This briefing report examines a growing willingness among governments, regulators, and courts to control access to digital services, artificial intelligence systems, biometric technologies, and online advertising. The central concern is increasingly difficult to ignore. Tech companies have been permitted to introduce systems with significant social consequences before legal responsibility was clearly established. Recent developments expose serious tensions around age verification, national security, privacy, platform monitoring, and institutional accountability. Readers will find a critical account of how law is responding to technologies that have already become deeply embedded in everyday life, often before the public has been given a meaningful opportunity to understand or challenge their operation.

Newsletter Edition 100

🔥 This edition includes important updates and news in technology law from the United States, India, Canada and the European Union. Access the latest opportunities, including remote jobs in technology law, grants, and call for papers.

The Latest in Technology Law:

Lead Story

United Kingdom announces social media ban for children under 16

The United Kingdom government has announced plans to prevent social media platforms from offering their services to children under 16. The proposal covers user to user platforms whose main purpose is social interaction and which combine user posts with recommendation systems.

The government has identified services such as Instagram, YouTube, TikTok, Snapchat, Facebook, and X as examples that may fall within the regime. Messaging services such as WhatsApp and Signal are not intended to be included.

The announcement goes beyond account access. Livestreaming and communication from strangers would be restricted for children under 16 across a wider group of online services, including gaming services.

Those functions would also be disabled as a default setting for users aged 16 and 17.

Leave a comment

AI services offering romantic companion functions would face a minimum age of 18. Similar intimate functions on general AI chatbots would be restricted for children.

The legal framework will depend heavily on age assurance.

Ofcom has been asked to examine methods capable of establishing whether a person is over 16 in a manner that is accurate, reliable, fair, and difficult to evade.

The government also plans research on the use of virtual private networks and other methods children may use to bypass access controls.

Adults may not always need a new check where an account already contains reliable age indicators. This part of the policy will require careful privacy scrutiny.

The first set of regulations are expected before the end of 2026, with implementation planned for spring 2027. The government intends to use powers under the Children’s Wellbeing and Schools Act and other secondary legislation.

Important details remain open, including the final list of covered services, exemptions for education and other activities, acceptable age assurance tools, data retention rules, and Ofcom’s enforcement approach.

Providers will need to understand which users can enter a service, which functions they can access, and what evidence demonstrates compliance. Families should expect clearer access rules.

The effectiveness of the regulation will depend on implementation, privacy protections, and consistent enforcement.

The proposal places age based access controls and feature restrictions at the centre of online safety law, creating direct duties for platform eligibility, age assurance, service design, documentation, and regulatory enforcement across social media, gaming services, and certain AI functions.

Technology Law: Updates and Developments

United States directive suspends foreign national access to Fable 5 and Mythos 5

Anthropic announced recently that it had received a United States government export control directive requiring the suspension of access to Fable 5 and Mythos 5 for every foreign national, whether located inside or outside the United States.

The restriction also applies to foreign national employees of Anthropic.

The company stated that it disabled the affected models across all customer accounts to secure compliance. Access to its other models remained available.

According to Anthropic, the government linked the directive to a possible method of bypassing Fable 5 safeguards. Anthropic said the government did not provide specific details in the directive and that the company had only received verbal evidence concerning a narrow technique.

The use of export control powers to regulate access to AI models according to nationality, including access within the United States, is quite significant and to some extent, unprecedented.

Customers using advanced models in multinational teams may now face service interruption even where the customer organisation itself is domestic.

This emerging development also raises important standards for transparency, technical assessment, procedural review, and the treatment of foreign national researchers and employees when advanced AI models are restricted on national security grounds.

X and xAI in breach of privacy law over sexualised deepfakes

Canada’s Office of the Privacy Commissioner found that X Corp. and xAI breached the Personal Information Protection and Electronic Documents Act after Grok was used to generate and publish sexualised deepfakes of identifiable people, including children.

The investigation began on 15 January 2026 after reports of widespread generation during late December 2025 and early January 2026.

Subscribe now

The finding shows that the Privacy Commissioner treated a synthetic depiction of an identifiable person as that person’s personal information, even where the image was false. X Corp. and xAI failed to obtain valid consent under Principle 4.3.

The Privacy Commissioner also found that a reasonable person would not consider the relevant collection, use, and disclosure appropriate under subsection 5(3).

Recommended measures included suspending Grok Imagine until effective safeguards could be demonstrated, establishing a formal privacy risk process within six months, providing annual independent audits, and documenting proactive monitoring.

The companies disputed the conclusions. They committed to several measures. The matter remained well founded and unresolved when the report was issued.

The decision provides a practical lesson for every generative AI provider. A policy prohibiting abuse is not enough. Product testing, access controls, detection systems, incident response, measurement, and evidence of effectiveness are very important when a feature can cause harm at scale.

The European Union and four African states conclude enhanced economic partnership negotiations

The European Union, Comoros, Madagascar, Mauritius, and Seychelles concluded negotiations on an enhanced Economic Partnership Agreement on 10 June 2026.

The agreement builds on the interim arrangement applied since 2012 and adds rules on services, investment, public procurement, intellectual property, sustainability, and digital trade.

The digital trade chapter would prohibit customs duties on electronic transmissions, strengthen online consumer protection, and reduce administrative requirements for electronic transactions.

These provisions can support digital services, electronic contracting, and cross border commercial activity.

Their practical value will depend on the final legal text, domestic implementation, regulatory capacity, and accessible remedies for consumers and businesses.

The agreement is not yet in force.

The European Commission must complete internal procedures and submit proposals to the Council for signature and conclusion.

Also, the European Parliament must give consent, the Council must adopt a conclusion decision, and the four African states must complete ratification.

Provisional application may be possible if the parties agree.

Subscribe now

The negotiated text had not been published with the announcement. Close review will therefore be needed once it becomes available, especially on data governance, exceptions, authentication, electronic signatures, cybersecurity cooperation, consumer redress, and dispute settlement.

Businesses should treat the announcement as the completion of negotiations, not as an immediate change to applicable trading rules.

Amazon Ring faces privacy lawsuit over Familiar Faces technology

A Virginia resident has filed a proposed class action against Amazon in federal court in Seattle, alleging that Ring’s optional Familiar Faces feature collected and retained facial images without proper consent.

The claimant, Charles Sigwalt, says Ring cameras at the homes of friends and relatives captured his face even though he was not the account holder and had not agreed to biometric processing.

The civil claim seeks at least five million US dollars in damages.

Familiar Faces uses facial recognition to identify people who regularly appear before a camera and can attach names to future notifications.

The legal concern centres on people who enter a camera’s field of view without any direct relationship with Ring.

Visitors, neighbours, delivery workers, and passers by may become biometric data subjects without seeing a notice or receiving a meaningful choice.

Case Note

Case: DRS Logistics Private Limited and another v Google India Private Limited and others
Citation: CS(COMM) 1/2017, I.A. 2646/2020, I.A. 2173/2022, I.A. 18605/2025 and I.A. 25645/2025

Facts in Issue

DRS Logistics and another claimant brought trade mark proceedings concerning the marks Agarwal, Aggarwal Packers And Movers, Drs Logistics, and related variations.

Earlier orders required Google entities to investigate complaints alleging that the claimants’ marks had been used as advertising keywords to divert traffic.

Google was also required to review the overall effect of a notified advertisement and block it where the use infringed the marks or amounted to passing off.

A Division Bench court declined to interfere with those directions in August 2023. During searches conducted in June 2025, the claimants found sponsored links appearing after searches using their marks.

They sent Google a notice supported by screenshots and later applied for contempt, alleging deliberate disobedience of the earlier judgments.

The complaint extended beyond keyword selection. It concerned the appearance of the marks in advertisement text, advertisement titles, and web addresses.

Google maintained that the earlier judgments required action after a specific complaint and did not create a general obligation to inspect every advertisement in advance.

Brief explanation of the dispute

The parties disagreed about the scope of the earlier court directions. DRS Logistics argued that Google had committed to prevent third parties from using the trademarks in advertisement text, titles, and web addresses, and that continued appearances demonstrated disobedience.

Leave a comment

Google argued that the operative directions concerned complaints about keyword use and the overall effect of identified advertisements.

Its advertising policy allowed trade mark complaints to be investigated after notice. Google said the judgments did not require permanent surveillance of all advertisements before publication.

Legal issue

The central issue was whether the earlier judgments applied only to the claimants’ trademarks as advertising keywords or also imposed duties concerning their appearance in advertisement text, advertisement titles, and web addresses.

A connected issue concerned the timing of Google’s responsibility. The court had to determine whether Google was required to identify prohibited uses on its own or whether its duty arose after the claimants submitted a complaint identifying a disputed advertisement.

Legal question considered by the court

The court considered whether Google’s failure to prevent third party advertisements containing the claimants’ marks amounted to wilful disobedience of the 2021 and 2023 judgments, and whether those judgments imposed a proactive monitoring duty without prior notice from the trade mark owner.

Decision

The High Court of Delhi dismissed the contempt application. Justice Tejas Karia held that the operative directions in the earlier judgments were confined to the investigation of complaints alleging use of the marks and their variations as keywords.

Those directions required Google to examine the overall effect of an identified advertisement and take action where infringement or passing off was established.

The court found no direction requiring Google to inspect all advertisements in advance for uses of the marks in advertisement text, titles, or web addresses.

References to Google’s policy in the earlier proceedings did not convert the policy into a general court ordered monitoring duty.

Google remained bound by its recorded statement that the marks would not be permitted in advertisement text, titles, or web addresses under its policy. That obligation operates through the complaint process.

A future disputed advertisement may be notified to Google, which must investigate and act under its policy as quickly as reasonably possible.

The court also noted that the web addresses identified in the contempt application had already been taken down after notice.

No wilful disobedience was established. The judgment therefore preserves a notice based enforcement model for these particular directions and confirms that contempt jurisdiction cannot be used to expand the plain terms of an earlier order.

Latest Opportunities

Remote jobs for lawyers

1. Director of Case Law AI-Driven Content (Remote, USA), LexisNexis: Responsible for defining and leading the editorial and subject matter expert teams responsible for delivering AI-enabled case law content initiatives that support LexisNexis’s evolving research and AI product strategy (find out more).

2. Legal Specialist (Remote, Australia), Scissero: You will work directly on live private equity, M&A, and financing transactions for leading global investment firms, asset managers, and corporates using an AI-enabled platform (find out more).

3. Senior Legal Consultant (Remote, Italy), Innodata: Innodata is seeking an experienced Senior Consultant in the legal research domain to support the Italy L&R Prime 2.0 rollout and vendor transition initiative (find out more).

4. Legal Consultant - Legal Tech Project Manager (Remote, USA), NetDocuments: Seeking a Legal Consultant to work with law firms and legal department clients to support their adoption of NetDocuments' platform and AI capabilities (find out more).

Subscribe now

5. AI Governance Advisor (Remote, USA), Credo AI: Provide a transformative experience for current and aspiring AI governance leaders by providing them with in-depth knowledge and hands-on engagement in AI risk management, governance, and compliance (find out more).

Conferences, fellowships, events and calls for papers

6. Fellowship Grant: Institute for Humane Studies, up to $20,000. Agentic AI and the Future of News and Information (find out more).

7. Call for Papers: Computational Legal Studies (Cambridge Forum on AI: Law and Governance). It publishes content focused on the governance of artificial intelligence (AI) from law, rules, and regulation through to ethical behaviour, accountability and responsible practice (find out more).

Final Summary

This edition shows regulators and courts paying closer attention to how technology systems operate in practice.

Age checks, AI safeguards, biometric features and advertising complaints, all depend on documented processes that can be tested after deployment.

Written policies carry limited weight when implementation cannot be demonstrated.

Public authorities are also demanding clearer responsibility across providers, developers, platforms, and customers.

The next stage of technology law will be judged through evidence of control, accountability, and effective remedies.

Leave a comment

This week’s technology law briefing examines a more uncomfortable reality about power over technology: AI, encryption, biometric identity and platform control are no longer matters that can be left to engineers, executives or general public. The discussions covered here show institutions struggling to decide who should benefit from technological progress, who should pay for its social costs and who gets to control the infrastructure through which people work, communicate, trade and prove who they are. The key observation is that technology law is becoming a test of institutional seriousness.

Newsletter Edition 99

🔥 This edition includes important updates and news in technology law from the United States, Canada, the Vatican, Costa Rica and the European Union. Access the latest opportunities, including remote jobs in technology law, conferences and events.

This Week in Technology Law:

Lead Story

The Vatican Warns Against Leaving AI to Market Power

On 25 May 2026, Pope Leo XIV signed his first encyclical Magnifica Humanitas. This appears to be a radical policy intervention marking the 135th anniversary of Rerum Novarum, Pope Leo XIII’s historic letter on workers’ rights during the industrial revolution.

Magnifica Humanitas approaches AI primarily as a tool and says its purpose is to protect human dignity.

The encyclical asserts that AI must serve humanity rather than allow markets and private platforms to determine its direction. To emphasise the moral continuity with the industrial era, Pope Leo compares today’s concentration of data and computing power to the nineteenth‑century concentration of capital and factories.

The document notes that major economic actors own the platforms, infrastructure and computing capacity and warns that relying on goodwill alone cannot protect dignity.

The encyclical draws a direct line between labour issues of the industrial age and today’s AI challenges. It critiques transhumanist ambitions that would surpass human limits and raises concerns about concentration of technological power. It also stresses the role of public policy in ensuring ethical governance.

According to the Vatican, AI governance is not merely a technical exercise but a moral problem requiring legal structures, public participation and courage. National laws, oversight mechanisms and public debate are essential for aligning AI with human dignity.

Leave a comment

This message resonates because many governments still defer to market forces when regulating AI.

The Pope cautions that the same market‑centred approach that once produced harsh working conditions could now degrade human dignity through unchecked automation.

Rather than demonise technology, he emphasises that AI remains a tool and that the important question is the purpose and values guiding it.

Magnifica Humanitas provides moral authority for regulators who wish to impose fairness, transparency and accountability on AI developers.

It frames AI governance as a defence of human dignity and invites policymakers to treat AI as a public issue, rather than a purely private innovation.

Technology Law: Updates and Developments

Should AI Productivity Be Taxed?

Senator Elizabeth Warren argues that AI’s productivity gains should benefit everyone rather than a few technology investors.

She warns that AI could concentrate wealth and suggests overhauling tax rules. She notes that companies currently pay payroll taxes for workers but receive tax breaks for investing in technology, effectively penalising human labour and encouraging automation.

Senator Warren proposes raising corporate and capital‑gains taxes, closing loopholes and strengthening the minimum tax to counter this perverse incentive.

She advocates taxing AI data centres through an excise tax on their energy consumption; larger data centres would pay more.

This tax could return some AI profits to communities through investments in health care, education and jobs, ensuring that AI benefits those who support it with data, infrastructure and public research. Senator Warren also endorses a wealth tax on AI billionaires to stop them paying lower tax rates than workers.

Pinsent Masons Self‑Referral over AI‑Generated Errors

Pinsent Masons became the latest law firm embroiled in an artificial‑intelligence controversy after an Insolvency and Companies Court judge found that the firm twice misled the court in the case of Cork & Anor v Smith.

A junior lawyer, anonymised as “LA,” relied on an internal AI tool to generate legal citations and produce an explanatory letter. The first submission contained hallucinated authorities; the second compounded the errors.

Judge Mullen said the junior lawyer had “almost entirely outsourced the thinking process” to the software and that supervising solicitors Samantha Poulton and partner Steven Cottee failed to review the work properly.

Pinsent Masons apologised and reported itself and three solicitors to the Solicitors Regulation Authority (SRA).

The judge declined to initiate contempt proceedings but noted there was at least a prima facie breach of duties not to mislead the court or waste court time.

Subscribe now

According to the judgment, the junior lawyer asked the AI to draft letters and did not verify the responses. Supervising lawyers approved a draft containing errors within hours without checking thoroughly.

Judge Mullen concluded that AI can serve as a starting point, but does not eliminate the need for critical thinking.

Apple and Google Warn Canada’s Bill C‑22 Could Threaten Encryption

Bill C‑22, currently before the Canadian House of Commons, seeks to expand “lawful access” to encrypted communications for law enforcement.

Apple and Meta argue that the bill could force companies to weaken end‑to‑end encryption or create backdoors.

Both companies fear the bill’s sweeping powers and minimal oversight could allow the government to compel them to install spyware on devices and break encryption.

Apple warns that the legislation would undermine its ability to offer privacy features and could force it to introduce systemic vulnerabilities.

Meta’s policy directors emphasise that the bill could require providers to build capabilities that break or circumvent encryption and to install government spyware directly into systems.

A spokesperson for Public Safety Canada argues that the bill does not require the creation of systemic vulnerabilities and that companies “know their systems and have a vested interest in keeping them secure”.

The objective of encryption is to protect e.g., journalists, activists, businesses and ordinary citizens from cybercrime, and weakening it could create new risks.

Legislators will need to design narrowly tailored, transparent mechanisms that respect necessity, proportionality and duration when granting access to encrypted data.

Costa Rica’s Electoral Tribunal Accused of Illegally Commercialising Biometric Data

Costa Rica’s Agency for the Protection of Inhabitants’ Data (Prodhab) has ordered the Supreme Electoral Tribunal (TSE) to stop commercialising biometric data without citizens’ informed consent.

The TSE’s Identity Verification System (VID) allows banks, businesses and public bodies to verify fingerprints and facial photographs for a fee.

Prodhab’s resolution of 4 May 2026 found that the TSE had violated the constitutional right to informational self‑determination by commercialising personal data without consent.

The agency emphasised that biometric data such as fingerprints and photographs are sensitive and that no public institution can sell them without legal authority.

The TSE has been monetising this data since 2017.

Prodhab’s order requires the TSE to obtain informed consent from citizens, update its database registration and publish information about its data processing practices. It also demands a list of data types processed and improvements to security measures within two months.

Failure to comply could lead to the cancellation of the TSE’s database registration.

The resolution sets a precedent in Costa Rica (and perhaps, globally) by explicitly classifying biometric data as sensitive and asserting that even government agencies must respect data protection law.

The TSE has not yet commented publicly on its compliance plans.

Curbing the Theft of AI Models with Export Controls

Many policymakers now see advanced artificial‑intelligence models as strategic assets comparable to sensitive defence technologies.

U.S. representatives Bill Huizenga and John Moolenaar introduced H.R. 8283, the Deterring American AI Model Theft Act of 2026, to address model theft.

According to Congressman Huizenga, state‑sponsored actors—especially in China—use “distillation” attacks to extract model weights, architectures and technical parameters from U.S. systems.

The bill would authorise discretionary sanctions, establish a “name‑and‑shame” list of foreign entities that steal AI models and facilitate public‑private threat sharing. It aims to ensure that companies and federal agencies share best practices and track attacks to strengthen defences.

The Congressional Budget Office (CBO) estimates that implementing the bill would cost about US$35 million over 2026–2031 for staffing, reporting and maintaining online platforms.

The CBO notes that federal agencies would need to identify foreign entities illicitly accessing AI models, share information with U.S. model owners and report on mitigation efforts.

Subscribe now

The bill expands export‑control authority, allowing the U.S. government to sanction entities that illicitly access AI models. Despite the small budgetary impact, compliance may require industry participation and increase restrictions on transactions with sanctioned parties.

The underlying question is whether AI models should be treated like other export‑controlled technologies.

It can be argued that strategic AI models underpin national security and economic competitiveness, and that theft undermines the U.S. innovation ecosystem.

However, it is reasonable to believe that export controls could hamper collaborative research and global AI development. As the bill moves through Congress, expect some deeper conversations about definitions of illicit access and the balance between security and openness.

Alaska’s Privacy Bill Puts Data Brokers on Notice

Alaska’s House Bill 367, the Consumer Data Privacy Act, represents a significant step in state privacy legislation. The bill, referred to the House Finance Committee on 12 May 2026, would grant Alaska residents rights to access, correct, delete and copy their personal data.

It applies to businesses that collected or processed data from at least 35,000 consumers during the previous year or those handling data for at least 10,000 consumers where more than 20 percent of gross revenue comes from selling personal data.

The bill excludes the federal and state governments, the University of Alaska and tribal governments.

Consumers would gain rights to confirm whether a controller is processing their data, to access and obtain a list of specific third parties to whom their data has been transferred.

They would also have the right to opt out of targeted advertising, data sales and certain profiling. Businesses subject to the bill would need to provide clear privacy notices and honour deletion and correction requests.

The bill establishes a data broker registry and treats violations as unfair or deceptive trade practices.

It is still moving through the legislative process, so amendments may modify its scope or enforcement mechanisms.

Case Note

Case: Meta Platforms v Commission
Citation: Judgment of the General Court in Case T‑1078/23 (3 June 2026)

Key Facts

Meta sought partial annulment of the Commission’s decision, contending that Messenger was not distinct from Facebook and that Marketplace did not meet the criteria for an online intermediation service.

The case raised questions about how the European Commission calculates user numbers, whether it must conduct market investigations and how it should classify services after platform modifications.

Legal Issue

Whether the European Commission lawfully designated Messenger and Marketplace as gatekeeper services under the DMA.

The court examined whether Messenger qualifies as a number‑independent interpersonal communications service, whether Marketplace is an online intermediation service and whether the Commission’s reasoning satisfied legal standards.

Legal Question Considered

Did the European Commission err in designating Messenger and Marketplace as important gateways for business users to reach end users?

Specifically, was Messenger distinct from Facebook, and did Marketplace meet the conditions to be classified as an online intermediation service under the DMA?

Was a market investigation required to verify the presumption of gatekeeper status?

Did the European Commission provide sufficient reasoning and use appropriate data when classifying Marketplace?

Decision

The General Court upheld the European Commission’s designation of Messenger.

It confirmed that Messenger is a number‑independent communication service distinct from Facebook and that it can be used through standalone apps. Integration with Facebook does not negate its distinct functionality.

Leave a comment

The court held that the European Commission did not err in counting all Messenger users, even those who also use Facebook, and that no market investigation was necessary because Meta’s arguments did not sufficiently rebut the presumption of gatekeeper status. The court also affirmed that Meta’s rights of defence were respected.

However, the court annulled the European Commission’s designation of Marketplace as a gatekeeper. It ruled that the Commission relied on data from the three years before the 2023 designation and failed to consider significant changes implemented in July 2023 that limited the number of listings per user.

The court found that the decision lacked concrete analysis of these changes and did not adequately demonstrate that Marketplace enabled business users to offer goods and services to consumers.

Without clear reasoning, the court could not determine whether Marketplace met the conditions for an online intermediation service.

As a result, Meta’s gatekeeper designation for Marketplace was annulled, though Messenger remains designated as a gatekeeper.

