger expectations on states and platforms while insisting on human rights safeguards. Additionally, the framework raises difficult questions about regulatory reach, platform accountability, and the risk that protective measures may legitimise the over-censorship of online discourse.

Share

Newsletter Edition 90

Introduction

The digital environment has become central to our social and civic lives. People gather news, express opinions, learn, play and work through online platforms. The Council of Europe, aware of the benefits and dangers of this transformation, adopted Recommendation CM/Rec(2026)4 on 8 April 2026 to guide member states toward safe and empowering online environments. This recommendation acknowledges that while the internet enhances freedom of expression, it also exposes users to harassment, misinformation and other risks that can undermine democracy. It seeks to protect individual and collective rights without sacrificing the openness of the digital realm.

The recommendation builds on previous Council of Europe instruments on internet freedom and the responsibilities of internet intermediaries. The explanatory memorandum emphasises that the right to freedom of expression protects speech that may offend, shock or disturb.

The recommendation proposes principles and measures for states, platforms and content creators to address online risks while enhancing user autonomy.

Understanding online risks

The recommendation categorises online risks that affect freedom of expression into three groups:

• Personal and community safety risks: Users may encounter abuse, harassment or content that threatens their well-being. This includes hate speech, violence and exploitation. Such risks can deter individuals from participating in public discourse, leading to self‑censorship and exclusion.

• Threats to democratic processes and information integrity: Misinformation, targeted disinformation campaigns, and manipulation of public debate undermine informed decision-making. These threats erode trust in institutions and polarise societies. Election interference and conspiracy narratives can weaken democratic legitimacy.

• Systemic risks from the design and operation of platforms: Algorithmic systems can influence the visibility of content, amplify harmful material or suppress minority voices. Platform design choices, driven by engagement metrics, may prioritise sensational content, leading to echo chambers and exposing users to harmful material. Artificial intelligence tools that produce or moderate content introduce new risks and amplify existing ones.

The memorandum explains that certain groups face heightened risks online: children, women and girls, people with disabilities or minority identities, migrants and content creators such as journalists and activists. Online abuse targeted at these groups often extends into the physical world, reinforcing social inequalities. When freedom of expression is curtailed by intimidation or discrimination, public debate suffers.

Technology Law

Your Online Freedom May Be About To End

New rules are transforming how online platforms and search services must operate in the United Kingdom. Age checks are now compulsory for services with adult content and strict obligations apply to anything that children can access. Some see this as protection and others see it as control. These rules will change what people see, how they join online pl…

Read more

a year ago · 11 likes · 3 comments · Technology Law

Principles for states

The recommendation stresses that states should foster an enabling online environment that is:

• Safe,

• Inclusive, and

• Pluralistic.

This involves measures both online and offline. States should develop comprehensive strategies that address underlying societal inequalities that lead to online abuse. Education and media literacy are central to empowering users; states are encouraged to invest in digital citizenship initiatives and strengthen media diversity.

States must avoid actions that compromise online safety. They should not introduce vulnerabilities into technical systems that protect privacy. Enhanced surveillance or general monitoring obligations are discouraged, as they threaten freedom of expression and could lead to the over-removal of lawful content. Instead, interventions should be evidence-based, transparent and proportionate. When developing regulations, governments should consult a wide range of stakeholders, including civil society and affected communities.

States should clearly identify what content is illegal or regulated, ensuring legal certainty and preventing arbitrary enforcement. Blocking entire services or domains is considered a severe interference with freedom of expression and should occur only under strict judicial oversight.

Responsibility for enforcing content restrictions cannot be transferred wholesale to private companies. States remain ultimately accountable for human rights protection. When authorities instruct platforms to remove content, platforms should inform users so they can challenge the decision. Legal frameworks must avoid compelling intermediaries to monitor all user content.

Responsibilities of platforms

Online platforms serve as gatekeepers to public discourse. The recommendation acknowledges that they play a central role in facilitating expression and, therefore, bear responsibilities commensurate with their impact.

Platforms of significant influence – those with large user bases and substantial impact on public communication – are expected to conduct risk assessments before implementing changes. These assessments should consider human rights impacts, involve stakeholder consultation and be published in a way that the public can understand. When risks are identified, platforms must implement mitigation measures before introducing new designs. This approach encourages transparency and accountability in corporate decision-making.

Subscribe now

Platforms are encouraged to employ staff knowledgeable about local contexts and languages, enabling them to understand specific risks in different regions. They should pay special attention to groups facing higher risks, such as children, women and minorities. Collaboration with user groups and civil society can inform more responsive policies.

One notable principle is the graduated and differentiated approach. Smaller platforms should not be overburdened by obligations suited for very large services. Conversely, platforms with significant influence should be subject to heightened duties that reflect their power and reach.

