Share

Newsletter Edition 96

The Honest Truth

The subject of digital identity (“Digital ID”) resonates with everyone because, at some point, we have all had to prove who we are, and we will eventually need to do so more often as public life and commerce migrate into electronic systems that demand confidence in our credentials.

We need to journey through the current state of digital ID in the European Union and the United Kingdom, as they are actively developing this infrastructure. Indeed, the subject is controversial because it sits at the junction of personal autonomy, privacy, government authority and commercial convenience, but it needs to be addressed objectively.

The European Union has spent years developing a framework for digital ID wallets that emphasises user control and cross‑border compatibility, while the United Kingdom is proposing a national digital ID scheme that has triggered a widespread public debate.

In this newsletter edition, we will look at the legal frameworks, the promises of convenience and efficiency, the technical and governance innovations such as zero‑knowledge proofs, and the deep concerns about surveillance and cultural acceptance.

European Union: The Right to a Digital Identity

The European Union laid the foundation for digital IDs with Regulation (EU) No 910/2014 on electronic identification and trust services, commonly referred to as the eIDAS Regulation. In April 2026, the Regulation was amended by Regulation (EU) 2024/1183, which created what is now known as the European Digital Identity Framework.

The legal framework establishes that everyone in the EU has the right to a digital identity under their sole control, enabling them to exercise their rights in the digital environment and participate in the digital economy. It also sets out the requirements for qualified trust service providers.

At the centre of this framework are the European Digital Identity Wallets.

These wallets allow natural (individuals) and legal persons (e.g., companies) to access services across Member States while ensuring the protection of personal data and privacy through secure digital identification.

This is an ambitious project on the surface. A common identity infrastructure that spans national boundaries, yet remains under the control of the individual, hopefully.

The official European Commission description of the Digital Identity Wallet emphasises its functionality.

The wallet is intended to enable users to access:

1. Online and offline public and private services,

2. Store and share digital documents, and

3. Create binding electronic signatures.

Member States are required to make wallets available to every citizen, resident and business by the end of 2026.

The European Commission lists numerous benefits of the digital ID wallet:

1. Easier access to services,

2. Better protection of personal data through selective disclosure,

3. Improved cybersecurity and enhanced fraud prevention.

It also indicates that everyone should always control their digital identity, and that the wallet is the means to do so. Citizens should be able to carry their digital identity with them across the EU, seamlessly crossing borders without losing control of their data.

These statements go beyond marketing and echo a European commitment to fundamental rights, data protection and interoperability.

From a legal perspective, the digital identity wallet is not a database, but a technical tool built upon principles of data minimisation and user consent.

It is important to appreciate the architecture of this system.

The wallet must support functions such as authentication, storage, selective sharing and digital signing.

This means that a user can store everything from a train ticket to a university degree certificate, share only the necessary attributes with a relying party, and provide legally binding electronic signatures.

The European Commission lists practical use cases:

1. Applying for passports or driving licences,

2. Opening bank accounts,

3. Registering SIM cards,

4. Signing contracts,

5. Claiming medical prescriptions, and

6. Carrying digital versions of travel documents.

These examples clearly show how deeply integrated the digital ID wallet is intended to become in everyday life.

The European Commission also links the digital ID wallet to other trust services such as eSignatures, eTimestamps, eSeals and qualified website authentication certificates, which are already recognised across the EU.

Each of these services reduces friction in transactions and increases security, but they also normalise the requirement to prove identity or attributes at every turn.

Implementing Acts and Technical Specifications

The EU legal framework provides high‑level requirements, but the technical details are being fleshed out through implementing acts.

These acts specify standardised rules, procedures and technical specifications. The European Commission publicly consults on these acts, emphasising transparency and allowing stakeholders to influence the design.

The Architecture and Reference Framework (ARF) sets out standards, protocols and formats for information exchange and includes an open‑source reference implementation. This ensures that Member States and service providers can build wallets that are interoperable and secure.

The ARF uses cryptographic techniques to support selective disclosure and verifiable credentials, and it accommodates future additions such as payment functionality and age verification.

One of the most innovative features being discussed is the adoption of zero‑knowledge proofs in age verification.

The European Commission advocates an anonymous age verification application that is compatible with the European Digital Identity Wallet and uses zero‑knowledge proofs.

In this model, the user does not share their date of birth with a service provider but instead provides a cryptographic proof that they fall within a certain age range.

The European Commission claims the app is completely anonymous, works on any device and is fully open source.

Critics have pointed out vulnerabilities in zero‑knowledge implementations, but the concept represents a significant attempt to reconcile privacy with regulatory compliance.

It illustrates how digital identity technology can both protect confidentiality and yet increase the prevalence of identity checks by making them easier to implement.

UK Digital Identity: The BritCard and the National Digital ID Scheme

While the EU has opted for a wallet model emphasising user control and voluntary adoption, the UK has taken a different path.

In March 2026, the UK government published a digital ID scheme explainer that describes a national digital ID stored securely on your phone.

The document says that the UK digital ID will simplify access to UK government services and private sector applications, and it will be free to download.

Employers will be required to use it as evidence of the right to work.

The roll‑out is expected to be complete by the end of this parliament.

The government promised that the police will not be able to demand to see your digital ID as part of a stop and search.

However, right‑to‑work checks and right‑to‑rent checks will become legally dependent upon the digital ID.

Unlike the EU wallet, the UK system is framed as a mandatory credential for “certain purposes”.

The explainer lists the data that will be held:

1. Name,

2. Date of birth,

3. Nationality or residency status, and

4. A photograph.

Additional information such as address may be considered.

The UK government asserts that the digital ID will improve access to public services, reduce identity fraud and toughen employment checks.

It will also streamline verification processes when opening bank accounts or proving age.

Subscribe now

Essentially, the scheme aims to make it easier to prove identity by consolidating credentials in one secure place, increase efficiency by enabling instant verification, reduce wait times for processing and allow easy updating of personal information.

The explainer shows that the system will use state‑of‑the‑art encryption and authentication technologies, storing credentials directly on the user’s device.

User control is described as central: sharing of information should be initiated by the user and the UK government pledges transparency about with whom information is shared.

The explainer also notes that millions of people in the UK lack traditional proofs of identity and that digital ID could reduce exclusion. Assistive technologies such as screen readers, voice commands and biometrics are promised to ensure accessibility.

Unlike the EU wallet, the UK digital ID is presented as a tool for immigration enforcement. The UK government states that it will be a legal requirement for employers to check a digital ID to confirm a worker’s right to work.

Only UK citizens and legal residents will be able to obtain a digital ID, thus excluding undocumented migrants from lawful employment.

The UK government frames this as a deterrent to illegal immigration. The intention to use digital IDs as an instrument of immigration control has contributed to a heated public debate and significant backlash.

The Data (Use and Access) Act and Trust Framework

Behind the scenes, the UK government is building the legal and technical infrastructure to support digital identity through the Data (Use and Access) Act 2025.

Part 2 of the Act entered into force on 1 December 2025, giving statutory footing to the UK digital identity and attributes trust framework (UKDIATF).

The trust framework sets out requirements for digital verification services (DVS) providers and includes supplementary codes and supporting documents.

In March 2026, the government released a pre‑release version of the UK digital verification services trust framework (version 1.0), along with new supplementary codes and supporting documents.

The pre‑release does not yet carry legal effect, but signals the first amendments to the UKDIATF since it became statutory.

The Office for Digital Identities and Attributes will accredit conformity assessment bodies to assess providers before full publication later in the year, and providers must comply with the existing Gamma version of the UKDIATF until 31 March 2026.

The pre‑release introduces several wholesale changes. Providers certified against version 1.0 will be able to use the new UK CertifID trust mark.

The terminology has been updated: the framework is now called the “UK digital verification services trust framework”.

New rules require holder service providers to share metadata about identities and authentication methods with relying parties. The first dedicated rules for orchestration service providers have been released, obliging them to confirm whether the services they orchestrate are on the DVS register.

Subscribe now

Providers must assess the risk posed by other providers losing certification.

Supporting documents are now version‑controlled and include guidance on delegated authority and vouching evidence. A new optional data schema has been introduced. All DVS providers must comply with inclusion and accessibility rules.

These changes may seem technical, but they reflect a maturing regulatory environment in the UK. The UK is moving from a non‑statutory trust framework to a statutory one, establishing accreditation mechanisms and codifying roles.

It is also preparing a public consultation on key issues such as, at what age individuals should get a digital ID, what information the ID should include, which government services should be priority use cases, and how to address obstacles such as digital literacy.

Notably, the consultation is structured in two phases and involves a randomly selected group of 100–120 public participants to ensure broad engagement. This approach acknowledges negative public sentiment and seeks to build legitimacy through deliberative processes.

Criticisms and Privacy Concerns

Digital ID systems promise convenience and security, but they also raise profound questions about privacy, autonomy and social control. Age verification mandates and digital trust technologies can be dangerous.

A coalition of 438 security and privacy scientists described large‑scale access control mechanisms without understanding their implications as socially unacceptable.

The European Digital Rights organisation has criticised age verification schemes for limiting young people’s rights and excluding large portions of the population while lacking effectiveness.

These criticisms extend to the digital identity wallets and age verification apps being promoted by the European Commission.

Although zero‑knowledge proofs preserve data confidentiality by proving an attribute without revealing underlying information, they can normalise constant demands for proof.

The easier it becomes for relying parties to request proofs, the more often individuals may be asked to demonstrate attributes. In this vision of the future mobile phones become keys to digital and physical spaces, reminiscent of Covid‑19 health certificates. This raises concerns about social stratification and the potential for peer policing.

A London School of Economics’ EUROPP blogpost has drawn a stark contrast between the EU’s digital wallet and the UK’s proposed BritCard.

The EU wallet is a user‑controlled data management tool that allows citizens to store credentials and share only the minimum necessary information. By contrast, the BritCard is framed as a single government‑issued credential mandatory for employment verification and immigration control.

This difference matters because citizen acceptance depends on perceived voluntariness and control. The blogpost points to the SOTERIA project, a 2024 pilot that tested a privacy‑first digital wallet with 6,500 citizens in Austria, Romania and Spain.

SOTERIA’s wallet employed selective disclosure, secured storage and high‑level identification.

Despite strong technical credentials, the results were mixed. Spanish participants in a mandatory e‑health pilot showed increased privacy control and intention to use the wallet, while Romanian participants in a voluntary e‑exam scenario reported increased perceived risks and decreased intention. Austrian participants emphasised security perception as critical.

A low number of participants would voluntarily store personal data, but more than sixty percent indicated they would reuse the tool after experiencing it once.

This suggests that initial adoption barriers may be overcome through positive experiences but that context and culture matter.

The same blogpost highlights that the UK government appears to be ignoring lessons from SOTERIA and is instead implementing a mandatory, top‑down system driven by immigration politics.

It goes further to argues that privacy by design is essential and that user control cannot be meaningful if the system is mandatory.

Security experts warn that digital IDs could become a honeypot for cybercriminals, which raises fundamental questions about the business model.

Digital identity infrastructure must be funded by someone, whether through government budgets, service provider fees or citizen payments. Each model has privacy implications because it creates an incentive to track transactions.

Following backlash, the UK has now decided not to make the digital ID system mandatory and government funded, raising concerns about surveillance and fiscal sustainability.

Europe’s more principled approach preserves the possibility of privacy‑respecting implementation, but struggles with sustainable funding. Cultural context is also significant. Britain abolished identity cards after the Second World War and has a history of resistance to national IDs. Requiring a one‑size‑fits‑all digital ID on a population historically hostile to such schemes risks failure.

Some Reflections: Identity, Power and Autonomy

Behind the technical and legal discussions lies a deeper philosophical question: what does it mean to have a digital ID?

The concept of identity has always been relational and contextual. A passport or driver’s licence does not create a person’s identity; it is a credential recognised by institutions.

In the digital realm, the same logic applies, but the possibilities for surveillance and control are vastly expanded.

A digital wallet that stores everything from educational qualifications to health data can empower individuals to prove attributes easily, yet it can also create a map of a person’s life that is accessible to whoever controls the infrastructure.

One can see these differences as manifestations of different political cultures: one rooted in rights‑based constitutionalism, the other in administrative pragmatism and law enforcement.

The adoption of zero‑knowledge proofs touches upon another emerging issue, i.e., trust.

The promise of zero‑knowledge proofs is that we can trust each other without revealing secrets. At the same time, these mechanisms make it trivial to request proofs for every interaction, which can erode trust by creating an expectation of constant verification.

Leave a comment

Paradoxically, technologies designed to enhance privacy can enable more pervasive control. This tension requires careful governance. It also raises questions about the role of private companies that provide the e-infrastructure or verification services.

In Europe, the emphasis on open standards and public consultation reflects a desire to democratise the design of digital ID systems. The UK consultation likewise attempts to involve citizens, but the nature of the scheme and its association with immigration enforcement may undermine trust.

Identity is also about belonging. In a multicultural union such as the EU, a digital wallet can symbolically unite citizens by providing a standardised credential that works across borders. This fosters a sense of European citizenship.

In the UK, the digital ID is explicitly used to exclude those who are deemed to have no right to work. This highlights how identity documents can be used both to include and to exclude.

The challenge is to design systems that recognise individuality and autonomy while preventing exclusion and discrimination.

The EU’s insistence that digital identity is a right, not an obligation, reflects this aspiration.

Whether Member States will implement this in a way that respects cultural differences and local norms remains to be seen.

Table: Comparing EU and UK Digital Identity Frameworks

The table illustrates the fundamental differences between the EU and UK approaches.

The EU emphasises decentralisation, selective disclosure and voluntary use. The UK proposes a centralised credential that is mandatory for employment, raising concerns about consent and surveillance.

Both systems rely on legislation and technical standards, but they embed different assumptions about identity and governance.

Myths, Mysteries or Monstrosities?

Throughout debates about digital identity, we encounter myths. One myth is that digital identification is purely a technical matter. In reality it is profoundly political and social. Technology choices embed values. The decision to use zero‑knowledge proofs, for example, establishes a commitment to data minimisation, but the absence of an obligation to use such proofs in the EU’s eIDAS 2.0 regulation suggests that not all Member States are ready to commit.

Another myth is that digital ID will automatically reduce fraud and improve efficiency. It might do so, but it also increases the attack surface for cybercriminals and may centralise valuable data.

A third myth is that government funding eliminates the need to think about business models. Funding mechanisms can create incentives for data monetisation.

Subscribe now

The mystery lies in how these systems will evolve once deployed. Will voluntary EU wallets become ubiquitous, or will they coexist with national e‑ID schemes?

Will the UK’s digital ID foster trust or provoke resistance? These questions cannot be answered definitively, but we can examine early signals.

The EU’s emphasis on consultation and iterative design suggests flexibility. The UK’s focus on enforcement may face cultural headwinds.

You will be within your rights to consider the UK’s digital ID roll-out as a monstrosity because they conjure images of total surveillance or dystopian control. Such language is understandable given the stakes.

However, it is more constructive to recognise that digital identity is a tool. Like any tool, it can be used to empower or to control. Its impact depends on legal safeguards, technical design, cultural acceptance and political accountability.

Monstrosity arises not from the technology itself, but from the imbalance of power it can facilitate.

A mandatory ID tied to employment and immigration status without robust privacy protections can become a mechanism of exclusion.

An optional wallet with granular consent can enhance convenience and autonomy. The challenge is to design and govern digital identity in a way that respects individual rights, supports social cohesion and fosters innovation.

As we stand at this inflection point, it is imperative to engage critically and philosophically with digital identity.

We must consider how these systems affect autonomy, equality, trust and belonging.

We must ask how they interact with cultural histories and political priorities.

We must also recognise that technology alone cannot resolve the dilemmas of identity; governance, accountability and public deliberation are essential.

Our hope is that this exploration will encourage you to think deeply about digital identity, to engage with the consultations and debates, and to demand systems that enhance rather than diminish our collective freedoms.

Only through informed and thoughtful participation can we ensure that the mysteries and myths around digital ID do not become monstrosities.

What are your thoughts about the imminent roll-out of digital IDs in the EU and UK? Please share your thoughts in the comment section.

Leave a comment

Share this newsletter

Technology law is entering a more confrontational phase. Governments are no longer treating AI as a neutral productivity tool but as a system capable of influencing constitutional rights, criminal investigations, healthcare, public trust, and democratic authority itself. This edition examines the EU’s decision to delay parts of the AI Act while expanding prohibitions, Canada’s findings against OpenAI’s data practices, the constitutional implications of geofence warrants before the U.S. Supreme Court, and the growing normalisation of AI within policing and surveillance institutions. Greece’s proposal to constitutionalise AI oversight and the UAE’s expansion into AI-driven legal services.

Share this newsletter

Newsletter Edition 95

🔥 This edition includes many important technology law news and updates from the EU, U.S., Canada, U.A.E, Greece and other jurisdictions. Also, keep reading to view the latest opportunities, including free courses, events, scholarships, and a list of remote tech lawyer jobs.

Lead Story

EU leaders agree to amend the EU AI Act: Deal reached on the AI Omnibus Regulation

On 7 May 2026, the Council of the European Union and the European Parliament announced a provisional political agreement to amend the EU AI Act.

The amendments, negotiated as part of a digital omnibus package, do not alter the AI Act's underlying structure but adjust the timelines for certain obligations and tighten prohibitions on specific AI practices.

Key elements of the provisional agreement

• Deferred application of high‑risk obligations. Under the current AI Act, high‑risk obligations for use cases listed in Annex III, such as biometric identification, critical infrastructure, education, employment, law enforcement and border management, would apply from 2 August 2026. The provisional agreement pushes these obligations to 2 December 2027, giving additional time for implementation. AI components that are safety parts of sectoral products (Annex I) will now be enforced from 2 August 2028, rather than 2 August 2027. These dates are fixed regardless of the availability of harmonised standards.

• Watermarking and generative AI output detection. A new deadline of 2 December 2026 will apply to generative AI providers obligated to detect and watermark AI‑generated content. This postponement aims to align with the development of technical tools and standards while ensuring that generative systems remain traceable.

• Prohibition of “nudifier” apps and AI‑generated child sexual abuse material (CSAM). The agreement explicitly bans AI systems that generate non‑consensual intimate imagery or CSAM. Providers must comply with this prohibition by 2 December 2026. The ban addresses concerns over tools that digitally remove clothing or synthesise exploitative images without consent.

• Registration and transparency requirements. Providers of “exempted” AI systems — systems originally classified as high‑risk but deemed low risk through derogations — must continue to register their models in the EU’s public database, albeit with simplified information requirements. Meanwhile, high‑risk providers still need to conduct conformity assessments, maintain documentation and provide risk management systems.

• Bias detection using sensitive data. The amendment broadens the scope for using sensitive personal data (for example, data revealing racial or ethnic origin) to detect and correct biases in AI systems, but processing must be strictly necessary and limited to addressing specific bias types. This reflects the EU’s recognition that accurate bias detection sometimes requires access to sensitive attributes.

• Other clarifications. The omnibus removes overlapping obligations for AI embedded in machinery products, narrows the concept of “safety components” and centralises enforcement of certain general-purpose AI systems under the EU AI Office. It also reduces the volume of information required for registration and tasks the Commission with issuing guidance on classification.

What are the implications of these changes?

The provisional agreement preserves the EU’s risk‑based framework while giving organisations more time to prepare for high‑risk obligations and generative AI watermarking.

Subscribe now

The explicit ban on “nudifier” tools and AI‑generated CSAM shows regulators taking a firm stance on preventing abuse.

The deferral should not be seen as a reprieve; organisations developing or deploying AI must continue building compliance programmes and documenting risk management.

Once finalised and formally adopted, these amendments will mark the first major adjustment to the world’s most comprehensive AI regulation.

Important Technology Law Updates

1. Department of War releases UFO and UAP files: what does space law say

On 8 May 2026, the U.S. Department of War (DoW) published more than 160 previously classified files related to unidentified anomalous phenomena (UAP) and unidentified flying objects (UFOs).

The release follows President Donald Trump’s directive to increase transparency about UAPs and directs the DoW, in collaboration with the Office of the Director of National Intelligence, to declassify unresolved cases.

The files include photographs, videos and transcripts of Apollo missions. Notably, they capture, among other things, an alleged 1947 report of “flying discs” and transcripts from Apollo 12 and 17, where astronauts observed bright particles and unusual phenomena.

The DoW emphasised that these cases remain unresolved because they lack sufficient data for definitive conclusions, and it invited private‑sector researchers to examine the materials.

Although some commentators and enthusiasts hoped that the release would confirm extraterrestrial life, the files provide no conclusive evidence of alien technology.

Critics have suggested the release may deflect attention from terrestrial military spending or other policy issues.

Nonetheless, the disclosure presents a useful moment to revisit international space and technology law.

Space law context

The Outer Space Treaty of 1967, the foundation of international space law, outlines several principles relevant to UAP disclosures. It stipulates that the exploration and use of outer space must benefit all countries; outer space and celestial bodies cannot be appropriated by states; and activities must be conducted for peaceful purposes.

States are responsible for national space activities and liable for damage caused by their space objects. The treaty also emphasises the need to avoid harmful contamination and to recognise astronauts as envoys of mankind.

If future evidence shows that UAPs originate from human technology (for example, secret military spacecraft), questions could arise about compliance with the treaty’s prohibition of weapons of mass destruction in orbit and the requirement that celestial bodies be used exclusively for peaceful purposes.

Conversely, if extraterrestrial origin were ever substantiated, states would need to consider how the “province of all mankind” principle applies to contact with non‑state entities.

The release, therefore, encourages jurists to think beyond speculation and to consider whether existing frameworks adequately regulate unknown phenomena.

Transparency and governance

The DoW’s release also highlights how governments balance national security with public interest. The files were previously withheld due to classification. Transparency advocates argue that withholding information can fuel conspiracy theories and undermine trust.

Declassifying unresolved phenomena carries its own risks: adversaries could infer U.S. surveillance capabilities, or citizens could misinterpret ambiguous data. Future disclosures may require international coordination to ensure that released information aligns with obligations under space treaties and fosters collaborative research rather than unilateral narratives.

2. Greece proposes a constitutional amendment on AI

Greece, historically known as the birthplace of democracy, has proposed a constitutional amendment that would explicitly mention artificial intelligence.

Prime Minister Kyriakos Mitsotakis explained that the amendment aims to ensure that AI serves human freedom and social prosperity, while mitigating risks. He emphasised that AI should not undermine individual rights, democratic processes or equal access to public services.

Leave a comment

Why a constitutional amendment?

For years, governments, including the EU, have approached AI regulation through the lens of consumer protection, including mandating transparency disclosures, creating risk categories and imposing fines for non‑compliance.

Greece’s proposal goes further by positioning AI as a matter of constitutional order. This reflects an emerging consensus that AI is not just a consumer product but a public governance tool.

AI systems influence elections, policing, welfare administration, tax systems and border control. When AI begins to impact state power, fundamental constitutional principles (dignity, proportionality, equality and due process) become relevant.

Constitutions are designed to restrain power and protect individuals; in the digital age, this restraint must cover both government use and private platforms that operate as gatekeepers of information.

Details of the proposal

Although the exact text of the amendment has not been finalised, it will likely include a clause stating that AI must respect human dignity and fundamental rights and that Parliament may regulate AI to protect democratic order.

Greece is already experimenting with AI in border surveillance, tax administration and other public services.

Lawmakers hope that embedding AI principles into the constitution will provide a foundation for future legislation and judicial interpretation.

Global implications

If adopted, Greece’s constitution would be among the first to explicitly address AI. It could influence discussions within the EU and beyond.

For example, the EU’s AI Act regulates AI through ordinary legislation; a constitutional clause adds an additional layer of protection that cannot be easily amended.

3. Joint investigation into OpenAI’s data processing practices

Canada’s privacy regulators have been at the forefront of scrutinising large AI models. On 25 April 2026, the Office of the Privacy Commissioner of Canada (OPC), along with the privacy commissioners of Québec, British Columbia and Alberta, released a joint report on their investigation into OpenAI’s data practices.

The investigation began with a complaint regarding ChatGPT’s handling of personal information during training and in user interactions.

Key findings

OPC concluded that OpenAI’s initial training of ChatGPT contravened Canadian privacy law. OpenAI collected and used personal information from publicly accessible websites without valid consent and did not provide sufficient transparency about its practices.

According to the report, OpenAI lacked a legal basis under federal and provincial laws for processing personal data. The investigation also criticised OpenAI for failing to adequately address accuracy and accountability issues, such as providing users with incorrect or biased information.

Subscribe now

OpenAI cooperated with the investigation and implemented several measures throughout the investigation. These include limiting the use of personal information in training, removing sensitive data from datasets, publishing a blog post about privacy practices, retiring older models such as GPT‑3.5 and 4, and improving procedures for individuals to challenge inaccurate outputs.

OpenAI also committed to implementing additional measures in the coming months, such as better consent mechanisms and data retention policies.

The Privacy Commissioner of Canada found the complaint well‑founded but conditionally resolved because the corrective measures addressed the primary concerns.

Québec’s commissioner emphasised that implied consent is inadequate when the collection or use of information is outside individuals’ reasonable expectations, involves sensitive data or creates a meaningful risk of harm. The regulators concluded that modern privacy laws need to catch up with generative AI models and called for legislative reform.

What do AI developers need to do?

Training AI models on public data does not automatically exempt organisations from privacy obligations. Consent must be meaningful, and individuals should have mechanisms to verify, correct or delete their data from training datasets.

Organisations operating in multiple jurisdictions face a patchwork of privacy laws; Canada’s case shows that provincial commissioners can jointly investigate AI developers and impose compliance commitments.

Developers should build privacy into their designs, minimising data collection and ensuring explicit consent where required.

Case of the Week

Litigants: United States v. Chatrie
Citation: 136 F. 4th 100 (4th Cir. 2025), cert. granted, 2026 WL 120676 (U.S. Jan. 16, 2026) (No. 25-112)

Facts and dispute

On 8 July 2019, a bank in Richmond, Virginia, was robbed. As part of their investigation, police obtained a “geofence warrant” compelling Google to provide information on all devices that had been within a 150‑metre radius of the bank around the time of the robbery.

Google responded with anonymised location data for dozens of devices. Investigators then asked Google to expand the time frame and requested more specific data on nine accounts (Step 2), followed by subscriber information for three accounts (Step 3) that matched suspect movements. Police identified Okello Chatrie as one of the device owners and charged him with robbery.

Subscribe now

Chatrie moved to suppress the evidence, arguing that the geofence warrant violated the Fourth Amendment. The U.S. District Court for the Eastern District of Virginia agreed that the warrant was overly broad because it gathered data on many innocent individuals and allowed investigators to narrow results without judicial oversight.

However, the court declined to suppress the evidence due to the “good faith” exception.

On appeal, a divided panel of the Fourth Circuit held that Chatrie lacked a reasonable expectation of privacy in his location data because he voluntarily carried a smartphone and had location services enabled. The full Fourth Circuit was evenly split en banc, leaving the panel decision intact.

Legal issues and questions before the Supreme Court

The central question was whether geofence warrants, which compel companies to disclose location data for all devices in a defined area during a specified time, satisfy the Fourth Amendment’s probable cause and particularity requirements.

Traditionally, warrants must specify the person or place to be searched and the items to be seized. In the Chatrie case, the warrant targeted an area and time period rather than a particular suspect. It could be argued that it functioned more like a general warrant by casting a digital dragnet over dozens of individuals. Supporters may counter that geofence warrants are a necessary investigative tool in the digital era and that anonymisation, combined with judicial oversight, minimises intrusions.

It is anticipated that the court may issue a narrow ruling focusing on whether additional judicial oversight is needed during the multi‑step narrowing process rather than banning geofence warrants outright.

The multi‑step process—where investigators request anonymised data, then expand or narrow the time frame, and finally seek subscriber information—may be seen to lack separate warrants or judicial review after the initial authorisation.

The Court may address whether each step constitutes a separate search requiring independent probable cause and whether general warrants are permissible in the digital context.

Decision and potential impacts

At the time of writing, the Supreme Court has not issued its decision. If the Court upholds the warrant, law enforcement agencies will continue to use geofence warrants with minimal changes.

However, if the Court rejects the warrant as unconstitutional, it could limit or eliminate the use of geofence warrants nationwide. This would require law enforcement to develop alternative investigative methods and may lead to new privacy protections for location data.