Latest Opportunities

Remote jobs in technology law

1. Regulatory Affairs Manager: Financial Crime/FinTech (Remote France), Revolut: Seeking a Regulatory Affairs Manager to support regulatory engagement in the EU. You'll be a key liaison between Revolut Bank UAB and regulators, such as the ECB (find out more).

2. General Counsel (Remote UAE), Quantum Light: Quantum Light is seeking a General Counsel to serve as the company's top legal authority and architect of our global investment platform (find out more).

3. Senior Patent Counsel (Remote US), Unified Patents: Unified Patents is again growing its legal department, and seeks to add an experienced, registered patent attorney (find out more).

4. TKYC Analyst (Remote Canada/US), Avantia: An AI-first legal and compliance services provider. As a Transaction KYC Analyst, you will work alongside asset managers’ legal, compliance, and investment teams to help bring complex private equity deals to completion (find out more).

Subscribe now

5. Regulatory Counsel (Remote Türkiye), Binance: A leading global blockchain ecosystem behind the world’s largest cryptocurrency exchange by trading volume and registered users. Assist with legal and regulatory matters related to financial products and services in the FinTech, crypto, and blockchain sectors (find out more).

6. Product Manager (Remote Japan), BoostDraft: BoostDraft is a software engineering company that develops IDEs for documents. Currently seeking Lawyers who draft relatively standardised but long documents, such as contracts (find out more).

Conferences, fellowships, events and calls for papers

7. The Centre for Legal Education and the Legal Profession (CLELP), Westminster Law School, University of Westminster UK: Delighted to invite abstract submissions for their second annual symposium. Topics include the future legal profession: technology, innovation and change; Generative AI: legal technology and digital transformation (find out more).

8. Call for Papers on the Right to Freedom of Expression in the Digital Era: Platforms, Deepfakes, Social Media, and the Public Sphere; XVIII International Natural Law Conference: The Conference will address the status of freedom of expression in a world increasingly shaped by digital platforms, AI, synthetic media, and new forms of public and private governance (find out more).

9. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words (find out more).

Final Summary

This week’s developments informs us of the growing significance between moral, regulatory and strategic dimensions of technology law.

The Vatican’s encyclical reinforces the view that AI governance is more than innovation which also includes preserving human dignity.

Also, legislators are grappling with how to distribute AI’s economic benefits, secure communications and protect personal data.

Meanwhile, courts and policymakers are refining definitions of gatekeepers and strategic technologies.

The conversation is changing from whether to regulate AI and digital platforms to how to design safeguards that balance innovation, privacy and fairness.

Transparent lawmaking and robust ethical frameworks will be essential for public trust and equitable outcomes.

Leave your comments to join the conversation.

Leave a comment

This week’s briefing report informs us that technology law sanctions are becoming less forgiving. This briefing report encompasses cybercrime policing, AI in legal practice, predictive government, student AI bans, data transfers, and prediction markets ban.

Newsletter Edition 98

🔥 This edition includes important updates and news in technology law from the Middle East and North Africa (MENA), Argentina, Germany, the UK, and the US. Access the latest opportunities, including remote jobs in technology law, free courses, events, and scholarships.

This Week in Technology Law:

Lead Story

Operation Ramz Cybercrime Crackdown

The Middle East and North Africa (MENA)

Between October 2025 and February 2026, thirteen countries joined forces under Interpol’s Operation Ramz. This four‑month campaign focused on phishing‑as‑a‑service platforms, malware distributors and online scam networks, culminating in 201 arrests and the identification of another 382 suspects.

Subscribe now

Investigators seized 53 servers and shared nearly 8,000 pieces of intelligence across participating jurisdictions.

The operation identified 3,867 victims and uncovered infrastructure in Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, Oman, Palestine, Qatar, Tunisia and the United Arab Emirates.

By pooling resources and intelligence form the MENA countries,

• Police dismantled a phishing‑as‑a‑service operation in Algeria, confiscating servers, computers and mobile devices.

• Moroccan officers seized hard drives containing banking data and phishing software.

• In Oman, a server hidden in a private residence contained sensitive information and was taken offline.

• Qatar uncovered compromised devices whose owners were unaware their computers were being used to propagate malware.

• Perhaps the most alarming discovery occurred in Jordan where fifteen people running financial‑investment scams were themselves victims of human trafficking. They had been lured from Asia with bogus job offers, had their passports taken and were forced to participate; investigators arrested two suspected organisers.

Operation Ramz demonstrates the value of transnational cooperation in addressing cybercrime.

Cybercrime schemes often span jurisdictions, making unilateral enforcement ineffective. Shared intelligence and simultaneous raids increase the likelihood of arrests, preserve evidence and disrupt infrastructure.

The operation also raises complex legal questions. Courts will have to determine how data was collected, whether warrants justified server seizures, and whether evidence from private cybersecurity firms is admissible.

Human‑trafficking victims forced into fraud present further challenges; prosecutors must reconcile their criminal involvement with the duress under which they acted.

Interpol emphasised that cybercrime is borderless and only an equally borderless response can work.

Leave a comment

As phishing kits, malware and social‑engineering scams proliferate, law‑enforcement agencies worldwide will need to build on this model of collaboration.

Operation Ramz also highlights the importance of transparency; victims deserve to know how evidence was collected and how their data may have been compromised.

Legal frameworks must evolve to balance the need for international cooperation with privacy, due process and the rights of those compelled into criminality.

The success of Operation Ramz shows what coordinated action can achieve, but also clarifies the necessity of clear legal standards for digital evidence and human rights considerations.

Technology Law: Updates and Developments

Argentina’s AI Social Digital Twin

Argentina’s government announced a “social digital twin” to model the impact of welfare programmes and other policies.

The Ministry of Human Capital said the project will use large‑scale datasets to simulate scenarios involving poverty, subsidies and labour trends in order to inform policymaking.

President Javier Milei promoted the initiative on social media as a paradigm shift towards data‑driven governance, claiming it would transform information into predictive capacity and strategic design for public policy.

According to officials, the system will draw on data from state agencies and private sources, correlating variables to identify problems and forecast the likely effects of interventions.

The announcement triggered immediate scrutiny. Opposition lawmakers filed formal requests in Congress seeking details about the project’s legal basis, the scope of data collection and the safeguards for personal information.

Subscribe now

The promotional video announcing the Gemelo Digital was quickly mocked for basic language errors. At 0:35, one graphic read “MULTIPLES FUENTES”, omitting the required accent in “múltiples.” At 0:54, a full-screen claim called it the “PRIMER SISTEMA QUE AYUDA PREDICIR EL FUTURO,” missing “a” before the verb and misspelling “predecir” as “predicir.”

Critics noted that the promotional materials were vague and raised concerns about potential involvement by Palantir Technologies, a data‑analytics company whose founder Peter Thiel had recently visited Argentina and met with the president.

Digital‑rights groups argued that merging welfare, health, judicial and education records into a single model could lead to profiling and discriminatory decision‑making. They demanded clarity on which datasets would be used, how they would be anonymised, and whether individuals could consent or opt out.

The government insisted that only aggregated and anonymised data would be processed and said the initiative is still at an early stage.

Without a transparent regulatory framework, simulation tools that promise efficiency could morph into pervasive surveillance. Argentina’s social digital twin encapsulates both the promise of AI‑assisted policy design and the perils of insufficient data‑governance.

Moving forward, public debate should focus on ensuring that predictive governance remains accountable governance, with clear procurement rules, independent audits and enforceable rights for individuals affected by algorithmic decisions.

UC Berkeley Law Bans Students From Using AI

The University of California, Berkeley Law School unveiled a sweeping rule governing students’ use of AI. Effective this summer, the AI policy prohibits students from using AI to conceptualise, outline, draft, revise, translate or edit any work submitted for credit.

It also forbids students from uploading assignments, readings, slides or class recordings into generative systems.

AI may be used solely for identifying sources such as cases, statutes or secondary materials, and students remain fully responsible for the accuracy of their research. Citations to nonexistent sources create a presumption of prohibited use.

Exceptions exist for courses specifically designed to teach AI fluency or where instructors obtain written approval to deviate from the default ban. Chris Hoofnagle, Faculty Director of the Berkeley Center for Law & Technology, explained that the AI policy aims to preserve cognitive skills central to legal education rather than to vilify AI.

Subscribe now

Previous guidelines permitted certain AI‑assisted corrections, but the rapid expansion of generative AI models prompted a reassessment.

The ban covers activities like brainstorming topics, proposing paper structures, drafting summaries of legal rules, identifying repetitive passages, polishing grammar, generating exam outlines and translating work.

The AI policy acknowledges that lawyers must eventually be conversant with AI. Many law firms already use generative tools for discovery and research.

However, UC Berkeley Law contends that students must first learn to think critically before leveraging automation; good lawyering requires “cognitive skills necessary to strategically deploy the technology”.

The school’s strict position has sparked online conversations. Supporters argue that it will protect academic integrity and prevent “AI slop,” while critics worry it may leave graduates less prepared for AI‑rich practices.

The policy’s carve‑outs may mitigate some concerns by allowing experimentation under faculty supervision.

Other law schools will watch closely to see whether such restrictions become a broader trend in legal education.

SRA Referrals for AI‑Generated Authorities

On 14 May 2026, His Honour Judge Grimshaw referred two solicitors, Kossar Qureshi and Mahmood Hussain, to the SRA after they submitted documents containing AI‑generated citations.

Hussain, a consultant at AML Legal in the West Midlands, told the court that a paralegal had helped prepare the materials; he acknowledged that he should have verified the research.

Qureshi, director of the firm, signed off on the email filing the bundle. The case, Rodney v Gee’z Micro Bar & Pitstop, involved an application for permission to appeal. The supporting documents contained incorrect case citations that appeared to have been generated by AI.

Judge Grimshaw said the growing use of AI and false authorities threatens the integrity of the justice system and called for judges to adopt a robust approach.

He described the behaviour as inexcusable and said admonishment alone would be insufficient. The skeleton argument looked as though it had been generated by AI, with phrases like “Relevance: your client was a litigant in person,” suggesting automated drafting.

Hussain accepted responsibility for the oversight and admitted that summaries from electronic research tools should have been checked before submission. Qureshi conceded she did not draft or supervise the original documents but acknowledged the seriousness of the lapse. The judge noted failures both by the individual solicitors and by firm management.

The risks of incorporating AI into legal practice without robust quality control will always exist.

Submitting fabricated authorities undermines trust in court processes and may lead to sanctions.

Regulators (such as the SRA) will need to balance accountability for lawyers with the recognition that many research tools now integrate AI.

Firms should implement protocols requiring cross‑checking of AI outputs and transparent disclosures when generative tools are used.

Leave a comment

The SRA’s investigation may prompt further guidance on acceptable uses of AI in court submissions and stricter penalties for negligence.

Bar Standards Board Guidance on AI and Other Technologies

The Bar Standards Board (BSB) issued comprehensive guidance on the adoption and use of artificial intelligence and other technologies to ensure barristers meet ethical and practice‑management obligations.

The document, effective 18 May 2026, acknowledges that AI can improve practice management and client service but emphasises the need for preparation.

It organises responsibilities by stages:

• general ethical considerations,

• competence and training,

• procurement,

• management procedures,

• duties when using AI and oversight of AI used by others.

Under “general ethical considerations,” the guidance reminds barristers of core duties to provide competent service (Core Duty 7), act in the best interests of clients (Core Duty 2), and maintain honesty and integrity (Core Duty 3).

It states that practitioners must maintain a sufficient understanding of AI to detect errors, preserve legal professional privilege and ensure accuracy when using AI tools.

Transparency is critical; barristers must disclose their use of AI when it materially affects the nature of services and ensure they do not mislead clients or the court. Because using AI amounts to outsourcing, lawyers remain personally responsible for any inaccuracies introduced by the tools.

The guidance emphasises competence and training. Barristers should obtain ongoing education on AI to understand benefits, risks and evolving legal standards.

When procuring AI systems, law chambers must establish governance frameworks, ensure confidentiality and data‑processing responsibilities are met, and adjust data policies accordingly.

The document advises record‑keeping, including maintaining AI audit logs and prompt histories, and adopting an AI policy covering acceptable uses and governance.

The BSB’s approach recognises that AI adoption is inevitable but must align with professional duties. This guidance may inform similar policies across the legal sector.

Barristers who disregard these standards risk disciplinary action, especially as courts and regulators become more attentive to AI‑related errors. Ultimately, the guidance encourages practitioners to view AI as a tool that requires careful management, rather than a substitute for professional judgment.

Minnesota’s Ban on Prediction Markets

Minnesota enacted the United States’ first law expressly banning online prediction‑market platforms, a move that sets up a conflict with federal regulators.

The Bill makes it a crime to host or advertise a system allowing wagers on future outcomes—ranging from sports and elections to entertainment and world events.

It extends the prohibition to services that help people circumvent location restrictions, such as virtual private networks.

Sites like Kalshi and Polymarket must cease operating in Minnesota or face felony charges when the law takes effect in August.

Lawmakers crafted the ban to protect residents, especially minors, from gambling risks. Representative Emma Greenman, who sponsored the measure, argued that the state should decide how to regulate wagering to safeguard public safety.

The law includes exceptions for event contracts used as insurance or for trading commodities and securities.

Subscribe now

Critics contend that the prohibition is overly broad and will drive prediction‑market activity offshore or into unregulated spaces. The

Commodity Futures Trading Commission (CFTC) has already filed a federal lawsuit seeking to block the law, asserting exclusive jurisdiction over prediction markets.

CFTC Chairman Michael Selig argued that the state ban turns lawful operators and participants into felons overnight and undermines legitimate hedging activities used by farmers and businesses.

According to the National Conference of State Legislatures, at least 14 other states are considering similar measures.

We should predict a protracted battle over whether states or federal agencies should regulate prediction markets. Most trading on these platforms relates to sports betting, which will further blur the distinction between financial instruments and gambling.

Minnesota’s law may thus become a test case for the future of event‑based trading and the scope of federal pre‑emption.

Case Note

Case: Munich Higher Regional Court, Decision of May 11, 2026
Citation: Case No. 21 U 3882/25 e, 21st Civil Division | REWIS RS 2026, 2815

Facts and Dispute

A Facebook and Instagram user sued the operator of the social networks (now Meta Platforms) in the Ingolstadt Regional Court, alleging that from 16 July 2020 onward his personal data had been unlawfully transferred to the United States and shared with U.S. authorities.

He sought damages, injunctive relief, a declaratory judgment, disclosure of information and reimbursement of legal costs. The trial court dismissed the action, and the plaintiff appealed to the Munich Higher Regional Court.

The appellate court issued an order indicating its intention to dismiss the appeal under § 522(2) of the German Code of Civil Procedure because the appeal had no prospect of success.

Legal Issue and Court’s Analysis

The primary issue was whether transfers of user data from the EU to the U.S. violated the General Data Protection Regulation (GDPR) in light of the Court of Justice of the European Union’s Schrems II decision, which invalidated the EU–U.S. Privacy Shield.

The plaintiff argued that the defendant lacked a legal basis for transfers after July 2020 and that standard contractual clauses were insufficient.

The court noted that although Article 45 GDPR was unavailable after the Schrems II ruling, Article 46 GDPR (standard contractual clauses) provided a valid basis for transfer, and Article 49 GDPR could also justify transfers where necessary for contract performance.

Subscribe now

The court emphasised that the defendant used both the 2010 and 2021 standard contractual clauses and adopted supplementary measures such as encryption and minimisation.

The plaintiff failed to contest these measures during the trial.

The court observed that an adequacy decision under the EU–U.S. Data Privacy Framework entered into force on 10 July 2023, rendering data transfers to the U.S. lawful.

It added that the defendant also could rely on the exception for transfers necessary to perform the contract because Facebook and Instagram are global services whose architecture requires data to flow between continents.

The plaintiff did not challenge this technical necessity.

Decision and Reasoning

The appellate court held that the appeal lacked merit. It concluded there was no violation of Article 82 GDPR and no infringement of the right to privacy.

Data transfers after July 2020 were valid under Article 46 GDPR and, from July 2023 onward, under Article 45 GDPR.

Supplementary safeguards and standard contractual clauses ensured appropriate protection.

The court found the claim for injunctive relief unfounded because there was no risk of repetition and transfers were now lawful. It rejected the request to enjoin processing “without consent” as too vague and lacking specificity.

The court held that the request for information under Article 15 GDPR was satisfied through a self‑service tool and that the plaintiff had not identified missing data.

Lacking a principal claim, the court also rejected claims for damages and reimbursement of legal fees.

The plaintiff was advised to withdraw the appeal to reduce court fees.

Significance

This decision clarifies that after the Schrems II judgment and before the new adequacy decision, data transfers to the U.S. could rely on standard contractual clauses supplemented by technical and organisational measures.

It confirms that once an adequacy decision is in place, transfers become lawful under Article 45 GDPR. The court also emphasised the necessity exception in Article 49 GDPR for global social‑media services, recognising that infrastructure and user connections require transatlantic data flows.

Procedurally, the case illustrates how German appellate courts may summarily dismiss appeals without oral hearings when there is no prospect of success and encourages plaintiffs to withdraw to avoid costs.

Latest Opportunities

Remote jobs in technology law

1. Senior Patent Counsel (Remote US), Unified Patents: Unified Patents is again growing its legal department, and seeks to add an experienced, registered patent attorney (find out more).

2. TKYC Analyst (Remote Canada/US), Avantia: An AI-first legal and compliance services provider. As a Transaction KYC Analyst, you will work alongside asset managers’ legal, compliance, and investment teams to help bring complex private equity deals to completion (find out more).

3. Regulatory Counsel (Remote Türkiye), Binance: A leading global blockchain ecosystem behind the world’s largest cryptocurrency exchange by trading volume and registered users. Assist with legal and regulatory matters related to financial products and services in the FinTech, crypto, and blockchain sectors (find out more).

Subscribe now

4. Product Manager (Remote Japan), BoostDraft: BoostDraft is a software engineering company that develops IDEs for documents. Currently seeking Lawyers who draft relatively standardised but long documents, such as contracts (find out more).

5. Counsel, Applied Legal Research (Remote Singapore), Centari: Centari is hiring a transactional lawyer for its Applied Legal Research team to help develop AI tools for corporate legal work, combining expertise in corporate transactions, legal analysis and generative AI product development (find out more).

Conferences, fellowships, events and calls for papers.

6. Call for Papers on the Right to Freedom of Expression in the Digital Era: Platforms, Deepfakes, Social Media, and the Public Sphere; XVIII International Natural Law Conference: The Conference will address the status of freedom of expression in a world increasingly shaped by digital platforms, AI, synthetic media, and new forms of public and private governance. (find out more).

7. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words (find out more).

8. AI, Justice and the Rule of Law (Free Course): UNESCO and the University of Oxford are offering a free self‑paced online course launched on 27 April 2026 to equip judges, lawyers and students with an understanding of how AI interacts with human rights and legal reasoning (find out more).

Final Summary

This briefing report notes that Interpol’s Operation Ramz marked a watershed moment for cross-border digital crime enforcement with more than 200 arrests, hundreds of suspects identified and victims rescued across 13 countries.

It also highlights Argentina’s reform to develop a Social Digital Twin to simulate policy outcomes using AI, while cautioning that regulators must ensure privacy, transparency and accountability.

This briefing report also scrutinises Pinsent Masons’ self-referral to the SRA after a court exposed AI-driven errors in legal submissions.

Another signpost comes from UC Berkeley Law, which imposed a strict ban on AI for coursework to preserve analytical skills amid concerns over AI hallucinations and loss of independent reasoning.

This week’s case note analyses a Munich Higher Regional Court decision upholding cross-border data transfers under the EU–U.S. Data Privacy Framework, demonstrating deference to established safeguards and rejecting claims for damages.

Leave your comments to join the conversation.

Leave a comment

This weekly briefing covers various updates and argues that technology law is no longer dealing with distant risks. AI is now appearing in cyber exploits, clinical harm, scholarly misconduct, public administration, copyright disputes, and national policy programmes. The uncomfortable lesson is that institutions are adopting AI faster than they are building credible accountability around it. Regulators, courts, publishing houses, governments, and companies are all reacting, but their responses remain uneven, fragmented, and often delayed. This edition examines why AI governance must now be treated as a practical legal discipline rather than mere public-relations “lip service.”

Newsletter Edition 97

🔥 This edition includes important technology law news and updates from the EU, Italy, Malta, the US and the UK. View the latest opportunities, including free courses, events, scholarships, and remote jobs in technology law.

Major news in Technology Law this week:

Lead Story

Google’s AI‑Powered Exploits and Cybersecurity Law

Google’s confirmation that criminals used an AI model to develop a zero‑day exploit that bypassed two‑factor authentication shows that machine‑generated offensive tools now present real‑world threats, forcing lawmakers to revisit cybercrime laws and impose duties of care on AI developers.

Google’s Global Threat Intelligence Group (GTIG) released a report describing a world-first incident of this kind.

Subscribe now

Criminals allegedly used a large language model to create a zero‑day vulnerability exploit that bypassed two‑factor authentication in an open‑source administration tool.

The Python script bore tell‑tale signs of generative AI, copious educational docstrings, a hallucinated CVSS score, and a clean, textbook style, and Google concluded that the attacker likely leveraged an AI model to discover and weaponise the vulnerability.

Google worked with the affected vendor to prevent mass exploitation, but the incident illustrates how threat actors are already using AI to automate vulnerability discovery, develop exploits and improve defence evasion.

Attackers’ use of AI

The report identifies Chinese and North Korean state‑sponsored groups actively using AI for vulnerability research and exploitation.

A China‑linked group used persona‑driven jailbreak techniques to get an AI model to act as a senior security auditor when probing embedded devices, while the North Korean group APT45 repeatedly prodded AI models to analyse CVEs and validate proof‑of‑concept exploits.

Clearly, AI is not limited to automating computational tasks; adversaries are now deliberately applying AI to accelerate the discovery and weaponisation of vulnerabilities within its ecosystem.

The threat is shifting from human‑crafted exploits to AI‑augmented campaigns with faster turnaround times and deeper target scopes.

Cybersecurity law challenges

The emergence of AI‑assisted exploits raises thorny questions for cybercrime statutes.

Laws such as the Computer Misuse Act 1990 in the UK and the Computer Fraud and Abuse Act 1986 (CFAA) in the United States criminalise unauthorised access and malicious hacking, but both rely on the premise that attacks are carried out by humans.

When AI systems autonomously discover or propose vulnerabilities, the line between tool and perpetrator blurs.

If an attacker prompts an AI to “find flaws in WebAdmin v3.2,” is the AI merely a tool or an accomplice? The CFAA, for instance, prohibits “knowingly and intentionally” accessing a protected computer without authorisation.