Content creator responsibilities

The recommendation recognises content creators as an essential part of the digital public sphere. It calls on them to uphold accuracy, fairness and integrity.

Creators who reach large audiences or claim professional expertise have a heightened duty to act in good faith.

These provisions acknowledge the rising number of child influencers and aim to protect them from exploitation.

Timeline of Council of Europe digital rights instruments

The timeline below illustrates how the Council of Europe has progressively addressed digital rights and online safety through a series of recommendations.

It places Recommendation CM/Rec(2026)4 in a broader context of regulatory development.

Events are plotted chronologically from 2016 to 2026.

Legal frameworks: content rules, intermediary liability and platform accountability

The recommendation divides legal frameworks into three pillars:

1. Content rules,

2. Intermediary liability rules, and

3. Platform accountability and user empowerment rules.

This structure recognises that different types of interventions require different approaches.

Content rules

Content rules govern what kind of expression may be restricted and under what circumstances. They must be clearly prescribed by law, pursue a legitimate aim and remain necessary and proportionate.

The recommendation reiterates that content lawful offline should generally be lawful online. When restrictions are necessary, the law should specify whether content is illegal (fully prohibited) or legal but regulated (subject to access or visibility limitations). The degree of risk severity and its imminence should guide the level of restriction.

Member states are encouraged to regularly review their online content laws to ensure clarity and relevance in a changing digital context.

Enforcement should, in principle, occur through formal orders by judicial or independent authorities, with users and intermediaries having access to effective remedies. Platforms may adopt additional rules through terms of service, but these should be transparent and consistent.

Intermediary liability rules

Excessive liability can turn intermediaries into de facto censors and encourage over-removal of lawful content. States should therefore avoid imposing disproportionate liability on intermediaries for user-generated content.

Liability may be appropriate when intermediaries fail to act expeditiously upon becoming aware of illegal content, provided that notice procedures are transparent and effective. The conditions for removal, including time frames, should be differentiated according to the nature and seriousness of the content.

When platforms enforce content restrictions in accordance with State orders, they should provide sufficient information to enable users to challenge those decisions. This ensures accountability and prevents arbitrary or discriminatory enforcement.

Platform accountability and user empowerment rules

Platform accountability rules address systemic duties that go beyond content moderation. They require platforms to design services with user safety and empowerment in mind. States should legislate to require platforms of significant influence to conduct risk assessments and publish documentation on their human rights impacts. Regulatory authorities overseeing these frameworks must be independent, well-resourced and subject to judicial review.

States are encouraged to share responsibility by involving non-state actors such as researchers, user groups and out-of-court dispute settlement bodies. These actors should operate under transparency and accountability mechanisms. By decentralising oversight, the recommendation envisions a collaborative approach to safety.

Technology Law

How A Content Creator Was Harassed Online For Years (Gasparetto v. Bradley)

A recent court case from Nova Scotia Supreme Court has made headlines for all the right reasons. After consistent targeted online abuse, the applicant took his fight to court and won. The judge ruled in his favour. The ruling breaks down what counts as cyberbullying, how far is too far, and why content creators should pay close attention. This is a deta…

Read more

a year ago · 5 likes · Technology Law

User empowerment measures

At the heart of the recommendation is the belief that empowering users can mitigate online risks and foster resilience. User empowerment duties are divided into four categories:

1. Design-related,

2. Transparency-related,

3. Fair process, and

4. Collective action.

Empowerment by design

Platforms should enable users to personalise their online experience. Automated systems for organising and recommending lawful content should allow users to opt out, hide certain categories of content or block other users.

Third-party labelling tools can help users make informed choices about content. Platforms of significant influence may need to open their systems to third-party tools that assist in personalisation, subject to accountability requirements.

Design must also promote inclusivity. Platforms should address accessibility barriers faced by persons with impairments and ensure that safety tools are usable by all.

Age assurance systems are required to protect children from age-restricted content, but they must respect children's privacy and evolving capacities. The recommendation cautions against excluding children from online spaces or exacerbating discrimination.

Transparency

Users should understand how platforms organise content and moderate behaviour. Platforms are urged to explain their algorithmic systems for content organisation and curation. They should publish statistics on content moderation decisions and qualitative reports on the accuracy of automated moderation tools.

Transparency extends to advertising: platforms must disclose the identities of advertisers, the targeting techniques used, and spending. They should reveal how user-generated content is monetised and the principles used to allocate resources to creators.

Independent researchers play a crucial role in uncovering systemic issues. The recommendation emphasises that researchers should have access to platform data in a secure, legal, and privacy-compliant manner. Access may be granted through external vetting when personal data is involved. Researchers should also be allowed to use platforms to study social phenomena.