Leave a comment

A narrow decision might require courts to oversee each step of a geofence search, ensuring that investigators cannot unilaterally narrow or expand data sets without additional warrants.

Such a ruling could also impact other general data warrants, such as those for cell‑site location information or IP addresses. Regardless of the outcome, Chatrie will likely shape the future of digital privacy law and clarify how constitutional protections apply to novel surveillance techniques.

Other Developments in Technology Law

1. Ashley MacIsaac sues Google over AI Overview mix‑up

Canadian fiddle virtuoso Ashley MacIsaac filed a defamation lawsuit against Google after the company’s AI Overview product falsely asserted that he had been convicted of sexual crimes.

According to the statement of claim, AI Overview summarised search results by saying MacIsaac had committed sex crimes and was convicted of sexual assault; the information was entirely false and not present in the sources that the AI summarised. MacIsaac learned of the defamatory statement when a concert venue cancelled a performance and later discovered that the AI system repeated the false allegations across various queries.

The lawsuit seeks at least USD 1.5 million in damages. MacIsaac’s lawyers argue that Google should be held liable for the statements generated by its AI because the system functions as a publisher and presents its outputs as factual summaries.

Google responded that AI Overviews are dynamic and automatically generated. Google eventually removed the erroneous summary and said it uses such incidents to improve its models.

The case raises questions about whether AI companies can be liable for defamation when their models produce false statements based on training data.

It also illustrates how AI summarisation tools can amplify inaccuracies and cause reputational harm. Courts will somehow need to consider whether existing defamation law applies to machine‑generated speech and whether AI providers have a duty to pre‑screen outputs for accuracy.

2. UAE’s AI‑powered legal platform Legaline launches

Dubai‑based Legaline, launched on 6 May 2026, touts itself as the first full‑cycle AI‑native legal services platform in the United Arab Emirates. The company developed its own AI stack using in‑house machine‑learning and neural‑network engineering and built a corpus of more than 60 000 searchable legal passages.

Legaline is designed for the complex UAE legal environment, covering federal laws, seven emirate‑level systems, the Dubai International Financial Centre (DIFC), the Abu Dhabi Global Market (ADGM) and more than 40 free zones. Its AI supports research across 33 jurisdictions and offers real‑time translation among English, Russian and Arabic.

The platform combines multiple tools: a public AI information assistant called “Baby Legal Bot” that helps users understand regulatory jurisdictions; an AI research assistant for lawyers with inline citations; an AI deliberation tool called “Brainstorm” that uses different foundation models to generate analytical diversity; and an automated document drafting module generating commercial documents within seconds while including references to current laws.

Subscribe now

Legaline also integrates an end‑to‑end workflow where clients post tasks, lawyers bid through a closed auction, negotiation and signing occur in an in‑app chat, and payment is held in escrow until completion. The company emphasises that its AI tools are trained exclusively on primary UAE legal sources and that user data is not used to train models.

3. Kash Patel and the normalisation of AI in law enforcement

FBI Director Kash Patel has become a prominent advocate for AI in law enforcement. In a recent interview, he claimed that AI was not used at the FBI until the current administration and that he is now “using it everywhere.”

Patel credited AI with stopping a potential school shooting in North Carolina and another in New York by quickly analysing tips and triaging threats. He also said AI has enabled the FBI’s National Threat Operations Center to sift through thousands of weekly tips and to “pop fingerprints immediately” in its criminal databases.

According to Patel, the FBI has embedded major tech companies into its infrastructure to build AI tools and modernise its systems.

While Patel portrays AI as a force multiplier, his comments illustrate a broader trend which is the rapid integration of AI into law enforcement without broad public deliberation.

The ability to triage tips and match fingerprints quickly can help prevent crimes, but it also raises concerns about due process, bias, accountability and transparency. When AI tools screen large volumes of data, there is a risk of false positives that can lead to unwarranted scrutiny.

Many predictive policing systems have been shown to reflect and magnify existing biases in data.

Critics worry that normalising AI in law enforcement could entrench opaque surveillance techniques and reduce human oversight.

Technology Law

Predictive Policing Is Making Marginalised Communities Live Under Permanent Suspicion

Predictive policing has turned suspicion into a routine administrative category that follows people long before any conduct occurs, and it is astonishing how easily this practice has been accepted as a normal feature of public safety. The idea that an algorithm can pre-assign risk to entire neighbourhoods and individuals has been absorbed into policing …

Read more

6 months ago · 16 likes · 7 comments · Technology Law

The U.S. legal framework has not kept pace with AI’s proliferation in policing. Unlike sectors such as healthcare or finance, law enforcement often employs AI without sector‑specific regulation. Chatrie v. United States, discussed above, indicates how new surveillance methods challenge constitutional protections.

Democratic institutions must examine whether traditional oversight mechanisms suffice. Questions include: should AI‑generated leads be subject to judicial review before action is taken? How can agencies ensure that training data does not encode racial or socio‑economic bias? How should AI vendors be vetted for law enforcement use? Policy makers must engage with these issues to avoid normalising AI surveillance without legal safeguards.

Latest Opportunities

Remote jobs for lawyers

1. Enterprise Account Executive DACH, Legal Tech, €80k base + 100% OTE (Remote Germany): DACH region Enterprise Account Executive to lead enterprise sales strategy, contract negotiations, and customer growth (find out more).

2. Counsel, Applied Legal Research (Remote Singapore): Centari is hiring a transactional lawyer for its Applied Legal Research team to help develop AI tools for corporate legal work, combining expertise in corporate transactions, legal analysis and generative AI product development (find out more).

3. Legal Expert (Remote UK): A remote‑based legal expert role advertised by a UK consultancy seeks professionals with expertise in technology law and digital regulation (find out more).

4. Junior/Mid AI Legal Specialist, EverAI (Remote UK): This role is aimed at lawyers or legal specialists interested in AI governance and product support (find out more).

Conferences, fellowships, scholarships, and calls for papers

5. Full scholarship (PhD & Postdoc): AI, medical law and ethics (The University of Amsterdam, Netherlands): Two fully funded PhD positions and one postdoctoral role in AI, medical law and ethics. Projects cover generative AI in healthcare and fairness in medical AI. Applications closes 18 May 2026, with a September 2026 start (find out more - PhD and Postdoc).

6. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words. (find out more).

7. Free Microsoft Virtual Training Day: Introduction to Azure (18 May 2026): Microsoft’s free virtual event offers a foundational overview of cloud concepts, core Azure services across compute, networking, storage and identity and demonstrates AI tools. Participants who complete the session receive a 50 percent discount on the Azure Fundamentals certification exam (find out more).

8. AI, Justice and the Rule of Law (Free Course): UNESCO and the University of Oxford are offering a free self‑paced online course launched on 27 April 2026 to equip judges, lawyers and students with an understanding of how AI interacts with human rights and legal reasoning (find out more).

This edition of weekly briefing highlight a growing problem between innovation and regulation.

Europe is attempting to reform its AI Act to balance technological progress with fundamental rights, while Greece proposes embedding AI principles into its constitution. Canada’s regulators are reprimanding AI developers that privacy obligations apply even when data is publicly available.

AI is gradually becoming pervasive, but we must insist that it serves human dignity, accountability and the rule of law.

Leave your comments to join the conversation.

Leave a comment

Disclaimer

This newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the authors alone.

This briefing examines the Musk v. Altman dispute over AI governance and organisational restructuring; regulatory failures exposed by South Africa’s withdrawal of its AI policy; Cambodia’s aggressive cybercrime response to cyber-slavery; and rising sanctions for AI-generated legal errors, revealing systemic weaknesses in oversight, incentives, and professional responsibility.

Share this newsletter

Newsletter Edition 94

🔥 This edition includes many important technology law news and updates. Also, keep reading to view the latest opportunities, including free courses, events, and a list of remote tech lawyer jobs.

Lead Story

Elon Musk v. Altman: the case so far

The courtroom battle between Elon Musk and OpenAI’s co‑founder, Sam Altman, has captivated observers of AI and corporate governance. Elon, who invested tens of millions of dollars in the early days of OpenAI, claims that the organisation betrayed its charitable mission by spinning out a for‑profit arm and selling equity to investors.

At stake is not only the fate of a generative‑AI powerhouse, but also questions about donor intent and the governance of technology nonprofits.

Background and legal claims

Elon co‑founded OpenAI in 2015 as a nonprofit research lab, pledged to develop artificial intelligence for the benefit of humanity. Elon Musk and other donors, including Peter Thiel and Reid Hoffman, contributed funds with the understanding that OpenAI would remain non‑profit and open.

As computing demands grew, the board created a for‑profit subsidiary in 2019 and allowed investors to purchase capped equity. The restructure attracted billions of dollars from Microsoft and other investors, enabling OpenAI to build large language models such as GPT‑4.

Elon alleges the shift to a for‑profit entity violated the original charter and seeks the removal of Altman and unwinding of the structure. OpenAI counters that Musk knew about the plan and that the restructure was necessary to fund the expensive research.

Leave a comment

What are the economic stakes?

The case could impact OpenAI’s valuation, which climbed to roughly $80 billion after recent funding rounds. A judgment in Elon Musk's favour could force the organisation to revert to a nonprofit model or return donor funds, potentially derailing its initial public offering.

It has been noted that the cost of training cutting‑edge AI models can exceed hundreds of millions of dollars, making purely charitable funding impractical. This case reinforces the tension between mission and commercialisation.

While Elon Musk contends that AI safety requires nonprofit stewardship, Altman argues that the investment structure allowed them to compete with corporations such as Google and Meta.

What happened in court?

During the first week of the trial, the judge repeatedly emphasised that the case was about alleged deception. Elon Musk’s team attempted to argue that unrestricted AI posed an existential threat, but the judge directed them to focus on whether Musk had been misled about the restructure.

Elon testified that he discovered the for‑profit arm only after the fact and that he never consented to it.

Under cross‑examination, however, lawyers presented emails suggesting Elon was aware of the new structure. Elon also admitted that his new company, xAI, uses OpenAI models and described his company as socially beneficial.

The defence argued that Musk left the board before the restructure and that he previously praised hybrid models similar to those adopted by competitor Anthropic.

Wider implications

The trial has become a proxy battle over AI governance. It is natural to worry that a sweeping verdict could discourage philanthropy in cutting‑edge science/tech if donors can later unwind corporate decisions.

On the other hand, nonprofit advocates argue that donors have a right to ensure their contributions are used as promised.

The case also surfaces conflicts of interest: Elon Musk now heads xAI, a competing AI company, and has indicated he would invest personally if OpenAI remains nonprofit.

This trial could open the door to similar claims by other donors and test whether creative corporate structures, such as capped‑profit entities, can satisfy charitable obligations.

Subscribe now

What happens next?

The trial is expected to last several weeks (or months), with testimony from Altman, board members, and experts on charitable law. Even if Elon prevails, it is unlikely the court will unwind the entire restructuring, as investors, including Microsoft, may negotiate settlements.

If Altman’s camp wins, it could strengthen hybrid models for AI research and solidify OpenAI’s path to a public offering.

Regardless of the outcome, the case will shape conversations about governance of AI labs and the responsibilities of tech philanthropists.

Technology Law Tracker: Other Significant Updates

1. Meta: a playground for scammers?

A class‑action complaint filed by the Consumer Federation of America (CFA) accuses Meta Platforms of turning its social media advertising system into what plaintiffs call a “pillar of the global fraud economy.”

The lawsuit, filed under Washington, D.C.’s consumer protection law, alleges that between 2021 and 2023, consumers lost at least 2.7 billion US dollars to scams on platforms like Facebook and Instagram.

Internal documents cited in the complaint purportedly show that Meta managers knew that a significant percentage of advertising revenue came from scam or high‑risk advertisers and that the company charged those advertisers higher rates rather than banning them.

The CFA claims Meta calculated that more than one-third of scam victims interacted with ads on its platforms and that the company collected around 16 billion US dollars from scam and banned‑goods ads during the period.

The lawsuit alleges that Meta publicly promoted its anti‑scam efforts while privately deeming certain advertisers “high value accounts” and granting them special leniency; such accounts could accumulate hundreds of strikes before being removed, whereas small advertisers were blocked after eight violations.

The plaintiffs argue that Meta’s advertising policies created a perverse incentive by profiting from fraud while diminishing consumer trust.

Leave a comment

They seek damages, punitive damages, and an injunction to reform the company’s advertising practices. Meta has not publicly commented on the details, but the case highlights the legal risks for online platforms whose revenue models rely heavily on targeted ads.

Regulators and consumer advocates view the complaint as a test of how consumer protection laws apply to digital advertising and of social media companies' responsibilities to police fraud.

2. The South African government withdraws its AI policy because of AI-generated content

South Africa’s government withdrew its draft national AI policy after journalists discovered that parts of the document were generated by AI and cited fake research.

The draft AI Policy included references to nonexistent journals and misattributed articles, revealing a failure of human oversight.

Communications minister Solly Malatsi acknowledged that unverified citations compromised the policy’s integrity and said that those responsible would face consequences.

The AI policy aimed to establish a National AI Commission, an ethics board and a regulatory authority, while offering tax incentives and grants to promote AI development. However, the reliance on AI‑generated text raised questions about authenticity and transparency.

The incident is worrying, exposing how easily generative AI content can produce plausible, but false references and how governments must verify sources before publishing.

Policy development agencies should emphasise information integrity, accountability, and human oversight. AI hallucinations can quickly undermine trust in governance and highlight the risk of embedding errors into future regulations.

The government has promised to revise the policy with proper vetting, setting an important lesson for policymakers: AI tools can assist research, but cannot replace careful human scrutiny.

3. Cambodia targets scam compounds with new cybercrime law

Cambodia’s parliament approved a cybercrime law aimed at dismantling scam compounds that have enslaved tens of thousands of people and lured victims worldwide with romance scams and bogus cryptocurrency schemes.

Authorities estimate that up to 150,000 people have been forced to work in these compounds, which are often run by transnational organised crime syndicates.

The new law makes online scams punishable by prison terms of two to five years and fines up to 125,000 US dollars; for operations involving multiple victims or gangs, the penalties rise to 10 years and 250,000 US dollars; ringleaders who traffic or torture workers face up to 20 years and fines up to 500,000 US dollars.

Subscribe now

The U.S. Department of Justice reports that scam centers across Southeast Asia coerce workers into conducting fake investment schemes, often operating through encrypted messaging apps and websites.

The DOJ’s Scam Center Strike Force recently charged Chinese nationals who managed a cryptocurrency fraud compound and seized a Telegram channel that recruited victims. U.S. officials estimate the strike force has frozen more than $ 700 million in funds linked to scams.

Cambodia’s law complements these international efforts by criminalising scam operations, providing legal tools to prosecute traffickers, and mandating support for victims. We hope the legislation will deter abuses and restore Cambodia’s reputation, though effective enforcement and cooperation with foreign partners will be essential, of course.

Case of the Week

Litigants: Couvrette v. Wisnovsky et al
Citation: No. 1:2021cv00157 - Document 227 (D. Or. 2026)

Background

Couvrette v Wisnovsky originated as a dispute among members of an Oregon family that owns Valley View Winery. The plaintiffs accused their relatives of breaching fiduciary duties and mismanaging trust assets.

As litigation progressed, plaintiffs’ counsel used generative‑AI tools to draft three summary judgment briefs. These filings included 15 nonexistent case citations and eight fabricated quotations, leading the court to sanction the lawyers for misusing AI.

Sanctions and fee awards

In a December 2025 order, U.S. Magistrate Judge Clarke held that the misrepresentations amounted to a failure to comply with the court’s local rules and the attorneys’ duty of candor.

The judge imposed a $15,500 penalty on pro hac vice counsel Michael Brigandi for the false citations and ordered defendants to file a motion detailing reasonable attorney’s fees and costs.

Clarke emphasised that lawyers cannot delegate their professional responsibility to verify the accuracy of citations to artificial intelligence and described the errors as part of a pattern of disregard for procedural rules. The court also vacated the withdrawal of local counsel Michael Murphy and instructed him to show cause why he should not be sanctioned.

In March 2026, the court granted the defendants’ motion for fees and costs. The court records show that the judge awarded approximately 94,704 US dollars in attorney fees and costs: 80,498.72 US dollars against Brigandi and 14,205.66 US dollars against Murphy.

The order further required Murphy to file the opinion with any future pro hac vice motions and noted that he failed to meaningfully participate as local counsel.

Combined with the earlier penalty, the monetary sanctions exceed 110,000 US dollars, making it one of the most significant AI‑related content hallucination sanction orders in U.S. courts.

Legal issue

The key legal question was whether the attorneys violated professional rules by submitting briefs with fabricated authorities and whether local counsel sufficiently supervised pro hac vice counsel.

The court held that attorneys cannot rely on AI tools without verifying their output and that local counsel must review all filings prepared by out‑of‑state lawyers. The court treated the attempt to file corrected briefs as part of the misconduct, not a cure, and dismissed the plaintiffs’ claims with prejudice.

The significance of this case

Couvrette v Wisnovsky exposes the ethical risks of generative AI in legal practice. Courts are increasingly sanctioning lawyers for citing hallucinated cases, reminding practitioners that AI may assist research but cannot replace professional judgment.

The case also highlights local counsel's responsibility to supervise filings; they cannot serve merely as names on a docket.

The significant monetary sanctions show that courts will impose meaningful penalties to deter misuse and protect the integrity of judicial proceedings. AI‑assisted tools will become commonplace; lawyers must implement robust verification processes and maintain accountability to avoid similar embarrassing outcomes.

Other Developments in Technology Law

1. A decade of the GDPR

Last week marked the 10th anniversary of the General Data Protection Regulation (GDPR), adopted on 27 April 2016. The GDPR codified clear rights for individuals, such as access, erasure, and data portability, and established the European Data Protection Board (EDPB) to coordinate cross-border enforcement.

Over the past ten years, national data protection authorities have used the regulation’s “one‑stop shop” mechanism to cooperate on large‑scale cases. The EDPB notes that the GDPR now interacts with the Digital Services Act, Digital Markets Act and AI Act, providing a foundation for a broader digital regulatory ecosystem.

2. Microsoft’s Legal Agent enters Word

On 30 April 2026, Microsoft introduced a “Legal Agent” for Word through its Frontier early‑access program. Unlike general chatbots, the Legal Agent follows structured workflows tailored to how lawyers work.

Microsoft explains that legal documents require precise clause analysis, redlining and adherence to internal policies. To meet these needs, the agent uses deterministic insertion layers rather than free‑form text generation.

Subscribe now

It can review contracts against playbooks, suggest redlines with tracked changes and provide citations for each recommendation. The legal agent operates within the Microsoft 365 security and compliance framework.

3. Swiss competition authority investigates search advertising pacts

The Swiss Competition Commission (ComCo) opened two investigations on 30 April 2026 into potential coordination in search engine advertising. The probe examines whether travel companies and online casino operators agreed not to bid on each other’s brand names in keyword auctions on platforms like Google and Bing.

Such agreements could distort competition by limiting the visibility of competitors’ offers and making it harder for consumers to compare prices. Reuters reports that ComCo is questioning three travel firms and nearly all online casinos in Switzerland and will consult search engines as part of the investigation. If ComCo finds an unlawful agreement, companies could face fines and injunctive orders.

4. Crime and Policing Act 2026 brings digital protections in the UK

The United Kingdom’s Crime and Policing Act 2026 has received Royal Assent and introduces a suite of measures to address digital harms and modern crimes.

Technology Law

Predictive Policing Is Making Marginalised Communities Live Under Permanent Suspicion

Predictive policing has turned suspicion into a routine administrative category that follows people long before any conduct occurs, and it is astonishing how easily this practice has been accepted as a normal feature of public safety. The idea that an algorithm can pre-assign risk to entire neighbourhoods and individuals has been absorbed into policing …

Read more

6 months ago · 16 likes · 7 comments · Technology Law

Among its provisions, the Act criminalises the manufacture and distribution of “nudification tools” that use AI to simulate clothing removal from images.

It makes it an offence to take or share screenshots of intimate images without consent and requires online platforms to remove non‑consensual intimate images within 48 hours of notification. Courts can order deletion of such images.

The Crime and Policing Act also extends offences related to paedophile manuals to include instructions on generating child sexual abuse material with AI and holds website moderators and administrators liable for hosting this content.

Beyond online harms, the Act gives police new powers to compel drug testing and seize stolen goods via warrantless entry and expands data‑sharing with the Driver and Vehicle Licensing Agency.

It introduces “respect orders” to tackle antisocial behaviour and creates specific offences for assaulting retail workers.

Latest Opportunities

Jobs, conferences, fellowships, and calls for papers

1. Legal Expert (Remote UK): A remote‑based legal expert role advertised by a UK consultancy seeks professionals with expertise in technology law and digital regulation (find out more).

2. Junior/Mid AI Legal Specialist, EverAI (Remote UK): This role is aimed at lawyers or legal specialists interested in AI governance and product support (find out more).

3. AdTech Lawyer, Axiom (Remote US): Axiom is hiring an AdTech Lawyer to advise on digital advertising agreements, data sharing, campaign data flows, and marketing compliance (find out more).

4. Smart Contract Legal Architect, Loti AI (Remote US): Loti AI is hiring for a legal engineering role focused on likeness rights, on-chain rights enforcement, Solidity, and digital identity. This may interest lawyers who combine intellectual property, technology law, and smart contract literacy (find out more).

5. Business Teacher, Postsecondary AI Training, Alignerr (Remote Australia): This opportunity appears to involve teaching business for AI training, with some connections to other disciplines such as privacy and data protection (find out more).

6. Lawyer, Global Licensing, Coins.ph (Remote Hong Kong): Coins.ph is hiring a lawyer to lead licensing work across payments, remittance, e-money, and virtual asset services. The listing seeks experience with financial regulation, licensing applications, regulators, external counsel, and multiple jurisdictions (find out more).

7. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words. (find out more).

8. Free Microsoft Virtual Training Day: Introduction to Azure (18 May 2026): Microsoft’s free virtual event offers a foundational overview of cloud concepts, core Azure services across compute, networking, storage and identity and demonstrates AI tools. Participants who complete the session receive a 50 percent discount on the Azure Fundamentals certification exam (find out more).

9. AI, Justice and the Rule of Law (Free Course): UNESCO and the University of Oxford are offering a free self‑paced online course launched on 27 April 2026 to equip judges, lawyers and students with an understanding of how AI interacts with human rights and legal reasoning (find out more).

This newsletter briefing highlights a world where law struggles to keep pace with technological ingenuity. From billion‑dollar disputes over AI governance to class actions against social platforms and sanctions for AI‑generated errors, courts and regulators are grappling with new challenges.

Responsible development demands integrity, transparency and deliberate oversight.

Post your comments to join the conversation.

Leave a comment

Disclaimer

This newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the authors alone.

Tech startups often claim that regulation restrains innovation. Regulatory sandboxes challenge that assumption. Many founders now deliberately pursue these programmes, recognising that controlled regulatory environments provide credibility, investor confidence, and legal clarity during early development. This newsletter examines how sandboxes function as strategic tools within technology markets and why regulators are permitting experimentation inside formal supervisory frameworks.

Share

Newsletter Edition 93

Why Regulatory Sandboxes Are Becoming Strategic Tools for Early Stage Tech Startups

Regulation is not the enemy of early-stage technology companies. Regulation is a legal framework. Smart founders understand this earlier than most lawyers.

Startups often describe regulation as a barrier to entry. Venture capitalists regularly frame compliance as a cost. Public debate frequently portrays regulation as an obstacle to innovation. That story feels intuitive, but it is also incomplete.

Regulatory sandboxes demonstrate something different. They show that regulation can operate as a strategic asset when a company understands how to use it.

Early-stage companies increasingly treat regulatory sandboxes as part of their growth strategy. This practice now appears across fintech, artificial intelligence, digital identity systems, blockchain infrastructure, digital health platforms, and climate technology.

Regulators introduced sandboxes to understand new technology. Startups now use them to access regulators, investors, and markets.

What a Regulatory Sandbox Actually Does

The modern sandbox model emerged from the Financial Conduct Authority sandbox programme in the United Kingdom, introduced in 2016.

Participants receive permission to test products with real users under regulatory oversight. Regulators collect information about risk, consumer protection, and technical performance. Companies obtain structured engagement with regulators before entering the full regulatory cycle.

The United Kingdom sandbox operates under powers granted by the Financial Services and Markets Act 2000, which allow the regulator to grant waivers and modifications to regulatory requirements.

Subscribe now

Other jurisdictions adopted similar frameworks.

Singapore operates a regulatory sandbox through the Monetary Authority of Singapore FinTech Regulatory Sandbox Guidelines.

Australia created a sandbox through the Corporations Act 2001 regulatory exemption framework administered by the Australian Securities and Investments Commission.

The European Union introduced an experimentation environment through the Artificial Intelligence Act regulatory sandbox provisions.

Sandboxes, therefore, represent a structured interface between innovators and regulators.

Early-stage companies discovered that this interface carries strategic value.

A Founder Secret That Lawyers Rarely Discuss

Technology founders often reveal something privately that rarely appears in policy reports.

Access to regulators accelerates a company.

Early-stage companies usually face three obstacles simultaneously.

• Legal uncertainty

• Investor scepticism

• Market trust

A sandbox addresses each of these challenges simultaneously.

A regulator that allows a company to operate within a sandbox provides a form of credibility that early-stage companies struggle to obtain elsewhere.

Investors understand that a regulator has reviewed the product. Consumers understand that the technology operates under supervision. The company obtains clarity about the regulatory framework before scaling.

This effect appears in empirical research.

A study published by the Bank for International Settlements found that firms admitted to regulatory sandboxes raise significantly more investment after participating in the sandboxes.

The Financial Conduct Authority’s sandbox evaluation report found that approximately 80% of sandbox participants continued to operate successfully after completing testing.

Numbers alone do not tell the full story. A closer look at how founders actually use sandboxes reveals something more interesting.

The Sandbox Strategy

Some startup founders treat sandbox admission as a milestone similar to product launch.

A four-step pattern has begun to appear in several technology sectors.

1. A company builds a prototype.

2. The company enters a regulatory sandbox.

3. The company tests the product under supervision.

4. Investors enter the picture.

This sequence increasingly appears in fintech ecosystems.

The Global Financial Innovation Network, a coalition of regulators across more than 70 jurisdictions, was created partly to enable cross-border sandbox testing.

Regulatory experimentation now occurs in sectors that previously had little direct interaction with regulators during early development stages.

Artificial intelligence developers test algorithmic decision systems in sandbox environments established under the European Union Digital Finance Package and AI regulatory experimentation frameworks.

Digital health platforms collaborate with health regulators through regulatory test environments in several jurisdictions.

Blockchain infrastructure companies interact with financial regulators earlier in product development.

This practice disrupts the traditional innovation sequence. Legal engagement now occurs during product design rather than after market launch.

A Snapshot of Global Sandbox Activity

The number of regulatory sandboxes has increased significantly during the past decade.

The following table provides an approximate snapshot of sandbox programmes worldwide, based on data compiled from reports by the World Bank, the OECD, and the Cambridge Centre for Alternative Finance.

This increase reflects demand from startups. Founders increasingly recognise that regulatory engagement can reduce the uncertainty that would otherwise delay investment and adoption.

Courts are Beginning to Notice

Courts rarely discuss regulatory sandboxes directly because sandboxes operate within regulatory supervision rather than litigation.

Judicial decisions nevertheless demonstrate how regulatory experimentation affects legal reasoning.

A well-known example arises in the litigation surrounding cryptocurrency exchanges and digital asset regulation.

The case SEC v Ripple Labs Inc, pending in the United States District Court for the Southern District of New York, illustrates how uncertainty regarding digital asset classification affects technology development and market entry.

European policymakers have explicitly acknowledged this function in the European Commission's Artificial Intelligence Act impact assessment, which identifies sandboxes as tools that enable regulators to understand algorithmic systems before enforcement actions are taken.

Lawyers sometimes treat litigation as a mechanism that clarifies the law. Sandboxes represent another mechanism that achieves similar clarity through experimentation.

Is there a serious risk of overregulation of tech in the EU?