Does a user who pastes AI‑generated exploit code into a command shell meet this mens rea? Attribution also becomes more complex because AI‑generated scripts may lack markers that investigators use to link exploits to specific operators.

Liability for AI developers

Google’s report shows that the exploited model was likely not Gemini, but the fact remains that an AI provider trained a model capable of generating harmful code.

Under US law, Section 230 of the Communications Decency Act protects platforms from liability for user‑generated content, but this safe harbour does not plainly apply to generative code.

AI vendors should be subject to strict liability regimes akin to product liability: if a product (the AI model) is unreasonably dangerous, its manufacturer should bear responsibility.

Developers of high‑risk AI systems must also conduct security testing and impose safeguards to prevent malicious misuse.

A White House executive order on AI called for risk assessments of models above a certain compute threshold, while the EU AI Act requires providers of high‑risk AI systems to implement risk management, transparency and human oversight. The zero‑day incident underscores the need for such obligations.

Duties of care and responsible disclosure

Google’s swift collaboration with the vendor to patch the vulnerability reflects responsible disclosure practices. However, not all AI‑enabled attackers will alert vendors.

Legislators may consider imposing a legal duty of care on AI developers to monitor for harmful outputs and restrict high‑risk functionalities. This could mean rate‑limiting vulnerability‑discovery prompts, refusing to generate exploit code, or watermarking outputs for traceability.

Of course, over‑regulation could stifle legitimate cybersecurity research and hinder the development of defensive AI tools. Lawmakers, therefore, face the delicate task of balancing innovation with security.

One suggestion is to adopt safe‑harbour provisions for researchers who use AI for defensive purposes and to prohibit only certain misuse categories, such as automated exploitation or large‑scale enumeration.

Under US federal law, the CFAA remains the primary statute for prosecuting hacking, but there is growing recognition that it is ill‑equipped for AI‑driven exploits.

Legislative proposals in Congress include modernising the CFAA to explicitly cover AI‑generated malicious code and clarifying that intent can be inferred when a user knowingly deploys AI outputs to breach security.

Separately, the Digital Millennium Copyright Act of 1998 (DMCA) prohibits circumventing technological protection measures, which could apply to AI scripts that bypass two‑factor authentication. The DMCA’s safe‑harbour for research might shield some AI‑driven vulnerability testing.

Leave a comment

Internationally, the Budapest Convention on Cybercrime sets common standards but predates generative AI; its ongoing Protocol 2 negotiation may need to incorporate AI‑specific obligations.

Future directions

Given the novelty of AI‑assisted exploits, legal frameworks are still catching up. Ongoing discussions around AI liability, cyberwarfare norms, and responsible AI will likely incorporate lessons from this incident.

Technology Law

Can AI Be Criminally Liable?

Read more

a year ago · 12 likes · 8 comments · Technology Law

Expect regulators to require AI developers to implement usage monitoring, impose mandatory reporting of harmful outputs, and share threat intelligence with government agencies.

Meanwhile, courts will confront cases testing whether a person can be held liable for crimes committed using AI. These questions will shape the next decade of cybersecurity law.

Technology Law Tracker

1. AI addiction – first clinical case treated

In early May, addiction specialists in Venice treated a 20‑year‑old woman who developed a behavioural dependency on an AI chatbot. Local media reported that she was so immersed in conversations with the algorithm that she spoke almost exclusively to the bot and withdrew from real‑world interactions.

The addiction service of the Ulss 3 health authority took her into care, marking the first such case in Italy.

According to Dr Laura Suardi, head of Serd, the AI’s adaptive design, learning the user’s preferences and giving increasingly personalised responses, reinforced a pseudo‑friendship that was “the tip of the iceberg” of a wider problem.

She explained that limiting usage alone is ineffective; treatment requires psychological and psychiatric support and involves the patient’s family.

AI systems can indeed cause psychological harm, raising questions about their regulation under medical and consumer protection laws. Medical definition of addiction: Behavioural addictions, such as internet gaming or gambling disorder, are recognised in the Diagnostic and Statistical Manual of Mental Disorders (DSM‑5).

They involve compulsive engagement despite negative consequences. While “AI addiction” is not yet a formal diagnosis, the Venice case suggests that interacting with a conversational AI can satisfy criteria for behavioural addiction: impaired control, craving, and continuation despite harm.

Clinicians must therefore determine whether existing diagnostic categories suffice or whether a new classification is needed.

Healthcare providers owe patients a duty to diagnose and treat mental disorders. When an AI system causes harm, questions arise about whether the system's provider could be liable.

Under the EU Product Liability Directive, producers are strictly liable for defects that cause physical injury. Psychological harm is less clearly covered, but consumer protection laws could apply if the AI marketed itself as a well‑being tool and failed to warn users of addictive risks.

Italy’s consumer code prohibits unfair commercial practices and could be used to hold developers accountable for designing interfaces that are addictive.

2. arXiv’s one‑year ban for AI‑generated hallucinations in publications

Researchers and students widely rely on arXiv to circulate preprints.

On 15 May 2026, Thomas Dietterich, chair of arXiv’s computer science section, announced a new enforcement policy: if a submission contains clear evidence that the authors did not check language‑model output, such as hallucinated references or leftover prompts, the entire author team faces a one‑year ban, after which any subsequent submission must first be accepted by a peer‑reviewed journal.

Dietterich explained that arXiv’s code of conduct already states that authors are fully responsible for their content regardless of how it was generated; the new penalty gives that principle teeth.

Examples of “incontrovertible evidence” include:

1. Fake citations, meta‑comments such as “here is a 200‑word summary, would you like me to make any changes?” and

2. Tables containing placeholder data with instructions to the author.

Any such slip makes the entire paper untrustworthy, hence the one‑strike rule.

ArXiv’s policy responds to an explosion of AI‑generated content in scientific publishing. According to a recent study, fabricated citations have risen 12-fold since 2023; in early 2026, one in 277 papers contained at least one fake reference.

Subscribe now

The surge correlates with widespread use of language models. Such errors propagate through citations and risk infecting downstream research.

ArXiv’s volunteer moderation system is not equipped to detect AI‑generated slop at scale, so the ban targets the most egregious cases.

Researchers may worry that using AI tools could expose them to penalties. Importantly, the policy does not ban AI outright. It acknowledges that authors may use AI for drafting or editing, provided they verify the output.

The key issue is scientific integrity. Authors must represent that they have reviewed and stand behind their work.

This resonates with AI misuse in legal practice, where US and UK judges have sanctioned lawyers for citing hallucinated cases.

In legal scholarship, mis‑citations could mislead courts and policymakers.

The arXiv penalty could therefore serve as a model for law journals and courts: a clear sanction deters irresponsible AI use without stifling legitimate assistance.

3. OpenAI offers ChatGPT Plus to Malta residents for free

On 17 May 2026, Malta announced a groundbreaking partnership with OpenAI. Every citizen and resident will receive a year of ChatGPT Plus free of charge after completing an AI literacy course.

The programme, dubbed AI for All, is delivered by the University of Malta and aims to teach participants what AI is, what it can and cannot do and how to use it responsibly.

Once they finish the online course, participants receive twelve months of ChatGPT Plus at no cost, including Maltese citizens living abroad.

The Malta Digital Innovation Authority manages access, and the scheme scales as more people complete the course. Government officials said the initiative is designed to transform an unfamiliar technology into practical assistance for families, students and workers.

The partnership comes amid litigation. In March 2026, Elon Musk sued OpenAI and Sam Altman, alleging breach of the company’s founding mission. It can be speculated that offering free subscriptions helps build goodwill.

We covered the ongoing OpenAI case of Elon Musk v. Sam Altman in our previous weekly briefing lead story.

Technology Law

Weekly Briefing: Elon Musk v. Altman in Court, Meta Ads Scam, Cyber-slavery in Cambodia, Attorney in Trouble for Using Fake AI Sources

Read more

2 months ago · 17 likes · 2 comments · Technology Law

Regardless of motivations, Malta’s programme could become a template for other countries.

If successful, it may inform how countries integrate AI into education and public services.

Conversely, if data breaches or misuse occur, it could prompt calls for stronger AI governance. For now, the scheme emphasises education and responsible adoption.

Case of the Week

Parties: Meta Platforms Ireland (Fair compensation)
Court: Judgment of the Court in Case C-797/23 (CJEU)

Facts and dispute

The dispute arose from Italian legislation implementing the EU Copyright in the Digital Single Market Directive (Directive 2019/790).

The law created a system requiring online service providers to pay publishers fair remuneration for using press publications on the internet.

Under this system, service providers must negotiate payments with publishers, provide relevant usage and revenue data, and refrain from reducing content visibility during negotiations. The Italian Communications Regulatory Authority (AGCOM) can set remuneration criteria, resolve disputes, and impose penalties.

Meta Platforms Ireland (Facebook’s European subsidiary) challenged AGCOM’s implementation of the law before an Italian administrative court. Meta argued that the Italian rules exceeded what EU law allows, infringing its freedom to conduct a business and misapplying the directive.

The Italian court referred questions to the Court of Justice of the European Union (CJEU) under the preliminary ruling procedure, asking whether the Italian system is compatible with EU law.

Legal issue and question

The core issue before the court was whether EU member states may impose a compulsory remuneration scheme on platforms for the online use of press publications and require negotiations without restricting content visibility.

Does such a system go beyond the rights and obligations established by the directive?

Meta argued that requiring payment irrespective of consent conflicts with Article 15 of Directive 2019/790, which grants publishers a related right to authorise or prohibit online use. It also claimed that mandatory negotiation and data‑sharing obligations unjustifiably restrict business freedom.

Decision

On 12 May 2026, the CJEU ruled that member states may enact systems that entitle publishers to fair remuneration for the use of their publications online, provided the payment is linked to authorisation.

Publishers must have the option to refuse authorisation or grant it free of charge, and no payment may be required when a platform does not use the publication.

The Court held that obligations to negotiate, to supply usage data and to avoid reducing visibility are permissible because they support a fair marketplace for copyright and help publishers recoup their investments.

While these obligations restrict the freedom to conduct a business, the Court found the limits justified and proportionate to the objectives of intellectual property protection and media pluralism.

Wider implications

The ruling affirms that EU law allows member states to strengthen publishers’ rights beyond the minimum floor set by the directive, as long as those measures respect the core rights — namely the ability to authorise use.

It clarifies that platforms cannot be required to pay when they do not host or index press content, and that publishers may choose to license content for free.

The decision supports the CJEU’s willingness to balance property rights with business freedoms. AGCOM’s authority to set remuneration criteria, decide disputes and impose penalties is validated.

Platforms operating in Italy and other EU countries may need to negotiate with publishers and share usage data. The case is particularly relevant for news aggregators, search engines and social networks.

What about platforms like Substack?

The ruling does not automatically apply to platforms hosting user‑generated newsletters. If a platform like Substack merely hosts content uploaded by publishers themselves, it is usually authorised.

The fair compensation requirement matters only when a platform uses third‑party press publications without permission, such as by displaying previews, recommendations or summaries that reproduce substantial extracts.

Leave a comment

In such cases, Substack may need to negotiate payments under national transpositions of the directive. For ordinary linking or short excerpts, fair use exceptions may apply.

Writers posting their own newsletters remain unaffected; they are for the publisher and the authorising party.

Other Developments in Technology Law

1. The European Union ratifies the Council of Europe Framework Convention on Artificial Intelligence

On 15 May 2026, during the 135th Session of the Council of Europe’s Committee of Ministers in Chișinău, the European Union ratified the Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law.

The convention, adopted in 2024, is the first legally binding international treaty on AI.

It provides a legal framework covering the entire lifecycle of AI systems and aims to ensure that AI use is consistent with human rights, democracy and the rule of law. It promotes responsible innovation, is technology‑neutral and is open to non‑European countries.

As of now, signatories include the EU, the UK, the United States and several other non‑member states.

The convention will enter into force once five signatories, including three Council of Europe members, ratify it.

2. Automated Vehicles Act 2024 (Commencement No. 2) Regulations 2026

The UK government is gradually bringing the Automated Vehicles Act 2024 into force. The Commencement No. 2 Regulations 2026, signed on 20 April 2026, bring Part 5 of the Act (permits for automated passenger services) into effect on 15 May 2026.

Part 5 creates a permit scheme for services using automated vehicles, such as taxis, private hire cars, shuttles, and buses.

Operators must obtain permits before running such services, and future regulations will detail safety requirements, passenger protections and information sharing. Sections 84 and 89, which relate to civil sanctions, have not yet commenced.

Will this permit regime apply to Full Self‑Driving services, such as Tesla’s proposed robotaxi fleet? Not immediately. A vehicle must first be recognised as an authorised automated system under UK law.

Subscribe now

Operators would then need a permit under Part 5, satisfy safety and passenger‑protection rules and ensure that the infrastructure communicates with the vehicle.

Because the regulations are tailored to passenger services operating on defined routes and under specific conditions, widespread robotaxi services will require additional approvals. The current commencement is therefore a step toward regulatory readiness, but not a green light for full self‑driving deployment.

3. HMRC to use AI for tax fraud detection

On 14 May 2026, the UK’s HM Revenue and Customs (HMRC) awarded a £175 million, ten‑year contract to London‑based AI company Quantexa to overhaul its data infrastructure and detect tax fraud.

The contract marks a deliberate move away from reliance on American surveillance company Palantir and demonstrates the government’s desire for sovereign AI.

Quantexa’s platform will unify HMRC datasets, use graph analytics to identify patterns of tax fraud and evasion, and support customer service operations.

Quantexa founder Vishal Marria stressed that automated decisions would still require human oversight and that HMRC data would remain inside the tax authority’s environment.

Linking fragmented tax datasets could help HMRC spot hidden networks of companies and individuals, close the £46.8 billion tax gap and improve response times to taxpayers.

However, using AI in tax enforcement raises questions under the GDPR.

Automated processing of financial data constitutes profiling, and Article 22 grants individuals the right not to be subject to decisions based solely on automated processing.

HMRC asserts that humans will verify AI‑flagged cases, which may fall under the GDPR’s legitimate interests exception (Recital 47), which allows data processing for fraud prevention.

However, there remain concerns about false positives and algorithmic transparency. Misclassification could lead to withheld refunds or penalties, placing burdens on taxpayers to contest AI‑generated suspicions.

Public law principles of fairness require HMRC to provide reasons for decisions and allow appeals. The Information Commissioner’s Office may scrutinise the deployment to ensure compliance.

The contract is part of the UK’s Sovereign AI initiative, funded with £500 million to support domestic AI champions. It follows criticism that government data contracts with Palantir have exported control of sensitive information.

Subscribe now

Quantexa, a British company with early roots in anti‑money‑laundering, demonstrates that the UK aims to build its own AI infrastructure.

If successful, the deal may set a precedent for other departments, from healthcare to border control, to adopt domestic AI solutions. If the project fails or produces high false‑positive rates, sceptics will argue that only established giants can handle public‑sector data problems.

Latest Opportunities

Remote jobs in technology law

1. TKYC Analyst (Remote Canada/US), Avantia: An AI-first legal and compliance services provider. As a Transaction KYC Analyst, you will work alongside asset managers’ legal, compliance, and investment teams to help bring complex private equity deals to completion (find out more).

2. Regulatory Counsel (Remote Türkiye), Binance: A leading global blockchain ecosystem behind the world’s largest cryptocurrency exchange by trading volume and registered users. Assist with legal and regulatory matters related to financial products and services in the FinTech, crypto, and blockchain sectors (find out more).

3. Product Manager (Remote Japan), BoostDraft: BoostDraft is a software engineering company that develops IDEs for documents. Currently seeking Lawyers who draft relatively standardised but long documents, such as contracts (find out more).

4. Counsel, Applied Legal Research (Remote Singapore), Centari: Centari is hiring a transactional lawyer for its Applied Legal Research team to help develop AI tools for corporate legal work, combining expertise in corporate transactions, legal analysis and generative AI product development (find out more).

5. Legal Expert (Remote UK), YO IT: A remote‑based legal expert role advertised by a UK consultancy seeks professionals with expertise in technology law and digital regulation (find out more).

Conferences, fellowships, events and calls for papers.

6. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words. (find out more).

7. Free Microsoft Virtual Training Day: Protect Sensitive Information in the AI Era with Microsoft Purview (4 and 5 June 2026): Explore how Microsoft Purview identifies and labels sensitive data, enforces DLP policies across endpoints and cloud apps, and helps detect insider risks with Adaptive Protection. The session also covers Purview DSPM for deeper visibility into data exposure and AI interactions. Complete the training to receive 50% off the Information Security Administrator Associate exam. (find out more).

8. AI, Justice and the Rule of Law (Free Course): UNESCO and the University of Oxford are offering a free self‑paced online course launched on 27 April 2026 to equip judges, lawyers and students with an understanding of how AI interacts with human rights and legal reasoning (find out more).

Final Summary

AI regulation is quickly moving from abstract principles to concrete legal obligations. Google’s revelation of an AI‑generated zero‑day exploit shows that malicious actors are already weaponising generative AI models.

The AI addiction case reminds us that AI systems can harm psychological health, forcing lawmakers to consider mental‑health impacts when regulating digital services.

ArXiv’s one‑year ban for hallucinated references demonstrates that professional communities are willing to impose severe penalties to maintain trust.

Government initiatives, whether Malta’s national ChatGPT rollout or HMRC’s sovereign AI contract, illustrate that public‑sector adoption is accelerating despite unresolved questions about privacy, liability and fairness.

The coming years will require careful balancing of innovation with the protection of rights. Now is the time for informed, inclusive debate and for building institutions capable of governing AI responsibly.

Leave your comments to join the conversation.

Leave a comment

Newsletter Edition 96

The Honest Truth about Digital IDs

The subject of digital identity (“Digital ID”) resonates with everyone because, at some point, we have all had to prove who we are, and we will eventually need to do so more often as public life and commerce migrate into electronic systems that demand confidence in our credentials.

We need to journey through the current state of digital ID in the European Union and the United Kingdom, as they are actively developing this infrastructure. Indeed, the subject is controversial because it sits at the junction of personal autonomy, privacy, government authority and commercial convenience, but it needs to be addressed objectively.

The European Union has spent years developing a framework for digital ID wallets that emphasises user control and cross‑border compatibility, while the United Kingdom is proposing a national digital ID scheme that has triggered a widespread public debate.

In this newsletter edition, we will look at the legal frameworks, the promises of convenience and efficiency, the technical and governance innovations such as zero‑knowledge proofs, and the deep concerns about surveillance and cultural acceptance.

The European Union: The Right to a Digital Identity

The European Union laid the foundation for digital IDs with Regulation (EU) No 910/2014 on electronic identification and trust services, commonly referred to as the eIDAS Regulation. In April 2026, the Regulation was amended by Regulation (EU) 2024/1183, which created what is now known as the European Digital Identity Framework.

The legal framework establishes that everyone in the EU has the right to a digital identity under their sole control, enabling them to exercise their rights in the digital environment and participate in the digital economy. It also sets out the requirements for qualified trust service providers.

At the centre of this framework are the European Digital Identity Wallets.

These wallets allow natural (individuals) and legal persons (e.g., companies) to access services across Member States while ensuring the protection of personal data and privacy through secure digital identification.

This is an ambitious project on the surface. A common identity infrastructure that spans national boundaries, yet remains under the control of the individual, hopefully.

The official European Commission description of the Digital Identity Wallet emphasises its functionality.

The wallet is intended to enable users to access:

1. Online and offline public and private services,

2. Store and share digital documents, and

3. Create binding electronic signatures.

Member States are required to make wallets available to every citizen, resident and business by the end of 2026.

The European Commission lists numerous benefits of the digital ID wallet:

1. Easier access to services,

2. Better protection of personal data through selective disclosure,

3. Improved cybersecurity and enhanced fraud prevention.

It also indicates that everyone should always control their digital identity, and that the wallet is the means to do so. Citizens should be able to carry their digital identity with them across the EU, seamlessly crossing borders without losing control of their data.

These statements go beyond marketing and echo a European commitment to fundamental rights, data protection and interoperability.

From a legal perspective, the digital identity wallet is not a database, but a technical tool built upon principles of data minimisation and user consent.

It is important to appreciate the architecture of this system.

The wallet must support functions such as authentication, storage, selective sharing and digital signing.

This means that a user can store everything from a train ticket to a university degree certificate, share only the necessary attributes with a relying party, and provide legally binding electronic signatures.

The European Commission lists practical use cases:

1. Applying for passports or driving licences,

2. Opening bank accounts,

3. Registering SIM cards,

4. Signing contracts,

5. Claiming medical prescriptions, and

6. Carrying digital versions of travel documents.

These examples clearly show how deeply integrated the digital ID wallet is intended to become in everyday life.

The European Commission also links the digital ID wallet to other trust services such as eSignatures, eTimestamps, eSeals and qualified website authentication certificates, which are already recognised across the EU.

Each of these services reduces friction in transactions and increases security, but they also normalise the requirement to prove identity or attributes at every turn.

Implementing Acts and Technical Specifications

The EU legal framework provides high‑level requirements, but the technical details are being fleshed out through implementing acts.

These acts specify standardised rules, procedures and technical specifications. The European Commission publicly consults on these acts, emphasising transparency and allowing stakeholders to influence the design.

The Architecture and Reference Framework (ARF) sets out standards, protocols and formats for information exchange and includes an open‑source reference implementation. This ensures that Member States and service providers can build wallets that are interoperable and secure.

The ARF uses cryptographic techniques to support selective disclosure and verifiable credentials, and it accommodates future additions such as payment functionality and age verification.

One of the most innovative features being discussed is the adoption of zero‑knowledge proofs in age verification.

The European Commission advocates an anonymous age verification application that is compatible with the European Digital Identity Wallet and uses zero‑knowledge proofs.

In this model, the user does not share their date of birth with a service provider but instead provides a cryptographic proof that they fall within a certain age range.

The European Commission claims the app is completely anonymous, works on any device and is fully open source.

Critics have pointed out vulnerabilities in zero‑knowledge implementations, but the concept represents a significant attempt to reconcile privacy with regulatory compliance.

It illustrates how digital identity technology can both protect confidentiality and yet increase the prevalence of identity checks by making them easier to implement.

UK Digital Identity: The BritCard and the National Digital ID Scheme

While the EU has opted for a wallet model emphasising user control and voluntary adoption, the UK has taken a different path.

In March 2026, the UK government published a digital ID scheme explainer that describes a national digital ID stored securely on your phone.

The document says that the UK digital ID will simplify access to UK government services and private sector applications, and it will be free to download.

Employers will be required to use it as evidence of the right to work.

The roll‑out is expected to be complete by the end of this parliament.

The government promised that the police will not be able to demand to see your digital ID as part of a stop and search.

However, right‑to‑work checks and right‑to‑rent checks will become legally dependent upon the digital ID.

Unlike the EU wallet, the UK system is framed as a mandatory credential for “certain purposes”.