Procedural rights and fair process

Platforms must be clear about the contractual policies and rules that govern their services. Changes to these rules should be notified in advance and explained in an accessible language.

When platforms make content moderation decisions, they should notify affected users, explain the grounds for the decision and provide avenues for appeal. Appeals should include independent oversight mechanisms, such as out-of-court dispute-resolution bodies.

Collective action

Users should be able to report breaches of platform rules and legal restrictions easily. Platforms should provide feedback on follow-up actions. Users submitting notices about potentially illegal content should also receive feedback and have the right to appeal decisions.

The recommendation encourages recognising professional flaggers and user groups who can act as independent experts and advocate for user interests.

Categories of online risks and recommended responses

Subscribe now

The significance of this recommendation

The Council of Europe’s new recommendation is both an evolution and a consolidation of existing human rights principles applied to the digital space.

It acknowledges the power asymmetry between large platforms and individual users, and addresses this by imposing differentiated responsibilities based on size and impact.

This approach recognises that uniform regulations can stifle innovation or overwhelm smaller actors, while leaving major services inadequately regulated.

The recommendation’s focus on empowerment is notable. It goes beyond protection to encourage users to actively curate their digital environment. Personalisation tools, third-party labels and accessible interfaces are intended to give users agency over what they see and engage with.

This reform reflects an understanding that safety cannot be achieved solely through content removal. A pluralistic digital sphere requires that users are equipped to navigate diversity and dissent without being overwhelmed by harm.

Another significant element is the recognition of intersecting vulnerabilities. Women, children and marginalised communities often bear the brunt of online abuse. The recommendation highlights the need for age-appropriate systems and inclusive design to ensure that safety tools serve all users. States and companies can address the long-standing inequities that persist both online and offline.

Transparency provisions also have far-reaching implications. Requiring platforms to disclose how algorithms work, how moderation is conducted and who funds advertising opens space for public scrutiny. It empowers researchers to study the impacts of digital platforms and fosters trust by shedding light on practices that have traditionally been opaque. However, implementing meaningful transparency will require cooperation between regulators, platforms and civil society.

The recommendation aligns with global trends towards regulating digital services. The European Union’s Digital Services Act and the United Kingdom’s Online Safety Act 2023 similarly impose obligations on platforms to assess and mitigate risks.

The Council of Europe’s focus on human rights provides an additional layer of normative guidance, emphasising the need to preserve freedom of expression. As such, this recommendation may influence future national legislation and international norms.

Leave a comment

This newsletter includes references and links to external sources for informational and educational purposes only. Inclusion of these sources does not constitute endorsement, approval, or verification of their views, accuracy, or conclusions. Responsibility for the content of the referenced materials remains solely with the original authors and publishers. Our newsletter does not represent any legal advice.

Abstract

The private tech company controversy

Private technology companies now wield operational influence in armed conflict that many states once considered an exclusive sovereign power. Decisions taken inside corporate boardrooms can affect military capability during active hostilities. Law has not fully caught up with this reality, yet the consequences are already visible in current world conflicts.

Public international law was designed with states and armed forces in mind; however, the legal framework governing armed conflict already contains rules that extend far beyond uniformed combatants. The rules contained under article 52 of the Additional Protocol I to the Geneva Conventions establish that objects become military objectives when they make an effective contribution to military action and when their destruction offers a definite military advantage.

Modern digital infrastructure exists directly within that legal logic. Corporate satellite networks, private intelligence platforms, and cloud computing systems can become operational components within a conflict environment even though they remain privately owned.

Technology companies therefore operate in a complex legal and political space where corporate decisions intersect with international humanitarian law, sanctions regulations, and corporate social responsibility.

When a private technology company decides who gets connectivity, cloud computing, satellite imagery, or defensive cyber services during an armed conflict, that company is not merely providing a service; it is exercising a form of power that can affect military operations and diplomatic outcomes.

Subscribe now

Existing laws already have mechanisms that can treat parts of that conduct as connected to the conflict.

The argument that the law does not already label technology firms as belligerents, because international humanitarian law still distinguishes civilians from combatants and civilian objects from military objectives. The law still treats civilian protection as the default.

However, the law is also clear that effects and contributions matter, and business and human rights standards likewise focus on adverse impacts and due diligence rather than on corporate self-description.

The private capabilities that now steer conflict

Let us reflect on commercial satellite connectivity. In plain terms, the same terminals and network can connect civilian services and also carry command communications, drone video, and targeting-related data. It was reported in June 2023 that the United States Department of Defense purchased satellite communications services from Starlink for Ukraine, and it was later reported in July 2025 that a global Starlink outage disrupted Ukrainian military communications, which is a reminder that dependence on a single private network can become an operational reality.

Read more