Technology Law

AI in Europe Is Gradually Becoming Over-regulated

Europe has regulated AI into a corner. The Artificial Intelligence Act, though hailed as a global benchmark, exemplifies the tension between ambition and practicality that defines modern EU digital regulation. Several laws also promise data protection and AI innovation, however together they form an administrative maze that risks stifling the very techn…

Read more

6 months ago · 14 likes · 6 comments · Technology Law

A Simple Model That Explains the Sandbox Advantage

A simple framework helps explain why founders pursue sandbox admission.

Consider three factors that determine whether a technology startup succeeds in a regulated industry.

• Regulatory clarity

• Market trust

• Access to capital

Normal innovation paths produce these factors slowly and unpredictably. Sandbox participation produces them simultaneously. The following simplified chart illustrates the difference.

Startup Development Without a Sandbox

Startup Development With Sandbox Participation

As shown in an AI regulatory study, investors frequently treat sandbox admission as evidence that regulatory engagement has begun.

The advantage becomes clear when capital enters the conversation.

Why Investors Should Care

Investors rarely discuss regulatory sandboxes publicly. Private investment conversations tell a different story.

Early-stage investors often interpret sandbox admission as an indicator that the company has begun to resolve regulatory uncertainty.

A venture capital firm evaluating a fintech startup often confronts a fundamental question. Is this technology legal to operate at scale?

Subscribe now

A sandbox does not answer every regulatory question, but it demonstrates that regulators are already engaged with the technology.

Empirical data support this observation.

A report from the International Monetary Fund's FinTech Notes Series shows that companies participating in regulatory sandboxes frequently secure additional financing after testing phases conclude.

Why Regulators Accept This Arrangement

Critics sometimes argue that regulatory sandboxes benefit startups more than regulators.

Regulators have strong incentives to participate.

Technological innovation introduces risks that regulators cannot fully understand without observing real-world deployment.

Artificial intelligence systems may influence lending decisions, insurance pricing, or medical diagnoses. Blockchain systems may facilitate financial transactions that fall outside existing regulatory categories.

A regulator attempting to supervise these technologies without direct observation operates with incomplete information.

Sandbox programmes allow regulators to observe the behaviour of technology under controlled conditions.

The Organisation for Economic Cooperation and Development report on regulatory sandboxes emphasises that regulators obtain valuable data regarding consumer risk, operational reliability, and compliance challenges during sandbox experiments.

Sandboxes, therefore, function as regulatory research laboratories.

The New Geography of Innovation

Another emerging development deserves attention.

Regulatory sandboxes can influence where startups decide to establish headquarters.

Jurisdictions that offer credible sandbox programmes attract technology founders.

Singapore offers a well-known example. The Monetary Authority of Singapore's sandbox programme has attracted dozens of fintech companies that later expanded across Asia.

Abu Dhabi created a similar framework through the Abu Dhabi Global Market RegLab programme, designed to attract financial technology firms.

The United Arab Emirates has built a regulatory innovation ecosystem, partly based on sandbox experimentation.

Governments recognise that regulatory sandboxes can operate as an economic development tool.

A Glimpse Into the Numbers

The following simplified dataset illustrates a pattern observed across several sandbox programmes based on publicly available reports from regulators and international organisations.

Sandbox Outcomes Observed Across Multiple Jurisdictions

Numbers rarely capture the cultural impact of this development. Sandboxes have changed how founders and regulators interact.

The Future Role of Sandboxes

Several policy reports anticipate that sandbox frameworks will expand into additional sectors.

Artificial intelligence governance provides a prominent example.

The European Union Artificial Intelligence Act explicitly encourages member states to establish regulatory sandboxes that allow developers to test high-risk AI systems under supervision.

For example:

• Climate technology companies developing carbon accounting platforms or environmental data systems may interact with regulators through sandbox environments.

• Digital identity infrastructure and privacy-enhancing technologies present similar opportunities.

Innovation occurs in domains where law and technology intersect.

Regulatory sandboxes provide a structured space where that intersection becomes visible.

Leave a comment

////////////////////END/////////////////

This newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the Technology Law e-Newsletter and do not necessarily reflect the views of any affiliated institution.

Technology law is entering a period in which institutional responsibility cannot be deferred to innovation narratives or voluntary guidelines. Governments are writing treaties on AI governance, prosecutors are testing the limits of liability for chatbot outputs, courts are treating online gaming assets as property, and regulators are scrutinising algorithmic markets. Legal practice itself is also changing as firms integrate AI into core workflows. This briefing examines these developments and considers what they reveal about accountability, authority, and risk in our digital systems.

Share

Newsletter Edition 92

Lead Story

The European Parliament has approved the EU’s signature of the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law.

This is a significant milestone because the Council of Europe describes the convention as the first international legally binding treaty in AI governance.

This treaty is designed to make sure that activities across the AI lifecycle remain consistent with

• Human rights

• Democracy, and

• The rule of law.

Parliament gave its consent to the EU’s signature with 455 votes in favour, 101 against, and 74 abstentions. The next step is for the Council to conclude the agreement.

The treaty applies to AI-related activities carried out by public authorities and private actors acting on their behalf. Private sector actors are also expected to address AI-related risks in line with the convention’s objectives, either by directly applying the convention’s obligations or by providing equivalent protection.

The Parliament’s own explanation states that the EU AI Act and other EU laws already provide a higher and more detailed level of protection within the EU internal market. The treaty establishes a broader international baseline for transparency, documentation, risk management, oversight, fundamental rights, democratic safeguards, and rule-of-law values.

The text of the treaty is built around the idea that AI systems should not be treated only as products, software, or business tools, while recognising that they can affect dignity, autonomy, equality, privacy, public institutions, and democratic participation.

The treaty, therefore, requires states to adopt or maintain legislative, administrative, or other measures to give effect to its provisions. Those measures may be specific to particular sectors or horizontal across technologies.

This matters because international AI governance is often discussed as if it is only about voluntary principles. This treaty takes a firmer route by providing contracting states with a common legal framework for AI risks without requiring every country to adopt the EU AI Act. That is important for states that want human rights-based AI governance, but do not have the same regulatory position as the EU.

Lawyers advising public bodies, technology sellers, and regulated businesses will need to ensure compliance. Procurement, due diligence, contract drafting, and AI governance policies will need to ascertain whether the use of AI affects rights, public accountability, and democratic values. AI policy documentation may become more important because transparency and oversight cannot work without reliable records.

Technology Law

Council of Europe Sets New Standards for Online Safety and Empowerment

The Council of Europe’s new recommendation on online safety presents an ambitious attempt to reconcile freedom of expression with the governance of digital platforms. The document proposes stronger expectations on states and platforms while insisting on human rights safeguards. Additionally, the framework raises difficult questions about regulatory reac…

Read more

a month ago · 15 likes · 2 comments · Technology Law

Regulators will also have a clearer basis for cooperation. AI systems cross borders, and many of the companies developing or deploying them operate globally. This uniform treaty framework will help regulators discuss risk, compliance, and institutional responsibility using shared concepts. That does not remove national differences, but it gives regulators a firmer starting point.

Subscribe now

Companies should not treat the convention as a distant public law instrument. Any business building AI tools for government, justice, education, healthcare, public services, security, finance, or civic participation should assume that human rights review will become a more visible part of the buying and supervision process. Strong internal records, testing, escalation procedures, and clear accountability lines will become easier to defend than vague statements about responsible AI.

The EU’s support for the Framework Convention positions AI governance within an international legal framework grounded in human rights, democracy, and the rule of law.

Technology Law Tracker: Other Relevant Updates

1. Freshfields and Anthropic partner on developing legal AI tools

Freshfields and Anthropic have agreed to work together on new AI applications for legal services. It was reported that Freshfields will collaborate with Anthropic’s legal team to develop tools for legal and market research, contract review, document drafting, and automation of internal business services workflows. Freshfields will also receive early access to future Anthropic models and products, although no financial terms were disclosed.

The development also comes at a time when courts are paying closer attention to AI errors in legal documents. Recently, there has been a rise in AI-generated inaccuracies in court filings, including inaccurate citations and other errors.

Legal AI is judged not only by speed, but also by reliability, auditability, and professional accountability. A tool that drafts faster but imposes verification burdens may save time in one place while creating risk in another.

2. OpenAI and ChatGPT investigated after deadly shooting

Florida Attorney General James Uthmeier has launched a criminal investigation into OpenAI and ChatGPT after a 2025 shooting at Florida State University that killed two people and injured six others.

The suspect was charged with multiple counts of murder and attempted murder, and the state is examining whether OpenAI bears criminal responsibility for ChatGPT’s alleged role in the incident. The Office of Statewide Prosecution has subpoenaed OpenAI for information and records.

Uthmeier said at a press briefing that the chatbot advised the shooter on the type of gun to use, ammunition compatibility, and whether a gun would be useful at short range.

OpenAI’s position, as reported by Reuters, is that the shooting was a tragedy, but that the company had no responsibility. The company also said it identified an account believed to be associated with the suspect and shared information with law enforcement.

It added that ChatGPT provided factual responses based on broadly available public information and did not encourage or promote illegal or harmful activity.

This investigation examines how prosecutors may view AI systems that produce information later linked to violent conduct. Criminal law usually focuses on human intent, conduct, causation, and knowledge.

Can AI be guilty of a crime? Read our newsletter on this delicate matter.

Technology Law

Can AI Be Criminally Liable?

Around the world, prosecutors are circling, and in some cases, people are already being charged for what their AI systems did. World legal systems are catching up with reckless automation, and the consequences are real: injury, death, and yes, prison time. In this article, we explore how criminal liability is entering the AI age, what cases are already …

Read more

a year ago · 12 likes · 8 comments · Technology Law

Applying those ideas to a chatbot raises difficult issues. An AI system can generate a harmful answer without having human intent. A company can design safety layers, but users may still ask dangerous questions in ways that are not always easy to detect.

The case also highlights the difference between public information and actionable assistance. Many facts about weapons, chemicals, cyber tools, and other dangerous subjects exist online. The legal question is whether an AI system changes the risk by making such information easier to access, combine, personalise, or apply. That question will remain central to AI safety discussions.

Which liabilities exist against LLMs offering misleading advice?

Technology Law

Can You Sue ChatGPT or Google Gemini for Providing Wrong Advice?

AI chatbots are everywhere. They answer questions, give tips, and sometimes issue wrong advice. From dangerous health advice to fake consumer product review, things go wrong more often than people think. When they do, the primary question is who takes the blame. This post looks at real examples of when AI provides misleading advice, how companies try to…

Read more

a year ago · 13 likes · 11 comments · Technology Law

Companies offering general-purpose AI tools should treat this development as a warning that safety design will be examined after serious harm occurs. It will not be enough to say that a user misused an AI system. Prosecutors, regulators, victims, and the public will ask what safeguards existed, how they were tested, what the company knew about foreseeable misuse, and how the system responded to high-risk prompts.

This is also a reminder that AI governance needs incident response planning. Companies should be prepared to preserve records, cooperate with lawful investigations, review model behaviour, and communicate carefully. The legal outcome remains uncertain, but the governance lesson is already clear.

3. UK courts and regulators consider clearer rules for AI-generated legal documents

The UK Civil Justice Council has been consulting on whether new procedural rules are needed for the use of AI in preparing court documents, including pleadings, witness statements, and expert reports.

Judicial concern about AI hallucinations, including false authorities, inaccurate case references, and wasted court resources. It also refers to recent cases in which AI-generated or AI-assisted legal material caused problems before the courts.

The judiciary is also examining other questions about AI, legal professional privilege, and confidentiality. In a speech on legal professional privilege in the age of AI, the Chancellor of the High Court noted that public AI systems may raise confidentiality concerns.

The speech discussed a tribunal decision holding that uploading confidential documents to an open-source AI tool such as ChatGPT can place that information in the public domain, breach client confidentiality, and waive privilege.

This matters for every lawyer, not only litigators. AI can help draft, summarise, translate, and organise material, but it cannot remove professional responsibility. Courts are likely to focus less on whether AI was used and more on whether the final document is accurate, honest, properly verified, and consistent with duties owed to the court.

Legal professionals should have a clear verification process. They should know which AI tools are approved for use in their jurisdiction, which data must not be entered, how outputs are checked, and how errors are recorded. Litigants-in-person may also need clearer public guidance because AI tools can make legal arguments look more polished without making them legally sound.

Case of the Week

Case: R v Lakeman
Citation: [2026] EWCA Crim 4

Facts

R v Lakeman concerned virtual gold pieces in the online game Old School RuneScape. The gold pieces were recorded in a ledger maintained by Jagex, the game’s developer and publisher. The terms and conditions stated that the gold pieces could be redeemed only inside the game, and Jagex could delete them or anything purchased with them. Sale or gifting in the real world was prohibited.

The defendant was an employee of Jagex. He was accused of hacking into player accounts, transferring a large number of gold pieces to accounts under his control, and selling them for real-world currency. The alleged theft involved around 705 billion gold pieces, valued at £543,123.

Subscribe now

Legal issue

The legal issue was whether virtual in-game currency could constitute property capable of being stolen under section 4 of the Theft Act 1968 (UK). This was not a simple question because the gold pieces existed inside a game environment, were subject to contractual restrictions, and could be modified or deleted by the game operator.

The defence argument was helped by the fact that the game rules did not allow real-world trading. Jagex also retained significant control over the game environment. The prosecution’s case depended on persuading the court that those features did not render the gold pieces property for the purposes of theft.

Decision

The Court of Appeal held that the gold pieces were property capable of being stolen for the purposes of section 4 of the Theft Act 1968. The court stressed that the definition of property in criminal law differs from that in private law. The court also discussed other related issues in digital asset property, including the idea that digital assets can be functional things distinct from the underlying code.

The court adopted a wider approach to property for theft purposes. The court considered whether the thing was freely bought and sold and capable of dishonest dealing that deprives the owner of its benefit. It allowed the prosecution’s appeal on the preliminary issue and held that the virtual gold pieces were property capable of theft.

The relevance of this judgment

Digital assets now carry real social and economic value. Games, virtual worlds, blockchain, digital collectables, token-based platforms, and online marketplaces all involve items that may be controlled by code, governed by terms, and valued by users. Criminal law cannot avoid these assets simply because they are intangible or platform-based.

The decision is especially important for gaming companies. Terms and conditions may say that in-game assets cannot be sold outside the game, but that does not necessarily prevent a court from treating those assets as property in a criminal context. Platform operators should therefore think carefully about account security, internal access controls, employee permissions, audit trails, and user protection.

Is crypto personal property? Read our newsletter to find out more:

Technology Law

What the Property (Digital Assets etc) Act 2025 Means for Your Cryptoassets

English law has spent more than a decade pretending that digital value could be economically real yet legally peripheral, and the Property (Digital Assets etc) Act 2025 exposes how unsustainable that posture had become. Treating cryptoassets as something to be tolerated rather than classified produced uncertainty that benefitted speculation while underm…

Read more

5 months ago · 11 likes · 5 comments · Technology Law

The court’s reasoning adds to a growing body of judicial reasoning about how law should treat digital things that have practical utility, scarcity, control, and market value. It does not answer every private law question about ownership, transfer, insolvency, or platform liability, but it gives courts and lawyers another important reference point.

The law is becoming more comfortable with the idea that digital value can be legally meaningful. Users may consider a virtual item valuable even if it exists on a controlled platform. Courts are beginning to take that experience seriously when dishonesty, deprivation, and market value are present.

Other Developments in Technology Law:

1. Investigation into music streaming platforms over alleged undisclosed promotion

The Texas Attorney General has launched an investigation into Spotify, Apple Music, Pandora, Amazon Music, and YouTube Music over alleged payola-type arrangements. The office says it is examining whether streaming services accepted undisclosed payments to promote certain songs, artists, or content through playlists, recommendations, or ranking systems. Civil Investigative Demands have been issued to the companies.

2. UK chatbot offence proposal withdrawn before debate

A proposed amendment to the Crime and Policing Bill, which has now been withdrawn, would have created offences related to AI chatbots that produce illegal or harmful content for children, or that use certain deceptive or exploitative chatbot designs.

The amendment also included duties for risk assessment, mitigation, transparency reporting, and potential criminal penalties. The amendment was withdrawn before debate, so no decision was taken on it.

3. Dutch financial regulator highlights AI risks in capital markets

The Netherlands Authority for the Financial Markets has published a report on AI in capital markets.

The regulator says AI can improve speed and reduce costs, but it can also affect price formation, amplify market vulnerabilities, and create new risks where trading models rely on similar data and objectives. It also warns that false or manipulated information could affect models that rely on news, sentiment, and social media.

Latest Opportunities

Jobs, conferences, fellowships, and calls for papers

1. Junior/Mid AI Legal Specialist, EverAI (Remote UK): This role is aimed at lawyers or legal specialists interested in AI governance and product support (find out more).

2. AdTech Lawyer, Axiom (Remote US): Axiom is hiring an AdTech Lawyer to advise on digital advertising agreements, data sharing, campaign data flows, and marketing compliance (find out more).

3. Smart Contract Legal Architect, Loti AI (Remote US): Loti AI is hiring for a legal engineering role focused on likeness rights, on-chain rights enforcement, Solidity, and digital identity. This may interest lawyers who combine intellectual property, technology law, and smart contract literacy (find out more).

4. Business Teacher, Postsecondary AI Training, Alignerr (Remote Australia):
This opportunity appears to involve teaching business for AI training, with some connections to other disciplines such as privacy and data protection (find out more).

5. Lawyer, Global Licensing, Coins.ph (Remote Hong Kong): Coins.ph is hiring a lawyer to lead licensing work across payments, remittance, e-money, and virtual asset services. The listing seeks experience with financial regulation, licensing applications, regulators, external counsel, and multiple jurisdictions (find out more).

6. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words. (find out more).

Conclusions

The common thread in this briefing is accountability. AI is becoming part of law, finance, public administration, entertainment, and criminal investigation, so legal systems are now asking who takes responsibility when automated systems affect people.

The most useful conversation is whether AI use can be explained, checked, and governed with sufficient care to preserve trust.

Disclaimer

This newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the Technology Law e-Newsletter and do not necessarily reflect the views of any affiliated institution.

Leave a comment

Your weekly briefing on technology law and regulation, AI governance, fintech policy, and career opportunities.

Share

Newsletter Edition 91

Lead Story

Your AI chats may become evidence in court!

Conversations with AI chatbots may not be treated like “confidential” conversations with a lawyer, doctor, or other protected professional. In a recent case of United States v. Heppner, No. 25-cr-503 (JSR) that brought this issue into sharper view, U.S. District Judge Jed Rakoff ruled in February that Bradley Heppner, the former chair of GWG Holdings, had to hand over 31 documents generated with Anthropic’s Claude in the course of a criminal securities fraud case.

Heppner had used Claude to prepare reports on his case for his lawyers, but the court was not persuaded that those exchanges were protected.

Judge Rakoff’s reasoning is important because he addressed the issue directly. He did not treat AI systems as something unusual or outside existing legal rules. In a written order, the judge explained that conversations with an AI system such as Claude cannot be treated as confidential legal advice. In other words, a person using the chatbot does not have an attorney-client relationship with the AI company (Anthropic).

The judge also looked closely at Anthropic’s privacy policy. That policy explains that the platform may collect the questions users type into the system and the responses the system generates. It may also use that information to improve the model and may disclose it to third parties when required in disputes or legal proceedings.

Because the company reserves the right to access and share that information, the judge concluded that users cannot reasonably expect those conversations to remain private in the legal sense required for attorney-client privilege.

It was reported that on the same day as Rakoff’s ruling, U.S. Magistrate Judge Anthony Patti in Michigan took a different view in Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. 2026), involving a self-represented litigant’s use of ChatGPT.

Patti treated those AI chats as part of the litigant’s own work product rather than a conversation with another person. In other words, chatbots are tools, not persons. That means some AI-generated material may still attract protection depending on who created it, why it was created, and how it was used.

Courts are not building a standalone doctrine of AI confidentiality all at once. They are doing something much more granular and much more consequential. They are applying existing rules on privilege, confidentiality, waiver, and work product to new patterns of behaviour.

Some uses of AI may be treated as internal drafting assistance. Other uses may look like disclosure to a third party. A great deal will depend on the system used, the provider’s terms, the purpose of the interaction, and the extent of lawyer involvement.

Subscribe now

Many people use AI systems as if they were private advisers. That assumption is understandable because the interface feels conversational, personal, and responsive. Legally, that feeling may be meaningless. Employees, founders, claimants, defendants, and ordinary users may all reveal sensitive material to an AI system that does not provide them with the legal protection they believe they have.

The deeper point is that AI use is now starting to alter the evidence record itself. An AI chatbot can help draft a witness outline, summarise internal documents, suggest a line of argument, or produce a statement of claim. Each of those outputs can later matter in disclosure fights, sanctions disputes, or credibility challenges. That is why the discoverability question matters far beyond the privilege doctrine.

Courts are beginning to treat AI chats as legally consequential records, not private thought spaces, and that changes how lawyers, clients, and companies need to use these tools.

Can you sue an LLM? Read our newsletter on the legal challenges of suing ChatGPT and Gemini.

Technology Law

Can You Sue ChatGPT or Google Gemini for Providing Wrong Advice?

AI chatbots are everywhere. They answer questions, give tips, and sometimes issue wrong advice. From dangerous health advice to fake consumer product review, things go wrong more often than people think. When they do, the primary question is who takes the blame. This post looks at real examples of when AI provides misleading advice, how companies try to…

Read more

a year ago · 13 likes · 11 comments · Technology Law

Key Regulation Tracker

1. Australia Federal Court issues AI practice note

The Federal Court of Australia’s new Generative AI Practice Note does not prohibit AI use. It does something more useful. It states that anyone using generative AI in connection with legal proceedings must understand its capabilities, limits, and risks, and that any use must not adversely affect the administration of justice. The Note also makes clear that the court may require disclosure of how AI was used in a proceeding.

The AI Practice Note also mentions that lawyers remain responsible for ensuring pleadings are supportable, authorities cited in submissions exist and support the stated proposition, and cited evidence exists and is likely to be admissible.

Subscribe now

It also requires disclosure where AI has been used to summarise or analyse information relied on by a witness or expert, and warns against entering privileged, confidential, suppressed, or otherwise restricted information into generally accessible tools. Non compliance may lead to adverse costs and other consequences. That is a clear framework other courts will be studying closely.

2. DOJ settles IBM case over anti-discrimination compliance certifications

The U.S. Department of Justice settlement agreement with IBM states that the United States contends IBM knowingly submitted false claims and knowingly made false statements in connection with federal contracts that incorporated anti-discrimination requirements, including Title VII requirements as reflected in federal procurement rules. The settlement amount is USD 17.1 million.

This agreement matters for tech companies because public contracting now carries heavy compliance exposure that goes well beyond cybersecurity representations or data handling promises.

Employment practices, internal governance, and certification processes can all become legal issues once they are baked into government contracts and digital service procurement. Compliance officers and legal teams should treat certification language as an operational commitment, not a box ticking exercise.

Case of the Week

Case: Nippon Life Insurance Company of America v. OpenAI Foundation
Citation: No. 1:26-cv-02448 (N.D. Ill. filed Mar. 4, 2026), United States District Court, Northern District of Illinois.

Facts

The complaint, filed on 4 March 2026, was brought by Nippon Life Insurance Company of America against OpenAI Foundation and OpenAI Group PBC.

According to the complaint, Nippon alleges that ChatGPT provided legal assistance to a user, Graciela Dela Torre, in connection with litigation and post settlement filings, and that this assistance contributed to tortious interference with a settlement agreement, abuse of process, and the unlicensed practice of law under Illinois law. The complaint says ChatGPT gave legal advice, legal analysis, legal research, and drafting help for motions and requests for judicial notice.

Legal Issue

The complaint relied on Illinois authority stating that the practice of law is not limited to courtroom appearances and includes out of court legal services and advice. They argued that ChatGPT is not admitted to practice law in Illinois or elsewhere, yet provides legal services to users who ask for them.

That issue sits at the intersection of several long standing legal concerns.

• One is professional licensing.

• Another is consumer protection.

• A third is court integrity, especially where AI generated legal assistance may influence filings or judicial process without the controls applied to licensed practitioners.

The complaint also raised a crucial question that regulators have not resolved yet: when does general information become personalised legal assistance that the law is willing to regulate?

Judicial Decision

There has not yet been a merits decision. What exists at this stage is the complaint and the claims it advances. The case therefore matters as a filing to follow. The complaint seeks relief that includes an injunction against continuing to provide legal assistance and a finding of unlicensed practice of law, among other remedies.

Courts still have to decide questions of standing, causation, duty, statutory scope, and the practical meaning of “practice of law” in the context of software outputs. Even so, the filing is notable because it states the claim plainly and in terms that another plaintiff, regulator, or bar authority could adapt.

Why stakeholders must take note of this case

• The case tests whether general purpose AI systems can remain legally characterised as neutral tools when they are marketed and used in ways that resemble professional assistance. Liability, regulatory design, product warnings, and system limitations may all depend on where that line is drawn.

• Financial services firms are already using AI in customer interaction, compliance triage, and document support. A court willing to look closely at AI outputs in the legal context may encourage similar scrutiny in regulated financial advice settings where licensing and consumer harm concerns are also acute. Of course, this case is not about financial advice, but the logic of role substitution matters across regulated services.

• Platform operators often describe AI as assistance rather than advice. This case shows why that distinction will not always end the debate. Claimants will look at what the system actually does, how it is presented to users, and what consequences follow. Product labels alone may not carry much weight if the system is doing work users would usually associate with a licensed professional.

• A licensed profession and a general LLM model tool produce very different governance expectations. The former leans toward competence, supervision, ethics, and record-keeping. The other leans toward consumer disclosures, safety testing, and platform moderation. Courts do not have to choose a full regulatory model in one case, but each procedural step is starting to affect the space companies have to design and market AI systems that touch professional decision making.

Latest Policy Insights and Updates

1. The European Commission Launches Age Verification App to Protect Children Online

The European Commission’s new age verification app seeks to facilitate child safety, and also support states in adopting stronger online age checks without building a system that normalises unnecessary data collection.

The European Commission (EC) says the app is ready for deployment, will allow users to prove age when accessing platforms, can be set up using a passport or ID card, works on any device, is anonymous, and is fully open source. Some EU countries are already planning to integrate it into national digital identity wallets.

Subscribe now

Age verification has often produced a false choice between child safety and privacy. The EC is trying to present a third route: age assurance with limited data exposure. Whether that works in practice will depend on design, uptake, interoperability, and whether platforms accept the tool as a sufficient compliance mechanism. The real policy issue is not whether age checks will exist, but rather, whether they can exist without becoming an identity system for ordinary internet use.

2. New Technical Standards Planned for Autonomous Driving in China

China’s Ministry of Industry and Information Technology has also closed consultation on draft mandatory national standards, including draft safety requirements for autonomous driving systems of intelligent and connected vehicles.

The ministry’s notice set 13 April 2026 as the deadline for comments, and the draft standard establishes technical and functional safety requirements for autonomous driving systems.

3. UK Competition Authority Begins Review of Paramount and Warner Bros Discovery Deal

In the United Kingdom, the Competition and Markets Authority has opened a consultation to comment on the anticipated acquisition involving Paramount and Warner Bros. The consultation runs from 13 April to 27 April 2026. The CMA notes that the formal phase 1 investigation has not yet launched and that the invitation to comment is the first part of its information gathering process.

Control of content libraries, streaming reach, advertising inventory, recommendation architecture, and audience data can all carry competition implications that spill well beyond traditional broadcasting. The point is not only who owns what studio, but how concentration affects distribution power in digital media markets that increasingly overlap with platform, advertising, and AI enabled content environments.

4. EU Develops Metadata Standards for the European Health Data Space

The European Commission (EC) has also closed consultation on a draft implementing regulation on minimum metadata elements for the European Health Data Space, including interoperability requirements for dataset descriptions used in the secondary use of electronic health data. Digital Policy Alert says the consultation closed on 12 May 2026 and links the proposal to Article 77(1) of the EHDS Regulation 2025/327.

This is exactly the kind of measure that determines whether data policy succeeds or stalls. Secondary use of health data depends on discoverability, standardisation, interoperability, and trustworthy governance. Metadata rules can decide whether researchers, hospitals, regulators, and innovators can actually find and reuse datasets in legally compliant ways.