The explainer lists the data that will be held:

1. Name,

2. Date of birth,

3. Nationality or residency status, and

4. A photograph.

Additional information such as address may be considered.

The UK government asserts that the digital ID will improve access to public services, reduce identity fraud and toughen employment checks.

It will also streamline verification processes when opening bank accounts or proving age.

Subscribe now

Essentially, the scheme aims to make it easier to prove identity by consolidating credentials in one secure place, increase efficiency by enabling instant verification, reduce wait times for processing and allow easy updating of personal information.

The explainer shows that the system will use state‑of‑the‑art encryption and authentication technologies, storing credentials directly on the user’s device.

User control is described as central: sharing of information should be initiated by the user and the UK government pledges transparency about with whom information is shared.

The explainer also notes that millions of people in the UK lack traditional proofs of identity and that digital ID could reduce exclusion. Assistive technologies such as screen readers, voice commands and biometrics are promised to ensure accessibility.

Unlike the EU wallet, the UK digital ID is presented as a tool for immigration enforcement. The UK government states that it will be a legal requirement for employers to check a digital ID to confirm a worker’s right to work.

Only UK citizens and legal residents will be able to obtain a digital ID, thus excluding undocumented migrants from lawful employment.

The UK government frames this as a deterrent to illegal immigration. The intention to use digital IDs as an instrument of immigration control has contributed to a heated public debate and significant backlash.

The Data (Use and Access) Act and Trust Framework

Behind the scenes, the UK government is building the legal and technical infrastructure to support digital identity through the Data (Use and Access) Act 2025.

Part 2 of the Act entered into force on 1 December 2025, giving statutory footing to the UK digital identity and attributes trust framework (UKDIATF).

The trust framework sets out requirements for digital verification services (DVS) providers and includes supplementary codes and supporting documents.

In March 2026, the government released a pre‑release version of the UK digital verification services trust framework (version 1.0), along with new supplementary codes and supporting documents.

The pre‑release does not yet carry legal effect, but signals the first amendments to the UKDIATF since it became statutory.

The Office for Digital Identities and Attributes will accredit conformity assessment bodies to assess providers before full publication later in the year, and providers must comply with the existing Gamma version of the UKDIATF until 31 March 2026.

The pre‑release introduces several wholesale changes. Providers certified against version 1.0 will be able to use the new UK CertifID trust mark.

The terminology has been updated: the framework is now called the “UK digital verification services trust framework”.

New rules require holder service providers to share metadata about identities and authentication methods with relying parties. The first dedicated rules for orchestration service providers have been released, obliging them to confirm whether the services they orchestrate are on the DVS register.

Subscribe now

Providers must assess the risk posed by other providers losing certification.

Supporting documents are now version‑controlled and include guidance on delegated authority and vouching evidence. A new optional data schema has been introduced. All DVS providers must comply with inclusion and accessibility rules.

These changes may seem technical, but they reflect a maturing regulatory environment in the UK. The UK is moving from a non‑statutory trust framework to a statutory one, establishing accreditation mechanisms and codifying roles.

It is also preparing a public consultation on key issues such as, at what age individuals should get a digital ID, what information the ID should include, which government services should be priority use cases, and how to address obstacles such as digital literacy.

Notably, the consultation is structured in two phases and involves a randomly selected group of 100–120 public participants to ensure broad engagement. This approach acknowledges negative public sentiment and seeks to build legitimacy through deliberative processes.

Criticisms and Privacy Concerns

Digital ID systems promise convenience and security, but they also raise profound questions about privacy, autonomy and social control. Age verification mandates and digital trust technologies can be dangerous.

A coalition of 438 security and privacy scientists described large‑scale access control mechanisms without understanding their implications as socially unacceptable.

The European Digital Rights organisation has criticised age verification schemes for limiting young people’s rights and excluding large portions of the population while lacking effectiveness.

These criticisms extend to the digital identity wallets and age verification apps being promoted by the European Commission.

Although zero‑knowledge proofs preserve data confidentiality by proving an attribute without revealing underlying information, they can normalise constant demands for proof.

The easier it becomes for relying parties to request proofs, the more often individuals may be asked to demonstrate attributes. In this vision of the future mobile phones become keys to digital and physical spaces, reminiscent of Covid‑19 health certificates. This raises concerns about social stratification and the potential for peer policing.

A London School of Economics’ EUROPP blogpost has drawn a stark contrast between the EU’s digital wallet and the UK’s proposed BritCard.

The EU wallet is a user‑controlled data management tool that allows citizens to store credentials and share only the minimum necessary information. By contrast, the BritCard is framed as a single government‑issued credential mandatory for employment verification and immigration control.

This difference matters because citizen acceptance depends on perceived voluntariness and control. The blogpost points to the SOTERIA project, a 2024 pilot that tested a privacy‑first digital wallet with 6,500 citizens in Austria, Romania and Spain.

SOTERIA’s wallet employed selective disclosure, secured storage and high‑level identification.

Despite strong technical credentials, the results were mixed. Spanish participants in a mandatory e‑health pilot showed increased privacy control and intention to use the wallet, while Romanian participants in a voluntary e‑exam scenario reported increased perceived risks and decreased intention. Austrian participants emphasised security perception as critical.

A low number of participants would voluntarily store personal data, but more than sixty percent indicated they would reuse the tool after experiencing it once.

This suggests that initial adoption barriers may be overcome through positive experiences but that context and culture matter.

The same blogpost highlights that the UK government appears to be ignoring lessons from SOTERIA and is instead implementing a mandatory, top‑down system driven by immigration politics.

It goes further to argues that privacy by design is essential and that user control cannot be meaningful if the system is mandatory.

Security experts warn that digital IDs could become a honeypot for cybercriminals, which raises fundamental questions about the business model.

Digital identity infrastructure must be funded by someone, whether through government budgets, service provider fees or citizen payments. Each model has privacy implications because it creates an incentive to track transactions.

Following backlash, the UK has now decided not to make the digital ID system mandatory and government funded, raising concerns about surveillance and fiscal sustainability.

Europe’s more principled approach preserves the possibility of privacy‑respecting implementation, but struggles with sustainable funding. Cultural context is also significant. Britain abolished identity cards after the Second World War and has a history of resistance to national IDs. Requiring a one‑size‑fits‑all digital ID on a population historically hostile to such schemes risks failure.

Some Reflections: Identity, Power and Autonomy

Behind the technical and legal discussions lies a deeper philosophical question: what does it mean to have a digital ID?

The concept of identity has always been relational and contextual. A passport or driver’s licence does not create a person’s identity; it is a credential recognised by institutions.

In the digital realm, the same logic applies, but the possibilities for surveillance and control are vastly expanded.

A digital wallet that stores everything from educational qualifications to health data can empower individuals to prove attributes easily, yet it can also create a map of a person’s life that is accessible to whoever controls the infrastructure.

One can see these differences as manifestations of different political cultures: one rooted in rights‑based constitutionalism, the other in administrative pragmatism and law enforcement.

The adoption of zero‑knowledge proofs touches upon another emerging issue, i.e., trust.

The promise of zero‑knowledge proofs is that we can trust each other without revealing secrets. At the same time, these mechanisms make it trivial to request proofs for every interaction, which can erode trust by creating an expectation of constant verification.

Leave a comment

Paradoxically, technologies designed to enhance privacy can enable more pervasive control. This tension requires careful governance. It also raises questions about the role of private companies that provide the e-infrastructure or verification services.

In Europe, the emphasis on open standards and public consultation reflects a desire to democratise the design of digital ID systems. The UK consultation likewise attempts to involve citizens, but the nature of the scheme and its association with immigration enforcement may undermine trust.

Identity is also about belonging. In a multicultural union such as the EU, a digital wallet can symbolically unite citizens by providing a standardised credential that works across borders. This fosters a sense of European citizenship.

In the UK, the digital ID is explicitly used to exclude those who are deemed to have no right to work. This highlights how identity documents can be used both to include and to exclude.

The challenge is to design systems that recognise individuality and autonomy while preventing exclusion and discrimination.

The EU’s insistence that digital identity is a right, not an obligation, reflects this aspiration.

Whether Member States will implement this in a way that respects cultural differences and local norms remains to be seen.

Table: Comparing EU and UK Digital Identity Frameworks

The table illustrates the fundamental differences between the EU and UK approaches.

The EU emphasises decentralisation, selective disclosure and voluntary use. The UK proposes a centralised credential that is mandatory for employment, raising concerns about consent and surveillance.

Both systems rely on legislation and technical standards, but they embed different assumptions about identity and governance.

Myths, Mysteries or Monstrosities?

Throughout debates about digital identity, we encounter myths. One myth is that digital identification is purely a technical matter. In reality it is profoundly political and social. Technology choices embed values. The decision to use zero‑knowledge proofs, for example, establishes a commitment to data minimisation, but the absence of an obligation to use such proofs in the EU’s eIDAS 2.0 regulation suggests that not all Member States are ready to commit.

Another myth is that digital ID will automatically reduce fraud and improve efficiency. It might do so, but it also increases the attack surface for cybercriminals and may centralise valuable data.

A third myth is that government funding eliminates the need to think about business models. Funding mechanisms can create incentives for data monetisation.

Subscribe now

The mystery lies in how these systems will evolve once deployed. Will voluntary EU wallets become ubiquitous, or will they coexist with national e‑ID schemes?

Will the UK’s digital ID foster trust or provoke resistance? These questions cannot be answered definitively, but we can examine early signals.

The EU’s emphasis on consultation and iterative design suggests flexibility. The UK’s focus on enforcement may face cultural headwinds.

You will be within your rights to consider the UK’s digital ID roll-out as a monstrosity because they conjure images of total surveillance or dystopian control. Such language is understandable given the stakes.

However, it is more constructive to recognise that digital identity is a tool. Like any tool, it can be used to empower or to control. Its impact depends on legal safeguards, technical design, cultural acceptance and political accountability.

Monstrosity arises not from the technology itself, but from the imbalance of power it can facilitate.

A mandatory ID tied to employment and immigration status without robust privacy protections can become a mechanism of exclusion.

An optional wallet with granular consent can enhance convenience and autonomy. The challenge is to design and govern digital identity in a way that respects individual rights, supports social cohesion and fosters innovation.

As we stand at this inflection point, it is imperative to engage critically and philosophically with digital identity.

We must consider how these systems affect autonomy, equality, trust and belonging.

We must ask how they interact with cultural histories and political priorities.

We must also recognise that technology alone cannot resolve the dilemmas of identity; governance, accountability and public deliberation are essential.

Our hope is that this exploration will encourage you to think deeply about digital identity, to engage with the consultations and debates, and to demand systems that enhance rather than diminish our collective freedoms.

Only through informed and thoughtful participation can we ensure that the mysteries and myths around digital ID do not become monstrosities.

What are your thoughts about the imminent roll-out of digital IDs in the EU and UK? Please share your thoughts in the comment section.

Leave a comment

Share this newsletter

Technology law is entering a more confrontational phase. Governments are no longer treating AI as a neutral productivity tool but as a system capable of influencing constitutional rights, criminal investigations, healthcare, public trust, and democratic authority itself. This edition examines the EU’s decision to delay parts of the AI Act while expanding prohibitions, Canada’s findings against OpenAI’s data practices, the constitutional implications of geofence warrants before the U.S. Supreme Court, and the growing normalisation of AI within policing and surveillance institutions. Greece’s proposal to constitutionalise AI oversight and the UAE’s expansion into AI-driven legal services.

Share this newsletter

Newsletter Edition 95

🔥 This edition includes many important technology law news and updates from the EU, U.S., Canada, U.A.E, Greece and other jurisdictions. Also, keep reading to view the latest opportunities, including free courses, events, scholarships, and a list of remote tech lawyer jobs.

Lead Story

EU leaders agree to amend the EU AI Act: Deal reached on the AI Omnibus Regulation

On 7 May 2026, the Council of the European Union and the European Parliament announced a provisional political agreement to amend the EU AI Act.

The amendments, negotiated as part of a digital omnibus package, do not alter the AI Act's underlying structure but adjust the timelines for certain obligations and tighten prohibitions on specific AI practices.

Key elements of the provisional agreement

• Deferred application of high‑risk obligations. Under the current AI Act, high‑risk obligations for use cases listed in Annex III, such as biometric identification, critical infrastructure, education, employment, law enforcement and border management, would apply from 2 August 2026. The provisional agreement pushes these obligations to 2 December 2027, giving additional time for implementation. AI components that are safety parts of sectoral products (Annex I) will now be enforced from 2 August 2028, rather than 2 August 2027. These dates are fixed regardless of the availability of harmonised standards.

• Watermarking and generative AI output detection. A new deadline of 2 December 2026 will apply to generative AI providers obligated to detect and watermark AI‑generated content. This postponement aims to align with the development of technical tools and standards while ensuring that generative systems remain traceable.

• Prohibition of “nudifier” apps and AI‑generated child sexual abuse material (CSAM). The agreement explicitly bans AI systems that generate non‑consensual intimate imagery or CSAM. Providers must comply with this prohibition by 2 December 2026. The ban addresses concerns over tools that digitally remove clothing or synthesise exploitative images without consent.

• Registration and transparency requirements. Providers of “exempted” AI systems — systems originally classified as high‑risk but deemed low risk through derogations — must continue to register their models in the EU’s public database, albeit with simplified information requirements. Meanwhile, high‑risk providers still need to conduct conformity assessments, maintain documentation and provide risk management systems.

• Bias detection using sensitive data. The amendment broadens the scope for using sensitive personal data (for example, data revealing racial or ethnic origin) to detect and correct biases in AI systems, but processing must be strictly necessary and limited to addressing specific bias types. This reflects the EU’s recognition that accurate bias detection sometimes requires access to sensitive attributes.

• Other clarifications. The omnibus removes overlapping obligations for AI embedded in machinery products, narrows the concept of “safety components” and centralises enforcement of certain general-purpose AI systems under the EU AI Office. It also reduces the volume of information required for registration and tasks the Commission with issuing guidance on classification.

What are the implications of these changes?

The provisional agreement preserves the EU’s risk‑based framework while giving organisations more time to prepare for high‑risk obligations and generative AI watermarking.

Subscribe now

The explicit ban on “nudifier” tools and AI‑generated CSAM shows regulators taking a firm stance on preventing abuse.

The deferral should not be seen as a reprieve; organisations developing or deploying AI must continue building compliance programmes and documenting risk management.

Once finalised and formally adopted, these amendments will mark the first major adjustment to the world’s most comprehensive AI regulation.

Technology Law Tracker

1. Department of War releases UFO and UAP files: what does space law say

On 8 May 2026, the U.S. Department of War (DoW) published more than 160 previously classified files related to unidentified anomalous phenomena (UAP) and unidentified flying objects (UFOs).

The release follows President Donald Trump’s directive to increase transparency about UAPs and directs the DoW, in collaboration with the Office of the Director of National Intelligence, to declassify unresolved cases.

The files include photographs, videos and transcripts of Apollo missions. Notably, they capture, among other things, an alleged 1947 report of “flying discs” and transcripts from Apollo 12 and 17, where astronauts observed bright particles and unusual phenomena.

The DoW emphasised that these cases remain unresolved because they lack sufficient data for definitive conclusions, and it invited private‑sector researchers to examine the materials.

Although some commentators and enthusiasts hoped that the release would confirm extraterrestrial life, the files provide no conclusive evidence of alien technology.

Critics have suggested the release may deflect attention from terrestrial military spending or other policy issues.

Nonetheless, the disclosure presents a useful moment to revisit international space and technology law.

Space law context

The Outer Space Treaty of 1967, the foundation of international space law, outlines several principles relevant to UAP disclosures. It stipulates that the exploration and use of outer space must benefit all countries; outer space and celestial bodies cannot be appropriated by states; and activities must be conducted for peaceful purposes.

States are responsible for national space activities and liable for damage caused by their space objects. The treaty also emphasises the need to avoid harmful contamination and to recognise astronauts as envoys of mankind.

If future evidence shows that UAPs originate from human technology (for example, secret military spacecraft), questions could arise about compliance with the treaty’s prohibition of weapons of mass destruction in orbit and the requirement that celestial bodies be used exclusively for peaceful purposes.

Conversely, if extraterrestrial origin were ever substantiated, states would need to consider how the “province of all mankind” principle applies to contact with non‑state entities.

The release, therefore, encourages jurists to think beyond speculation and to consider whether existing frameworks adequately regulate unknown phenomena.

Transparency and governance

The DoW’s release also highlights how governments balance national security with public interest. The files were previously withheld due to classification. Transparency advocates argue that withholding information can fuel conspiracy theories and undermine trust.

Declassifying unresolved phenomena carries its own risks: adversaries could infer U.S. surveillance capabilities, or citizens could misinterpret ambiguous data. Future disclosures may require international coordination to ensure that released information aligns with obligations under space treaties and fosters collaborative research rather than unilateral narratives.

2. Greece proposes a constitutional amendment on AI

Greece, historically known as the birthplace of democracy, has proposed a constitutional amendment that would explicitly mention artificial intelligence.

Prime Minister Kyriakos Mitsotakis explained that the amendment aims to ensure that AI serves human freedom and social prosperity, while mitigating risks. He emphasised that AI should not undermine individual rights, democratic processes or equal access to public services.

Leave a comment

Why a constitutional amendment?

For years, governments, including the EU, have approached AI regulation through the lens of consumer protection, including mandating transparency disclosures, creating risk categories and imposing fines for non‑compliance.

Greece’s proposal goes further by positioning AI as a matter of constitutional order. This reflects an emerging consensus that AI is not just a consumer product but a public governance tool.

AI systems influence elections, policing, welfare administration, tax systems and border control. When AI begins to impact state power, fundamental constitutional principles (dignity, proportionality, equality and due process) become relevant.

Constitutions are designed to restrain power and protect individuals; in the digital age, this restraint must cover both government use and private platforms that operate as gatekeepers of information.

Details of the proposal

Although the exact text of the amendment has not been finalised, it will likely include a clause stating that AI must respect human dignity and fundamental rights and that Parliament may regulate AI to protect democratic order.

Greece is already experimenting with AI in border surveillance, tax administration and other public services.

Lawmakers hope that embedding AI principles into the constitution will provide a foundation for future legislation and judicial interpretation.

Global implications

If adopted, Greece’s constitution would be among the first to explicitly address AI. It could influence discussions within the EU and beyond.

For example, the EU’s AI Act regulates AI through ordinary legislation; a constitutional clause adds an additional layer of protection that cannot be easily amended.

3. Joint investigation into OpenAI’s data processing practices

Canada’s privacy regulators have been at the forefront of scrutinising large AI models. On 25 April 2026, the Office of the Privacy Commissioner of Canada (OPC), along with the privacy commissioners of Québec, British Columbia and Alberta, released a joint report on their investigation into OpenAI’s data practices.

The investigation began with a complaint regarding ChatGPT’s handling of personal information during training and in user interactions.

Key findings

OPC concluded that OpenAI’s initial training of ChatGPT contravened Canadian privacy law. OpenAI collected and used personal information from publicly accessible websites without valid consent and did not provide sufficient transparency about its practices.

According to the report, OpenAI lacked a legal basis under federal and provincial laws for processing personal data. The investigation also criticised OpenAI for failing to adequately address accuracy and accountability issues, such as providing users with incorrect or biased information.

Subscribe now

OpenAI cooperated with the investigation and implemented several measures throughout the investigation. These include limiting the use of personal information in training, removing sensitive data from datasets, publishing a blog post about privacy practices, retiring older models such as GPT‑3.5 and 4, and improving procedures for individuals to challenge inaccurate outputs.

OpenAI also committed to implementing additional measures in the coming months, such as better consent mechanisms and data retention policies.

The Privacy Commissioner of Canada found the complaint well‑founded but conditionally resolved because the corrective measures addressed the primary concerns.

Québec’s commissioner emphasised that implied consent is inadequate when the collection or use of information is outside individuals’ reasonable expectations, involves sensitive data or creates a meaningful risk of harm. The regulators concluded that modern privacy laws need to catch up with generative AI models and called for legislative reform.

What do AI developers need to do?

Training AI models on public data does not automatically exempt organisations from privacy obligations. Consent must be meaningful, and individuals should have mechanisms to verify, correct or delete their data from training datasets.

Organisations operating in multiple jurisdictions face a patchwork of privacy laws; Canada’s case shows that provincial commissioners can jointly investigate AI developers and impose compliance commitments.

Developers should build privacy into their designs, minimising data collection and ensuring explicit consent where required.

Case of the Week

Litigants: United States v. Chatrie
Citation: 136 F. 4th 100 (4th Cir. 2025), cert. granted, 2026 WL 120676 (U.S. Jan. 16, 2026) (No. 25-112)

Facts and dispute

On 8 July 2019, a bank in Richmond, Virginia, was robbed. As part of their investigation, police obtained a “geofence warrant” compelling Google to provide information on all devices that had been within a 150‑metre radius of the bank around the time of the robbery.

Google responded with anonymised location data for dozens of devices. Investigators then asked Google to expand the time frame and requested more specific data on nine accounts (Step 2), followed by subscriber information for three accounts (Step 3) that matched suspect movements. Police identified Okello Chatrie as one of the device owners and charged him with robbery.

Subscribe now

Chatrie moved to suppress the evidence, arguing that the geofence warrant violated the Fourth Amendment. The U.S. District Court for the Eastern District of Virginia agreed that the warrant was overly broad because it gathered data on many innocent individuals and allowed investigators to narrow results without judicial oversight.

However, the court declined to suppress the evidence due to the “good faith” exception.

On appeal, a divided panel of the Fourth Circuit held that Chatrie lacked a reasonable expectation of privacy in his location data because he voluntarily carried a smartphone and had location services enabled. The full Fourth Circuit was evenly split en banc, leaving the panel decision intact.

Legal issues and questions before the Supreme Court

The central question was whether geofence warrants, which compel companies to disclose location data for all devices in a defined area during a specified time, satisfy the Fourth Amendment’s probable cause and particularity requirements.

Traditionally, warrants must specify the person or place to be searched and the items to be seized. In the Chatrie case, the warrant targeted an area and time period rather than a particular suspect. It could be argued that it functioned more like a general warrant by casting a digital dragnet over dozens of individuals. Supporters may counter that geofence warrants are a necessary investigative tool in the digital era and that anonymisation, combined with judicial oversight, minimises intrusions.

It is anticipated that the court may issue a narrow ruling focusing on whether additional judicial oversight is needed during the multi‑step narrowing process rather than banning geofence warrants outright.

The multi‑step process—where investigators request anonymised data, then expand or narrow the time frame, and finally seek subscriber information—may be seen to lack separate warrants or judicial review after the initial authorisation.

The Court may address whether each step constitutes a separate search requiring independent probable cause and whether general warrants are permissible in the digital context.

Decision and potential impacts

At the time of writing, the Supreme Court has not issued its decision. If the Court upholds the warrant, law enforcement agencies will continue to use geofence warrants with minimal changes.

However, if the Court rejects the warrant as unconstitutional, it could limit or eliminate the use of geofence warrants nationwide. This would require law enforcement to develop alternative investigative methods and may lead to new privacy protections for location data.

Leave a comment

A narrow decision might require courts to oversee each step of a geofence search, ensuring that investigators cannot unilaterally narrow or expand data sets without additional warrants.

Such a ruling could also impact other general data warrants, such as those for cell‑site location information or IP addresses. Regardless of the outcome, Chatrie will likely shape the future of digital privacy law and clarify how constitutional protections apply to novel surveillance techniques.

Other Developments in Technology Law

1. Ashley MacIsaac sues Google over AI Overview mix‑up

Canadian fiddle virtuoso Ashley MacIsaac filed a defamation lawsuit against Google after the company’s AI Overview product falsely asserted that he had been convicted of sexual crimes.

According to the statement of claim, AI Overview summarised search results by saying MacIsaac had committed sex crimes and was convicted of sexual assault; the information was entirely false and not present in the sources that the AI summarised. MacIsaac learned of the defamatory statement when a concert venue cancelled a performance and later discovered that the AI system repeated the false allegations across various queries.

The lawsuit seeks at least USD 1.5 million in damages. MacIsaac’s lawyers argue that Google should be held liable for the statements generated by its AI because the system functions as a publisher and presents its outputs as factual summaries.

Google responded that AI Overviews are dynamic and automatically generated. Google eventually removed the erroneous summary and said it uses such incidents to improve its models.

The case raises questions about whether AI companies can be liable for defamation when their models produce false statements based on training data.

It also illustrates how AI summarisation tools can amplify inaccuracies and cause reputational harm. Courts will somehow need to consider whether existing defamation law applies to machine‑generated speech and whether AI providers have a duty to pre‑screen outputs for accuracy.

2. UAE’s AI‑powered legal platform Legaline launches

Dubai‑based Legaline, launched on 6 May 2026, touts itself as the first full‑cycle AI‑native legal services platform in the United Arab Emirates. The company developed its own AI stack using in‑house machine‑learning and neural‑network engineering and built a corpus of more than 60 000 searchable legal passages.

Legaline is designed for the complex UAE legal environment, covering federal laws, seven emirate‑level systems, the Dubai International Financial Centre (DIFC), the Abu Dhabi Global Market (ADGM) and more than 40 free zones. Its AI supports research across 33 jurisdictions and offers real‑time translation among English, Russian and Arabic.

The platform combines multiple tools: a public AI information assistant called “Baby Legal Bot” that helps users understand regulatory jurisdictions; an AI research assistant for lawyers with inline citations; an AI deliberation tool called “Brainstorm” that uses different foundation models to generate analytical diversity; and an automated document drafting module generating commercial documents within seconds while including references to current laws.

Subscribe now

Legaline also integrates an end‑to‑end workflow where clients post tasks, lawyers bid through a closed auction, negotiation and signing occur in an in‑app chat, and payment is held in escrow until completion. The company emphasises that its AI tools are trained exclusively on primary UAE legal sources and that user data is not used to train models.

3. Kash Patel and the normalisation of AI in law enforcement

FBI Director Kash Patel has become a prominent advocate for AI in law enforcement. In a recent interview, he claimed that AI was not used at the FBI until the current administration and that he is now “using it everywhere.”

Patel credited AI with stopping a potential school shooting in North Carolina and another in New York by quickly analysing tips and triaging threats. He also said AI has enabled the FBI’s National Threat Operations Center to sift through thousands of weekly tips and to “pop fingerprints immediately” in its criminal databases.

According to Patel, the FBI has embedded major tech companies into its infrastructure to build AI tools and modernise its systems.

While Patel portrays AI as a force multiplier, his comments illustrate a broader trend which is the rapid integration of AI into law enforcement without broad public deliberation.

The ability to triage tips and match fingerprints quickly can help prevent crimes, but it also raises concerns about due process, bias, accountability and transparency. When AI tools screen large volumes of data, there is a risk of false positives that can lead to unwarranted scrutiny.

Many predictive policing systems have been shown to reflect and magnify existing biases in data.

Critics worry that normalising AI in law enforcement could entrench opaque surveillance techniques and reduce human oversight.

Technology Law

Predictive Policing Is Making Marginalised Communities Live Under Permanent Suspicion

Predictive policing has turned suspicion into a routine administrative category that follows people long before any conduct occurs, and it is astonishing how easily this practice has been accepted as a normal feature of public safety. The idea that an algorithm can pre-assign risk to entire neighbourhoods and individuals has been absorbed into policing …

Read more

7 months ago · 16 likes · 7 comments · Technology Law

The U.S. legal framework has not kept pace with AI’s proliferation in policing. Unlike sectors such as healthcare or finance, law enforcement often employs AI without sector‑specific regulation. Chatrie v. United States, discussed above, indicates how new surveillance methods challenge constitutional protections.

Democratic institutions must examine whether traditional oversight mechanisms suffice. Questions include: should AI‑generated leads be subject to judicial review before action is taken? How can agencies ensure that training data does not encode racial or socio‑economic bias? How should AI vendors be vetted for law enforcement use? Policy makers must engage with these issues to avoid normalising AI surveillance without legal safeguards.

Latest Opportunities

Remote jobs for lawyers

1. Enterprise Account Executive DACH, Legal Tech, €80k base + 100% OTE (Remote Germany): DACH region Enterprise Account Executive to lead enterprise sales strategy, contract negotiations, and customer growth (find out more).

2. Counsel, Applied Legal Research (Remote Singapore): Centari is hiring a transactional lawyer for its Applied Legal Research team to help develop AI tools for corporate legal work, combining expertise in corporate transactions, legal analysis and generative AI product development (find out more).

3. Legal Expert (Remote UK): A remote‑based legal expert role advertised by a UK consultancy seeks professionals with expertise in technology law and digital regulation (find out more).

4. Junior/Mid AI Legal Specialist, EverAI (Remote UK): This role is aimed at lawyers or legal specialists interested in AI governance and product support (find out more).

Conferences, fellowships, scholarships, and calls for papers

5. Full scholarship (PhD & Postdoc): AI, medical law and ethics (The University of Amsterdam, Netherlands): Two fully funded PhD positions and one postdoctoral role in AI, medical law and ethics. Projects cover generative AI in healthcare and fairness in medical AI. Applications closes 18 May 2026, with a September 2026 start (find out more - PhD and Postdoc).

6. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words. (find out more).

7. Free Microsoft Virtual Training Day: Introduction to Azure (18 May 2026): Microsoft’s free virtual event offers a foundational overview of cloud concepts, core Azure services across compute, networking, storage and identity and demonstrates AI tools. Participants who complete the session receive a 50 percent discount on the Azure Fundamentals certification exam (find out more).

8. AI, Justice and the Rule of Law (Free Course): UNESCO and the University of Oxford are offering a free self‑paced online course launched on 27 April 2026 to equip judges, lawyers and students with an understanding of how AI interacts with human rights and legal reasoning (find out more).

This edition of weekly briefing highlight a growing problem between innovation and regulation.

Europe is attempting to reform its AI Act to balance technological progress with fundamental rights, while Greece proposes embedding AI principles into its constitution. Canada’s regulators are reprimanding AI developers that privacy obligations apply even when data is publicly available.

AI is gradually becoming pervasive, but we must insist that it serves human dignity, accountability and the rule of law.

Leave your comments to join the conversation.

Leave a comment

Disclaimer

This newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the authors alone.

This week’s briefing report examines the Musk v. Altman dispute over AI governance and organisational restructuring; regulatory failures exposed by South Africa’s withdrawal of its AI policy; Cambodia’s aggressive cybercrime response to cyber-slavery; and rising sanctions for AI-generated legal errors, revealing systemic weaknesses in oversight, incentives, and professional responsibility.

Share this newsletter

Newsletter Edition 94

🔥 This edition includes many important technology law news and updates. Also, keep reading to view the latest opportunities, including free courses, events, and a list of remote tech lawyer jobs.

Lead Story

Elon Musk v. Altman: the case so far

The courtroom battle between Elon Musk and OpenAI’s co‑founder, Sam Altman, has captivated observers of AI and corporate governance. Elon, who invested tens of millions of dollars in the early days of OpenAI, claims that the organisation betrayed its charitable mission by spinning out a for‑profit arm and selling equity to investors.

At stake is not only the fate of a generative‑AI powerhouse, but also questions about donor intent and the governance of technology nonprofits.

Background and legal claims

Elon co‑founded OpenAI in 2015 as a nonprofit research lab, pledged to develop artificial intelligence for the benefit of humanity. Elon Musk and other donors, including Peter Thiel and Reid Hoffman, contributed funds with the understanding that OpenAI would remain non‑profit and open.

As computing demands grew, the board created a for‑profit subsidiary in 2019 and allowed investors to purchase capped equity. The restructure attracted billions of dollars from Microsoft and other investors, enabling OpenAI to build large language models such as GPT‑4.

Elon alleges the shift to a for‑profit entity violated the original charter and seeks the removal of Altman and unwinding of the structure. OpenAI counters that Musk knew about the plan and that the restructure was necessary to fund the expensive research.

Leave a comment

What are the economic stakes?

The case could impact OpenAI’s valuation, which climbed to roughly $80 billion after recent funding rounds. A judgment in Elon Musk's favour could force the organisation to revert to a nonprofit model or return donor funds, potentially derailing its initial public offering.

It has been noted that the cost of training cutting‑edge AI models can exceed hundreds of millions of dollars, making purely charitable funding impractical. This case reinforces the tension between mission and commercialisation.

While Elon Musk contends that AI safety requires nonprofit stewardship, Altman argues that the investment structure allowed them to compete with corporations such as Google and Meta.

What happened in court?

During the first week of the trial, the judge repeatedly emphasised that the case was about alleged deception. Elon Musk’s team attempted to argue that unrestricted AI posed an existential threat, but the judge directed them to focus on whether Musk had been misled about the restructure.

Elon testified that he discovered the for‑profit arm only after the fact and that he never consented to it.

Under cross‑examination, however, lawyers presented emails suggesting Elon was aware of the new structure. Elon also admitted that his new company, xAI, uses OpenAI models and described his company as socially beneficial.

The defence argued that Musk left the board before the restructure and that he previously praised hybrid models similar to those adopted by competitor Anthropic.

Wider implications

The trial has become a proxy battle over AI governance. It is natural to worry that a sweeping verdict could discourage philanthropy in cutting‑edge science/tech if donors can later unwind corporate decisions.

On the other hand, nonprofit advocates argue that donors have a right to ensure their contributions are used as promised.

The case also surfaces conflicts of interest: Elon Musk now heads xAI, a competing AI company, and has indicated he would invest personally if OpenAI remains nonprofit.

This trial could open the door to similar claims by other donors and test whether creative corporate structures, such as capped‑profit entities, can satisfy charitable obligations.

Subscribe now

What happens next?

The trial is expected to last several weeks (or months), with testimony from Altman, board members, and experts on charitable law. Even if Elon prevails, it is unlikely the court will unwind the entire restructuring, as investors, including Microsoft, may negotiate settlements.

If Altman’s camp wins, it could strengthen hybrid models for AI research and solidify OpenAI’s path to a public offering.

Regardless of the outcome, the case will shape conversations about governance of AI labs and the responsibilities of tech philanthropists.

Technology Law Tracker: Other Significant Updates

1. Meta: a playground for scammers?

A class‑action complaint filed by the Consumer Federation of America (CFA) accuses Meta Platforms of turning its social media advertising system into what plaintiffs call a “pillar of the global fraud economy.”

The lawsuit, filed under Washington, D.C.’s consumer protection law, alleges that between 2021 and 2023, consumers lost at least 2.7 billion US dollars to scams on platforms like Facebook and Instagram.

Internal documents cited in the complaint purportedly show that Meta managers knew that a significant percentage of advertising revenue came from scam or high‑risk advertisers and that the company charged those advertisers higher rates rather than banning them.

The CFA claims Meta calculated that more than one-third of scam victims interacted with ads on its platforms and that the company collected around 16 billion US dollars from scam and banned‑goods ads during the period.

The lawsuit alleges that Meta publicly promoted its anti‑scam efforts while privately deeming certain advertisers “high value accounts” and granting them special leniency; such accounts could accumulate hundreds of strikes before being removed, whereas small advertisers were blocked after eight violations.

The plaintiffs argue that Meta’s advertising policies created a perverse incentive by profiting from fraud while diminishing consumer trust.

Leave a comment

They seek damages, punitive damages, and an injunction to reform the company’s advertising practices. Meta has not publicly commented on the details, but the case highlights the legal risks for online platforms whose revenue models rely heavily on targeted ads.

Regulators and consumer advocates view the complaint as a test of how consumer protection laws apply to digital advertising and of social media companies' responsibilities to police fraud.

2. The South African government withdraws its AI policy because of AI-generated content

South Africa’s government withdrew its draft national AI policy after journalists discovered that parts of the document were generated by AI and cited fake research.

The draft AI Policy included references to nonexistent journals and misattributed articles, revealing a failure of human oversight.

Communications minister Solly Malatsi acknowledged that unverified citations compromised the policy’s integrity and said that those responsible would face consequences.

The AI policy aimed to establish a National AI Commission, an ethics board and a regulatory authority, while offering tax incentives and grants to promote AI development. However, the reliance on AI‑generated text raised questions about authenticity and transparency.

The incident is worrying, exposing how easily generative AI content can produce plausible, but false references and how governments must verify sources before publishing.

Policy development agencies should emphasise information integrity, accountability, and human oversight. AI hallucinations can quickly undermine trust in governance and highlight the risk of embedding errors into future regulations.

The government has promised to revise the policy with proper vetting, setting an important lesson for policymakers: AI tools can assist research, but cannot replace careful human scrutiny.

3. Cambodia targets scam compounds with new cybercrime law

Cambodia’s parliament approved a cybercrime law aimed at dismantling scam compounds that have enslaved tens of thousands of people and lured victims worldwide with romance scams and bogus cryptocurrency schemes.

Authorities estimate that up to 150,000 people have been forced to work in these compounds, which are often run by transnational organised crime syndicates.

The new law makes online scams punishable by prison terms of two to five years and fines up to 125,000 US dollars; for operations involving multiple victims or gangs, the penalties rise to 10 years and 250,000 US dollars; ringleaders who traffic or torture workers face up to 20 years and fines up to 500,000 US dollars.

Subscribe now

The U.S. Department of Justice reports that scam centers across Southeast Asia coerce workers into conducting fake investment schemes, often operating through encrypted messaging apps and websites.

The DOJ’s Scam Center Strike Force recently charged Chinese nationals who managed a cryptocurrency fraud compound and seized a Telegram channel that recruited victims. U.S. officials estimate the strike force has frozen more than $ 700 million in funds linked to scams.

Cambodia’s law complements these international efforts by criminalising scam operations, providing legal tools to prosecute traffickers, and mandating support for victims. We hope the legislation will deter abuses and restore Cambodia’s reputation, though effective enforcement and cooperation with foreign partners will be essential, of course.

Case of the Week

Litigants: Couvrette v. Wisnovsky et al
Citation: No. 1:2021cv00157 - Document 227 (D. Or. 2026)

Background

Couvrette v Wisnovsky originated as a dispute among members of an Oregon family that owns Valley View Winery. The plaintiffs accused their relatives of breaching fiduciary duties and mismanaging trust assets.

As litigation progressed, plaintiffs’ counsel used generative‑AI tools to draft three summary judgment briefs. These filings included 15 nonexistent case citations and eight fabricated quotations, leading the court to sanction the lawyers for misusing AI.

Sanctions and fee awards

In a December 2025 order, U.S. Magistrate Judge Clarke held that the misrepresentations amounted to a failure to comply with the court’s local rules and the attorneys’ duty of candor.

The judge imposed a $15,500 penalty on pro hac vice counsel Michael Brigandi for the false citations and ordered defendants to file a motion detailing reasonable attorney’s fees and costs.

Clarke emphasised that lawyers cannot delegate their professional responsibility to verify the accuracy of citations to artificial intelligence and described the errors as part of a pattern of disregard for procedural rules. The court also vacated the withdrawal of local counsel Michael Murphy and instructed him to show cause why he should not be sanctioned.

In March 2026, the court granted the defendants’ motion for fees and costs. The court records show that the judge awarded approximately 94,704 US dollars in attorney fees and costs: 80,498.72 US dollars against Brigandi and 14,205.66 US dollars against Murphy.

The order further required Murphy to file the opinion with any future pro hac vice motions and noted that he failed to meaningfully participate as local counsel.

Combined with the earlier penalty, the monetary sanctions exceed 110,000 US dollars, making it one of the most significant AI‑related content hallucination sanction orders in U.S. courts.

Legal issue

The key legal question was whether the attorneys violated professional rules by submitting briefs with fabricated authorities and whether local counsel sufficiently supervised pro hac vice counsel.

The court held that attorneys cannot rely on AI tools without verifying their output and that local counsel must review all filings prepared by out‑of‑state lawyers. The court treated the attempt to file corrected briefs as part of the misconduct, not a cure, and dismissed the plaintiffs’ claims with prejudice.

The significance of this case

Couvrette v Wisnovsky exposes the ethical risks of generative AI in legal practice. Courts are increasingly sanctioning lawyers for citing hallucinated cases, reminding practitioners that AI may assist research but cannot replace professional judgment.

The case also highlights local counsel's responsibility to supervise filings; they cannot serve merely as names on a docket.

The significant monetary sanctions show that courts will impose meaningful penalties to deter misuse and protect the integrity of judicial proceedings. AI‑assisted tools will become commonplace; lawyers must implement robust verification processes and maintain accountability to avoid similar embarrassing outcomes.

Other Developments in Technology Law

1. A decade of the GDPR

Last week marked the 10th anniversary of the General Data Protection Regulation (GDPR), adopted on 27 April 2016. The GDPR codified clear rights for individuals, such as access, erasure, and data portability, and established the European Data Protection Board (EDPB) to coordinate cross-border enforcement.

Over the past ten years, national data protection authorities have used the regulation’s “one‑stop shop” mechanism to cooperate on large‑scale cases. The EDPB notes that the GDPR now interacts with the Digital Services Act, Digital Markets Act and AI Act, providing a foundation for a broader digital regulatory ecosystem.

2. Microsoft’s Legal Agent enters Word

On 30 April 2026, Microsoft introduced a “Legal Agent” for Word through its Frontier early‑access program. Unlike general chatbots, the Legal Agent follows structured workflows tailored to how lawyers work.

Microsoft explains that legal documents require precise clause analysis, redlining and adherence to internal policies. To meet these needs, the agent uses deterministic insertion layers rather than free‑form text generation.

Subscribe now

It can review contracts against playbooks, suggest redlines with tracked changes and provide citations for each recommendation. The legal agent operates within the Microsoft 365 security and compliance framework.

3. Swiss competition authority investigates search advertising pacts

The Swiss Competition Commission (ComCo) opened two investigations on 30 April 2026 into potential coordination in search engine advertising. The probe examines whether travel companies and online casino operators agreed not to bid on each other’s brand names in keyword auctions on platforms like Google and Bing.

Such agreements could distort competition by limiting the visibility of competitors’ offers and making it harder for consumers to compare prices. Reuters reports that ComCo is questioning three travel firms and nearly all online casinos in Switzerland and will consult search engines as part of the investigation. If ComCo finds an unlawful agreement, companies could face fines and injunctive orders.

4. Crime and Policing Act 2026 brings digital protections in the UK

The United Kingdom’s Crime and Policing Act 2026 has received Royal Assent and introduces a suite of measures to address digital harms and modern crimes.

Technology Law

Predictive Policing Is Making Marginalised Communities Live Under Permanent Suspicion

Predictive policing has turned suspicion into a routine administrative category that follows people long before any conduct occurs, and it is astonishing how easily this practice has been accepted as a normal feature of public safety. The idea that an algorithm can pre-assign risk to entire neighbourhoods and individuals has been absorbed into policing …

Read more

7 months ago · 16 likes · 7 comments · Technology Law

Among its provisions, the Act criminalises the manufacture and distribution of “nudification tools” that use AI to simulate clothing removal from images.

It makes it an offence to take or share screenshots of intimate images without consent and requires online platforms to remove non‑consensual intimate images within 48 hours of notification. Courts can order deletion of such images.

The Crime and Policing Act also extends offences related to paedophile manuals to include instructions on generating child sexual abuse material with AI and holds website moderators and administrators liable for hosting this content.

Beyond online harms, the Act gives police new powers to compel drug testing and seize stolen goods via warrantless entry and expands data‑sharing with the Driver and Vehicle Licensing Agency.

It introduces “respect orders” to tackle antisocial behaviour and creates specific offences for assaulting retail workers.

Latest Opportunities

Jobs, conferences, fellowships, and calls for papers

1. Legal Expert (Remote UK): A remote‑based legal expert role advertised by a UK consultancy seeks professionals with expertise in technology law and digital regulation (find out more).

2. Junior/Mid AI Legal Specialist, EverAI (Remote UK): This role is aimed at lawyers or legal specialists interested in AI governance and product support (find out more).

3. AdTech Lawyer, Axiom (Remote US): Axiom is hiring an AdTech Lawyer to advise on digital advertising agreements, data sharing, campaign data flows, and marketing compliance (find out more).

4. Smart Contract Legal Architect, Loti AI (Remote US): Loti AI is hiring for a legal engineering role focused on likeness rights, on-chain rights enforcement, Solidity, and digital identity. This may interest lawyers who combine intellectual property, technology law, and smart contract literacy (find out more).

5. Business Teacher, Postsecondary AI Training, Alignerr (Remote Australia): This opportunity appears to involve teaching business for AI training, with some connections to other disciplines such as privacy and data protection (find out more).

6. Lawyer, Global Licensing, Coins.ph (Remote Hong Kong): Coins.ph is hiring a lawyer to lead licensing work across payments, remittance, e-money, and virtual asset services. The listing seeks experience with financial regulation, licensing applications, regulators, external counsel, and multiple jurisdictions (find out more).

7. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words. (find out more).

8. Free Microsoft Virtual Training Day: Introduction to Azure (18 May 2026): Microsoft’s free virtual event offers a foundational overview of cloud concepts, core Azure services across compute, networking, storage and identity and demonstrates AI tools. Participants who complete the session receive a 50 percent discount on the Azure Fundamentals certification exam (find out more).

9. AI, Justice and the Rule of Law (Free Course): UNESCO and the University of Oxford are offering a free self‑paced online course launched on 27 April 2026 to equip judges, lawyers and students with an understanding of how AI interacts with human rights and legal reasoning (find out more).