Other important developments

1. The EU proposes measures requiring Google to share certain search data with third party search engines under the Digital Markets Act: The European Commission says the draft measures cover ranking, query, click, and view data, with feedback open until 1 May (read here).

2. EU presses Meta over WhatsApp access for rival AI assistants: The European Commission intends to order Meta to reinstate rival AI assistants on WhatsApp after Meta imposed an access fee that regulators say may exclude competitors (read here).

3. European AI Office opens a targeted consultation on measuring the energy consumption and emissions of AI models and systems: The consultation runs from 7 April to 15 May 2026 (read here).

Subscribe now

4. SEC staff issues a statement on certain crypto transaction interfaces: The Division of Trading and Markets says the statement sets out staff views on broker dealer registration requirements for some interfaces used to prepare transactions in crypto asset securities (read here).

5. FTC secures a USD 1.5 million settlement with Publishing.com. The FTC says the online self publishing company misled consumers about likely earnings and must substantiate earnings claims going forward (read here).

6. EDPB advances new guidance on scientific research data processing. Its Guidelines 1/2026 on personal data for scientific research were adopted on 15 April 2026 in a version for public consultation (read here).

7. SEC’s 2025 enforcement results underline continued focus on emerging technology risk. The European Commission highlighted the Cyber and Emerging Technologies Unit, which covers blockchain technology, AI, account takeovers, and cybersecurity (read here).

Latest opportunities

Jobs, conferences, fellowships, and calls for papers

1. DSIT Fellowship Cohort 4: Applications are open for 2026 to 2027 secondments in AI, data, economics, international work, horizon scanning, and science ecosystem roles. Deadline: 6 May 2026 (further details).

2. Allen Institute for AI, Legal Counsel: Applications are due by 30 April 2026. The role calls for technology transactions experience and familiarity with data governance, privacy law, and the EU AI Act (further details).

3. Benchling, Legal Counsel, Product and AI: Benchling is recruiting product and AI counsel in San Francisco to advise on AI governance, privacy, intellectual property, licensing, and product legal issues (further details).

4. Lecturer in Law and Technology, Aston University: Applicants required with expertise in areas such as AI and law, digital regulation, data governance, cyber law, platform regulation, or the legal implications of emerging technologies (further details).

5. GitLab, Legal Counsel, Commercial (Canada, US, Remote): The role includes negotiating complex commercial and technology agreements, including data privacy and AI related contracts (further details).

6. AIDA2J Workshop at ICAIL 2026: Papers, short papers, and demo proposals are invited for the Artificial Intelligence for Access to Justice workshop in Singapore. Submission deadline: 1 May 2026 (further details).

7. PLSC Europe 2026: KU Leuven’s Centre for IT and IP Law is hosting this privacy scholarship workshop in Leuven on 29 and 30 October 2026. Abstract deadline: 15 May 2026 (further details).

Disclaimer

This weekly briefing and newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the author and do not necessarily reflect the views of any affiliated institution.

Leave a comment

/////////////////////END///////////////////////

The Council of Europe’s new recommendation on online safety presents an ambitious attempt to reconcile freedom of expression with the governance of digital platforms. The document proposes stronger expectations on states and platforms while insisting on human rights safeguards. Additionally, the framework raises difficult questions about regulatory reach, platform accountability, and the risk that protective measures may legitimise the over-censorship of online discourse.

Share

Newsletter Edition 90

Introduction

The digital environment has become central to our social and civic lives. People gather news, express opinions, learn, play and work through online platforms. The Council of Europe, aware of the benefits and dangers of this transformation, adopted Recommendation CM/Rec(2026)4 on 8 April 2026 to guide member states toward safe and empowering online environments. This recommendation acknowledges that while the internet enhances freedom of expression, it also exposes users to harassment, misinformation and other risks that can undermine democracy. It seeks to protect individual and collective rights without sacrificing the openness of the digital realm.

The recommendation builds on previous Council of Europe instruments on internet freedom and the responsibilities of internet intermediaries. The explanatory memorandum emphasises that the right to freedom of expression protects speech that may offend, shock or disturb.

The recommendation proposes principles and measures for states, platforms and content creators to address online risks while enhancing user autonomy.

Understanding online risks

The recommendation categorises online risks that affect freedom of expression into three groups:

• Personal and community safety risks: Users may encounter abuse, harassment or content that threatens their well-being. This includes hate speech, violence and exploitation. Such risks can deter individuals from participating in public discourse, leading to self‑censorship and exclusion.

• Threats to democratic processes and information integrity: Misinformation, targeted disinformation campaigns, and manipulation of public debate undermine informed decision-making. These threats erode trust in institutions and polarise societies. Election interference and conspiracy narratives can weaken democratic legitimacy.

• Systemic risks from the design and operation of platforms: Algorithmic systems can influence the visibility of content, amplify harmful material or suppress minority voices. Platform design choices, driven by engagement metrics, may prioritise sensational content, leading to echo chambers and exposing users to harmful material. Artificial intelligence tools that produce or moderate content introduce new risks and amplify existing ones.

The memorandum explains that certain groups face heightened risks online: children, women and girls, people with disabilities or minority identities, migrants and content creators such as journalists and activists. Online abuse targeted at these groups often extends into the physical world, reinforcing social inequalities. When freedom of expression is curtailed by intimidation or discrimination, public debate suffers.

Technology Law

Your Online Freedom May Be About To End

New rules are transforming how online platforms and search services must operate in the United Kingdom. Age checks are now compulsory for services with adult content and strict obligations apply to anything that children can access. Some see this as protection and others see it as control. These rules will change what people see, how they join online pl…

Read more

10 months ago · 11 likes · 3 comments · Technology Law

Principles for states

The recommendation stresses that states should foster an enabling online environment that is:

• Safe,

• Inclusive, and

• Pluralistic.

This involves measures both online and offline. States should develop comprehensive strategies that address underlying societal inequalities that lead to online abuse. Education and media literacy are central to empowering users; states are encouraged to invest in digital citizenship initiatives and strengthen media diversity.

States must avoid actions that compromise online safety. They should not introduce vulnerabilities into technical systems that protect privacy. Enhanced surveillance or general monitoring obligations are discouraged, as they threaten freedom of expression and could lead to the over-removal of lawful content. Instead, interventions should be evidence-based, transparent and proportionate. When developing regulations, governments should consult a wide range of stakeholders, including civil society and affected communities.

States should clearly identify what content is illegal or regulated, ensuring legal certainty and preventing arbitrary enforcement. Blocking entire services or domains is considered a severe interference with freedom of expression and should occur only under strict judicial oversight.

Responsibility for enforcing content restrictions cannot be transferred wholesale to private companies. States remain ultimately accountable for human rights protection. When authorities instruct platforms to remove content, platforms should inform users so they can challenge the decision. Legal frameworks must avoid compelling intermediaries to monitor all user content.

Responsibilities of platforms

Online platforms serve as gatekeepers to public discourse. The recommendation acknowledges that they play a central role in facilitating expression and, therefore, bear responsibilities commensurate with their impact.

Platforms of significant influence – those with large user bases and substantial impact on public communication – are expected to conduct risk assessments before implementing changes. These assessments should consider human rights impacts, involve stakeholder consultation and be published in a way that the public can understand. When risks are identified, platforms must implement mitigation measures before introducing new designs. This approach encourages transparency and accountability in corporate decision-making.

Subscribe now

Platforms are encouraged to employ staff knowledgeable about local contexts and languages, enabling them to understand specific risks in different regions. They should pay special attention to groups facing higher risks, such as children, women and minorities. Collaboration with user groups and civil society can inform more responsive policies.

One notable principle is the graduated and differentiated approach. Smaller platforms should not be overburdened by obligations suited for very large services. Conversely, platforms with significant influence should be subject to heightened duties that reflect their power and reach.

Content creator responsibilities

The recommendation recognises content creators as an essential part of the digital public sphere. It calls on them to uphold accuracy, fairness and integrity.

Creators who reach large audiences or claim professional expertise have a heightened duty to act in good faith.

These provisions acknowledge the rising number of child influencers and aim to protect them from exploitation.

Timeline of Council of Europe digital rights instruments

The timeline below illustrates how the Council of Europe has progressively addressed digital rights and online safety through a series of recommendations.

It places Recommendation CM/Rec(2026)4 in a broader context of regulatory development.

Events are plotted chronologically from 2016 to 2026.

Legal frameworks: content rules, intermediary liability and platform accountability

The recommendation divides legal frameworks into three pillars:

1. Content rules,

2. Intermediary liability rules, and

3. Platform accountability and user empowerment rules.

This structure recognises that different types of interventions require different approaches.

Content rules

Content rules govern what kind of expression may be restricted and under what circumstances. They must be clearly prescribed by law, pursue a legitimate aim and remain necessary and proportionate.

The recommendation reiterates that content lawful offline should generally be lawful online. When restrictions are necessary, the law should specify whether content is illegal (fully prohibited) or legal but regulated (subject to access or visibility limitations). The degree of risk severity and its imminence should guide the level of restriction.

Member states are encouraged to regularly review their online content laws to ensure clarity and relevance in a changing digital context.

Enforcement should, in principle, occur through formal orders by judicial or independent authorities, with users and intermediaries having access to effective remedies. Platforms may adopt additional rules through terms of service, but these should be transparent and consistent.

Intermediary liability rules

Excessive liability can turn intermediaries into de facto censors and encourage over-removal of lawful content. States should therefore avoid imposing disproportionate liability on intermediaries for user-generated content.

Liability may be appropriate when intermediaries fail to act expeditiously upon becoming aware of illegal content, provided that notice procedures are transparent and effective. The conditions for removal, including time frames, should be differentiated according to the nature and seriousness of the content.

When platforms enforce content restrictions in accordance with State orders, they should provide sufficient information to enable users to challenge those decisions. This ensures accountability and prevents arbitrary or discriminatory enforcement.

Platform accountability and user empowerment rules

Platform accountability rules address systemic duties that go beyond content moderation. They require platforms to design services with user safety and empowerment in mind. States should legislate to require platforms of significant influence to conduct risk assessments and publish documentation on their human rights impacts. Regulatory authorities overseeing these frameworks must be independent, well-resourced and subject to judicial review.

States are encouraged to share responsibility by involving non-state actors such as researchers, user groups and out-of-court dispute settlement bodies. These actors should operate under transparency and accountability mechanisms. By decentralising oversight, the recommendation envisions a collaborative approach to safety.

Technology Law

How A Content Creator Was Harassed Online For Years (Gasparetto v. Bradley)

A recent court case from Nova Scotia Supreme Court has made headlines for all the right reasons. After consistent targeted online abuse, the applicant took his fight to court and won. The judge ruled in his favour. The ruling breaks down what counts as cyberbullying, how far is too far, and why content creators should pay close attention. This is a deta…

Read more

a year ago · 5 likes · Technology Law

User empowerment measures

At the heart of the recommendation is the belief that empowering users can mitigate online risks and foster resilience. User empowerment duties are divided into four categories:

1. Design-related,

2. Transparency-related,

3. Fair process, and

4. Collective action.

Empowerment by design

Platforms should enable users to personalise their online experience. Automated systems for organising and recommending lawful content should allow users to opt out, hide certain categories of content or block other users.

Third-party labelling tools can help users make informed choices about content. Platforms of significant influence may need to open their systems to third-party tools that assist in personalisation, subject to accountability requirements.

Design must also promote inclusivity. Platforms should address accessibility barriers faced by persons with impairments and ensure that safety tools are usable by all.

Age assurance systems are required to protect children from age-restricted content, but they must respect children's privacy and evolving capacities. The recommendation cautions against excluding children from online spaces or exacerbating discrimination.

Transparency

Users should understand how platforms organise content and moderate behaviour. Platforms are urged to explain their algorithmic systems for content organisation and curation. They should publish statistics on content moderation decisions and qualitative reports on the accuracy of automated moderation tools.

Transparency extends to advertising: platforms must disclose the identities of advertisers, the targeting techniques used, and spending. They should reveal how user-generated content is monetised and the principles used to allocate resources to creators.

Independent researchers play a crucial role in uncovering systemic issues. The recommendation emphasises that researchers should have access to platform data in a secure, legal, and privacy-compliant manner. Access may be granted through external vetting when personal data is involved. Researchers should also be allowed to use platforms to study social phenomena.

Procedural rights and fair process

Platforms must be clear about the contractual policies and rules that govern their services. Changes to these rules should be notified in advance and explained in an accessible language.

When platforms make content moderation decisions, they should notify affected users, explain the grounds for the decision and provide avenues for appeal. Appeals should include independent oversight mechanisms, such as out-of-court dispute-resolution bodies.

Collective action

Users should be able to report breaches of platform rules and legal restrictions easily. Platforms should provide feedback on follow-up actions. Users submitting notices about potentially illegal content should also receive feedback and have the right to appeal decisions.

The recommendation encourages recognising professional flaggers and user groups who can act as independent experts and advocate for user interests.

Categories of online risks and recommended responses

Subscribe now

The significance of this recommendation

The Council of Europe’s new recommendation is both an evolution and a consolidation of existing human rights principles applied to the digital space.

It acknowledges the power asymmetry between large platforms and individual users, and addresses this by imposing differentiated responsibilities based on size and impact.

This approach recognises that uniform regulations can stifle innovation or overwhelm smaller actors, while leaving major services inadequately regulated.

The recommendation’s focus on empowerment is notable. It goes beyond protection to encourage users to actively curate their digital environment. Personalisation tools, third-party labels and accessible interfaces are intended to give users agency over what they see and engage with.

This reform reflects an understanding that safety cannot be achieved solely through content removal. A pluralistic digital sphere requires that users are equipped to navigate diversity and dissent without being overwhelmed by harm.

Another significant element is the recognition of intersecting vulnerabilities. Women, children and marginalised communities often bear the brunt of online abuse. The recommendation highlights the need for age-appropriate systems and inclusive design to ensure that safety tools serve all users. States and companies can address the long-standing inequities that persist both online and offline.

Transparency provisions also have far-reaching implications. Requiring platforms to disclose how algorithms work, how moderation is conducted and who funds advertising opens space for public scrutiny. It empowers researchers to study the impacts of digital platforms and fosters trust by shedding light on practices that have traditionally been opaque. However, implementing meaningful transparency will require cooperation between regulators, platforms and civil society.

The recommendation aligns with global trends towards regulating digital services. The European Union’s Digital Services Act and the United Kingdom’s Online Safety Act 2023 similarly impose obligations on platforms to assess and mitigate risks.

The Council of Europe’s focus on human rights provides an additional layer of normative guidance, emphasising the need to preserve freedom of expression. As such, this recommendation may influence future national legislation and international norms.

Leave a comment

This newsletter includes references and links to external sources for informational and educational purposes only. Inclusion of these sources does not constitute endorsement, approval, or verification of their views, accuracy, or conclusions. Responsibility for the content of the referenced materials remains solely with the original authors and publishers. Our newsletter does not represent any legal advice.

Private technology companies now exercise operational influence in armed conflict, e.g., through control of digital infrastructure, satellite connectivity, artificial intelligence systems, cybersecurity and cloud computing networks that states rely on during hostilities. Existing legal frameworks, such as public international law and corporate social responsibility frameworks, appear institutionally unprepared for this reality, which exposes an uncomfortable concentration of strategic authority in private entities that were never designed to exercise war-related power.

Share

Newsletter Edition 89

The private tech company controversy

Private technology companies now wield operational influence in armed conflict that many states once considered an exclusive sovereign power. Decisions taken inside corporate boardrooms can affect military capability during active hostilities. Law has not fully caught up with this reality, yet the consequences are already visible in current world conflicts.

Public international law was designed with states and armed forces in mind; however, the legal framework governing armed conflict already contains rules that extend far beyond uniformed combatants. The rules contained under article 52 of the Additional Protocol I to the Geneva Conventions establish that objects become military objectives when they make an effective contribution to military action and when their destruction offers a definite military advantage.

Modern digital infrastructure exists directly within that legal logic. Corporate satellite networks, private intelligence platforms, and cloud computing systems can become operational components within a conflict environment even though they remain privately owned.

Technology companies therefore operate in a complex legal and political space where corporate decisions intersect with international humanitarian law, sanctions regulations, and corporate social responsibility.

When a private technology company decides who gets connectivity, cloud computing, satellite imagery, or defensive cyber services during an armed conflict, that company is not merely providing a service; it is exercising a form of power that can affect military operations and diplomatic outcomes.

Subscribe now

Existing laws already have mechanisms that can treat parts of that conduct as connected to the conflict.

The argument that the law does not already label technology firms as belligerents, because international humanitarian law still distinguishes civilians from combatants and civilian objects from military objectives. The law still treats civilian protection as the default.

However, the law is also clear that effects and contributions matter, and business and human rights standards likewise focus on adverse impacts and due diligence rather than on corporate self-description.

The private capabilities that now steer conflict

Let us reflect on commercial satellite connectivity. In plain terms, the same terminals and network can connect civilian services and also carry command communications, drone video, and targeting-related data. It was reported in June 2023 that the United States Department of Defense purchased satellite communications services from Starlink for Ukraine, and it was later reported in July 2025 that a global Starlink outage disrupted Ukrainian military communications, which is a reminder that dependence on a single private network can become an operational reality.

Control over that service is not a nominal issue. It was reported on 25 July 2025 that Elon Musk ordered the deactivation of Starlink coverage in specific occupied areas during late September 2022, and that the resulting blackout impaired Ukrainian operations. It was also reported in September 2023 that Elon Musk refused a request linked to Starlink use near Crimea for an attack on Russian forces.

Read our previous newsletter on the use of autonomous weapons and the proliferation of AI in armed conflicts.

Technology Law

The Human Cost of Giving AI the Right to Kill Through Autonomous Weapons

Automation is disrupting the battlefield, and autonomous weapons and AI are getting closer to making life-and-death decisions on their own. This newsletter unpacks what that means for international law, human responsibility, and the future of war. We break down the key takeaways from a recent peer-reviewed journal article on autonomous weapons systems a…

Read more

a year ago · 2 likes · 1 comment · Technology Law

Commercial earth observation falls into the same strategic category because high-resolution satellite imagery can be public record and intelligence, and providers can decide when imagery is released and who can access it.

On 5 April 2026, it was reported that Planet Labs would indefinitely withhold imagery of Iran and surrounding conflict areas at the request of the United States government, and that a broader effort was underway to limit access to conflict imagery through distribution controls by providers that depend on government demand.

Information control is not only a Western problem. The Washington Post reported in April 2026 that private firms in China were marketing intelligence products on the Iran war, using satellite imagery and open-source data with artificial intelligence analysis, and the report described how private actors can amplify wartime information dynamics while states preserve formal distance.

Access controls also appear through government distribution channels. Reuters reported on 7 March 2025 that the United States government temporarily disabled Ukraine's access to commercial satellite imagery delivered through a United States government distribution programme, with the National Geospatial Intelligence Agency confirming the action, and the reporting described this as a pause implemented via the private provider Maxar.

Technology firms can also become strategic actors when they build systems for intelligence and defence customers, because private capability becomes state capability through procurement.

It was reported in March 2024 that SpaceX was building a network of spy satellites for the National Reconnaissance Office under a contract associated with Starshield, illustrating how corporate infrastructure can become intelligence infrastructure with limited public visibility.

Cyber operations and information operations sit alongside these tech systems. Microsoft describes nation-state cyber threats and influence operations in its Digital Defence Report; the United Nations has endorsed norms of responsible state behaviour in cyberspace through its expert process; and influential legal scholarship has examined how existing international law applies to cyber operations, including through the Tallinn Manual 2.0.

International humanitarian law already has categories for these actions

International humanitarian law applies based on facts, not labels, and a widely cited reference point is the Tadic Appeals Chamber, which described armed conflict as a resort to armed force between states or as protracted armed violence involving organised armed groups.

The rule that matters most for private technology infrastructure is the rule on civilian objects. Article 52 of Additional Protocol I to the Geneva Conventions 1949 states that civilian objects are all objects that are not military objectives, and it defines military objectives as objects that, by their nature, location, purpose, or use, make an effective contribution to military action and whose destruction offers a definite military advantage.

Digital infrastructure fits inside that logic without any need to invent new legal categories.

A satellite ground station, a data centre, or a particular communications link can remain protected as a civilian object in many settings, and that same object can become a military objective when it is used in a way that makes an effective contribution to specific military operations, which is why private assets can enter the targeting calculus even when privately owned.

The human side of the same problem is captured by the rule that civilians lose protection from direct attack for so long as they take a direct part in hostilities, and the International Committee of the Red Cross’s interpretive guidance explains direct participation through a threshold of harm, direct causation, and a nexus to hostilities.

Subscribe now

When a company becomes an arm of a state

Responsibility debates often turn on attribution. The International Law Commission Articles on State Responsibility provide that conduct carried out on the instructions of, or under the direction or control of, a state is attributable to that state. The commentaries also underline that attribution can exist even when the conduct is performed through private entities.

Case law illustrates contested thresholds. In Nicaragua v. United States of America, the International Court of Justice rejected attribution of all contra conduct to the United States despite extensive support, relying on an effective control approach focused on control over the specific operations, while the International Criminal Tribunal for the former Yugoslavia Appeals Chamber in Tadic ruled on an overall control concept in its own context, and academic analysis has compared these standards and their implications for state responsibility.

This framing matters when governments use private technology services as policy instruments. A government request to restrict satellite imagery distribution, a government decision to purchase and configure military connectivity from a commercial provider, or a government direction to pause intelligence sharing can become part of the factual record of state action, and those facts frame legal responsibility debates even when the public narrative focuses on the vendor rather than on the state.

Accountability arrives through regulation long before it arrives through courts

Domestic regulation often reaches companies first, because sanctions and export controls are designed for speed. In the United Kingdom, the Sanctions and Anti-Money Laundering Act 2018 is the framework statute for sanctions, and government guidance outlines licensing controls for exports of dual-use items, including software and technology. The European Union also controls exports and related services for dual-use items as part of a peace and security regime.

The United States provide similar leverage. The International Emergency Economic Powers Act provides statutory authority to act against an unusual and extraordinary threat originating outside the United States after a national emergency is declared, and this authority underpins sanctions and restrictions that can affect technology services and cross-border commercial activity.

Read our newsletter on accountability in space.

Technology Law

Space Law Since 1967 With Aspirations Written, But Accountability Missing

International space law has become an uneven patchwork of commitments, voluntary guidelines, and contested interpretations, and yet the newly released United Nations treaty booklet presents it as a comprehensive and reliable framework. Such presentation conceals persistent gaps in compliance, the limits of enforcement, and the reality that non-binding g…

Read more

8 months ago · 6 likes · 2 comments · Technology Law

Corporate responsibility frameworks have become compliance architecture rather than rhetoric. The UN Guiding Principles on Business and Human Rights mention a corporate responsibility to respect human rights through due diligence and remediation. The OECD Guidelines for Multinational Enterprises on Responsible Business Conduct embed risk-based due diligence as a government-backed expectation across products and services. The European Union Corporate Sustainability Due Diligence Directive entered into force in July 2024 with the stated aim of requiring companies to identify and address adverse human rights and environmental impacts across operations and value chains.

Litigation remains a narrower and contested route, particularly in the United States. Kiobel v. Royal Dutch Petroleum Co., 569 U.S. 108 (2013), applied a presumption against the extraterritorial application of the Alien Tort Statute. Jesner et al. v. Arab Bank, PLC, 584 U.S. 241 (2018) held that foreign corporations cannot be defendants under the statute. Nestle USA, Inc. v. Doe et al. 593 US _ (2021) rejected an Alien Tort Statute claim where the conduct relevant to the statute's focus did not occur in the United States, and further commentaries have described how these decisions narrow pathways for civil accountability for overseas harm.

International criminal law focuses on individual responsibility even when corporate structures sit in the background. Article 25 of the Rome Statute sets out individual criminal responsibility, including forms of participation such as aiding, abetting, or otherwise assisting in crimes within the International Criminal Court's jurisdiction. Article 25 significantly limits the ICC's personal jurisdiction to natural persons, which means corporate accountability questions often depend on domestic criminal law, domestic corporate liability rules, or regulatory action rather than on direct international prosecution of companies.

What ordinary people are left holding

Civilians have become users of wartime critical infrastructure whether they want that status or not, because the same services that keep hospitals connected and families communicating can also carry military communications and operational data.

Reporting on Starlink control during the war in Ukraine and on commercial imagery restrictions during the Iran war shows how quickly a commercially marketed service can become an operational dependency, and how quickly access can become subject to executive decisions, government requests, and platform-level restrictions that sit outside most public oversight.

Public regulation is not aligned neatly with conflict realities, and the gaps are sometimes explicit. The European Union AI Act entered into force on 1 August 2024 and will become fully applicable on 2 August 2026, with phased obligations. Importantly, article 2(3) of the AI Act excludes certain military, defence, and national security uses, and the official text explains that public international law is the more appropriate primary framework for military and defence activities involving lethal force.

Recurring governance issues appear across these themes, even when the technologies differ, for example:

• allocation decisions that determine where connectivity or data is available and on what terms;

• contract terms that constrain service refusal or embed security controls for particular government entities;

• access controls that limit who can see high-resolution imagery, threat intelligence, or location data during active hostilities

Private technology companies now sit inside the operational environment of armed conflict. Infrastructure owned and operated through corporate platforms now carries military communications, processes intelligence data, and controls access to digital systems that governments rely upon during hostilities. International humanitarian law, including the rules on military objectives, already recognises that objects which make an effective contribution to military action may enter the legal calculus of war.

Legal responsibility, therefore, extends beyond traditional battlefields and into corporate systems that support modern conflict operations. Corporate conduct, regulatory oversight, and public international law now intersect in ways that affect civilians, governments, and companies simultaneously.

Public debate about warfare rarely includes the legal implications of privately owned technology infrastructure. Greater scrutiny of that relationship encourages a deeper understanding of how modern conflict actually operates and how law responds when corporate power intersects with armed force.

Leave a comment

This newsletter includes references and links to external sources for informational and educational purposes only. Inclusion of these sources does not constitute endorsement, approval, or verification of their views, accuracy, or conclusions. Responsibility for the content of the referenced materials remains solely with the original authors and publishers.

Governmental interest in automated AI judges is driven less by justice and more by administrative convenience, fiscal pressure, and institutional control. This newsletter exposes how AI promises speed, uniformity, and predictability while threatening transparency, accountability, and human judgment. The analysis challenges the assumption that efficiency improves justice, warning that delegating adjudication to AI risks transforming courts into instruments of bureaucratic optimisation rather than guardians of legal legitimacy.

Share

Newsletter Edition 88

The Administrative Fantasy of Justice Without Human Intervention

I might raise some eyebrows by saying this, but some governments appear eager to place your fate in the hands of an algorithm. In fact, in China, millions of legal cases have already been decided by “Internet courts” staffed with non-human judges operating entirely online.

These AI-driven cases handle everything from e-commerce disputes to loan defaults, and remarkably 98% of their rulings have been accepted without appeal.

It might be startling to learn that a court with no human judge present can ask questions, weigh evidence, and issue verdicts via a holographic avatar, as demonstrated in Hangzhou’s Internet Court.

The system even runs 24 hours a day, 7 days a week – a round-the-clock justice delivery that no human judge could ever match.

When I first heard about this, I felt equal parts fascinated and uneasy. I want to talk to you about why some governments are so tempted by the idea of AI judges, and what it means for the future of justice.

The Allure of Automated Justice

I have spent enough time around the legal system to know that efficiency is the magic word that every government loves to hear. Courtrooms around the world face crushing case backlogs and slow proceedings. The notion of an AI “robot judge” promises lightning-fast case processing, potentially clearing dockets that human judges struggle to manage.

Sometime ago, media reports breathlessly announced that Estonia was building exactly such a robot judge to handle small claims disputes and help clear its backlog. Officials supposedly wanted an algorithm to analyze documents and reach decisions on claims under €7,000, which a human judge would then simply review.

The project was touted as one of the most advanced examples of AI in the judiciary, justice by artificial intelligence. What exactly was the promise? Quicker resolutions, lower costs, and no more waiting months for a court date.

We later learned that this story was more hype than reality. In 2022 the Estonian Ministry of Justice felt compelled to clarify it never had any project or even ambition to replace human judges with AI.