This newsletter briefing highlights a world where law struggles to keep pace with technological ingenuity. From billion‑dollar disputes over AI governance to class actions against social platforms and sanctions for AI‑generated errors, courts and regulators are grappling with new challenges.

Responsible development demands integrity, transparency and deliberate oversight.

Post your comments to join the conversation.

Leave a comment

Disclaimer

This newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the authors alone.

Tech startups often claim that regulation restrains innovation. Regulatory sandboxes challenge that assumption. Many founders now deliberately pursue these programmes, recognising that controlled regulatory environments provide credibility, investor confidence, and legal clarity during early development. This newsletter examines how sandboxes function as strategic tools within technology markets and why regulators are permitting experimentation inside formal supervisory frameworks.

Share

Newsletter Edition 93

Why Regulatory Sandboxes Are Becoming Strategic Tools for Early Stage Tech Startups

Regulation is not the enemy of early-stage technology companies. Regulation is a legal framework. Smart founders understand this earlier than most lawyers.

Startups often describe regulation as a barrier to entry. Venture capitalists regularly frame compliance as a cost. Public debate frequently portrays regulation as an obstacle to innovation. That story feels intuitive, but it is also incomplete.

Regulatory sandboxes demonstrate something different. They show that regulation can operate as a strategic asset when a company understands how to use it.

Early-stage companies increasingly treat regulatory sandboxes as part of their growth strategy. This practice now appears across fintech, artificial intelligence, digital identity systems, blockchain infrastructure, digital health platforms, and climate technology.

Regulators introduced sandboxes to understand new technology. Startups now use them to access regulators, investors, and markets.

What a Regulatory Sandbox Actually Does

The modern sandbox model emerged from the Financial Conduct Authority sandbox programme in the United Kingdom, introduced in 2016.

Participants receive permission to test products with real users under regulatory oversight. Regulators collect information about risk, consumer protection, and technical performance. Companies obtain structured engagement with regulators before entering the full regulatory cycle.

The United Kingdom sandbox operates under powers granted by the Financial Services and Markets Act 2000, which allow the regulator to grant waivers and modifications to regulatory requirements.

Subscribe now

Other jurisdictions adopted similar frameworks.

Singapore operates a regulatory sandbox through the Monetary Authority of Singapore FinTech Regulatory Sandbox Guidelines.

Australia created a sandbox through the Corporations Act 2001 regulatory exemption framework administered by the Australian Securities and Investments Commission.

The European Union introduced an experimentation environment through the Artificial Intelligence Act regulatory sandbox provisions.

Sandboxes, therefore, represent a structured interface between innovators and regulators.

Early-stage companies discovered that this interface carries strategic value.

A Founder Secret That Lawyers Rarely Discuss

Technology founders often reveal something privately that rarely appears in policy reports.

Access to regulators accelerates a company.

Early-stage companies usually face three obstacles simultaneously.

• Legal uncertainty

• Investor scepticism

• Market trust

A sandbox addresses each of these challenges simultaneously.

A regulator that allows a company to operate within a sandbox provides a form of credibility that early-stage companies struggle to obtain elsewhere.

Investors understand that a regulator has reviewed the product. Consumers understand that the technology operates under supervision. The company obtains clarity about the regulatory framework before scaling.

This effect appears in empirical research.

A study published by the Bank for International Settlements found that firms admitted to regulatory sandboxes raise significantly more investment after participating in the sandboxes.

The Financial Conduct Authority’s sandbox evaluation report found that approximately 80% of sandbox participants continued to operate successfully after completing testing.

Numbers alone do not tell the full story. A closer look at how founders actually use sandboxes reveals something more interesting.

The Sandbox Strategy

Some startup founders treat sandbox admission as a milestone similar to product launch.

A four-step pattern has begun to appear in several technology sectors.

1. A company builds a prototype.

2. The company enters a regulatory sandbox.

3. The company tests the product under supervision.

4. Investors enter the picture.

This sequence increasingly appears in fintech ecosystems.

The Global Financial Innovation Network, a coalition of regulators across more than 70 jurisdictions, was created partly to enable cross-border sandbox testing.

Regulatory experimentation now occurs in sectors that previously had little direct interaction with regulators during early development stages.

Artificial intelligence developers test algorithmic decision systems in sandbox environments established under the European Union Digital Finance Package and AI regulatory experimentation frameworks.

Digital health platforms collaborate with health regulators through regulatory test environments in several jurisdictions.

Blockchain infrastructure companies interact with financial regulators earlier in product development.

This practice disrupts the traditional innovation sequence. Legal engagement now occurs during product design rather than after market launch.

A Snapshot of Global Sandbox Activity

The number of regulatory sandboxes has increased significantly during the past decade.

The following table provides an approximate snapshot of sandbox programmes worldwide, based on data compiled from reports by the World Bank, the OECD, and the Cambridge Centre for Alternative Finance.

This increase reflects demand from startups. Founders increasingly recognise that regulatory engagement can reduce the uncertainty that would otherwise delay investment and adoption.

Courts are Beginning to Notice

Courts rarely discuss regulatory sandboxes directly because sandboxes operate within regulatory supervision rather than litigation.

Judicial decisions nevertheless demonstrate how regulatory experimentation affects legal reasoning.

A well-known example arises in the litigation surrounding cryptocurrency exchanges and digital asset regulation.

The case SEC v Ripple Labs Inc, pending in the United States District Court for the Southern District of New York, illustrates how uncertainty regarding digital asset classification affects technology development and market entry.

European policymakers have explicitly acknowledged this function in the European Commission's Artificial Intelligence Act impact assessment, which identifies sandboxes as tools that enable regulators to understand algorithmic systems before enforcement actions are taken.

Lawyers sometimes treat litigation as a mechanism that clarifies the law. Sandboxes represent another mechanism that achieves similar clarity through experimentation.

Is there a serious risk of overregulation of tech in the EU?

Technology Law

AI in Europe Is Gradually Becoming Over-regulated

Europe has regulated AI into a corner. The Artificial Intelligence Act, though hailed as a global benchmark, exemplifies the tension between ambition and practicality that defines modern EU digital regulation. Several laws also promise data protection and AI innovation, however together they form an administrative maze that risks stifling the very techn…

Read more

8 months ago · 14 likes · 6 comments · Technology Law

A Simple Model That Explains the Sandbox Advantage

A simple framework helps explain why founders pursue sandbox admission.

Consider three factors that determine whether a technology startup succeeds in a regulated industry.

• Regulatory clarity

• Market trust

• Access to capital

Normal innovation paths produce these factors slowly and unpredictably. Sandbox participation produces them simultaneously. The following simplified chart illustrates the difference.

Startup Development Without a Sandbox

Startup Development With Sandbox Participation

As shown in an AI regulatory study, investors frequently treat sandbox admission as evidence that regulatory engagement has begun.

The advantage becomes clear when capital enters the conversation.

Why Investors Should Care

Investors rarely discuss regulatory sandboxes publicly. Private investment conversations tell a different story.

Early-stage investors often interpret sandbox admission as an indicator that the company has begun to resolve regulatory uncertainty.

A venture capital firm evaluating a fintech startup often confronts a fundamental question. Is this technology legal to operate at scale?

Subscribe now

A sandbox does not answer every regulatory question, but it demonstrates that regulators are already engaged with the technology.

Empirical data support this observation.

A report from the International Monetary Fund's FinTech Notes Series shows that companies participating in regulatory sandboxes frequently secure additional financing after testing phases conclude.

Why Regulators Accept This Arrangement

Critics sometimes argue that regulatory sandboxes benefit startups more than regulators.

Regulators have strong incentives to participate.

Technological innovation introduces risks that regulators cannot fully understand without observing real-world deployment.

Artificial intelligence systems may influence lending decisions, insurance pricing, or medical diagnoses. Blockchain systems may facilitate financial transactions that fall outside existing regulatory categories.

A regulator attempting to supervise these technologies without direct observation operates with incomplete information.

Sandbox programmes allow regulators to observe the behaviour of technology under controlled conditions.

The Organisation for Economic Cooperation and Development report on regulatory sandboxes emphasises that regulators obtain valuable data regarding consumer risk, operational reliability, and compliance challenges during sandbox experiments.

Sandboxes, therefore, function as regulatory research laboratories.

The New Geography of Innovation

Another emerging development deserves attention.

Regulatory sandboxes can influence where startups decide to establish headquarters.

Jurisdictions that offer credible sandbox programmes attract technology founders.

Singapore offers a well-known example. The Monetary Authority of Singapore's sandbox programme has attracted dozens of fintech companies that later expanded across Asia.

Abu Dhabi created a similar framework through the Abu Dhabi Global Market RegLab programme, designed to attract financial technology firms.

The United Arab Emirates has built a regulatory innovation ecosystem, partly based on sandbox experimentation.

Governments recognise that regulatory sandboxes can operate as an economic development tool.

A Glimpse Into the Numbers

The following simplified dataset illustrates a pattern observed across several sandbox programmes based on publicly available reports from regulators and international organisations.

Sandbox Outcomes Observed Across Multiple Jurisdictions

Numbers rarely capture the cultural impact of this development. Sandboxes have changed how founders and regulators interact.

The Future Role of Sandboxes

Several policy reports anticipate that sandbox frameworks will expand into additional sectors.

Artificial intelligence governance provides a prominent example.

The European Union Artificial Intelligence Act explicitly encourages member states to establish regulatory sandboxes that allow developers to test high-risk AI systems under supervision.

For example:

• Climate technology companies developing carbon accounting platforms or environmental data systems may interact with regulators through sandbox environments.

• Digital identity infrastructure and privacy-enhancing technologies present similar opportunities.

Innovation occurs in domains where law and technology intersect.

Regulatory sandboxes provide a structured space where that intersection becomes visible.

Leave a comment

////////////////////END/////////////////

This newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the Technology Law e-Newsletter and do not necessarily reflect the views of any affiliated institution.

Technology law is entering a period in which institutional responsibility cannot be deferred to innovation narratives or voluntary guidelines. Governments are writing treaties on AI governance, prosecutors are testing the limits of liability for chatbot outputs, courts are treating online gaming assets as property, and regulators are scrutinising algorithmic markets. Legal practice itself is also changing as firms integrate AI into core workflows. This briefing examines these developments and considers what they reveal about accountability, authority, and risk in our digital systems.

Share

Newsletter Edition 92

Lead Story

The European Parliament has approved the EU’s signature of the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law.

This is a significant milestone because the Council of Europe describes the convention as the first international legally binding treaty in AI governance.

This treaty is designed to make sure that activities across the AI lifecycle remain consistent with

• Human rights

• Democracy, and

• The rule of law.

Parliament gave its consent to the EU’s signature with 455 votes in favour, 101 against, and 74 abstentions. The next step is for the Council to conclude the agreement.

The treaty applies to AI-related activities carried out by public authorities and private actors acting on their behalf. Private sector actors are also expected to address AI-related risks in line with the convention’s objectives, either by directly applying the convention’s obligations or by providing equivalent protection.

The Parliament’s own explanation states that the EU AI Act and other EU laws already provide a higher and more detailed level of protection within the EU internal market. The treaty establishes a broader international baseline for transparency, documentation, risk management, oversight, fundamental rights, democratic safeguards, and rule-of-law values.

The text of the treaty is built around the idea that AI systems should not be treated only as products, software, or business tools, while recognising that they can affect dignity, autonomy, equality, privacy, public institutions, and democratic participation.

The treaty, therefore, requires states to adopt or maintain legislative, administrative, or other measures to give effect to its provisions. Those measures may be specific to particular sectors or horizontal across technologies.

This matters because international AI governance is often discussed as if it is only about voluntary principles. This treaty takes a firmer route by providing contracting states with a common legal framework for AI risks without requiring every country to adopt the EU AI Act. That is important for states that want human rights-based AI governance, but do not have the same regulatory position as the EU.

Lawyers advising public bodies, technology sellers, and regulated businesses will need to ensure compliance. Procurement, due diligence, contract drafting, and AI governance policies will need to ascertain whether the use of AI affects rights, public accountability, and democratic values. AI policy documentation may become more important because transparency and oversight cannot work without reliable records.

Technology Law

Council of Europe Sets New Standards for Online Safety and Empowerment

The Council of Europe’s new recommendation on online safety presents an ambitious attempt to reconcile freedom of expression with the governance of digital platforms. The document proposes stronger expectations on states and platforms while insisting on human rights safeguards. Additionally, the framework raises difficult questions about regulatory reac…

Read more

3 months ago · 15 likes · 2 comments · Technology Law

Regulators will also have a clearer basis for cooperation. AI systems cross borders, and many of the companies developing or deploying them operate globally. This uniform treaty framework will help regulators discuss risk, compliance, and institutional responsibility using shared concepts. That does not remove national differences, but it gives regulators a firmer starting point.

Subscribe now

Companies should not treat the convention as a distant public law instrument. Any business building AI tools for government, justice, education, healthcare, public services, security, finance, or civic participation should assume that human rights review will become a more visible part of the buying and supervision process. Strong internal records, testing, escalation procedures, and clear accountability lines will become easier to defend than vague statements about responsible AI.

The EU’s support for the Framework Convention positions AI governance within an international legal framework grounded in human rights, democracy, and the rule of law.

Technology Law Tracker: Other Relevant Updates

1. Freshfields and Anthropic partner on developing legal AI tools

Freshfields and Anthropic have agreed to work together on new AI applications for legal services. It was reported that Freshfields will collaborate with Anthropic’s legal team to develop tools for legal and market research, contract review, document drafting, and automation of internal business services workflows. Freshfields will also receive early access to future Anthropic models and products, although no financial terms were disclosed.

The development also comes at a time when courts are paying closer attention to AI errors in legal documents. Recently, there has been a rise in AI-generated inaccuracies in court filings, including inaccurate citations and other errors.

Legal AI is judged not only by speed, but also by reliability, auditability, and professional accountability. A tool that drafts faster but imposes verification burdens may save time in one place while creating risk in another.

2. OpenAI and ChatGPT investigated after deadly shooting

Florida Attorney General James Uthmeier has launched a criminal investigation into OpenAI and ChatGPT after a 2025 shooting at Florida State University that killed two people and injured six others.

The suspect was charged with multiple counts of murder and attempted murder, and the state is examining whether OpenAI bears criminal responsibility for ChatGPT’s alleged role in the incident. The Office of Statewide Prosecution has subpoenaed OpenAI for information and records.

Uthmeier said at a press briefing that the chatbot advised the shooter on the type of gun to use, ammunition compatibility, and whether a gun would be useful at short range.

OpenAI’s position, as reported by Reuters, is that the shooting was a tragedy, but that the company had no responsibility. The company also said it identified an account believed to be associated with the suspect and shared information with law enforcement.

It added that ChatGPT provided factual responses based on broadly available public information and did not encourage or promote illegal or harmful activity.

This investigation examines how prosecutors may view AI systems that produce information later linked to violent conduct. Criminal law usually focuses on human intent, conduct, causation, and knowledge.

Can AI be guilty of a crime? Read our newsletter on this delicate matter.

Technology Law

Can AI Be Criminally Liable?

Around the world, prosecutors are circling, and in some cases, people are already being charged for what their AI systems did. World legal systems are catching up with reckless automation, and the consequences are real: injury, death, and yes, prison time. In this article, we explore how criminal liability is entering the AI age, what cases are already …

Read more

a year ago · 12 likes · 8 comments · Technology Law

Applying those ideas to a chatbot raises difficult issues. An AI system can generate a harmful answer without having human intent. A company can design safety layers, but users may still ask dangerous questions in ways that are not always easy to detect.

The case also highlights the difference between public information and actionable assistance. Many facts about weapons, chemicals, cyber tools, and other dangerous subjects exist online. The legal question is whether an AI system changes the risk by making such information easier to access, combine, personalise, or apply. That question will remain central to AI safety discussions.

Which liabilities exist against LLMs offering misleading advice?

Technology Law

Can You Sue ChatGPT or Google Gemini for Providing Wrong Advice?

AI chatbots are everywhere. They answer questions, give tips, and sometimes issue wrong advice. From dangerous health advice to fake consumer product review, things go wrong more often than people think. When they do, the primary question is who takes the blame. This post looks at real examples of when AI provides misleading advice, how companies try to…

Read more

a year ago · 13 likes · 11 comments · Technology Law

Companies offering general-purpose AI tools should treat this development as a warning that safety design will be examined after serious harm occurs. It will not be enough to say that a user misused an AI system. Prosecutors, regulators, victims, and the public will ask what safeguards existed, how they were tested, what the company knew about foreseeable misuse, and how the system responded to high-risk prompts.

This is also a reminder that AI governance needs incident response planning. Companies should be prepared to preserve records, cooperate with lawful investigations, review model behaviour, and communicate carefully. The legal outcome remains uncertain, but the governance lesson is already clear.

3. UK courts and regulators consider clearer rules for AI-generated legal documents

The UK Civil Justice Council has been consulting on whether new procedural rules are needed for the use of AI in preparing court documents, including pleadings, witness statements, and expert reports.

Judicial concern about AI hallucinations, including false authorities, inaccurate case references, and wasted court resources. It also refers to recent cases in which AI-generated or AI-assisted legal material caused problems before the courts.

The judiciary is also examining other questions about AI, legal professional privilege, and confidentiality. In a speech on legal professional privilege in the age of AI, the Chancellor of the High Court noted that public AI systems may raise confidentiality concerns.

The speech discussed a tribunal decision holding that uploading confidential documents to an open-source AI tool such as ChatGPT can place that information in the public domain, breach client confidentiality, and waive privilege.

This matters for every lawyer, not only litigators. AI can help draft, summarise, translate, and organise material, but it cannot remove professional responsibility. Courts are likely to focus less on whether AI was used and more on whether the final document is accurate, honest, properly verified, and consistent with duties owed to the court.

Legal professionals should have a clear verification process. They should know which AI tools are approved for use in their jurisdiction, which data must not be entered, how outputs are checked, and how errors are recorded. Litigants-in-person may also need clearer public guidance because AI tools can make legal arguments look more polished without making them legally sound.

Case of the Week

Case: R v Lakeman
Citation: [2026] EWCA Crim 4

Facts

R v Lakeman concerned virtual gold pieces in the online game Old School RuneScape. The gold pieces were recorded in a ledger maintained by Jagex, the game’s developer and publisher. The terms and conditions stated that the gold pieces could be redeemed only inside the game, and Jagex could delete them or anything purchased with them. Sale or gifting in the real world was prohibited.

The defendant was an employee of Jagex. He was accused of hacking into player accounts, transferring a large number of gold pieces to accounts under his control, and selling them for real-world currency. The alleged theft involved around 705 billion gold pieces, valued at £543,123.

Subscribe now

Legal issue

The legal issue was whether virtual in-game currency could constitute property capable of being stolen under section 4 of the Theft Act 1968 (UK). This was not a simple question because the gold pieces existed inside a game environment, were subject to contractual restrictions, and could be modified or deleted by the game operator.

The defence argument was helped by the fact that the game rules did not allow real-world trading. Jagex also retained significant control over the game environment. The prosecution’s case depended on persuading the court that those features did not render the gold pieces property for the purposes of theft.

Decision

The Court of Appeal held that the gold pieces were property capable of being stolen for the purposes of section 4 of the Theft Act 1968. The court stressed that the definition of property in criminal law differs from that in private law. The court also discussed other related issues in digital asset property, including the idea that digital assets can be functional things distinct from the underlying code.

The court adopted a wider approach to property for theft purposes. The court considered whether the thing was freely bought and sold and capable of dishonest dealing that deprives the owner of its benefit. It allowed the prosecution’s appeal on the preliminary issue and held that the virtual gold pieces were property capable of theft.

The relevance of this judgment

Digital assets now carry real social and economic value. Games, virtual worlds, blockchain, digital collectables, token-based platforms, and online marketplaces all involve items that may be controlled by code, governed by terms, and valued by users. Criminal law cannot avoid these assets simply because they are intangible or platform-based.

The decision is especially important for gaming companies. Terms and conditions may say that in-game assets cannot be sold outside the game, but that does not necessarily prevent a court from treating those assets as property in a criminal context. Platform operators should therefore think carefully about account security, internal access controls, employee permissions, audit trails, and user protection.

Is crypto personal property? Read our newsletter to find out more:

Technology Law

What the Property (Digital Assets etc) Act 2025 Means for Your Cryptoassets

English law has spent more than a decade pretending that digital value could be economically real yet legally peripheral, and the Property (Digital Assets etc) Act 2025 exposes how unsustainable that posture had become. Treating cryptoassets as something to be tolerated rather than classified produced uncertainty that benefitted speculation while underm…

Read more

7 months ago · 11 likes · 5 comments · Technology Law

The court’s reasoning adds to a growing body of judicial reasoning about how law should treat digital things that have practical utility, scarcity, control, and market value. It does not answer every private law question about ownership, transfer, insolvency, or platform liability, but it gives courts and lawyers another important reference point.

The law is becoming more comfortable with the idea that digital value can be legally meaningful. Users may consider a virtual item valuable even if it exists on a controlled platform. Courts are beginning to take that experience seriously when dishonesty, deprivation, and market value are present.

Other Developments in Technology Law:

1. Investigation into music streaming platforms over alleged undisclosed promotion

The Texas Attorney General has launched an investigation into Spotify, Apple Music, Pandora, Amazon Music, and YouTube Music over alleged payola-type arrangements. The office says it is examining whether streaming services accepted undisclosed payments to promote certain songs, artists, or content through playlists, recommendations, or ranking systems. Civil Investigative Demands have been issued to the companies.

2. UK chatbot offence proposal withdrawn before debate

A proposed amendment to the Crime and Policing Bill, which has now been withdrawn, would have created offences related to AI chatbots that produce illegal or harmful content for children, or that use certain deceptive or exploitative chatbot designs.

The amendment also included duties for risk assessment, mitigation, transparency reporting, and potential criminal penalties. The amendment was withdrawn before debate, so no decision was taken on it.

3. Dutch financial regulator highlights AI risks in capital markets

The Netherlands Authority for the Financial Markets has published a report on AI in capital markets.

The regulator says AI can improve speed and reduce costs, but it can also affect price formation, amplify market vulnerabilities, and create new risks where trading models rely on similar data and objectives. It also warns that false or manipulated information could affect models that rely on news, sentiment, and social media.

Latest Opportunities

Jobs, conferences, fellowships, and calls for papers

1. Junior/Mid AI Legal Specialist, EverAI (Remote UK): This role is aimed at lawyers or legal specialists interested in AI governance and product support (find out more).

2. AdTech Lawyer, Axiom (Remote US): Axiom is hiring an AdTech Lawyer to advise on digital advertising agreements, data sharing, campaign data flows, and marketing compliance (find out more).

3. Smart Contract Legal Architect, Loti AI (Remote US): Loti AI is hiring for a legal engineering role focused on likeness rights, on-chain rights enforcement, Solidity, and digital identity. This may interest lawyers who combine intellectual property, technology law, and smart contract literacy (find out more).

4. Business Teacher, Postsecondary AI Training, Alignerr (Remote Australia):
This opportunity appears to involve teaching business for AI training, with some connections to other disciplines such as privacy and data protection (find out more).

5. Lawyer, Global Licensing, Coins.ph (Remote Hong Kong): Coins.ph is hiring a lawyer to lead licensing work across payments, remittance, e-money, and virtual asset services. The listing seeks experience with financial regulation, licensing applications, regulators, external counsel, and multiple jurisdictions (find out more).

6. Call for papers on Quantum Technology and Law, Leiden Law School: Leiden Law School invites chapters for an edited volume on quantum technology and law. Topics include legal, ethical, social, and regulatory issues linked to quantum technology. Abstracts should be 150 to 250 words, and chapters should be around 8,000 to 10,000 words. (find out more).

Conclusions

The common thread in this briefing is accountability. AI is becoming part of law, finance, public administration, entertainment, and criminal investigation, so legal systems are now asking who takes responsibility when automated systems affect people.

The most useful conversation is whether AI use can be explained, checked, and governed with sufficient care to preserve trust.

Disclaimer

This newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the Technology Law e-Newsletter and do not necessarily reflect the views of any affiliated institution.

Leave a comment

Your weekly briefing report on technology law and regulation, AI governance, fintech policy, and career opportunities.

Share

Newsletter Edition 91

Lead Story

Your AI chats may become evidence in court!

Conversations with AI chatbots may not be treated like “confidential” conversations with a lawyer, doctor, or other protected professional. In a recent case of United States v. Heppner, No. 25-cr-503 (JSR) that brought this issue into sharper view, U.S. District Judge Jed Rakoff ruled in February that Bradley Heppner, the former chair of GWG Holdings, had to hand over 31 documents generated with Anthropic’s Claude in the course of a criminal securities fraud case.

Heppner had used Claude to prepare reports on his case for his lawyers, but the court was not persuaded that those exchanges were protected.

Judge Rakoff’s reasoning is important because he addressed the issue directly. He did not treat AI systems as something unusual or outside existing legal rules. In a written order, the judge explained that conversations with an AI system such as Claude cannot be treated as confidential legal advice. In other words, a person using the chatbot does not have an attorney-client relationship with the AI company (Anthropic).

The judge also looked closely at Anthropic’s privacy policy. That policy explains that the platform may collect the questions users type into the system and the responses the system generates. It may also use that information to improve the model and may disclose it to third parties when required in disputes or legal proceedings.

Because the company reserves the right to access and share that information, the judge concluded that users cannot reasonably expect those conversations to remain private in the legal sense required for attorney-client privilege.

It was reported that on the same day as Rakoff’s ruling, U.S. Magistrate Judge Anthony Patti in Michigan took a different view in Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. 2026), involving a self-represented litigant’s use of ChatGPT.

Patti treated those AI chats as part of the litigant’s own work product rather than a conversation with another person. In other words, chatbots are tools, not persons. That means some AI-generated material may still attract protection depending on who created it, why it was created, and how it was used.

Courts are not building a standalone doctrine of AI confidentiality all at once. They are doing something much more granular and much more consequential. They are applying existing rules on privilege, confidentiality, waiver, and work product to new patterns of behaviour.

Some uses of AI may be treated as internal drafting assistance. Other uses may look like disclosure to a third party. A great deal will depend on the system used, the provider’s terms, the purpose of the interaction, and the extent of lawyer involvement.

Subscribe now

Many people use AI systems as if they were private advisers. That assumption is understandable because the interface feels conversational, personal, and responsive. Legally, that feeling may be meaningless. Employees, founders, claimants, defendants, and ordinary users may all reveal sensitive material to an AI system that does not provide them with the legal protection they believe they have.

The deeper point is that AI use is now starting to alter the evidence record itself. An AI chatbot can help draft a witness outline, summarise internal documents, suggest a line of argument, or produce a statement of claim. Each of those outputs can later matter in disclosure fights, sanctions disputes, or credibility challenges. That is why the discoverability question matters far beyond the privilege doctrine.

Courts are beginning to treat AI chats as legally consequential records, not private thought spaces, and that changes how lawyers, clients, and companies need to use these tools.

Can you sue an LLM? Read our newsletter on the legal challenges of suing ChatGPT and Gemini.

Technology Law

Can You Sue ChatGPT or Google Gemini for Providing Wrong Advice?

AI chatbots are everywhere. They answer questions, give tips, and sometimes issue wrong advice. From dangerous health advice to fake consumer product review, things go wrong more often than people think. When they do, the primary question is who takes the blame. This post looks at real examples of when AI provides misleading advice, how companies try to…

Read more

a year ago · 13 likes · 11 comments · Technology Law

Key Regulation Tracker

1. Australia Federal Court issues AI practice note

The Federal Court of Australia’s new Generative AI Practice Note does not prohibit AI use. It does something more useful. It states that anyone using generative AI in connection with legal proceedings must understand its capabilities, limits, and risks, and that any use must not adversely affect the administration of justice. The Note also makes clear that the court may require disclosure of how AI was used in a proceeding.

The AI Practice Note also mentions that lawyers remain responsible for ensuring pleadings are supportable, authorities cited in submissions exist and support the stated proposition, and cited evidence exists and is likely to be admissible.

Subscribe now

It also requires disclosure where AI has been used to summarise or analyse information relied on by a witness or expert, and warns against entering privileged, confidential, suppressed, or otherwise restricted information into generally accessible tools. Non compliance may lead to adverse costs and other consequences. That is a clear framework other courts will be studying closely.

2. DOJ settles IBM case over anti-discrimination compliance certifications

The U.S. Department of Justice settlement agreement with IBM states that the United States contends IBM knowingly submitted false claims and knowingly made false statements in connection with federal contracts that incorporated anti-discrimination requirements, including Title VII requirements as reflected in federal procurement rules. The settlement amount is USD 17.1 million.

This agreement matters for tech companies because public contracting now carries heavy compliance exposure that goes well beyond cybersecurity representations or data handling promises.

Employment practices, internal governance, and certification processes can all become legal issues once they are baked into government contracts and digital service procurement. Compliance officers and legal teams should treat certification language as an operational commitment, not a box ticking exercise.

Case of the Week

Case: Nippon Life Insurance Company of America v. OpenAI Foundation
Citation: No. 1:26-cv-02448 (N.D. Ill. filed Mar. 4, 2026), United States District Court, Northern District of Illinois.

Facts

The complaint, filed on 4 March 2026, was brought by Nippon Life Insurance Company of America against OpenAI Foundation and OpenAI Group PBC.

According to the complaint, Nippon alleges that ChatGPT provided legal assistance to a user, Graciela Dela Torre, in connection with litigation and post settlement filings, and that this assistance contributed to tortious interference with a settlement agreement, abuse of process, and the unlicensed practice of law under Illinois law. The complaint says ChatGPT gave legal advice, legal analysis, legal research, and drafting help for motions and requests for judicial notice.

Legal Issue

The complaint relied on Illinois authority stating that the practice of law is not limited to courtroom appearances and includes out of court legal services and advice. They argued that ChatGPT is not admitted to practice law in Illinois or elsewhere, yet provides legal services to users who ask for them.

That issue sits at the intersection of several long standing legal concerns.

• One is professional licensing.

• Another is consumer protection.

• A third is court integrity, especially where AI generated legal assistance may influence filings or judicial process without the controls applied to licensed practitioners.

The complaint also raised a crucial question that regulators have not resolved yet: when does general information become personalised legal assistance that the law is willing to regulate?

Judicial Decision

There has not yet been a merits decision. What exists at this stage is the complaint and the claims it advances. The case therefore matters as a filing to follow. The complaint seeks relief that includes an injunction against continuing to provide legal assistance and a finding of unlicensed practice of law, among other remedies.

Courts still have to decide questions of standing, causation, duty, statutory scope, and the practical meaning of “practice of law” in the context of software outputs. Even so, the filing is notable because it states the claim plainly and in terms that another plaintiff, regulator, or bar authority could adapt.

Why stakeholders must take note of this case

• The case tests whether general purpose AI systems can remain legally characterised as neutral tools when they are marketed and used in ways that resemble professional assistance. Liability, regulatory design, product warnings, and system limitations may all depend on where that line is drawn.

• Financial services firms are already using AI in customer interaction, compliance triage, and document support. A court willing to look closely at AI outputs in the legal context may encourage similar scrutiny in regulated financial advice settings where licensing and consumer harm concerns are also acute. Of course, this case is not about financial advice, but the logic of role substitution matters across regulated services.

• Platform operators often describe AI as assistance rather than advice. This case shows why that distinction will not always end the debate. Claimants will look at what the system actually does, how it is presented to users, and what consequences follow. Product labels alone may not carry much weight if the system is doing work users would usually associate with a licensed professional.

• A licensed profession and a general LLM model tool produce very different governance expectations. The former leans toward competence, supervision, ethics, and record-keeping. The other leans toward consumer disclosures, safety testing, and platform moderation. Courts do not have to choose a full regulatory model in one case, but each procedural step is starting to affect the space companies have to design and market AI systems that touch professional decision making.

Latest Policy Insights and Updates

1. The European Commission Launches Age Verification App to Protect Children Online

The European Commission’s new age verification app seeks to facilitate child safety, and also support states in adopting stronger online age checks without building a system that normalises unnecessary data collection.

The European Commission (EC) says the app is ready for deployment, will allow users to prove age when accessing platforms, can be set up using a passport or ID card, works on any device, is anonymous, and is fully open source. Some EU countries are already planning to integrate it into national digital identity wallets.

Subscribe now

Age verification has often produced a false choice between child safety and privacy. The EC is trying to present a third route: age assurance with limited data exposure. Whether that works in practice will depend on design, uptake, interoperability, and whether platforms accept the tool as a sufficient compliance mechanism. The real policy issue is not whether age checks will exist, but rather, whether they can exist without becoming an identity system for ordinary internet use.

2. New Technical Standards Planned for Autonomous Driving in China

China’s Ministry of Industry and Information Technology has also closed consultation on draft mandatory national standards, including draft safety requirements for autonomous driving systems of intelligent and connected vehicles.

The ministry’s notice set 13 April 2026 as the deadline for comments, and the draft standard establishes technical and functional safety requirements for autonomous driving systems.

3. UK Competition Authority Begins Review of Paramount and Warner Bros Discovery Deal

In the United Kingdom, the Competition and Markets Authority has opened a consultation to comment on the anticipated acquisition involving Paramount and Warner Bros. The consultation runs from 13 April to 27 April 2026. The CMA notes that the formal phase 1 investigation has not yet launched and that the invitation to comment is the first part of its information gathering process.

Control of content libraries, streaming reach, advertising inventory, recommendation architecture, and audience data can all carry competition implications that spill well beyond traditional broadcasting. The point is not only who owns what studio, but how concentration affects distribution power in digital media markets that increasingly overlap with platform, advertising, and AI enabled content environments.

4. EU Develops Metadata Standards for the European Health Data Space

The European Commission (EC) has also closed consultation on a draft implementing regulation on minimum metadata elements for the European Health Data Space, including interoperability requirements for dataset descriptions used in the secondary use of electronic health data. Digital Policy Alert says the consultation closed on 12 May 2026 and links the proposal to Article 77(1) of the EHDS Regulation 2025/327.

This is exactly the kind of measure that determines whether data policy succeeds or stalls. Secondary use of health data depends on discoverability, standardisation, interoperability, and trustworthy governance. Metadata rules can decide whether researchers, hospitals, regulators, and innovators can actually find and reuse datasets in legally compliant ways.

Other important developments

1. The EU proposes measures requiring Google to share certain search data with third party search engines under the Digital Markets Act: The European Commission says the draft measures cover ranking, query, click, and view data, with feedback open until 1 May (read here).

2. EU presses Meta over WhatsApp access for rival AI assistants: The European Commission intends to order Meta to reinstate rival AI assistants on WhatsApp after Meta imposed an access fee that regulators say may exclude competitors (read here).

3. European AI Office opens a targeted consultation on measuring the energy consumption and emissions of AI models and systems: The consultation runs from 7 April to 15 May 2026 (read here).

Subscribe now

4. SEC staff issues a statement on certain crypto transaction interfaces: The Division of Trading and Markets says the statement sets out staff views on broker dealer registration requirements for some interfaces used to prepare transactions in crypto asset securities (read here).

5. FTC secures a USD 1.5 million settlement with Publishing.com. The FTC says the online self publishing company misled consumers about likely earnings and must substantiate earnings claims going forward (read here).

6. EDPB advances new guidance on scientific research data processing. Its Guidelines 1/2026 on personal data for scientific research were adopted on 15 April 2026 in a version for public consultation (read here).

7. SEC’s 2025 enforcement results underline continued focus on emerging technology risk. The European Commission highlighted the Cyber and Emerging Technologies Unit, which covers blockchain technology, AI, account takeovers, and cybersecurity (read here).

Latest opportunities

Jobs, conferences, fellowships, and calls for papers

1. DSIT Fellowship Cohort 4: Applications are open for 2026 to 2027 secondments in AI, data, economics, international work, horizon scanning, and science ecosystem roles. Deadline: 6 May 2026 (further details).

2. Allen Institute for AI, Legal Counsel: Applications are due by 30 April 2026. The role calls for technology transactions experience and familiarity with data governance, privacy law, and the EU AI Act (further details).

3. Benchling, Legal Counsel, Product and AI: Benchling is recruiting product and AI counsel in San Francisco to advise on AI governance, privacy, intellectual property, licensing, and product legal issues (further details).

4. Lecturer in Law and Technology, Aston University: Applicants required with expertise in areas such as AI and law, digital regulation, data governance, cyber law, platform regulation, or the legal implications of emerging technologies (further details).

5. GitLab, Legal Counsel, Commercial (Canada, US, Remote): The role includes negotiating complex commercial and technology agreements, including data privacy and AI related contracts (further details).

6. AIDA2J Workshop at ICAIL 2026: Papers, short papers, and demo proposals are invited for the Artificial Intelligence for Access to Justice workshop in Singapore. Submission deadline: 1 May 2026 (further details).

7. PLSC Europe 2026: KU Leuven’s Centre for IT and IP Law is hosting this privacy scholarship workshop in Leuven on 29 and 30 October 2026. Abstract deadline: 15 May 2026 (further details).

Disclaimer

This weekly briefing and newsletter is provided for informational and educational purposes only. It does not constitute legal advice, and readers should not rely on it as a substitute for professional legal counsel. The views expressed are those of the author and do not necessarily reflect the views of any affiliated institution.

Leave a comment

/////////////////////END///////////////////////

The Council of Europe’s new recommendation on online safety presents an ambitious attempt to reconcile freedom of expression with the governance of digital platforms. The document proposes stronger expectations on states and platforms while insisting on human rights safeguards. Additionally, the framework raises difficult questions about regulatory reach, platform accountability, and the risk that protective measures may legitimise the over-censorship of online discourse.

Share

Newsletter Edition 90

Introduction

The digital environment has become central to our social and civic lives. People gather news, express opinions, learn, play and work through online platforms. The Council of Europe, aware of the benefits and dangers of this transformation, adopted Recommendation CM/Rec(2026)4 on 8 April 2026 to guide member states toward safe and empowering online environments. This recommendation acknowledges that while the internet enhances freedom of expression, it also exposes users to harassment, misinformation and other risks that can undermine democracy. It seeks to protect individual and collective rights without sacrificing the openness of the digital realm.

The recommendation builds on previous Council of Europe instruments on internet freedom and the responsibilities of internet intermediaries. The explanatory memorandum emphasises that the right to freedom of expression protects speech that may offend, shock or disturb.

The recommendation proposes principles and measures for states, platforms and content creators to address online risks while enhancing user autonomy.

Understanding online risks

The recommendation categorises online risks that affect freedom of expression into three groups:

• Personal and community safety risks: Users may encounter abuse, harassment or content that threatens their well-being. This includes hate speech, violence and exploitation. Such risks can deter individuals from participating in public discourse, leading to self‑censorship and exclusion.

• Threats to democratic processes and information integrity: Misinformation, targeted disinformation campaigns, and manipulation of public debate undermine informed decision-making. These threats erode trust in institutions and polarise societies. Election interference and conspiracy narratives can weaken democratic legitimacy.

• Systemic risks from the design and operation of platforms: Algorithmic systems can influence the visibility of content, amplify harmful material or suppress minority voices. Platform design choices, driven by engagement metrics, may prioritise sensational content, leading to echo chambers and exposing users to harmful material. Artificial intelligence tools that produce or moderate content introduce new risks and amplify existing ones.

The memorandum explains that certain groups face heightened risks online: children, women and girls, people with disabilities or minority identities, migrants and content creators such as journalists and activists. Online abuse targeted at these groups often extends into the physical world, reinforcing social inequalities. When freedom of expression is curtailed by intimidation or discrimination, public debate suffers.

Technology Law

Your Online Freedom May Be About To End

New rules are transforming how online platforms and search services must operate in the United Kingdom. Age checks are now compulsory for services with adult content and strict obligations apply to anything that children can access. Some see this as protection and others see it as control. These rules will change what people see, how they join online pl…

Read more

a year ago · 11 likes · 3 comments · Technology Law

Principles for states

The recommendation stresses that states should foster an enabling online environment that is:

• Safe,

• Inclusive, and

• Pluralistic.

This involves measures both online and offline. States should develop comprehensive strategies that address underlying societal inequalities that lead to online abuse. Education and media literacy are central to empowering users; states are encouraged to invest in digital citizenship initiatives and strengthen media diversity.

States must avoid actions that compromise online safety. They should not introduce vulnerabilities into technical systems that protect privacy. Enhanced surveillance or general monitoring obligations are discouraged, as they threaten freedom of expression and could lead to the over-removal of lawful content. Instead, interventions should be evidence-based, transparent and proportionate. When developing regulations, governments should consult a wide range of stakeholders, including civil society and affected communities.

States should clearly identify what content is illegal or regulated, ensuring legal certainty and preventing arbitrary enforcement. Blocking entire services or domains is considered a severe interference with freedom of expression and should occur only under strict judicial oversight.

Responsibility for enforcing content restrictions cannot be transferred wholesale to private companies. States remain ultimately accountable for human rights protection. When authorities instruct platforms to remove content, platforms should inform users so they can challenge the decision. Legal frameworks must avoid compelling intermediaries to monitor all user content.

Responsibilities of platforms

Online platforms serve as gatekeepers to public discourse. The recommendation acknowledges that they play a central role in facilitating expression and, therefore, bear responsibilities commensurate with their impact.

Platforms of significant influence – those with large user bases and substantial impact on public communication – are expected to conduct risk assessments before implementing changes. These assessments should consider human rights impacts, involve stakeholder consultation and be published in a way that the public can understand. When risks are identified, platforms must implement mitigation measures before introducing new designs. This approach encourages transparency and accountability in corporate decision-making.

Subscribe now

Platforms are encouraged to employ staff knowledgeable about local contexts and languages, enabling them to understand specific risks in different regions. They should pay special attention to groups facing higher risks, such as children, women and minorities. Collaboration with user groups and civil society can inform more responsive policies.

One notable principle is the graduated and differentiated approach. Smaller platforms should not be overburdened by obligations suited for very large services. Conversely, platforms with significant influence should be subject to heightened duties that reflect their power and reach.

Content creator responsibilities

The recommendation recognises content creators as an essential part of the digital public sphere. It calls on them to uphold accuracy, fairness and integrity.

Creators who reach large audiences or claim professional expertise have a heightened duty to act in good faith.

These provisions acknowledge the rising number of child influencers and aim to protect them from exploitation.

Timeline of Council of Europe digital rights instruments

The timeline below illustrates how the Council of Europe has progressively addressed digital rights and online safety through a series of recommendations.

It places Recommendation CM/Rec(2026)4 in a broader context of regulatory development.

Events are plotted chronologically from 2016 to 2026.

Legal frameworks: content rules, intermediary liability and platform accountability

The recommendation divides legal frameworks into three pillars:

1. Content rules,

2. Intermediary liability rules, and

3. Platform accountability and user empowerment rules.

This structure recognises that different types of interventions require different approaches.

Content rules

Content rules govern what kind of expression may be restricted and under what circumstances. They must be clearly prescribed by law, pursue a legitimate aim and remain necessary and proportionate.

The recommendation reiterates that content lawful offline should generally be lawful online. When restrictions are necessary, the law should specify whether content is illegal (fully prohibited) or legal but regulated (subject to access or visibility limitations). The degree of risk severity and its imminence should guide the level of restriction.

Member states are encouraged to regularly review their online content laws to ensure clarity and relevance in a changing digital context.

Enforcement should, in principle, occur through formal orders by judicial or independent authorities, with users and intermediaries having access to effective remedies. Platforms may adopt additional rules through terms of service, but these should be transparent and consistent.

Intermediary liability rules

Excessive liability can turn intermediaries into de facto censors and encourage over-removal of lawful content. States should therefore avoid imposing disproportionate liability on intermediaries for user-generated content.

Liability may be appropriate when intermediaries fail to act expeditiously upon becoming aware of illegal content, provided that notice procedures are transparent and effective. The conditions for removal, including time frames, should be differentiated according to the nature and seriousness of the content.

When platforms enforce content restrictions in accordance with State orders, they should provide sufficient information to enable users to challenge those decisions. This ensures accountability and prevents arbitrary or discriminatory enforcement.

Platform accountability and user empowerment rules

Platform accountability rules address systemic duties that go beyond content moderation. They require platforms to design services with user safety and empowerment in mind. States should legislate to require platforms of significant influence to conduct risk assessments and publish documentation on their human rights impacts. Regulatory authorities overseeing these frameworks must be independent, well-resourced and subject to judicial review.

States are encouraged to share responsibility by involving non-state actors such as researchers, user groups and out-of-court dispute settlement bodies. These actors should operate under transparency and accountability mechanisms. By decentralising oversight, the recommendation envisions a collaborative approach to safety.

Technology Law

How A Content Creator Was Harassed Online For Years (Gasparetto v. Bradley)

A recent court case from Nova Scotia Supreme Court has made headlines for all the right reasons. After consistent targeted online abuse, the applicant took his fight to court and won. The judge ruled in his favour. The ruling breaks down what counts as cyberbullying, how far is too far, and why content creators should pay close attention. This is a deta…

Read more

a year ago · 5 likes · Technology Law

User empowerment measures

At the heart of the recommendation is the belief that empowering users can mitigate online risks and foster resilience. User empowerment duties are divided into four categories:

1. Design-related,

2. Transparency-related,

3. Fair process, and

4. Collective action.

Empowerment by design

Platforms should enable users to personalise their online experience. Automated systems for organising and recommending lawful content should allow users to opt out, hide certain categories of content or block other users.