That did not stop the idea from capturing imaginations. And frankly, it is easy to see why the idea is seductive.

Automating routine court decisions could free up human judges for the hardest cases and eliminate mundane tasks.

In theory, an AI judge might churn through straightforward disputes with the detached precision. One enthusiastic commentator described the potential “cost savings” as “astronomical”, noting that an AI system could issue a preliminary decision in under a month, and unlike a human it “is not hungry or tired”.

Governments hear things like that and start picturing leaner budgets and ultra-efficient courts.

Consistency and objectivity are another part of the allure. Ask any lawyer and they will tell you that different judges can reach very different outcomes on similar facts.

Humans are fallible and sometimes inconsistent, but an AI algorithm can be replicated and standardized nationwide. In China, the ruling Communist Party has explicitly embraced “Smart Courts” as a way to improve consistency in judicial outcomes and increase public trust in the courts.

From the perspective of central authorities, if every courtroom uses the same AI system, you eliminate rogue judges who might deviate from policy and you ensure each defendant is subject to the same decision criteria everywhere.

The temptation here is control: AI systems can be centrally updated or monitored, giving governments more oversight over the judicial process.

In an authoritarian system, that consistency also conveniently enables centralized oversight and intervention in cases when needed.

Even in democracies, one can see the appeal of a tool that might render justice more predictable – no more “judge lottery” where your fate depends on who happens to preside.

There is also a public perception angle. Many people have stories of judicial errors, biases, or high-profile miscarriages of justice. An AI, on the surface, carries none of the human baggage; it does not have bad days, it does not hold grudges, it does not get star-struck or prejudiced.

Some technocrat policymakers genuinely believe that a well-designed AI could be more impartial than a human judge. For example, in traffic or parking fine disputes, an algorithm might decide purely on data (Was the car parked too long? Did the camera catch the license plate?) without being swayed by a defendant’s attitude or appearance.

We have already seen glimpses of this: a UK-developed chatbot lawyer app famously overturned 160,000 parking tickets by automatically generating appeals, exploiting the system’s own rules.

If an AI can beat humans at following legal rules for parking fines, why not let it decide them in the first place?

Also, let us not forget speed and accessibility. A digital judge could in theory handle cases via video or online submissions, delivering rulings in hours rather than weeks.

During the COVID-19 pandemic, courts around the world turned to Zoom and online systems out of necessity. This accelerated acceptance of online disputes resolution.

Tech-forward nations like China took it further. Their Internet courts allow citizens to file cases online, attend hearings by video chat, and receive judgments electronically.

Such systems can dramatically lower the barrier to accessing justice, especially for people in remote areas or with small claims not worth a costly legal battle.

Proponents say AI judges are a natural next step to make justice system more user-friendly. No intimidating courthouse, just an app on your phone that issues a ruling.

In Beijing’s Internet Court, the average case reportedly concludes in just 40 days, with hearings under an hour on average.

Imagine a civil claim being filed, argued, and resolved in a matter of weeks entirely through an online platform. That is the vision.

Reality Check: Experiments in AI Judging

We should acknowledge that so far, fully automated judges remain mostly experimental.

China is the clear frontrunner. Since 2017, its specialized Internet Courts have been operating in cities like Hangzhou, Beijing, and Guangzhou.

The “judges” in these courts are effectively AI-powered decision systems with a virtual judge interface. They handle a surge of cases tied to the digital economy (online commerce disputes, copyright for online content, etc.), and by all accounts the volume is immense.

In just a six-month period in 2019, users conducted over 3.1 million legal activities through the Hangzhou Internet Court platform.

One striking statistic from Beijing is that over a million people have used the system, yet appeals are extraordinarily rare, nearly all parties accept the AI’s verdict.

The platform even populates a life-like avatar of a judge, a 3D modelled person in judge’s robes, who can ask the litigants questions on screen. Chinese reporters have sat in on these virtual hearings and watched a holographic judge guide the proceedings.

Other countries have flirted with AI judging in narrower contexts. You might have heard of proposals to use AI for small claims and disputes.

While Estonia’s “robot judge” turned out to be a myth, the very idea sparked global discussion.

There is a kernel of reality in these ideas: Online dispute resolution (ODR) systems are growing, and they often involve automated decision-making for low-stakes issues.

For instance, Canada has experimented with ODR for simple civil claims and certain tribunals, where an algorithm or guided system helps the parties reach a resolution or even renders a proposed outcome.

These systems stop short of a final binding judgment by AI, but they inch close. If an AI mediator proposes an outcome and both sides accept, effectively the AI “decided” the case.

In the United States, meanwhile, we see a different path to using AI to assist judges rather than replace them, at least for now. American courtrooms in several states have started integrating algorithmic risk assessment tools to guide decisions on things like bail and sentencing.

These programs, such as the well-known COMPAS system, generate scores predicting a defendant’s likelihood of reoffending. Judges then consider those scores when deciding whether someone gets bail or how long a sentence to give.

In theory it is just advisory, but in practice it can heavily sway outcomes. This approach has been contentious – I will get to the controversies in a moment – but it shows how even in a justice system that values jury trials and human judges, some decision-making is being handed to algorithms.

In fact, the Wisconsin Supreme Court confronted this issue in a notable case: State v. Loomis 881 N.W.2d 749 (Wis. 2016). In that case a defendant argued it was unfair that an opaque algorithm helped determine his prison sentence.

The court upheld the sentence but cautioned that such risk scores should be only a supplementary factor and must not replace a judge’s own judgment.

The message from the ruling was essentially in that you can use the AI’s recommendation, but the human judge is still responsible for the decision.

That seems to be a critical point. So far, even the most ambitious experiments usually leave a human with some liability. For instance, China allows appeals to a human judge if someone disagrees with the AI outcome.

The vision of completely replacing judges in all cases remains more of a thought experiment than a reality in 2026. However, every year, the line nudges forward.

Just recently, I saw news of two U.S. judges who admitted their staff had used ChatGPT-style AI tools to draft portions of judicial orders, with disastrously erroneous results that slipped through. This caused quite a stir, prompting calls for clearer rules on how judges and clerks may use AI.

Indeed, it is a reminder that even if we are not handing the gavel to an online judge today, AI is already seeping into the judicial process in bits and pieces, for better or worse.

Blind Justice or Biased Algorithms?

Before we all warm up to the inevitable, we need to discuss frankly about the serious concerns and limitations of AI as a Judge.

The promise of impartiality from an AI is not a given at all. Yes, an AI comes without human emotions, but it inherits the biases of its data and programming.

That risk is present. In the United States, the use of COMPAS and similar sentencing algorithms has become a cautionary tale. Investigative journalists discovered that COMPAS was far more likely to falsely label Black defendants as high-risk future criminals compared to white defendants. Think about that; a supposedly objective tool was doubling the rate of false “future crime” flags for Black individuals.

Meanwhile it was more often underestimating risk for white defendants, incorrectly giving them low risk scores.

The bias was not deliberate in the sense of someone programming racism openly; it emerged from patterns in the underlying data and how the algorithm was developed.

Should we regulate the developers or the AI model? Read our newsletter to learn more about regulatory approaches:

Technology Law

Regulate the AI Developers, Not the AI

AI systems are getting more powerful, but the real risk often lies with the companies behind them. In this research spotlight, we discuss a scholarly article “Entity-Based Regulation in Frontier AI Governance” published on the Carnegie Endowment for International Peace website. It explores why current rules that focus on AI tools themselves are missing …

Read more

10 months ago · 9 likes · 2 comments · Technology Law

From the perspective of the defendant who is denied bail because a computer indicated so, the distinction does not matter, it just feels like algorithmic prejudice.

This is a nightmare scenario for automated justice, that we might replace human bias with a hidden, harder-to-challenge bias embedded in code.

Another glaring issue is transparency and the right to explanation. In a courtroom, a human judge is expected to explain their reasoning in a judgment. How do you question an algorithm’s reasoning?

Many AI models, especially advanced machine learning ones, operate as a “black box”. They crunch inputs and produce outputs, and not even the developers can easily explain the exact decision path.

This was a core of Mr. Loomis’s complaint in the Wisconsin case as he had no way to challenge the COMPAS algorithm because its inner workings were proprietary and opaque.

It is fundamentally troubling to imagine standing in court, hearing “the computer says you are high risk, so you get a harsher sentence,” and not being able to assess that computer’s logic.

Due process in many countries includes the right to review and contest evidence, but does an algorithm’s output count as evidence? If so, can the defendant demand access to the source code?

These legal questions are largely unresolved. There is a growing movement insisting that “algorithmic accountability” and transparency must accompany any use of AI in government decisions affecting rights.

Without transparency, an AI judge would be an inscrutable authority, which undermines a fundamental principle of justice. Decisions must not only be fair, but be seen to be fair and reasoned.

We also have to consider empathy and moral judgment, qualities that we expect, or at least hope, human judges will possess.

A judge in a courtroom can look a defendant in the eye, can consider pleas for mercy, can weigh intangible factors like remorse. Can an AI do that? Not really, not yet.

An algorithm scores what it is given to score. It might be great at parsing legal texts and past cases, but justice is more than black letter law application.

There are fears that an automated judge would be ultra-strict, after all, a computer won’t bend a rule or overlook a nuance unless explicitly programmed to.

It has been argued that mercy, context, and human intuition are indispensable to justice, and these are things no AI can replicate. I find it hard to imagine an AI automated system exercising equitable discretion or interpreting a law in light of evolving social values.

At best, it will do what it’s told; at worst, it might rigidly enforce even unjust laws without question.

A chilling thought is that an authoritarian government could program an AI judge to enforce oppressive laws to the letter, with flawless efficiency and no dissent. Human judges can resist immoral orders; AI might not have that capacity.

The accountability problem looms large too. If a human judge makes a grievous error or is biased, there are mechanisms (imperfect as they are) to appeal, to seek review, even to impeach or discipline the judge.

If an AI judge makes an error, say, convicts an innocent person due to a glitch or biases, who is responsible? The company that developed the software? The government officials who deployed it? It becomes a blame-shifting fiasco.

Also, how would such an error even be discovered? If all judges were algorithms applying the same model, a systemic flaw could go unnoticed for a long time, affecting thousands of cases before anyone realizes. That scenario should keep anyone up at night more than we care to admit!

Collision Course with the Law

You might be wondering whether governments even legally hand over judging to AI? In many places, this idea runs into legal roadblocks, and rightly so.

For example, in Europe there are strong legal guarantees of a fair trial and human accountability. The European Union’s data protection law (GDPR) explicitly gives people the right not to be subject to a decision based solely on automated processing if it has significant effects on them.

What is the future of European courts with the integration of AI in the judicial process? Find out more:

Technology Law

The Digital Future of European Courts

The European Commission is drafting a new strategy to bring courts into the digital age by 2030. These reforms will involve faster case hearings, fewer delays, smarter tools (e.g., AI) and less paperwork. The European Commission intends to fix outdated, expensive and slow justice systems…

Read more

a year ago · 4 likes · Technology Law

A judgment in court is arguably the most significant decision one could face.

This means that under current EU law, you can insist on a human review of an automated decision.

A fully AI judge with no human involvement would be at variance with that right, unless EU countries carve out an exception in law. Indeed, the EU is actively working on regulations for AI.

The EU Artificial Intelligence Act classifies any AI used in judicial decision-making as “high-risk”, recognizing the profound impact on rule of law and individual rights.

The EU lawmakers have even inserted a clear principle in the latest draft: AI may support judges but must not replace them, the final decision must always be made by a human.

In other words, European policy is drawing a red line that no matter how advanced AI gets, an actual person should be the one delivering the verdict when it comes to dispensing justice.

Are lawyers losing control to AI? Is the legal profession at risk of AI proliferation and to what extent? Read our newsletter to find out more:

Technology Law

The Legal Profession Is Losing Control To AI

The legal profession is outsourcing its thinking. AI is already writing arguments, summarising cases and drafting contracts, often without human intervention. Is this an erosion of legal practice? If the law becomes automated guesswork, then justice becomes optional. The silence from regulators and educators is not only strange, but it is dangerous…

Read more

9 months ago · 11 likes · 1 comment · Technology Law

This aligns with the prevailing view in international human rights law that everyone is entitled to have their case heard by a “competent, independent and impartial tribunal”, phrases which presume a human judge sitting and listening.

Outside Europe, these debates are just as alive. In the United States, there is no single law like the GDPR’s Article 22, but the judiciary itself is proceeding cautiously. A U.S. federal judicial task force recently warned judges not to delegate core judicial functions to AI, especially not the act of adjudicating a case.

The concern is that even if AI can help with research or drafting, the judge must remain fully responsible and engaged in the decision.

Influential voices in the legal community are emphasizing that AI should assist, not replace human judgment.

Even China, for all its tech enthusiasm, maintains a fig leaf of human involvement, as noted, one can appeal an AI court’s decision to a human judge, and Chinese officials portray their Smart Courts as enhancing efficiency while still maintaining human oversight.

The official line is that technology should support the decision-making power of judges, but not supplant it.

Of course, the reality of how much human oversight is actually happening in China’s Internet Courts might be debatable, but at least on paper, they acknowledge a human backstop.

It is interesting that even governments keen on automation still feel the need to reassure the public that judges are not being entirely replaced.

That tells us something that there is a deeply ingrained cultural and constitutional importance to the human judge as a symbol of justice.

Replacing that human figure with a AI is bound to provoke resistance. Indeed, when the idea of the robot judge in Estonia made headlines, it sparked plenty of discussion in Europe about the ethics and legality of such a move.

The pushback from the legal community was swift, and as we saw, the government backed away, calling it misleading news.

Likewise, in France, instead of automating judges, the government went the other direction by banning the practice of statistical analysis of judges’ past decisions (to profile or predict their rulings).

A law was passed to protect human judges from being quantified by AI, ironically.

While some authorities fantasize about AI judges to streamline justice, others are enacting laws to shield the human element in judging.

A Careful Path Forward

As someone deeply fascinated by the intersection of law and technology, I understand both the temptation and the fear at play here. When talking to non-lawyers about this, I often find people initially intrigued. Who would not want faster and cheaper court cases?

Then arrives the viscerally uncomfortable thought of an AI driven robot pronouncing a prison sentence or deciding a child custody dispute. That discomfort is healthy. It means we recognize something vital that justice is not merely computational. The rule of law is as much about process and trust as it is about outcomes.

We trust a human judge to hear us, even if they might err, because we ascribe legitimacy to that human deliberation. Transferring that trust to an AI is a huge leap.

Governments will likely continue to experiment with AI around the edges of the judicial process.

We will see more AI legal assistants that help judges research cases or draft routine parts of judgments.

We will see expanded online courts for minor issues, possibly with automated mediation and suggested resolutions.

Be that as it may, there is a long road from there to a world where you walk into a courthouse (or log into one) and face an AI judge as the final arbiter.

For the foreseeable future, fully autonomous AI judges remain a controversial proposition fraught with legal and moral peril.

Even the most advanced AI cannot yet replicate the full spectrum of human judgment, especially the qualities of compassion, wisdom, and public accountability that we expect from our judges.

I have confidence that many of the safeguards in law will hold, and that any use of AI in judging will be accompanied by the right to a human appeal or review.

International principles are already crystal clear on one thing: technology should serve humanity, not displace it in the courtroom.

So, is an AI judge coming for your day in court? The honest answer is that governments are tempted, yes, but also wary. They stand to gain efficiency and control, yet they risk losing the public’s faith in justice if they go too far.

For now, I am relieved that the consensus is to move carefully. We should demand nothing less. The day may come when AI takes its place on the bench, but if and when that happens, I suspect we will still want a human behind the gavel of justice.

Leave a comment

Disinformation laws are often drafted with a confidence that is not matched by their democratic legitimacy. Legal systems appear willing to trade precision, restraint, and procedural safeguards for speed and symbolic reassurance, even when the subject matter sits at the core of political expression. This trend deserves sustained criticism, not because false information is harmless, but because law that intervenes too broadly in public discourse alters how democratic power is exercised, delegated, and justified.

Share

Newsletter Edition 87

The Legal Campaign Against Disinformation and Its Democratic Risks

The current generation of laws meant to counter falsehood in the digital world carries a real risk of weakening the very democratic values they claim to defend. It is easy to accept the impulse behind these laws. False information can corrode trust, deepen division, and influence the course of public decision making in ways that are harmful to societies.

Nonetheless, the responses that legal systems are adopting raise questions about freedom of speech, accountability, and the role of government and private technology companies in controlling what citizens are allowed to know and say.

Governments are passing statutes and regulators are enforcing rules with significant consequences. Individuals are being asked to adapt to legal frameworks that touch on fundamental liberties while technology platforms are being pressed into roles that shape political discourse.

This newsletter will trace legislative frameworks, highlight relevant legal developments globally, and critically assess how these laws are playing out as real world tools that interact with technology and civil liberties.

The Rise of Disinformation Regulation

In recent years, the response to disinformation has included a mix of statutory mandates and regulatory expectations. In the European Union, the Digital Services Act (Regulation of the European Parliament and of the Council of 19 October 2022) is central to how online content is regulated.

It imposes new responsibilities on very large online platforms and search engines aimed at enhancing transparency of content moderation and curbing harmful content including disinformation under certain conditions.

The European Commission has emphasised that this is part of broader efforts to protect democratic processes and strengthen public debate.

In the United Kingdom, the Online Safety Act 2023 creates an expansive set of obligations on providers of internet services to manage harmful content.

Civil liberties organisations have argued that the Act grants broad powers to regulate speech and encourages platforms to take down content pre emptively to avoid liability.

Critics such as the Open Rights Group and Article 19 have warned that such mechanisms risk impinging on freedom of expression and access to information.

Beyond Europe, legal frameworks are emerging that criminalise or civilly sanction the communication of false information. In the Indian state of Karnataka, a draft bill proposes jail terms for spreading so called fake news or content that is defined in vague terms, including anti feminist content and superstition. Free speech advocates warn that such legal language could sweep in a vast range of expression and be used inconsistently.

Singapore’s Protection from Online Falsehoods and Manipulation Act was passed in 2019 with the intention to counter deliberate online falsehoods while attempting to exclude opinion and satire, yet concerns remain about the broad discretion given to authorities and the potential chilling effect on legitimate discourse.

Ethiopia’s Hate Speech and Disinformation Prevention and Suppression Proclamation makes social media users and intermediaries criminally liable for posts deemed to disrupt public order, showing how legal tools can extend to severe penalties for online speech. Human rights organisations have criticised this law as infringing on fundamental expression rights.

These legislative efforts reflect the global urgency with which false information online is treated. However, the very design of these laws often places enormous discretionary power in the hands of regulators or platform operators to decide what content is permissible.

Democracies are rethinking how they legislate free speech in an environment where digital systems mediate so much of public discourse, but many of the legislative responses are bending longstanding protections in ways that deserve careful scrutiny.

The Legal and Constitutional Debate

The core tension at the heart of these laws is the balance between preventing harm and protecting freedom of expression. Democratic constitutions and human rights frameworks often guarantee robust rights to free speech.

In the United States, the First Amendment has been interpreted to protect even false statements in many contexts unless they harm specific individuals through defamation or similar legal channels.

Attempts at regulating deepfakes and election related speech have encountered immediate legal challenge on constitutional grounds. In 2025, X Corp filed a federal lawsuit to overturn Minnesota’s ban on political deepfakes arguing that the law penalises election related expression and violates First Amendment rights.

For a thoughtful discussion on the negative impact of deepfakes in our courts and society, please read our newsletter:

Technology Law

Why Deepfake Technology Forces Courts to Rethink The Reliability of Evidence

Courts can no longer credibly claim that evidentiary reliability is a settled problem managed through existing rules and judicial instinct. Deepfake technology has exposed how fragile long held assumptions about recorded truth really are, not because judges are inattentive, but because the legal system was never designed to verify authenticity in an env…

Read more

4 months ago · 11 likes · 7 comments

In Murthy v. Missouri, the United States Supreme Court addressed the ability of the federal government to communicate with social media companies about content moderation. The Court allowed government involvement regarding misinformation removal, but this itself sparked controversy about where the line is drawn between legitimate action against falsehoods and the government influencing the decisions of private platforms.

In Europe, freedom of expression is safeguarded under Article 10 of the European Convention on Human Rights and the EU Charter of Fundamental Rights. However, the EU’s regulatory approach does not explicitly define disinformation in statutory text, and enforcement under the Digital Services Act is tasked to both regulators and platforms to curtail disinformation and illegal content.

Scholars have raised serious questions about whether these approaches sufficiently protect free expression rights and whether they empower private companies to act as arbiters of political speech without due process.1

The German Network Enforcement Act, passed in 2017, obliges platforms to remove illegal content within strict timeframes or face steep fines. The law has been widely criticised for creating incentives for platforms to err on the side of removal to avoid penalties, which essentially pushes companies to make judgments about speech that ought to be matters for courts. Critics argue that this dynamic can lead to disproportionate censorship of legitimate expression.

France’s Avia Law, aimed at combating hateful and illegal content, saw major portions struck down by the Constitutional Council because they infringed too broadly on freedom of expression. Yet, the law’s initial passage highlighted how national legislatures are grappling with the challenge of regulating online speech.

These legal debates involve core principles that structure democratic participation. The ability to hear opposing views, to criticise government action, and to engage in public debate are foundational to self governance.

When legal frameworks alter incentives for speech or create mechanisms that lead to over removal of content, there is a collateral effect on democratic engagement.

Democracy Beyond False Statements

It is vital to acknowledge that disinformation does cause harm in itself. False narratives and fake news about elections, public health, or civic processes can mislead citizens and erode trust in institutions.

Technical studies have shown that online propaganda and misinformation contribute to polarisation and societal division.2

At the same time, it is essential to differentiate the regulation of harmful and criminal speech from broad preventive laws that apply across wide categories of expression.

Democracies have long recognised that some kinds of speech such as incitement to violence or defamation can be subject to legal limits.

Nonetheless, new laws aimed at digital disinformation often lack clear definitions that distinguish between intentional manipulation and honest error or opinion.

Legal frameworks that do not ensure procedural safeguards or judicial oversight risk granting regulatory bodies or private entities the power to remove speech without sufficient justification.

If laws are designed in ways that blur these fundamental distinctions, then democracy itself suffers. Citizens are less exposed to the full range of perspectives and have diminished ability to challenge prevailing narratives. A society that cannot tolerate disagreement and dissent risks becoming less resilient, less informed, and ultimately less democratic.

Private Actors as Public Regulators

A critical concern in the modern legal regime on disinformation is the role of private technology companies. Laws like the EU digital services framework and the UK’s online safety model rely heavily on what platforms decide and how they enforce rules.

Platforms are required to act to avoid penalties. This effectively deputises private companies to enforce public norms about speech that historically were the domain of public law and independent courts.

Platforms have commercial incentives and policies that are not always transparent or consistent across jurisdictions. A decision to remove content or to label it as false is made within a corporate governance structure not accountable to the public in the same manner as a democratic legislature or a judicial body.

This dynamic raises a question about legitimacy. Democracies rely on transparent and accountable institutions to define and enforce the legal bounds of expression. When private platforms operate in lieu of those institutions on matters that affect political speech, the democratic quality of that enforcement is uncertain at best.

Leave a comment

Legislative frameworks that push more power to platforms without robust oversight risk enabling forms of censorship that are neither subject to clear legal standards nor to democratic accountability.

Citizens often do not know why a piece of content is taken down. They have limited rights to appeal, and they encounter different outcomes depending on where they are located or how a platform interprets vague legal duties.

The International Ripple Effect

Legal approaches in one jurisdiction influence others. The European regulatory model, because of its size and market power, affects global platform behaviour.

US officials have openly criticised the EU Digital Services Act on grounds that it enables censorship beyond European borders and undermines free speech.

These critiques have become part of international diplomatic friction, with officials from one democracy publicly challenging another democracy’s approach to regulating digital speech.

At times, national courts take positions that reshape legal obligations. The Brazilian Supreme Court’s 2025 ruling that social media platforms can be held liable for user posts without judicial orders puts pressure on platforms to act quickly to remove harmful content or face legal risks. Such rulings create asymmetric incentives for moderation that may encourage broad content removal to mitigate liability, again with potential impacts on democratic debate.

Other countries, including in South Asia and Africa, are adopting laws that grant governments sweeping control over content under the pretext of security or misinformation control. These laws often intersect with broader patterns of suppression and have severe consequences for dissenting voices and civic freedoms.

The international proliferation of disinformation laws creates a patchwork of standards that technology companies must navigate.

In the absence of clear, globally accepted norms that respect free expression while addressing harm, there is a risk that legal models that prioritise control over speech will be adopted more widely, with negative consequences for democratic engagement.

What Democracy Requires

Democracy depends on open public discourse where ideas can compete and be tested against evidence and argument. The impulse to regulate falsehood is understandable, yet legal solutions must be calibrated carefully to respect foundational rights. Laws that are vague in definition, broad in scope, or lack adequate procedural protections risk being repurposed to silence dissent or to restrict controversial opinions that are essential to democratic deliberation.

Legal frameworks to counter disinformation should ideally operate with clear definitions, predictable procedures, and robust safeguards that protect legitimate political speech. They must uphold independent oversight and judicial review so that when speech is restricted, there is accountability and transparency in the process.

The current wave of disinformation regulation reflects a genuine concern about the impact of false information, but there is a real danger that in addressing this issue through broad legal authority, democracies may erode the very principles of free expression and accountability that make them resilient.

Links in this article reference public legal developments and reporting from credible sources. Readers are invited to examine the original materials themselves to further understand the content and context of the legislative and judicial activities discussed.

What are your thoughts about disinformation and fake news undermining democratic practices?

Leave a comment

Courts can no longer credibly claim that evidentiary reliability is a settled problem managed through existing rules and judicial instinct. Deepfake technology has exposed how fragile long-held assumptions about recorded truth really are, not because judges are inattentive, but because the legal system was never designed to verify authenticity in an environment where fabrication is easy, convincing, and legally consequential.

Share

Newsletter Edition 86

Deepfakes Are Not Just a Tech Problem; They Are a Justice Problem!

Courts have always depended on evidence as the anchor of decision-making. That dependence now sits under sustained pressure. This is not an abstract debate about future technology. It is a present reality that demands careful attention from anyone who cares about the rule of law, accountability, and fairness.

Video and audio that appear authentic can now be generated or altered in ways that defeat casual inspection and, in some cases, expert review. Courts have traditionally relied on a combination of common sense, procedural safeguards, and expert testimony to decide whether evidence is reliable. Deepfake technology puts pressure on all three at once.

This newsletter looks at why this matters, how existing evidentiary principles are being strained, and why courts are being forced to reconsider assumptions that once felt stable.

What Deepfakes Really Do to Evidence

Deepfake technology undermines a basic assumption that has long guided judicial reasoning, which is that recorded audio and video tend to reflect real events unless there is a concrete reason to doubt them.

Courts never treated recordings as infallible, but there was an underlying confidence that fabrication required effort, expertise, and resources that were not widely available.

That confidence no longer holds. Software tools now allow realistic manipulation of facial movements, voice patterns, timing, and context using datasets that can be gathered from public sources.

Social media platforms, conference recordings, podcasts, and court filings themselves provide the raw material. The result is not simply the existence of fake content, but uncertainty about authentic content.

A recording can be genuine and still be challenged with credibility. A recording can be fake and still persuade. Courts must now consider not only whether evidence appears real, but whether appearance itself has lost probative value. This affects admissibility decisions, weight given to evidence, and the allocation of burdens between parties.

Traditional Evidentiary Safeguards Under Pressure

Legal systems rely on a layered approach to evidentiary reliability. Authentication rules require parties to show that evidence is what it claims to be. Cross examination allows weaknesses to be exposed. Expert witnesses provide technical insight, while judges and juries assess credibility in context.

Deepfakes complicate each layer. Authentication becomes harder when visual similarity and voice matching are no longer meaningful indicators of origin. Cross examination struggles when the witness did not create the content and cannot explain the manipulation. Expert evidence becomes contested when experts disagree or rely on tools that themselves produce probabilistic conclusions.

Interested in learning more the future of courts in the EU? Check out this newsletter:

Technology Law

Issue 15: The Digital Future of European Courts

The European Commission is drafting a new strategy to bring courts into the digital age by 2030. These reforms will involve faster case hearings, fewer delays, smarter tools (e.g., AI) and less paperwork. The European Commission intends to fix outdated, expensive and slow justice systems…

Read more

a year ago · 4 likes · Technology Law

The law has always accepted that evidence can be forged. What is different now is scale and plausibility. Fabrication is easier, faster, and more convincing than before. This changes how much confidence can be placed in surface level indicators of truth.

Courts in several jurisdictions have already acknowledged this difficulty. Judicial opinions have begun to reference the risk of manipulated media, even where no deepfake allegation is proven. This shows that the issue is not limited to cases involving advanced forgery, but extends to general evidentiary assessment.

Criminal Justice and the Risk of Error

Criminal proceedings illustrate the stakes most clearly. Video evidence often carries strong persuasive force. Jurors tend to trust what they can see and hear. Prosecutors rely on recordings to establish presence, intent, or conduct. Defendants rely on recordings to show innocence, coercion, or misconduct by authorities.

Deepfakes introduce two risks at once. False inculpatory evidence may be introduced. Genuine exculpatory evidence may be dismissed as fake. Both risks undermine fairness.

Judicial systems have limited tolerance for error in criminal cases, yet procedural rules are slow to adapt. Judges must decide whether to admit recordings while knowing that their own ability to evaluate authenticity is constrained.

Excluding all contested recordings is not realistic. Admitting all recordings without deeper scrutiny is equally problematic.

Civil Litigation and Commercial Disputes

Civil courts are not insulated from these issues. Employment disputes may rely on recorded conversations. Commercial litigation may involve video meetings, voice messages, or recorded negotiations. Defamation claims increasingly involve manipulated content circulated online.

The evidentiary standard in civil cases is lower than in criminal cases, which increases exposure. A manipulated recording may tip the balance of probabilities even if doubts exist. This raises concerns about strategic misuse of deepfake material in high value disputes.

Judges must assess whether existing disclosure rules, expert evidence standards, and sanctions for misconduct are sufficient deterrents. There is growing recognition that technical manipulation can occur without leaving obvious traces, making post hoc remedies less effective.

Evidentiary Reliability as an Institutional Problem

Deepfakes force courts to confront evidentiary reliability as an institutional issue rather than a case specific anomaly. The problem is not limited to one dishonest party or one flawed expert. It is systemic.

Courts operate under time constraints, resource limits, and procedural fairness requirements. Judges cannot become forensic technologists. Jurors cannot be trained to detect synthetic media. Reliance on expert witnesses introduces cost and inequality, as well resourced parties can commission more persuasive testimony.

Several structural tensions become visible.

1. Authentication standards assume stable technical benchmarks.

2. Expert disagreement undermines judicial confidence.

3. Procedural equality is strained by asymmetric access to technical expertise.

These tensions are not resolved through better education alone. They require reconsideration of how evidentiary trust is constructed.

Regulatory and Policy Responses

Outside the courtroom, lawmakers and regulators are attempting to address deepfakes through criminalisation, labelling obligations, and platform duties. These measures indirectly affect evidentiary reliability by shaping how content is created, distributed, and preserved.

AI may be criminally liable, but only in some niche context. Read our deep-dive editorial on this topic:

Technology Law

Can AI Be Criminally Liable?

Around the world, prosecutors are circling, and in some cases, people are already being charged for what their AI systems did. World legal systems are catching up with reckless automation, and the consequences are real: injury, death, and yes, prison time. In this article, we explore how criminal liability is entering the AI age, what cases are already …

Read more

a year ago · 12 likes · 8 comments · Technology Law

European Union policy discussions under the Digital Services Act and Artificial Intelligence Act acknowledge the evidentiary risks posed by synthetic media.

United States federal agencies have issued guidance on synthetic media risks, particularly in election integrity and fraud contexts, which has downstream relevance for courts assessing authenticity.

Regulation alone does not solve the courtroom problem, but it influences the ecosystem in which evidence arises. Courts must operate within that ecosystem rather than outside it.

Why Courts Cannot Rely on Intuition Anymore

Judicial intuition has always played a role in assessing evidence. Judges develop instincts through experience. Deepfakes undermine that reliance because realism is no longer a reliable cue.

A video that looks implausible may be authentic, and a video that looks ordinary may be entirely fabricated. This inversion destabilises confidence in visual reasoning. Courts must acknowledge that intuition is no longer sufficient when dealing with contested digital media.

This recognition is already visible in judicial training materials and appellate commentary. It does not imply judicial failure, but it reflects technological change that outpaces inherited methods of evaluation.

Evidentiary Reliability as a Public Trust Issue

Courts do not operate in isolation. Public confidence in judicial outcomes depends on the belief that evidence can be assessed fairly. If members of the public believe that any recording can be dismissed as fake or accepted uncritically, trust erodes.

Deepfakes create a credibility gap in that genuine victims may struggle to prove harm. Wrongdoers may exploit doubt, and courts become arbiters of technical disputes that the public cannot easily follow.

This is not an abstract concern since media reporting already reflects scepticism about video evidence. That scepticism spills into legal proceedings, influencing juror attitudes and public reaction to verdicts.

Where the Conversation Is Heading

Courts are beginning to recognise that evidentiary reliability in the age of deepfakes cannot rest on assumptions formed in earlier technological contexts. Procedural rules, judicial reasoning, and evidentiary doctrines are being tested in real cases rather than academic debate.

The conversation is moving toward deeper scrutiny of provenance, stronger emphasis on corroboration, and greater caution in assigning persuasive weight to recordings standing alone.

This topic deserves sustained attention from lawyers, technologists, judges, and the public. Discussion, critique, and shared understanding matter because evidentiary reliability is not merely technical but it is foundational to justice.

How do you see courts addressing this problem in practice?

Leave a comment

English law has spent more than a decade pretending that digital value could be economically real yet legally peripheral, and the Property (Digital Assets etc) Act 2025 exposes how unsustainable that posture had become. Treating cryptoassets as something to be tolerated rather than classified produced uncertainty that benefitted speculation while undermining credit, enforcement, and accountability. Legislative recognition arrives late, not visionary, and it reflects institutional pressure rather than conceptual enthusiasm.

Share

Newsletter Edition 85

Digital property is no longer a theoretical category reserved for academic debate or courtroom experiments at the edge of private law, and the Property (Digital Assets etc) Act 2025 confirms that reality with a clarity that many governments have avoided for years.

This legislation matters because it places digital assets within the paradigm of property law rather than treating them as contractual conveniences or technological curiosities, and that decision has consequences for credit, debt, and access to finance that extend well beyond England and Wales.

Readers who have followed cryptocurrency since its early years will recognise a long period where value existed without legal recognition as property, and that gap created friction in every interaction with the financial system, particularly where lending, security, insolvency, and enforcement were involved.

The Act addresses that gap directly, and it does so with implications that are global in scope.

What the Act actually does

The Property (Digital Assets etc) Act 2025 confirms that certain digital assets are capable of being objects of personal property even where they do not fit neatly within traditional categories such as choses in possession or choses in action.

That statement appears simple, yet it resolves a problem that has affected courts, lenders, insolvency practitioners, and investors for more than a decade.

English law has historically relied on categories that assume tangibility or enforceable rights against a person.

Cryptocurrencies and related digital assets sit awkwardly outside those assumptions. They exist, they hold value, they can be controlled, and they can be transferred, yet they do not depend on a counterparty in the conventional sense.

The Act acknowledges this reality and provides statutory confirmation that these assets are not legal outliers.

Several court decisions paved the way for this outcome.

AA v Persons Unknown [2019] EWHC 3556 (Comm) confirmed that cryptoassets could be treated as property for the purposes of granting proprietary injunctions.

Ion Science v Persons Unknown [2020] EWHC 3688 (Comm) reinforced the view that digital assets could attract proprietary remedies.

Tulip Trading v Bitcoin Association [2022] EWHC 667 (Ch) raised more difficult questions about control, duties, and decentralised governance, but it still accepted the premise that the assets themselves were capable of being property.

The Property (Digital Assets etc) Act 2025 consolidates this judicial direction and removes uncertainty that had persisted because those decisions rested on common law reasoning rather than legislative authority.

Subscribe now

Why property status matters for credit and debt

Property status determines whether an asset can be used as collateral, whether it can be seized, whether it can be traced, and whether it survives insolvency. These questions are not academic. They decide whether lenders extend credit and whether borrowers gain access to capital on workable terms.

Cryptocurrency markets have grown in value without integration into mainstream credit systems because lenders rely on enforceability. A bank does not care about technical novelty. A bank cares about priority, certainty, and recovery. Without clear property status, digital assets sit outside the risk models that underpin lending decisions.

The Act brings digital assets closer to those models.

Collateralisation becomes legally intelligible once an asset is recognised as property. Enforcement becomes conceptually coherent once courts can treat digital assets as things rather than abstractions. Insolvency treatment becomes predictable once assets can be identified, valued, and distributed.

None of this requires enthusiasm for cryptocurrency as a social project. The law does not need belief. The law needs classification.

Access to finance and developing countries

Access to finance remains one of the most persistent structural problems facing developing economies. Credit is expensive, collateral is scarce, and legal infrastructure often struggles to support complex financial arrangements. Digital assets have often been presented as a partial response to these problems, yet legal uncertainty has limited their practical use.

Recognition of digital assets as property under a major commercial legal system has effects that travel beyond its borders.

English law remains a preferred governing law for international finance, commodity trade, and cross border lending. Legal recognition under English law influences contract drafting, risk allocation, and enforcement strategies in transactions involving parties across Africa, Asia, and Latin America.

Once digital assets can be recognised as property under English law, they can be referenced more comfortably in security agreements, trust arrangements, and financing structures that rely on English legal concepts. That matters in jurisdictions where domestic law may lag behind technological practice but where English law still governs the underlying transaction.

The Property (Digital Assets etc) Act 2025 does not solve access to finance, yet it removes one of the barriers that made digital assets unusable as serious financial tools in cross border contexts.

Debt, default, and enforcement

Debt markets depend on predictable outcomes in default scenarios. Creditors extend funds based on assumptions about recovery, ranking, and control. Digital assets challenged those assumptions because enforcement did not fit neatly into established procedures.

Recognition as property allows courts to issue proprietary remedies with greater confidence. Freezing orders, tracing claims, and equitable relief become easier to justify when the asset in question sits within a recognised legal category.

This matters for creditors, but it also matters for debtors. Legal clarity reduces the scope for arbitrary outcomes and inconsistent treatment. A system where enforcement is uncertain tends to favour those with superior resources and technical sophistication.

Clear classification improves procedural fairness even when outcomes remain contested.

Cryptocurrency and philosophical discomfort

Cryptocurrency has always produced philosophical discomfort within legal systems built around central authority. Property law developed in contexts where ownership could be anchored to physical control or legal rights against identifiable persons. Digital assets challenge both assumptions.

The Act represents an acceptance that law must describe reality rather than insist on historical categories. Control over a digital asset may be exercised through cryptographic keys rather than physical possession, yet control remains control. Exclusion remains possible. Transfer remains meaningful.

This does not resolve deeper debates about decentralisation, governance, or power. It simply recognises that value exists and that law must account for it.

Philosophically, this approach treats law as an organising system rather than a moral referee. The Act does not endorse cryptocurrency as good or bad. It acknowledges existence and assigns legal consequences.

Do you know that there are currently no international uniform conflict of law rules governing crypto assets globally? Read our newsletter to find out more:

Technology Law

Issue 16: International Law Cannot Keep Up With Crypto Assets

The UK is undertaking a significant reform of outdated legal rules that impact cross-border disputes involving crypto, blockchain, and electronic trade documents. These digital assets are recognised across borders and there are no standalone rules that enable predictable mechanisms to resolve legal conflicts…

Read more

a year ago · 5 likes · Technology Law

Many readers associate property law with land registries and conveyancing documents rather than digital wallets. The relevance becomes clearer once everyday interactions are considered.

Loss through fraud becomes a legal issue once assets are recognised as property.

Inheritance planning becomes coherent once digital assets can be treated as part of an estate.

Business balance sheets become more accurate once digital assets can be recognised as assets rather than accounting anomalies.

Employment disputes, marital property disputes, and insolvency proceedings increasingly involve digital assets. Legal recognition improves consistency across these contexts.

International implications

The Property (Digital Assets etc) Act 2025 contributes to an emerging consensus among advanced legal systems that digital assets require bespoke treatment within property law. That consensus affects regulatory coordination and private ordering.

Many countries seeking to attract investment often look to English law as a reference point. Legislative recognition creates a benchmark that others may follow, adapt, or resist.

Developing countries face a particular tension. Digital assets offer potential tools for inclusion, yet legal uncertainty increases risk. External legal frameworks often fill that gap. Recognition under English law provides a reference that can be leveraged even where domestic reform remains slow.

This does not impose English law on others. It influences contractual choices and dispute resolution preferences that already exist.

Cases that still matter

Despite legislative clarity, courts will continue to play a central role. Property status answers foundational questions but leaves many issues open.

Control and responsibility within decentralised systems remain contested.

Duties of developers and network participants remain uncertain.

Custody arrangements raise questions about bailment, trust, and fiduciary responsibility.

Tulip Trading case illustrates that property recognition does not resolve governance disputes. It frames them. Litigation will continue to define boundaries, particularly where losses occur and responsibility is disputed.

Interested in reading more about restitution and tort of conversion over crypto assets? Check out this newsletter:

Technology Law

Legal Update: The UK Just Reversed the Burden of Proof in Crypto Scam Cases and It’s a Big Deal

If you have ever worried about losing money to a crypto investment site, this one is for you, and it comes with a rare bit of good news. A crypto scammer thought he got away with over £500,000, until a new English law helped claw it all back. This is the first time victims have used a court power to recover stolen digital assets in full. Here's how it w…

Read more

a year ago · 3 likes · Technology Law

Key points from this new legislation

• Digital assets are now explicitly capable of being property under English law.

• Property status affects credit, collateral, restitution, trusts, insolvency, and enforcement.

• Legal clarity improves predictability without endorsing any technology.

• Cross border finance benefits from alignment with English legal concepts.

• Courts remain central in resolving unresolved governance questions.

Closing reflections

The Property (Digital Assets etc) Act 2025 places cryptocurrency within the machinery of private law rather than treating it as an exception that must be managed at the margins. That choice carries weight because property law structures economic life in ways that regulation alone cannot.

Recognition does not eliminate risk, volatility, or misuse. It reduces ambiguity. Ambiguity tends to favour insiders and penalise those without access to specialised expertise. Legal clarity distributes understanding more evenly, even when outcomes remain contested.

Property law has always been about allocating risk, value, and responsibility. Digital assets now sit within that framework, and the conversation about their role in credit, debt, and access to finance becomes more grounded as a result.

Comments are welcome on how recognition of digital assets as property may influence finance, responsibility, and legal coherence.

Leave a comment

European digital platforms have long treated user advertisements as harmless content that simply passes through their systems, yet this assumption has now reached its limit. The judgment in Russmedia Digital demonstrates that platforms have operated with an inflated sense of detachment from the personal data they publish. Courts are no longer willing to accept claims of neutrality when the harm caused to individuals is real, foreseeable, and preventable.

Share

Newsletter Edition 84

When Online Platforms Become Data Controllers

On 2 December 2025, the Court of Justice of the European Union delivered a significant judgment in Case C-492/23, Russmedia Digital and Inform Media Press. The Court’s decision marks an important clarification of responsibility under European data protection law.

The case establishes that the operator of an online marketplace must be regarded as a controller under the General Data Protection Regulation when personal data appear in advertisements published on its platform.

The case arose in Romania, where a woman discovered an online advertisement offering sexual services under her name, using photographs and a telephone number without her consent.

The advertisement was placed on the website www.publi24.ro, operated by Russmedia Digital.

Although the company removed the advertisement within an hour of being notified, the material had already spread to other websites and continued to cause harm.

The woman brought proceedings for the violation of her privacy, honour, and personal data rights.

The local court awarded her damages, but an appellate court overturned that decision, reasoning that the platform was merely a hosting provider with no direct control over the content uploaded by users.

The Romanian Court of Appeal then referred the matter to Luxembourg for a preliminary ruling, asking the Court of Justice to clarify the obligations of an online marketplace under the GDPR and whether such an operator could rely on the liability exemptions of the EU e-Commerce Directive.

Interested in reading more cases about the application of EU law? Check out this case report newsletter:

Technology Law

Case Report: The Cost of Ignoring an EU Directive (Commission v. Bulgaria)

The European Union gave every country a clear deadline. Bulgaria missed it. Then came silence, excuses, and political delays. Eventually, the European Commission ran out of patience and took the matter to court. At the centre of it all was a law about public data that should have been simple to adopt. Instead, it ended in a financial penalty and a warni…

Read more

a year ago · 4 likes · Technology Law

Defining Responsibility under the GDPR

The Court’s ruling provides a decisive interpretation of who controls personal data in online advertising.

It holds that an operator such as Russmedia Digital is not merely a passive intermediary but a controller within the meaning of Article 4(7) of the GDPR.

This status arises because the platform determines the technical and organisational means by which advertisements are published and made accessible to the public.

The advertisements exist on the internet solely through the platform’s intervention.

Accordingly, the operator bears responsibility for ensuring that personal data contained in advertisements are handled lawfully.

Subscribe now

This includes verifying whether the advertiser has the right to publish such data or whether the data subject has given explicit consent.

In the present case, the Court ruled that the marketplace must identify, before publication, any advertisement that includes sensitive data such as photographs, personal contact details, or references to sexual life.

Under Article 9 of the GDPR, such data receive heightened protection. Processing them is generally prohibited unless one of the narrowly defined exceptions applies.

The Court explained that a platform must put in place adequate technical and organisational measures to detect advertisements containing sensitive data before they go online.

These measures must also verify the authenticity of the advertiser’s identity. If the advertiser is not the person featured, the platform must ensure that the data subject has given explicit consent to publication.

To learn more about the operation of the GDPR in practice, check out our newsletter:

Technology Law

Issue 22: Serious AI Incidents, Child Privacy Reform, and Europe’s Digital Enforcement

Governments are no longer waiting for technology to self-regulate. This week, Europe wants AI developers to explain their mistakes, Australia plans to keep children off social media, and Italy is improving control of digital systems. Regulators are acting faster than many companies expected, and compliance will no longer be optional. From AI accountabil…

Read more

7 months ago · 9 likes · 1 comment · Technology Law

When neither condition is met, the operator must refuse to publish the advertisement. These obligations are not optional compliance suggestions; they form part of the core duties attached to the status of a data controller.

The decision demonstrates how the concept of control under the GDPR extends beyond traditional database management.

A platform’s active role in structuring, publishing, and disseminating user content transforms it from a neutral intermediary into an entity that participates in the determination of processing purposes and means.

The Court’s reasoning reinforces the principle that control follows function rather than form.

The question is not what the operator claims to be but what it does in practice.

Rejecting the e-Commerce Directive’s Safe Harbour

The company argued that it was entitled to rely on the liability exemptions under Articles 12 to 15 of the e-Commerce Directive, which protect providers of information society services from being held liable for unlawful user content when they act as neutral hosts.

The Court rejected that argument.

It found that the operator’s duties under the GDPR cannot be displaced or diminished by the Directive’s safe-harbour provisions.

The Court reasoned that the e-Commerce Directive governs liability in the context of information society services but does not affect the obligations imposed by the GDPR concerning data processing.

Subscribe now

These are two distinct legal frameworks serving different purposes. The Directive deals with intermediary liability, while the GDPR addresses the protection of personal data.

When an online marketplace processes personal data contained in advertisements, it acts not merely as a conduit but as a controller subject to independent obligations.

Therefore, a platform cannot shield itself by asserting that it merely stores third-party content. Once it publishes or facilitates the publication of content that includes personal data, it becomes directly responsible for compliance with the GDPR.

This position aligns with the principle that fundamental rights, such as privacy and data protection, take precedence over economic exemptions designed for intermediary services.

Leave a comment

The Court further emphasised that an operator’s responsibilities extend beyond initial publication.

It must also take reasonable steps to prevent the further dissemination of unlawful content. When sensitive data are unlawfully published, the operator should implement measures to prevent those materials from being copied or republished elsewhere.

Do you want to know how search engine platform regulations impact us? Our newsletter explains the intricacies of these regulations.

Technology Law

Law Reform: Your Online Freedom May Be About To End

New rules are transforming how online platforms and search services must operate in the United Kingdom. Age checks are now compulsory for services with adult content and strict obligations apply to anything that children can access. Some see this as protection and others see it as control. These rules will change what people see, how they join online pl…

Read more

10 months ago · 11 likes · 3 comments · Technology Law

The duty to act does not end once an advertisement is taken down; it includes ongoing prevention through appropriate security and technical safeguards.

This interpretation expands the operational expectations placed on online marketplaces. They are no longer viewed as passive technical platforms but as active participants in the publication and persistence of content that contains personal data.

The ruling sets a higher bar for compliance by tying the concept of responsibility to the real impact of data processing on individuals’ rights.

Implications for Online Platforms and Compliance Practice

The judgment carries direct consequences for online marketplaces, advertising platforms, and digital intermediaries across the European Union.

By categorising platform operators as data controllers when they publish user-generated advertisements containing personal data, the Court has introduced a tougher standard of care.

Operators must design internal processes capable of detecting sensitive content before it is published. This obligation requires both technical and procedural innovation.

Platforms will need automated systems capable of identifying personal data such as names, phone numbers, or images, combined with manual review for complex cases.

In addition, there must be reliable mechanisms for verifying that the advertiser is the data subject or that explicit consent has been granted.

These steps may appear demanding, but they represent the necessary cost of handling personal data in a digital environment governed by fundamental rights.

The judgment also highlights the importance of transparency and traceability.

Platforms should maintain records of verification procedures, consent documentation, and the steps taken to prevent unauthorised reuse of sensitive materials.

When disputes arise, these records will serve as evidence of compliance.

Furthermore, the Court’s reference to preventing further publication introduces a forward-looking duty. Once a platform becomes aware that an advertisement contains unlawful personal data, it must act not only reactively but also proactively.

Technical safeguards such as content fingerprinting, URL blocking, or watermarking may help limit replication. However, each platform will need to determine proportionate measures that align with the GDPR’s accountability principle.

This ruling effectively narrows the margin of neutrality previously enjoyed by hosting providers.

Operators must reassess their classification under data protection law and adapt compliance programmes accordingly.

In practice, many intermediaries will now fall within the controller category for at least part of their operations.

The Russmedia Digital case thus redefines the balance between innovation, user autonomy, and protection.

It invites operators, policymakers, and citizens to understand that personal data protection is not an external constraint on digital activity but a foundational condition for its legitimacy.

The message is clear: accountability in the digital era begins with recognising that every act of publication is also an act of data processing, and with that recognition comes responsibility.

This judgment invites reflection on the responsibilities that digital platforms now carry. You are welcome to share thoughts or practical experiences that might enrich future discussions and help build stronger understanding of accountability in online environments.

Leave a comment

Predictive policing has turned suspicion into a routine administrative category that follows people long before any conduct occurs, and it is astonishing how easily this practice has been accepted as a normal feature of public safety. The idea that an algorithm can pre-assign risk to entire neighbourhoods and individuals has been absorbed into policing culture with little discomfort, even though the practice alters long standing assumptions about fairness, due process and the meaning of community trust. The technology has not simply introduced new methods but it has redefined the threshold at which suspicion begins, and it has done so without meaningful and transparent legal scrutiny.

Share

Newsletter Edition 83

I want to spend time on an issue that has been growing in scale and consequence, yet it still feels misunderstood in public debate.

I am referring to predictive policing, a set of technologies that use large pools of data to indicate where law enforcement attention should concentrate.1

I have observed governments, police forces, and private vendors speak about predictive policing as if it represents a neutral and objective way to allocate resources.

I have also watched the public absorb these narratives with a mixture of curiosity and unease.

I want to offer clarity about why this technology matters, how it transforms the experience of living in a community, and why it normalises suspicion long before any crime is committed.

The way predictive policing works has a direct influence on how neighbourhoods are perceived, how people are categorised, and how law enforcement behaves.

It is important to understand that predictive policing does not operate as a futuristic idea. It exists today in different countries and in many cities across the world. It is not an idea waiting to be tested. It is already being deployed.

I approach this subject as someone who studies and also teaches the relationship between law, technology, and society.

I spend a considerable amount of time reading legal documentation, technical reports, and implementation stories about these tools.

The system processes this information and produces indications about where police officers should patrol or who they should focus on.

It presents these outputs as neutral observations.

A police department may receive a notification that a particular neighbourhood might experience crime within a certain period or that a particular individual might be at risk of involvement in criminal activity.

This may seem harmless and appear like a helpful tool.

In fact, it looks like data is offering support to public safety professionals.

The story becomes more complicated when we examine how the data is produced, how the system interprets it, and how the outputs transform behaviour.

Historical crime data is rarely a clean record of events.

It is influenced by years of policing patterns, community interactions, and institutional priorities.

If a community receives disproportionate police attention, the data will reflect that increased presence.

Increased presence results in increased arrests, even when the actual level of crime might not be higher than neighbouring communities.

The data feeds back into the system, which then tells the police to return to the same neighbourhood. The loop continues.

In many countries, predictive policing amplifies historical patterns without critically evaluating them. This is how suspicion becomes normalised long before anything happens.

I want you to imagine how it feels to live in an area that appears frequently in these predictions.

I said imagine rather than picture an analogy because this is not a metaphor.

Residents begin to notice police officers spending more time near their homes, walking on their streets, and conducting more stops. Police presence gradually becomes part of daily life.

People begin to feel observed. Some might feel safer at first, but many begin to feel targeted.

Subscribe now

Teenagers walking to school are questioned. Adults leaving for work notice patrol vehicles lingering.

The message embedded in these actions is that the neighbourhood requires surveillance. It affects how residents understand themselves.

It affects how they think others see them.

Suspicion moves from the environment to individuals.

Certain predictive policing systems produce lists of people who are classified as likely to be involved in criminal activity.2 These individuals may not have committed a crime.

Their names appear because they have friends or relatives who have been arrested or because they live in areas with high levels of police activity.

Some systems categorise them because of past incidents that have nothing to do with future behaviour.

People on these lists often do not know they have been categorised in this manner.

They experience unexpected visits from law enforcement. They feel pressure to account for their movement.

They sense that their name carries an invisible mark created by a machine.

I want you to see how suspicion becomes embedded. A community or a person is identified through a technical process that appears neutral.

Police officers can act on this information. Their actions create more data. The system absorbs the data and produces a similar outcome.

Each time this cycle repeats, suspicion appears more legitimate. People begin to say that these neighbourhoods always have crime.

People begin to say that certain individuals seem to be involved in suspect activities.

People forget that the perception was constructed through a technical loop rather than emerging from an independent assessment of facts.

It is important to understand that predictive policing does not emerge from malicious intent!

Many police departments genuinely believe the technology will help them.

They believe it will reduce crime, help them allocate limited resources, and reduce guesswork.

Technology companies promote these tools as solutions that draw on modern computational methods and data analysis.

The result is a set of practices that police officers come to trust without fully understanding how the predictions are constructed. This trust gives the system authority.

Once a system has authority, it becomes very difficult to challenge.

I have spoken with individuals who believe predictive policing simply automates what police departments already do.

It is true that police officers often rely on intuition and local knowledge when allocating resources.

Intuition can be biased. Data driven tools appear more objective. This is where the danger resides.

When a biased dataset is presented as objective intelligence, the entire system becomes insulated against critique.

It becomes harder to point out that the underlying data reflects years of unequal attention. It also becomes harder to question the conclusions. People begin to think the technology has independent insight.

Law plays an important role here.

Predictive policing does not live outside the structure of legal rules. It must comply with constitutional principles, human rights protections, procedural fairness, and public accountability mechanisms.

Legal systems are not always ready to review how predictive tools categorise individuals.

Subscribe now

Courts often see predictive tools as internal police processes.3

The legal system does not always require disclosure of how predictions are created.

Individuals who are affected by these predictions often have no avenue to challenge the categorisation.

This is how predictive policing gradually normalises the idea that suspicion can arise without any clear demonstration of wrongdoing.

Some communities see an increase in tension between residents and law enforcement. Others experience a gradual erosion of trust.

When a community feels that policing is based on algorithmic assumptions rather than lived experiences, relationships deteriorate.

Community members feel watched rather than supported. Police officers feel justified in their presence because the system gave them a reason to be there. Each group begins to misunderstand the other.

The misunderstanding is amplified each time the system reinforces the same prediction.

Individuals who are placed on predictive lists experience a more personal form of harm. They lose control over how they are perceived.

Their classification follows them in the background. It influences how officers interact with them. It influences how others talk about them.

This classification often has no clear path for removal. People live with an unspoken sense of scrutiny. This scrutiny can create emotional and psychological strain.

They carry the feeling that something external has defined them without their participation.

I want to highlight that predictive policing is not only a policing issue. It is a societal issue.

When communities begin to internalise the idea that some individuals are suspicious before they act, social cohesion weakens.

People feel pressure to distance themselves from individuals who might attract police attention.

People begin to self censor. They worry about where they go, who they speak with, or how they conduct simple daily routines.

The awareness that an algorithm might interpret these patterns differently adds an invisible layer of anxiety.

These systems also introduce a form of administrative opacity. Decisions made by predictive tools are often explained through abstract descriptions of risk.

People cannot see the complete dataset. They cannot examine the model. They cannot review the reasoning.

Police departments may not understand the model themselves.

Technology companies mischievously protect their algorithms as intellectual property.

Courts often accept these explanations, especially in early stages of deployment.

This lack of transparency restricts accountability. Accountability becomes difficult when individuals and communities do not know how the system reaches its conclusions.

When police officers rely on predictive tools, their actions seem more defensible.

A patrol in a neighbourhood becomes routine. A stop becomes part of the standard procedure. An investigation into a listed individual becomes an expected task.

Suspicion becomes embedded into everyday policing. This is how predictive policing normalises suspicion long before any crime occurs.4

The process unfolds gently but consistently. It alters behavioural expectations. It modifies community interactions. It changes the experience of being a citizen.

I approach this subject with a recognition that technology will continue to influence public safety practices.

Predictive policing is one expression of a broader trend in the integration of data driven decision making in public institutions.

I believe people should understand predictive policing clearly, not with exaggeration or fear, but with careful attention to how the technology functions and how it influences society.

Understanding gives communities the ability to participate in discussions about appropriate use, oversight, and accountability.

I am not offering advice, but rather inviting constructive thoughts.

Predictive policing raises significant questions about fairness, transparency, trust, and the lived experience of communities. These questions deserve an open discussion.

People should be part of these conversations.

When people understand how predictive systems work, they can reflect on how the technology influences their daily lives.

Leave a comment

Artificial intelligence governance is developing in a manner that exposes an uncomfortable truth about contemporary regulatory ambition, which is that states are now asserting control over digital systems with an intensity previously reserved for physical infrastructure. This trajectory reflects neither technological optimism nor pessimism. It reflects a growing insistence that AI must fit within existing structures of authority even when those structures are under strain.

Share

Newsletter Edition 82

United States: H.R. 5885 - GAIN AI Act of 2025

In the United States, the House of Representatives introduced the GAIN AI Act of 2025 on 31 October, under bill number H.R. 5885.

The text mandates that entities seeking export licences for advanced artificial-intelligence-related chips must provide certification that United States persons enjoy priority access to those chips.

The bill was referred to the House Committee on Foreign Affairs.

What this measure highlights is the increasing linkage between export controls, chip supply chains, and the governance of AI.

The bill reflects a recognition that advanced semiconductors and AI hardware count as strategic assets, and that policy-makers are prepared to place conditions on their export in order to safeguard national interest.

At the same time, the certification requirement implies that firms will need to structure their compliance mechanisms and their internal disclosure processes to satisfy governmental oversight.

Though still at an early stage in the legislative process, this bill tells us that AI regulation in the United States is no longer confined to model behaviour or data privacy, but is extending into hardware, supply-chain resilience, and the conditions under which AI capacities are exchanged internationally.

It would be prudent for organisations engaged in AI hardware design, export, or supply-chain logistics to monitor not only the final outcome of the bill but also its drafting of licence-criteria, definitions of “advanced AI chips,” geographic scope of “countries of concern,” and how priority access is defined and enforced.

European Union: Artificial Intelligence Act (EU) and monitoring of EU law

The European Parliament’s Policy Department for Justice, Civil Liberties and Institutional Affairs published a study dated 30 October 2025, entitled “AI and monitoring the application of EU law”.

The report surveys how AI techniques are being used, and might be used to support the monitoring and enforcement of EU law, including in legislative drafting, transposition of directives, administrative decisions, compliance tracking, and social-behavioural governance.

This work draws attention to the fact that regulation of AI is not only about controlling AI systems themselves but also about using AI systems as regulatory tools.

The symmetry is significant: AI becomes both the object of governance and a means of governance.

The study points out that while there are existing AI-monitoring applications in EU law enforcement and administrative practice, the potential for more advanced deployment remains under-analysed, including how fundamental rights and legal principles should be respected when AI assists regulatory monitoring.

This suggests two key observations. First, regulated entities in the EU should anticipate that AI governance may include oversight via AI-driven monitoring, meaning that their compliance processes may themselves become subject to enhanced scrutiny through technological means.

Second, the EU’s legislative timetable for AI regulation and related frameworks, such as the risk-based classification and obligations under the AI Act, continue to generate implications for how AI can be deployed in public-administration and regulatory enforcement settings.

Subscribe now

United Kingdom: Judicial Guidance on AI Use by the Judiciary

In England and Wales, the Judiciary of England & Wales (courts and tribunals) published updated guidance on 31 October 2025, addressing the use of AI by judicial office-holders.

The document replaces the April 2025 edition, enlarging the glossary of terms, expanding sections on bias in training data and “hallucinations” (incorrect or misleading outputs), and emphasising confidentiality obligations: judicial officers are reminded not to input private or non-public information into publicly accessible AI tools, and to treat any inadvertent disclosure as a data incident.

The guidance underlines that any use of AI by or on behalf of the judiciary must be consistent with its overarching obligation to protect the integrity of the administration of justice and to uphold the rule of law.

Lord Justice Birss, Lead Judge for Artificial Intelligence, emphasised the personal responsibility of judicial office-holders for material produced in their name.

This means that even within the judicial context, where the use of AI might appear less commercially oriented and more internal or procedural, strong guidelines are being imposed.

The guidance shows that where AI is used, it must be carefully controlled, with human accountability non-negotiable.

As AI enters institutional and public sectors, the threshold for documentation, oversight, verification, and risk mitigation increases.

While the guidance is directed at judicial office-holders, its principles may serve as a benchmark for other professions engaged in regulatory or public functions.

Netherlands: Autoriteit Persoonsgegevens (AP) Warns of Biased Voting Chatbots

In the Netherlands, the data-protection authority issued a warning on 21 October 2025 that AI chatbots used as voting-aid tools produced highly distorted and biased results.

The AP’s study involved four major chatbot platforms tested against various fictional voter profiles. It found that the systems often offered advice heavily favouring just two political parties, regardless of user input.

While such tools may appear to offer impartial guidance, the AP concluded that they present a threat to electoral integrity and democratic participation.

The experiment revealed that the chatbots, contrasted with established voting-advice applications, lacked representativeness of all parties and funnelled users disproportionately to the same two options.

The AP labelled the advice “unreliable and clearly biased.”

This development is quite significant because it touches on the intersection of automated systems, political influence, transparency, and fairness.

The findings reflect risks associated with using generative-AI tools or chatbots in sensitive contexts such as elections, where the decisions impacted are inherently public and governed by principles of fairness and neutrality.

Organisations operating chatbots or AI-based recommendation systems in civic or electoral domains will need to consider how these systems are designed, how their outputs are audited, and how they are communicated to users.

Final Thoughts

These developments, while distinct in jurisdiction and focus, together map out an important dimension of current tech-law development: regulation and governance of AI are expanding beyond traditional domains of data privacy and algorithmic fairness to include hardware exports, institutional use of AI within justice systems, monitoring of regulatory compliance via AI, and algorithmic impact on democratic processes.

What emerges is a reminder of the importance of governance frameworks that address the full lifecycle of AI, from hardware and supply-chain, through software and model training, to public-deployment and institutional adoption.

What remains clear is that the legal and regulatory environment for AI remains multifaceted including export-control law, public-sector AI governance, electoral regulation, fundamental-rights frameworks, and compliance monitoring are all part of the field.

Leave a comment

I will close this edition here with an invitation to continue the discussion. Readers who wish to reflect on any part of this analysis are encouraged to share considered thoughts in the comments so that future editions benefit from a wider range of perspectives.

Europe has regulated AI into a corner. The Artificial Intelligence Act, though hailed as a global benchmark, exemplifies the tension between ambition and practicality that defines modern EU digital regulation. Several laws also promise data protection and AI innovation, however together they form an administrative maze that risks stifling the very technological progress Europe claims to champion.

Share

Newsletter Edition 81

The AI Act and Europe’s Digital Legal Framework

When the European Union adopted the Artificial Intelligence Act in June 2024, it presented the world’s first comprehensive attempt to regulate artificial intelligence in a structured and rights-based way.

The AI Act’s ambition is significant. It aims to ensure that AI systems placed on the European market are trustworthy, safe, and compliant with fundamental rights.

Nonetheless, this new framework operates alongside a web of other digital laws that already govern data protection, cybersecurity, market competition, and digital services.

The study prepared for the European Parliament’s Committee on Industry, Research and Energy (ITRE) examines this web in detail.

Its findings are important for everyone.

At the core of the study lies a simple insight that every law in the EU digital framework is individually well designed, but together they create a structure that is heavy, overlapping, and sometimes unclear.

The AI Act was intended to complete the EU’s digital single market, yet its interactions with other frameworks have introduced a new kind of complexity.

Understanding the Purpose and Logic of the AI Act

The AI Act rests on a risk-based approach.

It prohibits a narrow category of AI practices that are deemed unacceptable, imposes strict controls on high-risk systems, and sets transparency duties for low- and medium-risk uses such as chatbots or generative tools.

It also creates separate obligations for general-purpose AI models that are powerful enough to have systemic effects.

This tiered logic mirrors the EU’s long-standing product safety regime but extends it to an entirely new domain.

The study explains that this approach was a deliberate choice.

Before the AI Act, artificial intelligence was largely unregulated, and Member States risked introducing divergent national laws.

The new regulation harmonises the internal market by setting a single framework.

Nonetheless, that harmonisation comes at a cost.

The report highlights that the AI Act stretches the boundaries of traditional product regulation.

It asks conformity assessment bodies to evaluate not only technical safety but also respect for fundamental rights and societal values.

That task, the authors note, may prove difficult because human rights compliance cannot easily be reduced to technical checklists.

Subscribe now

For high-risk systems, the obligations are extensive.

Providers must establish risk management systems, data governance protocols, technical documentation, human oversight, and quality management frameworks.

They must demonstrate accuracy, robustness, and cybersecurity, and affix the familiar CE marking.

These are familiar requirements in manufacturing but novel in software development.

The study observes that while the AI Act promotes trust, it also places significant compliance responsibilities on providers and deployers alike, particularly smaller businesses without specialised legal teams.

An additional layer applies to general-purpose AI models, known as GPAIs.

These are the large, adaptable models that underpin tools for text, image, or speech generation.

The AI Act introduces transparency, copyright compliance, and cybersecurity duties for all GPAI providers, and enhanced obligations for those with systemic risk.

The report notes that a model trained with computing power above a specific threshold is presumed to be of systemic importance.

This presumption was designed to ensure oversight of the most powerful systems but may prove too static as technology progresses.

The Act also includes innovation measures.

Open-source AI systems are mostly exempt from its scope, and each Member State must establish a regulatory sandbox to allow experimentation under supervision.

The study recognises these as positive steps but cautions that their success will depend on national authorities’ willingness to interpret the rules in an enabling way.

Intersections Across the Digital Legal Framework

The central part of the study examines how the AI Act interacts with other EU digital laws.

The most significant areas of intersection involve the GDPR, the Data Act, the Cyber Resilience Act, the Digital Services Act, the Digital Markets Act, and the NIS2 Directive.

Each of these laws is vital in its own domain, but together they form a dense compliance environment that can be difficult to understand.

Technology Law

EU Artificial Intelligence Tracker

This EU Artificial Intelligence tracker monitors key dates and information on legal and policy developments surrounding artificial intelligence in the EU. It covers major legislative initiatives, law reforms and policy updates impacting artificial intelligence in the European Union…

Read more

8 months ago · 10 likes · Technology Law

Under the GDPR, many AI systems that process personal data already fall within an existing legal structure that emphasises lawfulness, transparency, and accountability.

The AI Act introduces additional assessments, particularly the Fundamental Rights Impact Assessment (FRIA), which often overlaps with the Data Protection Impact Assessment (DPIA) required under the GDPR.

The study observes that both tools serve legitimate goals but differ in supervision and procedure.

As a result, organisations may find themselves conducting two separate yet similar evaluations for the same system.

The report recommends aligning these assessments through joint guidance and mutual recognition.

The Data Act establishes rules for access to and sharing of data generated by connected products and services.

AI providers who hold or use such data may therefore face obligations under both Acts.

For instance, they must ensure that data is shared in a fair and secure way while also maintaining compliance with AI risk and transparency duties.

The study points out that these cumulative requirements could discourage experimentation and impose a heavy administrative load, especially in cross-border contexts or when data flows from third countries.

In the field of cybersecurity, the Cyber Resilience Act imposes mandatory security standards for digital products.

Many of these overlap with the AI Act’s own cybersecurity and robustness requirements.

Although the CRA allows for a presumption of compliance under certain conditions, the partial alignment of the two frameworks can still produce uncertainty.

The report suggests that greater coordination between the responsible authorities would help prevent duplicated audits or inconsistent expectations.

For large online platforms and search engines, the Digital Services Act and the Digital Markets Act add yet another layer.

These instruments require transparency and accountability for algorithmic systems used in content moderation, advertising, or recommender functions.

The study notes that such platforms might be subject to simultaneous risk assessments under both the AI Act and the DSA.

Moreover, gatekeepers under the DMA must meet obligations relating to data access and interoperability, which could overlap with AI governance duties.

While the DMA does not yet classify AI systems as core platform services, their growing economic role makes such an intersection increasingly relevant.

The NIS2 Directive, which focuses on network and information security, introduces reporting and risk management obligations for essential and important entities.

Many of these entities will also deploy AI systems covered by the AI Act.

The report finds that the incident reporting and supply-chain management requirements of both frameworks often intersect, potentially creating parallel channels of compliance.

Across all these examples, the study reaches a consistent conclusion: the EU’s digital regulatory framework has become internally complex.

Each law serves a clear purpose, but their cumulative effect risks slowing innovation and discouraging smaller actors from entering the market.

Governance and Implementation Challenges

A key section of the study analyses the institutional architecture created by the AI Act.

At its centre stands the European AI Office, which operates within the European Commission.

The AI Office is responsible for supervising general-purpose AI models, supporting regulatory sandboxes, and coordinating national authorities.

It works alongside the European AI Board and interacts with data protection authorities, market surveillance bodies, and other sectoral regulators.

This structure reflects an attempt to balance central oversight with national autonomy.

However, the study raises concerns about potential overlaps of competence.

The AI Office’s mandate intersects with that of existing regulators, yet it lacks a distinct legal personality and depends on Commission resources.

Subscribe now

Without sufficient independence or capacity, its effectiveness could be limited.

The authors warn that fragmented governance may lead to inconsistent enforcement and uncertainty for businesses seeking to comply across multiple jurisdictions.

At the national level, market surveillance authorities will play a key role in enforcing the AI Act’s provisions.

These bodies are accustomed to monitoring tangible goods such as machinery or medical devices.

The report suggests that applying the same methods to algorithmic systems will require substantial training, technical expertise, and coordination.

Inconsistent capacity among Member States could produce uneven application of the law.

The study also identifies the importance of cooperation among supervisory authorities.

Given that AI systems often implicate personal data, cybersecurity, and consumer rights simultaneously, regulators must establish clear protocols for joint inspections and shared investigations.

The report encourages the development of consistent EU-level guidance to avoid contradictory interpretations.

Toward a More Coherent Digital Future

The final section of the study turns from analysis to reflection.

It recognises that the EU’s digital legislative framework represents an extraordinary achievement in scope and ambition.

However, the authors argue that the cumulative regulatory weight could unintentionally hinder innovation, particularly among small and medium-sized enterprises.

Short-term progress, they suggest, can come through practical coordination.

Supervisory bodies should publish joint guidance, share expertise, and recognise equivalent compliance efforts.

For instance, if a company completes a DPIA under the GDPR that already covers the relevant risks, it should not be required to repeat the process for a FRIA under the AI Act.

Similarly, Member States could align their sandbox procedures to ensure consistent conditions for testing and experimentation across borders.

In the medium term, modest legislative clarifications could help.

These might include refining definitions of high-risk systems, clarifying the interaction between cybersecurity obligations, and specifying the responsibilities of different actors in the AI supply chain.

The goal would not be to weaken regulation but to make it more understandable and executable.

Over the longer term, the study recommends a more strategic review of the EU’s digital architecture.

It argues that Europe should consider consolidation and simplification of its legal instruments, aiming for coherence rather than volume.

The authors envision a framework where data, AI, cybersecurity, and digital market rules operate as complementary parts of a single ecosystem rather than as separate compartments.

This integrated model would better support agile compliance while preserving the Union’s core values of trust, rights, and safety.

Technology Law

Case Report: EU-US Data Privacy Framework Survives Attack In Court (Latombe v. Commission)

The latest controversial judgment of the General Court in Latombe v Commission represents a decisive moment in the ongoing contest over transatlantic data transfers between the US and EU. The Court has endorsed the European Commission’s adequacy decision, validating the EU-US Data Privacy Framework. Critics will argue that the Court has accepted surveil…

Read more

8 months ago · 13 likes · 5 comments · Technology Law

The report concludes with a broader reflection on competitiveness.

The European Union’s AI investment levels remain lower than those of the United States and China.

The authors caution that complex regulation may further reduce the continent’s ability to attract and retain AI innovation.

Simplification, coordinated enforcement, and strategic alignment are therefore not merely administrative improvements; they are essential to ensuring that the EU can sustain a globally competitive AI industry.

A Framework in Need of Balance

The European Parliament’s study makes one theme clear: the AI Act embodies both the promise and the challenge of Europe’s digital governance.

It is unprecedented in global regulation, but its effectiveness will depend on how well it integrates with surrounding laws and institutions.

Each layer of the digital framework; privacy, data access, cybersecurity, and platform regulation, serves a vital purpose, but the combined system must remain useful, especially for innovators and smaller enterprises that form the backbone of Europe’s technology sector.

Achieving that balance requires coordination, clarity, and a shared vision of digital policy.

The authors’ recommendations are measured and pragmatic.

They do not call for deregulation but for coherence.

They remind policymakers that trust and innovation are not mutually exclusive.

By streamlining its legal framework and ensuring consistent enforcement, the EU can maintain its commitment to fundamental rights while enabling a dynamic and competitive AI ecosystem.

In essence, the study offers a roadmap for governance that is both principled and practical. It recognises that the challenge is not the existence of rules but their integration.

If the EU succeeds in aligning its digital laws, the AI Act could stand not only as a regulatory milestone but also as the foundation of a genuinely coherent European digital future.

The questions raised by the AI Act’s complexity deserve sustained discussion. Readers are invited to share perspectives or industry experiences that can inform future editions.

Leave a comment

Welcome to this week’s edition of the Technology Law Newsletter. This week looks closely at four significant updates: the AAA-ICDR’s plan to launch an AI-native arbitrator, the ISO’s new policy brief on responsible AI standards, the EU’s AI Act Compliance Checker, and the JRC’s new framework for classifying modified general-purpose AI models.

Share

1. The Launch of an AI-Native Arbitrator by American Arbitration Association: International Centre for Dispute Resolution (AAA-ICDR)

A significant development in the dispute-resolution domain has taken place: AAA-ICDR has announced that it will launch an “AI-native” arbitrator, initially applied to documents-only construction cases from November 2025.

The AI legal tool is trained on more than 1,500 construction law awards and refined with expert-labelled examples, to ground its decision-making in prior arbitrator reasoning.

The system uses a structured legal prompt library and conversational AI to deliver draft awards and recommendations, but it is explicitly embedded within a “human-in-the-loop” framework: human arbitrators review and validate outcomes before any final award is issued.

Initially, the deployment is limited to documents-only construction cases where the volume is high and the process largely transactional. Further roll-out to insurance and other dispute types is indicated.

Significance of this development

From a legal-operational perspective, this shows that ADR providers are embracing advanced AI systems not merely as adjuncts, but as central to the adjudication workflow.

This development raises immediate considerations: how does one draft arbitration clauses that anticipate AI-native arbitrators?

How do parties assess fairness, transparency, and evidential parity when an algorithmic actor participates in a legally binding decision?

The human-in-the-loop framing addresses the duty of care, but questions of explainability, bias, data governance and procedural fairness remain salient.

Moreover, the focus on high-volume, document-only contexts suggests a deployment model where cost-efficiency and speed are drivers, a marker for where “AI first” approaches may get traction in legal services.

• Ethical obligations for arbitrators and counsel remain unchanged: competence, impartiality, confidentiality and independence remain foundational. The association’s own principles reinforce that technology must not supplant these duties.

• Data provenance and model training become part of the governance equation: the tool was trained on prior arbitral awards, but parties might ask how representative that dataset is, how the model reasons, whether there is auditability and recourse.

• Liability questions will emerge: though humans review the output, reliance on a draft generated by an AI raises potential issues around decision-making attribution and oversight.

• Contract drafting and dispute resolution strategy will adjust: parties may want to negotiate explicitly on how an AI arbitrator is used, what review rights exist, whether a traditional arbitrator may override, and how reasoning transparency is ensured.

The AAA-ICDR announcement marks a milestone in legal-tech integration: AI moves from adjunct tool to core component of dispute resolution.

Legal professionals should prepare for change in ADR protocols, model training and contract drafting.

2. International Organization for Standardization (ISO) Policy Brief on Standards for Responsible AI Development and Governance

ISO has issued a policy brief titled Harnessing International Standards for Responsible AI Development and Governance (Publication 100498) that underlines the role of standards in bridging the gap between high-level principles and operational implementation.

The policy brief emphasises that standards provide a common language for developers, governments, regulators and users, helping to translate abstract ethical and policy objectives (such as transparency, fairness, accountability) into technical requirements, benchmarks and conformity-assessment frameworks.

It discusses the socio-technical nature of AI-systems: the interaction of algorithms, data, hardware, institutions, human users and societal norms.

It highlights existing standards under the ISO/IEC umbrella (such as ISO/IEC 42001: AI management system; ISO/IEC 42005: AI system impact assessment; ISO/IEC TS 12791: treatment of unwanted bias) and emphasises that while the pace of AI development is fast, consensus-based standards create a reliable baseline.

The document provides targeted recommendations for policymakers, standards bodies, industry stakeholders and civil society.

While adherence to standards remains voluntary in many jurisdictions, regulators often use standard-referencing as a mechanism to define due-care, conformity, and safety benchmarks.

Subscribe now

In contracts, procurement, governance frameworks and compliance assessments, referencing ISO standards will enhance legal robustness.

For organisations deploying AI systems, the policy brief offers a roadmap: not just to comply with regulation, but to implement management systems, assess impacts, mitigate bias, manage data quality, ensure transparency, and enable oversight.

The emphasis on lifecycle (from conception to retirement) is useful for legal counsel advising on AI governance frameworks or vendor contracts.

Legal-governance take-aways

• Organisations should evaluate whether they are aligning with AI standards: e.g., has an AI management system been documented and maintained? Are impact assessments conducted? Are bias-mitigation controls in place?

• Tendering, procurement and vendor contracts should include provisions linking to relevant standards (e.g., ISO/IEC 42001) to clarify responsibilities and bench-marks.

• Regulators may rely on standard-referencing to define compliance thresholds; hence organisations should map standard-coverage to regulatory obligations to reduce surprise risk.

• Legal teams should monitor updates to key standards and how they are referenced in national laws or sector-specific regulation, particularly in high-stakes sectors such as finance, healthcare, or transport.

The ISO policy brief reinforces the rising importance of standardisation in AI governance and clarifies how legal frameworks and corporate governance will increasingly lean on standards as reference points.

3. The Launch of the EU Artificial Intelligence Act Compliance Checker Tool

The European Commission and associated bodies have made available an interactive tool (often labelled the “EU AI Act Compliance Checker”) to help organisations determine whether their AI systems fall under the Act, and what obligations may apply.

The tool guides users through a series of questions to identify: the user’s role (provider, deployer, importer, distributor), the nature of the AI system (general-purpose, high-risk, limited risk), whether the system is used within the EU market, and then provides an indication of applicable legal obligations under the AI Act.

The interface is designed for embedding and broad use; it is described as a “simplified” instrument, offering early assessment rather than definitive legal advice.

Why it is relevant

For any organisation that develops, supplies or deploys AI systems, and for their legal advisers, the availability of a self-assessment tool is a helpful entry point to compliance preparation.

It reflects the regulatory intention to impose clear obligations by role and risk category rather than a one-size-fits-all model.

The availability of such a tool shows that compliance will be actively scrutinised, and that preparedness will likely become expected.

Courts or regulators may view use of such tools (or documented assessment) as evidence of a compliance-minded approach.

While the tool is useful, legal practitioners will need to caution users that self-assessment does not replace legal advice, documentation, or the full suite of compliance obligations under the AI Act.

The questions answered by the tool form a baseline; organisations will need to move from assessment into detailed documentation, governance updates, risk assessments, supplier/contractor reviews and perhaps certification (or future equivalent).

The tool also emphasises that each AI system must be assessed individually—if an organisation utilises multiple systems, each may have differing obligations.

Summary

The release of the compliance checker tool represents a practical aid to organisations utilising the AI Act.

Legal advisors should treat this as a platform of regulatory maturity: readiness is advantageous, and it becomes sensible to integrate structured assessments, role-based obligations and system-by-system reviews into compliance workflows.

4. The Joint Research Centre (JRC) Report: “A Framework to Categorise Modified General-Purpose AI Models as New Models Based on Behavioural Changes” (JRC143257)

The JRC has published a scientific study that addresses how modifications of general-purpose AI models (GPAI) may give rise to what should be recognised as new models for regulatory purposes under the AI Act.

The report presents two approaches for assessing when a modified GPAI has become a “new model” rather than a variant of the original:

1. Direct measurement of differences in capability profiles or instance-level answers;

2. Use of proxy metrics related to the modification process (for example fine-tuning, data-usage, computational resources).

The study underlines that distinguishing between an ‘updated’ version and a truly new model is critical because under the AI Act, different obligations may apply depending on how a model is categorised (for instance registration, transparency, higher oversight).

Subscribe now

The report emphasises methodological challenges in measurement, the need for clear definitions, and the implication that model providers may need to document modifications and behavioural change metrics.

Implications for regulation and contracts

This report has several implications:

• Vendor contracts and procurement instruments involving AI models should consider the possibility that a provider’s “update” may trigger new obligations under the AI Act if the modification results in behavioural change beyond a defined threshold.

• Model governance frameworks need to include versioning, baseline behaviour metrics and documentation of modifications, along with change-logs that enable comparison of behaviour before and after fine-tuning or data updates.

• Organisations using GPAI models must be aware that compliance obligations may not cease once version 1 is covered; subsequent modifications may constitute “new models” and thus restart regulatory timelines or obligations.

• Legal risk assessment frameworks should incorporate the possibility that an AI provider may have to treat an updated model as a new product, with downstream liability or regulatory reporting implications.

The JRC report adds depth to the interpretive infrastructure of the AI Act by mapping how behavioural change and model modification intersect with regulatory categorisation.

Practitioners should build into their advisory frameworks the need for versioning, modification documentation and contract provisions dealing with “material change” in AI models.

Final Remarks

The four developments reviewed this week highlight a clear pattern: legal frameworks, standards and technology architectures are increasingly intersecting in tangible ways, rather than remaining abstract.

Organisations and their tech advisors are well-advised to make operational and contractual preparations now: governance frameworks need attention, system-by-system assessment is becoming essential, and documentation of AI model changes and their implications will be a necessary part of compliance.

Thank you for reading this week’s newsletter. I hope these insights help you stay informed.

Leave a comment

I would love to hear your thoughts or experiences on any of these developments; feel free to share your comments or reply directly to this email.

Governments are no longer waiting for technology to self-regulate. This week, Europe wants AI developers to explain their mistakes, Australia plans to keep children off social media, and Italy is improving control of digital systems. Regulators are acting faster than many companies expected, and compliance will no longer be optional. From AI accountability to data protection, this week’s updates reveal a clear turn in technology law toward power, oversight, and strict responsibility.

Share

Technology Law Weekly Review: Europe’s AI Guidance, Australia’s Social Media Age Rule, Quantum Regulation, and More.

This week has been marked by significant legal and policy developments in the regulation of digital technologies and data governance.

From the European Commission’s draft guidance on serious AI incidents to Australia’s proposal for a minimum social media age, regulators are expanding the boundaries of how technology, responsibility, and accountability should coexist.

The relationship between existing frameworks such as the GDPR and new instruments like the Digital Markets Act continues to raise questions about enforcement and harmonisation.

Meanwhile, Italy has introduced a major legislative update addressing cybersecurity and digital infrastructure, and the European Commission has released a notable competition enforcement report highlighting the implementation of the Digital Markets Act.

Finally, a new academic call for papers invites contributions on the regulation of quantum computing, signalling the next frontier in technology law.

AI Regulation: The European Commission’s Draft Guidance on Serious AI Incidents

The European Commission has issued a draft guidance document and a reporting template for “serious AI incidents,” a crucial component in the implementation of the forthcoming AI Act.

The document, now open for public consultation, outlines the procedures that providers, users, and other entities will be expected to follow when reporting incidents linked to artificial intelligence systems.

The focus is on ensuring early detection of risks and building a coherent framework for incident response and transparency.

The guidance identifies serious incidents as events or malfunctions of AI systems that result in harm to health, safety, or fundamental rights.

It proposes a harmonised template for notification to competent authorities, requiring detailed descriptions of the incident, its effects, and the remedial measures undertaken.

This process aims to strengthen oversight and allow for consistent regulatory monitoring across Member States.

This initiative is necessary because it addresses one of the most complex aspects of the AI Act: translating high-level principles into operational compliance mechanisms.

The guidance shows that the obligation to report extends not only to providers but also to users where applicable, marking a shared responsibility model that could influence how AI liability is understood across jurisdictions.

Subscribe now

Organisations developing or deploying AI systems in Europe should now begin reviewing their internal compliance structures, especially incident management procedures, to ensure alignment with the upcoming requirements.

The consultation also offers an opportunity for industry participants and academic experts to influence how “seriousness” is defined in the context of AI-related harms.

This is essential, as early-stage interpretations may set precedents for how regulators treat accountability under the AI Act once enforcement begins in 2026.

Privacy and Child Protection: Australia’s Move Toward a Social Media Age Requirement

The Office of the Australian Information Commissioner (OAIC) has opened consultations on a proposed legislative framework to introduce a minimum age for social media users.

The initiative follows years of debate about the intersection between child protection, data privacy, and commercial digital practices.

It is expected to establish that children under a specified age, likely 16, will require parental consent before using social media services.

The OAIC’s proposal is grounded in principles of privacy protection and informed consent.

The regulator argues that children are often unable to understand the consequences of data sharing on social platforms and therefore need stronger legal safeguards.

The draft framework also contemplates obligations for service providers to verify user ages, implement risk assessments, and maintain transparency about their data-handling practices.

If adopted, the Australian regime could position itself alongside similar child online safety frameworks in the European Union and the United Kingdom.

Its approach blends privacy law with child protection objectives, an area where global regulators are increasingly converging.

However, the practicalities of age verification remain contentious.

Industry stakeholders have raised concerns about feasibility, privacy implications of identification systems, and the risk of excluding young users from digital participation.

The OAIC’s effort reflects a broader trend toward placing greater responsibility on platforms to ensure that their design, algorithms, and engagement mechanisms are not exploitative or harmful to minors.

The proposal invites reflection on how international data protection norms might evolve toward harmonised standards, even without formal treaty coordination.

Legal advisors will need to monitor this development closely, as cross-border compliance between European and Australian regimes could soon become more complex for global social media companies.

Interlinking Frameworks: The Digital Markets Act and the GDPR

The European Commission and the European Data Protection Board have launched a consultation on draft joint guidelines clarifying the link between the Digital Markets Act (DMA) and the General Data Protection Regulation (GDPR).

This document represents a critical interpretative effort to ensure coherence between two of Europe’s most ambitious regulatory instruments.

The DMA targets structural imbalances in digital markets by imposing obligations on large online platforms designated as “gatekeepers.”

These obligations often intersect with data protection principles under the GDPR, particularly regarding consent, data portability, and user profiling.

The new joint guidelines seek to articulate how gatekeepers can comply with both frameworks simultaneously without creating conflicts or loopholes.

The consultation draft emphasises that compliance with the GDPR does not automatically imply compliance with the DMA, and vice versa.

It demonstrates that consent under the GDPR must be freely given and cannot be conditioned on access to services controlled by gatekeepers.

It also clarifies that data minimisation and purpose limitation under the GDPR must guide the way gatekeepers combine data across services.

The joint initiative is noteworthy for several reasons.

First, it demonstrates growing regulatory coordination within the European Union, signalling that data protection and competition law are no longer treated as distinct silos.

Second, it may shape future enforcement actions, particularly where data concentration is used to entrench market dominance.

Third, it sets the tone for how emerging technologies such as artificial intelligence and quantum analytics might be treated under combined regulatory frameworks.

Stakeholders are invited to comment on the consultation until early 2026, with final guidelines expected later that year.

In the meantime, gatekeepers and large digital firms should revisit their data governance structures to ensure that business practices comply with both legal instruments in substance rather than in form.

Italy’s New Law on Cybersecurity and Digital Governance

Italy has enacted Law No. 132 of 2025, a comprehensive measure aimed at enhancing the country’s digital infrastructure, cybersecurity preparedness, and public sector digital transformation.

The law consolidates multiple initiatives under a single framework, creating a unified governance model for cybersecurity oversight and digital public services.

Among its most important provisions, the law establishes a national cybersecurity coordination authority with expanded investigative and regulatory powers.

It reinforces requirements for critical infrastructure operators, public administrations, and digital service providers to implement robust security measures and report significant incidents.

The legislation also promotes the development of national cloud infrastructure, aligning Italy more closely with the European Union’s digital sovereignty agenda.

From a legal perspective, Law No. 132 reflects the increasing integration of cybersecurity regulation with broader principles of administrative law and data protection.

It creates an obligation for public authorities to ensure interoperability and transparency in digital service delivery, an approach that could enhance public trust in e-government platforms.

The Italian reform also represents an important case study in how Member States are adapting their domestic laws to support European objectives such as the Cyber Resilience Act and the NIS2 Directive.

The implications are equally significant for the private sector. Companies engaged in digital services or cloud computing in Italy will face new compliance requirements, including tougher contractual terms for data processing and cross-border transfers.

European Commission Competition Report: Enforcement under the Digital Markets Act

The European Commission has released a new report summarising progress under the Digital Markets Act, highlighting the designation of gatekeepers and the first wave of enforcement actions.

The report notes that several major technology firms have already been required to adjust their practices, particularly concerning data interoperability, default settings, and advertising transparency.

The European Commission emphasises that the DMA’s objective is to ensure fairness and contestability in digital markets, with a particular focus on protecting business users and consumers.

Enforcement has centred on the assessment of compliance reports submitted by designated gatekeepers, as well as ongoing dialogue with national competition authorities to coordinate oversight.

The report also draws attention to the role of civil society and academia in monitoring DMA implementation.

Subscribe now

It calls for continued collaboration between regulators and researchers to assess whether the regulation effectively enhances market openness and innovation.

While the European Commission acknowledges challenges in interpretation and enforcement, it stresses that the early phase of the DMA has already produced measurable improvements in user choice and interoperability.

The report offers insight into how enforcement priorities are being determined. The focus on transparency and verifiable compliance may prompt gatekeepers to develop more detailed internal reporting systems, similar to those required under the AI Act.

The European Commission’s clear emphasis on measurable outcomes, rather than abstract principles, could influence how compliance assessments are structured in the coming years.

This report confirms that the European Union is not only legislating but also enforcing its digital laws with increasing precision.

It reinforces the expectation that non-compliance will attract significant penalties and reputational consequences.

Call for Papers: Quantum Computing and the Regulation of Law

The International Review of Law, Cyber Technology & Regulation (IRLCT) has issued a call for papers for a forthcoming special issue titled Quantum Computing and the Regulation of Law.

The issue, to be published in late 2026 or early 2027, invites scholarly contributions addressing the legal and regulatory dimensions of quantum technologies.

The editors, Professor James Griffin and Dr Chunping Bush of the University of Exeter, seek submissions exploring themes such as quantum advantage, regulatory frameworks for quantum hardware and software, intellectual property, quantum-safe cryptography, and liability for quantum systems.

The call also welcomes interdisciplinary research spanning law, computer science, philosophy, and public policy.

Abstract submissions are due by 15 January 2026, with full manuscripts expected by 1 May 2026. The issue aims to catalyse academic dialogue around how legal systems can respond to the disruptive potential of quantum computing.

Of particular interest are discussions on governance and accountability in a post-quantum world, where traditional encryption and privacy safeguards may become obsolete.

The significance of this call lies in its recognition that quantum computing is transitioning from theoretical research to practical deployment.

Regulators and legal scholars are beginning to anticipate the challenges this technology will pose to existing frameworks governing privacy, security, and intellectual property.

Submitting a paper could provide an opportunity to contribute to early thought leadership in an area that will likely dominate the next generation of technology regulation debates.

Conclusion

This week’s developments reinforce that technology regulation is entering a phase of consolidation.

The European Commission’s AI incident reporting guidance and DMA-GDPR interplay consultation both shows an effort to ensure regulatory consistency.

Italy’s comprehensive digital law and Australia’s proposal for a minimum social media age show that national regulators are equally active in strengthening accountability and user protection.

The coming months will require attention to detail, engagement with consultation processes, and preparation for implementation.

Those working in technology policy, law and regulation should seize these moments of regulatory definition to ensure that their organisations and clients remain not only compliant but also informed participants in influencing the norms of digital governance.

✨ Key Deadlines and Actions

• European Commission AI incident reporting consultation: open now.

• DMA-GDPR joint consultation: submissions accepted until early 2026.

• Australia’s OAIC social media age consultation: currently open for feedback.

• IRLCT Quantum Computing & Regulation of Law abstract deadline: 15 January 2026.

I would love to hear your thoughts on these developments and how they may influence your work or research. Share your comments, insights, or questions. Your perspectives help keep this newsletter grounded in real conversations.

Leave a comment

The drive to regulate quantum computing reveals a profound tension between legitimate security concerns and the need for scientific freedom, exposing how the wrong policy decisions could either hinder a transformative technology or fail to address genuine risks. Advocates and critics alike often oversimplify the debate, ignoring the complex issues of international collaboration, nascent research, and geopolitical interests that define this contentious subject.

Share

In this newsletter, we will cover:

1. Quantum computing is still in its infancy; imposing regulations risks choking off international collaboration, supply chains and the scientific freedom that has driven technological breakthroughs.

2. Export controls and classifications hinder research by slowing equipment imports, compliance costs and greatly discouraging foreign partnerships needed for quantum companies and laboratories to thrive.

3. Security concerns are valid but should be addressed through targeted measures and quantum cryptography standards than sweeping regulations that slow innovation and harm legitimate research.

4. Standards bodies like ISO, IEC and NIST provide flexible frameworks for terminology, interoperability and security that evolve with quantum technologies without imposing rigid, obsolete mandates.

5. Policymakers should invest in research, education and collaboration, adopting application specific oversight rather than broad prohibitions to protect national security while promoting quantum innovation sustainably.

The Demerits of Quantum Computing Regulation

The controversial debate over whether quantum computing should be regulated has become increasingly intense as governments, industry leaders and commentators grapple with the implications of this emerging technology.

On one side stand those who argue that quantum computers and related technologies pose profound security and economic risks that justify pre‑emptive regulation; on the other side are those who believe that premature regulation will stifle innovation, fragment global research networks and undermine the potential benefits that quantum technologies promise.

This editorial aligns with the latter view, arguing that the current push to regulate quantum computing is misguided, grounded in a distorted perception of risk, and driven by motives that have little to do with safeguarding innovation or national security.

Drawing on a range of academic research, policy analyses and government reports, this editorial critically examines the arguments for regulation and highlights the dangers of a regulatory rush.

There is the question of whether quantum computing is sufficiently mature to warrant legal and economic controls.

Quantum technologies remain at an early stage; most devices are experimental, and their capabilities are limited to specific problems.

Yet, some policymakers have moved to classify quantum computers as critical technologies and impose export controls on their components.

In the United States, the Department of Commerce extended export controls to quantum computing and other emerging technologies in 2024, requiring companies to obtain licenses when selling or transferring quantum hardware, software or services.

Subscribe now

The official justification was national security: regulators fear that countries like China might use advanced quantum systems to break encryption and gain military advantages.

However, this justification rests on speculative scenarios rather than present realities.

As the Center for Strategic and International Studies (CSIS) notes, quantum computers capable of performing such decryption are still many years away, and overbroad restrictions risk cutting off U.S. companies from international research networks and markets.

The consequences of misclassifying quantum computing as a mature, high‑risk technology are immediate and far‑reaching.

Export controls, by design, restrict the flow of hardware, software and knowledge across borders.

For quantum research, which relies on globally distributed expertise and equipment, such restrictions are particularly harmful.

A panel discussion at the recently emphasised that quantum laboratories depend on cryogenics, photonics and other components sourced from multiple countries.

When governments treat these instruments as strategic commodities, they risk creating choke points that disrupt supply chains, increase costs and delay research.

These regulatory interventions also undermine academic and commercial collaboration in quantum research.

Aziz Huq, a constitutional law scholar, has argued that export controls focus on restricting the flow of ideas, capital and goods across borders rather than building the infrastructure and norms needed to leverage innovation for national benefit.

By placing hardware and research data under the same restrictions as military equipment, policymakers fail to recognise that innovation flourishes through open exchange.

The result is a chilling effect: universities hesitate to partner with foreign institutions, startups struggle to secure funding and cross‑border projects are postponed or cancelled.

In the name of national security, regulators may be inadvertently weakening their own countries’ positions in the global quantum race.

Subscribe now

The United Kingdom’s Regulatory Horizons Council (RHC) has taken a different approach, one that emphasises caution and proportion.

In a February 2024 report, the RHC noted that quantum technologies are at various stages of development and argued that it is too early to jump to legally based regulation.

The report acknowledged that discussions and planning are necessary but cautioned against imposing rules before the applications and risks are fully understood.

The UK government’s response agreed, stating that regulation must be introduced at the right time so that it supports rather than stifles innovation.

This measured stance stands in stark contrast to the regulatory zeal seen in other regions, suggesting that effective governance can be more nuanced and less reactive.

Academics who study export controls and innovation policy share the RHC’s concerns.

Anh Nguyen of the University of Amsterdam has argued that current quantum export control proposals are unprecedented attempts to restrict a future technology and that performance thresholds used to trigger controls often exceed the capabilities of existing devices.

Nguyen and others warn that overbroad restrictions risk creating regulatory choke points and weakening global research networks.

Therefore, by treating quantum components like conventional dual‑use items, policymakers ignore the fact that many parts of quantum systems have purely civilian or benign applications.

For example, precision lasers used in quantum experiments are also used in medical diagnostics and manufacturing; cryogenic systems are essential for high‑energy physics and neuroscience. Classifying these items as strategic risks freezing entire sectors.

Think tanks and policy institutes provide further evidence that regulation could backfire.

A 2022 RAND Corporation report recommended that policymakers should not impose export controls on quantum computers or communications systems, noting that the eventual applications and timelines are highly uncertain and that restrictions could limit the exchange of ideas and slow technological progress.

The CSIS has echoed this view, highlighting that overly restrictive technology transfer policies would cut off access to the global quantum research community and harm startups.

These analyses share a common conclusion: premature regulation threatens to undermine innovation and leadership more than it protects security.

The debate is not confined to the United States and the United Kingdom alone.

In Europe, the drive for digital sovereignty has spurred proposals to create a “Quantum Act” that would place quantum computing under a regulatory regime similar to other critical infrastructures.

The European Centre for International Political Economy (ECIPE) has criticised this approach, pointing out that quantum technologies have emerged from global scientific interdependence and that regulation can support innovation only when grounded in a clear understanding of how a technology is likely to develop.

The authors warn that Europe risks stifling its own industry by over regulating too early and argue that a coordinated effort should allow member states to cultivate strengths in their own domains.

Overly prescriptive legislation for quantum computing could lead to uneven enforcement and further fragmentation,

These concerns are compounded by the fact that almost every key component of a quantum computer is sourced internationally.

Trying to build a fully domestic supply chain is unrealistic and could isolate Europe from global innovation.

Voluntary international standards offer the most promising framework for governing quantum technologies.

According to this view, standards bodies such as the International Organization for Standardization (ISO), the International Electrotechnical Commission (IEC), the Institute of Electrical and Electronics Engineers (IEEE) and the U.S. National Institute of Standards and Technology (NIST) are already developing frameworks for terminology, interoperability, security and risk management.

These standards are faster to update than laws, apply across borders and provide shared benchmarks without imposing legal mandates.

They build trust, reduce ambiguity and lay a foundation for eventual regulation without stifling innovation during early development.

Standardisation efforts are already yielding tangible results.

The ISO/IEC Joint Technical Committee on Quantum Technologies, established in 2024, coordinates terminology, benchmarks and interoperability standards across the quantum ecosystem.

NIST has finalised Federal Information Processing Standards that specify algorithms designed to resist attacks from quantum computers.

These standards enable organisations to prepare for quantum risks without the need for sweeping legislative action.

They also foster international collaboration, providing a common language and set of expectations for researchers, developers and regulators.

This standards‑first approach is a pragmatic alternative to immediate regulation, offering flexibility and adaptability as the technology evolves.

The U.K. Regulatory Horizons Council’s recommendation of a “regulation by application” model aligns with the standards‑first perspective.

It proposes that regulators focus on specific use cases rather than imposing blanket rules across the entire quantum domain. Under this model, legislation would apply only when a technology’s applications are clearly understood and when risks are concrete and measurable.

The U.K. government’s response supports this approach, emphasising that discussions, upskilling and international standardisation should precede any legislative requirements.

By upskilling regulators and engaging with industry through forums and workshops, governments can ensure that regulatory interventions are informed, targeted and proportionate.

Critics of regulation also stress the importance of international cooperation.

The Chicago Quantum Exchange event highlighted existing partnerships between the United States, Japan, France and Switzerland, underscoring that cross‑border collaboration is essential for quantum progress.

Scholars argue that building solid infrastructure and shared norms is crucial for nations to derive economic benefits from quantum innovation.

These norms include commitments to responsible research, ethical standards and open exchange of knowledge.

Targeted controls on malicious use cases may be necessary for national security, but blanket regulations would cut researchers off from the global ecosystem.

For innovation to flourish, governments must foster, not inhibit, these international networks.

Proponents of immediate regulation often portray critics as naive or indifferent to security concerns.

Such characterisations are unfair and ignore the fact that targeted measures are already in place.

The argument for regulation also often conflates worst‑case scenarios with imminent threats.

The possibility that quantum computers might one day break classical encryption does not justify imposing controls on research equipment or software today.

As RAND and CSIS highlight, the timeline for practical, scalable quantum computers remains uncertain.

Even if quantum computers eventually pose a security threat, the appropriate response is not to restrict research but to accelerate the development of quantum‑resistant cryptography and security practices.

Therefore, by investing in mitigation strategies and adaptive governance, policymakers can prepare for the quantum future without hampering innovation.

Economic considerations further undermine the case for regulation.

Quantum technologies are expected to create new industries and markets, driving job growth and attracting investment.

Restrictive regulation could deter venture capital and corporate investment, as companies may perceive a hostile environment for quantum research. In contrast, countries that adopt supportive, flexible policies are likely to attract talent and capital.

The CSIS report emphasises the need to increase support for research through funding, tax incentives and programs that nurture startups.

It calls for bolstering technological cooperation with allies and developing common policies on technology transfer to avoid cutting off access to the global research community.

These recommendations highlight that economic leadership in quantum technologies requires openness and collaboration, not isolation and control.

The ethical dimension of quantum regulation cannot be ignored.

Quantum technologies have the potential to revolutionise medicine, climate science, finance and logistics.

They could enable early detection of diseases, optimise supply chains and model complex chemical reactions.

Premature regulation that delays these innovations is not merely a missed economic opportunity; it is an ethical failure.

When policymakers restrict research based on speculative fears, they risk denying society the benefits that quantum computing could bring.

Given the urgency of global challenges, pandemics, climate change, resource management, the responsible course is to encourage research while putting in place mechanisms to address specific risks as they arise.

In the final analysis, the case against regulating quantum computing at this stage is compelling.

The technology is still maturing, and its capabilities and risks remain uncertain.

National security concerns, while legitimate, are better addressed through targeted measures, investment in cryptographic resilience and international cooperation than through sweeping export controls.

The misclassification of quantum hardware as inherently dual use ignores the civilian applications of many components and disrupts supply chains.

In conclusion, regulating quantum computing now would be a mistake.

The risks that proponents of regulation highlight are real but speculative and can be mitigated through targeted, flexible approaches.

Sweeping controls on components and knowledge threaten to undermine the global research collaborations that drive innovation and could delay the development of applications with enormous social and economic benefits.

Governments should resist the impulse to regulate for regulation’s sake. Instead, they should invest in research, support standardisation, engage with international partners and apply regulation only when applications and risks are clearly understood.

If you have thoughts or experiences on this debate, I welcome your contributions; please share your perspective, questions, or critiques; civil discourse enriches understanding and helps ensure policies are informed by diverse voices and informed analysis and encourages thoughtful engagement.

Leave a comment

International cooperation in science and technology is rarely as straightforward. The Technology Prosperity Deal between the United States and the United Kingdom is framed as a landmark agreement, yet its ambitions expose unresolved questions of governance, accountability, and national interest.

Share

The Technology Prosperity Deal: A New Era of US–UK Cooperation

On 18 September 2025, the governments of the United States and the United Kingdom signed a Memorandum of Understanding establishing what is called the Technology Prosperity Deal.

This agreement represents a structured partnership to deepen cooperation in science and technology.

It builds on a long history of collaboration between the two countries and sets out a framework for cooperation in areas such as artificial intelligence, nuclear technologies, and quantum research.

The deal involves creating tangible outcomes for citizens by aligning legal, regulatory, and research structures.

It also ensures that both countries remain influential leaders in the development of science and technology in ways that safeguard values of security, prosperity, and innovation.

Artificial Intelligence

Artificial intelligence is given priority attention within the agreement.

Both governments have committed to expanding access to compute infrastructure, supporting the development of shared datasets, and establishing flagship research programs in AI-enabled science.

These will cover areas such as biotechnology, cancer research, rare and chronic diseases, and energy research including fusion.

The agreement establishes a pathway for U.S. and UK research institutions, such as the Department of Energy, the National Science Foundation, and the UK Research and Innovation body, to coordinate joint funding, joint use of compute resources, and collaboration on new AI models.

There will be efforts to advance automated laboratory technologies, expand opportunities for joint research, and strengthen AI applications in space exploration through links between NASA and the UK Space Agency.

An important institutional link is also planned between the U.S. Center for AI Standards and Innovation and the UK AI Security Institute.

Their cooperation will include joint work on standards, research into advanced AI capabilities, and talent exchanges.

This is intended to establish a framework for trusted AI adoption while also supporting industry export opportunities, particularly in semiconductors, data centers, and models.

For citizens and businesses, this offers the possibility of more collaborative projects, greater employment opportunities in AI-related roles, and access to stronger infrastructure supporting scientific advancement.

Civil Nuclear Energy

The memorandum also recognises nuclear technologies as central to the future of energy, security, and industrial competitiveness.

The governments of the United States and the United Kingdom aim to accelerate development in advanced nuclear reactors and fuels, ensure secure supply chains, and establish independence from Russian nuclear fuel by the end of 2028.

The document is explicit about improving regulatory timelines, with targets such as completing reactor design reviews within two years and site licensing within one year.

The aim is to give industry greater certainty while ensuring high standards of safety, security, and non-proliferation.

Collaboration will also extend into fusion energy research. Both countries have committed to pursuing harmonised policy and regulation to support a global market for fusion energy led by the United States and the United Kingdom.

The memorandum also leaves open possibilities for civil maritime nuclear applications and for nuclear-powered resilience in defence facilities.

These provisions are not abstract; they mean practical efforts to reduce costs, accelerate projects, and strengthen energy resilience for both societies.

Subscribe now

Quantum Technologies

The agreement addresses quantum technologies as a central frontier in science and innovation.

The text identifies cooperation in quantum information science, quantum computing, and secure quantum communications.

It commits to supporting collaborative research, developing standards, and encouraging workforce development.

Although the memorandum does not prescribe detailed technical objectives, it provides a basis for cross-governmental and cross-agency partnerships.

This creates the foundation for long-term leadership in quantum research and for coordinated policy frameworks that can support adoption by businesses and research institutions.

Subscribe now

Strategic Importance

The memorandum emphasises that the United States and the United Kingdom share deep-rooted expertise, strong security partnerships, and complementary regulatory regimes.

By agreeing to this structured partnership, both governments are positioning themselves to influence global standards, develop joint responses to strategic challenges, and support domestic industries in highly technical fields.

For the general public, the implications are clear. Access to new energy technologies, new medical applications of AI, and more resilient infrastructure are not distant policy concepts but elements that can affect jobs, healthcare, and national security in direct ways.

The memorandum offers opportunities to participate in collaborative projects, benefit from streamlined regulatory processes, and enter export markets supported by joint government frameworks.

Why This Matters

The Technology Prosperity Deal shows that governments are prepared to create structured and ambitious frameworks for science and technology cooperation.

It signals that innovation is not only about industry leadership but also about government-led coordination, standards, and infrastructure.

Practical measures such as joint funding, shared access to compute, regulatory streamlining, and supply chain security will directly influence how technologies develop over the next decade.

Individuals who are part of research communities, industry associations, or educational institutions should be aware of the opportunities to engage with collaborative projects supported by this deal.

Businesses involved in nuclear, AI, or quantum sectors should pay attention to the new export and regulatory provisions that may open doors for participation.

This memorandum of understanding is a reminder that science and technology progress most effectively when supported by structured international partnerships.

The United States and the United Kingdom have chosen to formalise their cooperation with clarity on purpose, scope, and timelines.

Citizens, businesses, and institutions in both countries should be attentive to the opportunities and responsibilities that follow.

The Technology Prosperity Deal is a practical document with clear commitments.

It represents a deliberate effort to coordinate resources, policies, and expertise in order to deliver benefits for people in both countries and to support leadership in technologies that will define the coming decades.

The Deal in Perspective

The Deal between the United States and the United Kingdom is presented as a landmark framework for cooperation on artificial intelligence, nuclear energy, and quantum technologies.

Yet the memorandum offers more political symbolism than substantive detail.

The text highlights ambitions such as accelerated nuclear licensing timelines, joint AI research programs, and secure supply chains, but it avoids addressing deeper questions of accountability, governance, and the distribution of benefits.

In nuclear energy, the proposed two year reactor review and one year site licensing targets may satisfy industry demand for certainty, but they risk compromising the independence of regulatory oversight.

In AI, the rhetoric of shared compute access and datasets sounds progressive, yet there is no clear plan for public accountability in developing and deploying models that may influence health, security, and data systems.

The agreement also elevates government-led standards without meaningful consideration of global participation.

By presenting the memorandum as a neutral framework, both governments appear to sidestep the political reality that technology standards are instruments of power.

The deal therefore risks becoming less about prosperity and more about reinforcing influence.

The absence of mechanisms for public scrutiny should concern anyone invested in long term democratic governance of technology.

Leave a comment

The Technology Prosperity Deal raises important questions about governance, industry participation, and long-term accountability. We welcome your reflections and perspectives on what this agreement could mean in practice. Reply to share your thoughts.