Third-party labelling tools can help users make informed choices about content. Platforms of significant influence may need to open their systems to third-party tools that assist in personalisation, subject to accountability requirements.

Design must also promote inclusivity. Platforms should address accessibility barriers faced by persons with impairments and ensure that safety tools are usable by all.

Age assurance systems are required to protect children from age-restricted content, but they must respect children's privacy and evolving capacities. The recommendation cautions against excluding children from online spaces or exacerbating discrimination.

Transparency

Users should understand how platforms organise content and moderate behaviour. Platforms are urged to explain their algorithmic systems for content organisation and curation. They should publish statistics on content moderation decisions and qualitative reports on the accuracy of automated moderation tools.

Transparency extends to advertising: platforms must disclose the identities of advertisers, the targeting techniques used, and spending. They should reveal how user-generated content is monetised and the principles used to allocate resources to creators.

Independent researchers play a crucial role in uncovering systemic issues. The recommendation emphasises that researchers should have access to platform data in a secure, legal, and privacy-compliant manner. Access may be granted through external vetting when personal data is involved. Researchers should also be allowed to use platforms to study social phenomena.

Procedural rights and fair process

Platforms must be clear about the contractual policies and rules that govern their services. Changes to these rules should be notified in advance and explained in an accessible language.

When platforms make content moderation decisions, they should notify affected users, explain the grounds for the decision and provide avenues for appeal. Appeals should include independent oversight mechanisms, such as out-of-court dispute-resolution bodies.

Collective action

Users should be able to report breaches of platform rules and legal restrictions easily. Platforms should provide feedback on follow-up actions. Users submitting notices about potentially illegal content should also receive feedback and have the right to appeal decisions.

The recommendation encourages recognising professional flaggers and user groups who can act as independent experts and advocate for user interests.

Categories of online risks and recommended responses

Subscribe now

The significance of this recommendation

The Council of Europe’s new recommendation is both an evolution and a consolidation of existing human rights principles applied to the digital space.

It acknowledges the power asymmetry between large platforms and individual users, and addresses this by imposing differentiated responsibilities based on size and impact.

This approach recognises that uniform regulations can stifle innovation or overwhelm smaller actors, while leaving major services inadequately regulated.

The recommendation’s focus on empowerment is notable. It goes beyond protection to encourage users to actively curate their digital environment. Personalisation tools, third-party labels and accessible interfaces are intended to give users agency over what they see and engage with.

This reform reflects an understanding that safety cannot be achieved solely through content removal. A pluralistic digital sphere requires that users are equipped to navigate diversity and dissent without being overwhelmed by harm.

Another significant element is the recognition of intersecting vulnerabilities. Women, children and marginalised communities often bear the brunt of online abuse. The recommendation highlights the need for age-appropriate systems and inclusive design to ensure that safety tools serve all users. States and companies can address the long-standing inequities that persist both online and offline.

Transparency provisions also have far-reaching implications. Requiring platforms to disclose how algorithms work, how moderation is conducted and who funds advertising opens space for public scrutiny. It empowers researchers to study the impacts of digital platforms and fosters trust by shedding light on practices that have traditionally been opaque. However, implementing meaningful transparency will require cooperation between regulators, platforms and civil society.

The recommendation aligns with global trends towards regulating digital services. The European Union’s Digital Services Act and the United Kingdom’s Online Safety Act 2023 similarly impose obligations on platforms to assess and mitigate risks.

The Council of Europe’s focus on human rights provides an additional layer of normative guidance, emphasising the need to preserve freedom of expression. As such, this recommendation may influence future national legislation and international norms.

Leave a comment

This newsletter includes references and links to external sources for informational and educational purposes only. Inclusion of these sources does not constitute endorsement, approval, or verification of their views, accuracy, or conclusions. Responsibility for the content of the referenced materials remains solely with the original authors and publishers. Our newsletter does not represent any legal advice.

Private technology companies now exercise operational influence in armed conflict, e.g., through control of digital infrastructure, satellite connectivity, artificial intelligence systems, cybersecurity and cloud computing networks that states rely on during hostilities. Existing legal frameworks, such as public international law and corporate social responsibility frameworks, appear institutionally unprepared for this reality, which exposes an uncomfortable concentration of strategic authority in private entities that were never designed to exercise war-related power.

Share

Newsletter Edition 89

The private tech company controversy

Private technology companies now wield operational influence in armed conflict that many states once considered an exclusive sovereign power. Decisions taken inside corporate boardrooms can affect military capability during active hostilities. Law has not fully caught up with this reality, yet the consequences are already visible in current world conflicts.

Public international law was designed with states and armed forces in mind; however, the legal framework governing armed conflict already contains rules that extend far beyond uniformed combatants. The rules contained under article 52 of the Additional Protocol I to the Geneva Conventions establish that objects become military objectives when they make an effective contribution to military action and when their destruction offers a definite military advantage.

Modern digital infrastructure exists directly within that legal logic. Corporate satellite networks, private intelligence platforms, and cloud computing systems can become operational components within a conflict environment even though they remain privately owned.

Technology companies therefore operate in a complex legal and political space where corporate decisions intersect with international humanitarian law, sanctions regulations, and corporate social responsibility.

When a private technology company decides who gets connectivity, cloud computing, satellite imagery, or defensive cyber services during an armed conflict, that company is not merely providing a service; it is exercising a form of power that can affect military operations and diplomatic outcomes.

Subscribe now

Existing laws already have mechanisms that can treat parts of that conduct as connected to the conflict.

The argument that the law does not already label technology firms as belligerents, because international humanitarian law still distinguishes civilians from combatants and civilian objects from military objectives. The law still treats civilian protection as the default.

However, the law is also clear that effects and contributions matter, and business and human rights standards likewise focus on adverse impacts and due diligence rather than on corporate self-description.

The private capabilities that now steer conflict

Let us reflect on commercial satellite connectivity. In plain terms, the same terminals and network can connect civilian services and also carry command communications, drone video, and targeting-related data. It was reported in June 2023 that the United States Department of Defense purchased satellite communications services from Starlink for Ukraine, and it was later reported in July 2025 that a global Starlink outage disrupted Ukrainian military communications, which is a reminder that dependence on a single private network can become an operational reality.

Control over that service is not a nominal issue. It was reported on 25 July 2025 that Elon Musk ordered the deactivation of Starlink coverage in specific occupied areas during late September 2022, and that the resulting blackout impaired Ukrainian operations. It was also reported in September 2023 that Elon Musk refused a request linked to Starlink use near Crimea for an attack on Russian forces.

Read our previous newsletter on the use of autonomous weapons and the proliferation of AI in armed conflicts.

Technology Law

The Human Cost of Giving AI the Right to Kill Through Autonomous Weapons

Automation is disrupting the battlefield, and autonomous weapons and AI are getting closer to making life-and-death decisions on their own. This newsletter unpacks what that means for international law, human responsibility, and the future of war. We break down the key takeaways from a recent peer-reviewed journal article on autonomous weapons systems a…

Read more

a year ago · 2 likes · 1 comment · Technology Law

Commercial earth observation falls into the same strategic category because high-resolution satellite imagery can be public record and intelligence, and providers can decide when imagery is released and who can access it.

On 5 April 2026, it was reported that Planet Labs would indefinitely withhold imagery of Iran and surrounding conflict areas at the request of the United States government, and that a broader effort was underway to limit access to conflict imagery through distribution controls by providers that depend on government demand.

Information control is not only a Western problem. The Washington Post reported in April 2026 that private firms in China were marketing intelligence products on the Iran war, using satellite imagery and open-source data with artificial intelligence analysis, and the report described how private actors can amplify wartime information dynamics while states preserve formal distance.

Access controls also appear through government distribution channels. Reuters reported on 7 March 2025 that the United States government temporarily disabled Ukraine's access to commercial satellite imagery delivered through a United States government distribution programme, with the National Geospatial Intelligence Agency confirming the action, and the reporting described this as a pause implemented via the private provider Maxar.

Technology firms can also become strategic actors when they build systems for intelligence and defence customers, because private capability becomes state capability through procurement.

It was reported in March 2024 that SpaceX was building a network of spy satellites for the National Reconnaissance Office under a contract associated with Starshield, illustrating how corporate infrastructure can become intelligence infrastructure with limited public visibility.

Cyber operations and information operations sit alongside these tech systems. Microsoft describes nation-state cyber threats and influence operations in its Digital Defence Report; the United Nations has endorsed norms of responsible state behaviour in cyberspace through its expert process; and influential legal scholarship has examined how existing international law applies to cyber operations, including through the Tallinn Manual 2.0.

International humanitarian law already has categories for these actions

International humanitarian law applies based on facts, not labels, and a widely cited reference point is the Tadic Appeals Chamber, which described armed conflict as a resort to armed force between states or as protracted armed violence involving organised armed groups.

The rule that matters most for private technology infrastructure is the rule on civilian objects. Article 52 of Additional Protocol I to the Geneva Conventions 1949 states that civilian objects are all objects that are not military objectives, and it defines military objectives as objects that, by their nature, location, purpose, or use, make an effective contribution to military action and whose destruction offers a definite military advantage.

Digital infrastructure fits inside that logic without any need to invent new legal categories.

A satellite ground station, a data centre, or a particular communications link can remain protected as a civilian object in many settings, and that same object can become a military objective when it is used in a way that makes an effective contribution to specific military operations, which is why private assets can enter the targeting calculus even when privately owned.

The human side of the same problem is captured by the rule that civilians lose protection from direct attack for so long as they take a direct part in hostilities, and the International Committee of the Red Cross’s interpretive guidance explains direct participation through a threshold of harm, direct causation, and a nexus to hostilities.

Subscribe now

When a company becomes an arm of a state

Responsibility debates often turn on attribution. The International Law Commission Articles on State Responsibility provide that conduct carried out on the instructions of, or under the direction or control of, a state is attributable to that state. The commentaries also underline that attribution can exist even when the conduct is performed through private entities.

Case law illustrates contested thresholds. In Nicaragua v. United States of America, the International Court of Justice rejected attribution of all contra conduct to the United States despite extensive support, relying on an effective control approach focused on control over the specific operations, while the International Criminal Tribunal for the former Yugoslavia Appeals Chamber in Tadic ruled on an overall control concept in its own context, and academic analysis has compared these standards and their implications for state responsibility.

This framing matters when governments use private technology services as policy instruments. A government request to restrict satellite imagery distribution, a government decision to purchase and configure military connectivity from a commercial provider, or a government direction to pause intelligence sharing can become part of the factual record of state action, and those facts frame legal responsibility debates even when the public narrative focuses on the vendor rather than on the state.

Accountability arrives through regulation long before it arrives through courts

Domestic regulation often reaches companies first, because sanctions and export controls are designed for speed. In the United Kingdom, the Sanctions and Anti-Money Laundering Act 2018 is the framework statute for sanctions, and government guidance outlines licensing controls for exports of dual-use items, including software and technology. The European Union also controls exports and related services for dual-use items as part of a peace and security regime.

The United States provide similar leverage. The International Emergency Economic Powers Act provides statutory authority to act against an unusual and extraordinary threat originating outside the United States after a national emergency is declared, and this authority underpins sanctions and restrictions that can affect technology services and cross-border commercial activity.

Read our newsletter on accountability in space.

Technology Law

Space Law Since 1967 With Aspirations Written, But Accountability Missing

International space law has become an uneven patchwork of commitments, voluntary guidelines, and contested interpretations, and yet the newly released United Nations treaty booklet presents it as a comprehensive and reliable framework. Such presentation conceals persistent gaps in compliance, the limits of enforcement, and the reality that non-binding g…

Read more

9 months ago · 6 likes · 2 comments · Technology Law

Corporate responsibility frameworks have become compliance architecture rather than rhetoric. The UN Guiding Principles on Business and Human Rights mention a corporate responsibility to respect human rights through due diligence and remediation. The OECD Guidelines for Multinational Enterprises on Responsible Business Conduct embed risk-based due diligence as a government-backed expectation across products and services. The European Union Corporate Sustainability Due Diligence Directive entered into force in July 2024 with the stated aim of requiring companies to identify and address adverse human rights and environmental impacts across operations and value chains.

Litigation remains a narrower and contested route, particularly in the United States. Kiobel v. Royal Dutch Petroleum Co., 569 U.S. 108 (2013), applied a presumption against the extraterritorial application of the Alien Tort Statute. Jesner et al. v. Arab Bank, PLC, 584 U.S. 241 (2018) held that foreign corporations cannot be defendants under the statute. Nestle USA, Inc. v. Doe et al. 593 US _ (2021) rejected an Alien Tort Statute claim where the conduct relevant to the statute's focus did not occur in the United States, and further commentaries have described how these decisions narrow pathways for civil accountability for overseas harm.

International criminal law focuses on individual responsibility even when corporate structures sit in the background. Article 25 of the Rome Statute sets out individual criminal responsibility, including forms of participation such as aiding, abetting, or otherwise assisting in crimes within the International Criminal Court's jurisdiction. Article 25 significantly limits the ICC's personal jurisdiction to natural persons, which means corporate accountability questions often depend on domestic criminal law, domestic corporate liability rules, or regulatory action rather than on direct international prosecution of companies.

What ordinary people are left holding

Civilians have become users of wartime critical infrastructure whether they want that status or not, because the same services that keep hospitals connected and families communicating can also carry military communications and operational data.

Reporting on Starlink control during the war in Ukraine and on commercial imagery restrictions during the Iran war shows how quickly a commercially marketed service can become an operational dependency, and how quickly access can become subject to executive decisions, government requests, and platform-level restrictions that sit outside most public oversight.

Public regulation is not aligned neatly with conflict realities, and the gaps are sometimes explicit. The European Union AI Act entered into force on 1 August 2024 and will become fully applicable on 2 August 2026, with phased obligations. Importantly, article 2(3) of the AI Act excludes certain military, defence, and national security uses, and the official text explains that public international law is the more appropriate primary framework for military and defence activities involving lethal force.

Recurring governance issues appear across these themes, even when the technologies differ, for example:

• allocation decisions that determine where connectivity or data is available and on what terms;

• contract terms that constrain service refusal or embed security controls for particular government entities;

• access controls that limit who can see high-resolution imagery, threat intelligence, or location data during active hostilities

Private technology companies now sit inside the operational environment of armed conflict. Infrastructure owned and operated through corporate platforms now carries military communications, processes intelligence data, and controls access to digital systems that governments rely upon during hostilities. International humanitarian law, including the rules on military objectives, already recognises that objects which make an effective contribution to military action may enter the legal calculus of war.

Legal responsibility, therefore, extends beyond traditional battlefields and into corporate systems that support modern conflict operations. Corporate conduct, regulatory oversight, and public international law now intersect in ways that affect civilians, governments, and companies simultaneously.

Public debate about warfare rarely includes the legal implications of privately owned technology infrastructure. Greater scrutiny of that relationship encourages a deeper understanding of how modern conflict actually operates and how law responds when corporate power intersects with armed force.

Leave a comment

This newsletter includes references and links to external sources for informational and educational purposes only. Inclusion of these sources does not constitute endorsement, approval, or verification of their views, accuracy, or conclusions. Responsibility for the content of the referenced materials remains solely with the original authors and publishers.

Governmental interest in automated AI judges is driven less by justice and more by administrative convenience, fiscal pressure, and institutional control. This newsletter exposes how AI promises speed, uniformity, and predictability while threatening transparency, accountability, and human judgment. The analysis challenges the assumption that efficiency improves justice, warning that delegating adjudication to AI risks transforming courts into instruments of bureaucratic optimisation rather than guardians of legal legitimacy.

Share

Newsletter Edition 88

The Administrative Fantasy of Justice Without Human Intervention

I might raise some eyebrows by saying this, but some governments appear eager to place your fate in the hands of an algorithm. In fact, in China, millions of legal cases have already been decided by “Internet courts” staffed with non-human judges operating entirely online.

These AI-driven cases handle everything from e-commerce disputes to loan defaults, and remarkably 98% of their rulings have been accepted without appeal.

It might be startling to learn that a court with no human judge present can ask questions, weigh evidence, and issue verdicts via a holographic avatar, as demonstrated in Hangzhou’s Internet Court.

The system even runs 24 hours a day, 7 days a week – a round-the-clock justice delivery that no human judge could ever match.

When I first heard about this, I felt equal parts fascinated and uneasy. I want to talk to you about why some governments are so tempted by the idea of AI judges, and what it means for the future of justice.

The Allure of Automated Justice

I have spent enough time around the legal system to know that efficiency is the magic word that every government loves to hear. Courtrooms around the world face crushing case backlogs and slow proceedings. The notion of an AI “robot judge” promises lightning-fast case processing, potentially clearing dockets that human judges struggle to manage.

Sometime ago, media reports breathlessly announced that Estonia was building exactly such a robot judge to handle small claims disputes and help clear its backlog. Officials supposedly wanted an algorithm to analyze documents and reach decisions on claims under €7,000, which a human judge would then simply review.

The project was touted as one of the most advanced examples of AI in the judiciary, justice by artificial intelligence. What exactly was the promise? Quicker resolutions, lower costs, and no more waiting months for a court date.

We later learned that this story was more hype than reality. In 2022 the Estonian Ministry of Justice felt compelled to clarify it never had any project or even ambition to replace human judges with AI.

That did not stop the idea from capturing imaginations. And frankly, it is easy to see why the idea is seductive.

Automating routine court decisions could free up human judges for the hardest cases and eliminate mundane tasks.

In theory, an AI judge might churn through straightforward disputes with the detached precision. One enthusiastic commentator described the potential “cost savings” as “astronomical”, noting that an AI system could issue a preliminary decision in under a month, and unlike a human it “is not hungry or tired”.

Governments hear things like that and start picturing leaner budgets and ultra-efficient courts.

Consistency and objectivity are another part of the allure. Ask any lawyer and they will tell you that different judges can reach very different outcomes on similar facts.

Humans are fallible and sometimes inconsistent, but an AI algorithm can be replicated and standardized nationwide. In China, the ruling Communist Party has explicitly embraced “Smart Courts” as a way to improve consistency in judicial outcomes and increase public trust in the courts.

From the perspective of central authorities, if every courtroom uses the same AI system, you eliminate rogue judges who might deviate from policy and you ensure each defendant is subject to the same decision criteria everywhere.

The temptation here is control: AI systems can be centrally updated or monitored, giving governments more oversight over the judicial process.

In an authoritarian system, that consistency also conveniently enables centralized oversight and intervention in cases when needed.

Even in democracies, one can see the appeal of a tool that might render justice more predictable – no more “judge lottery” where your fate depends on who happens to preside.

There is also a public perception angle. Many people have stories of judicial errors, biases, or high-profile miscarriages of justice. An AI, on the surface, carries none of the human baggage; it does not have bad days, it does not hold grudges, it does not get star-struck or prejudiced.

Some technocrat policymakers genuinely believe that a well-designed AI could be more impartial than a human judge. For example, in traffic or parking fine disputes, an algorithm might decide purely on data (Was the car parked too long? Did the camera catch the license plate?) without being swayed by a defendant’s attitude or appearance.

We have already seen glimpses of this: a UK-developed chatbot lawyer app famously overturned 160,000 parking tickets by automatically generating appeals, exploiting the system’s own rules.

If an AI can beat humans at following legal rules for parking fines, why not let it decide them in the first place?

Also, let us not forget speed and accessibility. A digital judge could in theory handle cases via video or online submissions, delivering rulings in hours rather than weeks.

During the COVID-19 pandemic, courts around the world turned to Zoom and online systems out of necessity. This accelerated acceptance of online disputes resolution.

Tech-forward nations like China took it further. Their Internet courts allow citizens to file cases online, attend hearings by video chat, and receive judgments electronically.

Such systems can dramatically lower the barrier to accessing justice, especially for people in remote areas or with small claims not worth a costly legal battle.

Proponents say AI judges are a natural next step to make justice system more user-friendly. No intimidating courthouse, just an app on your phone that issues a ruling.

In Beijing’s Internet Court, the average case reportedly concludes in just 40 days, with hearings under an hour on average.

Imagine a civil claim being filed, argued, and resolved in a matter of weeks entirely through an online platform. That is the vision.

Reality Check: Experiments in AI Judging

We should acknowledge that so far, fully automated judges remain mostly experimental.

China is the clear frontrunner. Since 2017, its specialized Internet Courts have been operating in cities like Hangzhou, Beijing, and Guangzhou.

The “judges” in these courts are effectively AI-powered decision systems with a virtual judge interface. They handle a surge of cases tied to the digital economy (online commerce disputes, copyright for online content, etc.), and by all accounts the volume is immense.

In just a six-month period in 2019, users conducted over 3.1 million legal activities through the Hangzhou Internet Court platform.

One striking statistic from Beijing is that over a million people have used the system, yet appeals are extraordinarily rare, nearly all parties accept the AI’s verdict.

The platform even populates a life-like avatar of a judge, a 3D modelled person in judge’s robes, who can ask the litigants questions on screen. Chinese reporters have sat in on these virtual hearings and watched a holographic judge guide the proceedings.

Other countries have flirted with AI judging in narrower contexts. You might have heard of proposals to use AI for small claims and disputes.

While Estonia’s “robot judge” turned out to be a myth, the very idea sparked global discussion.

There is a kernel of reality in these ideas: Online dispute resolution (ODR) systems are growing, and they often involve automated decision-making for low-stakes issues.

For instance, Canada has experimented with ODR for simple civil claims and certain tribunals, where an algorithm or guided system helps the parties reach a resolution or even renders a proposed outcome.

These systems stop short of a final binding judgment by AI, but they inch close. If an AI mediator proposes an outcome and both sides accept, effectively the AI “decided” the case.

In the United States, meanwhile, we see a different path to using AI to assist judges rather than replace them, at least for now. American courtrooms in several states have started integrating algorithmic risk assessment tools to guide decisions on things like bail and sentencing.

These programs, such as the well-known COMPAS system, generate scores predicting a defendant’s likelihood of reoffending. Judges then consider those scores when deciding whether someone gets bail or how long a sentence to give.

In theory it is just advisory, but in practice it can heavily sway outcomes. This approach has been contentious – I will get to the controversies in a moment – but it shows how even in a justice system that values jury trials and human judges, some decision-making is being handed to algorithms.

In fact, the Wisconsin Supreme Court confronted this issue in a notable case: State v. Loomis 881 N.W.2d 749 (Wis. 2016). In that case a defendant argued it was unfair that an opaque algorithm helped determine his prison sentence.

The court upheld the sentence but cautioned that such risk scores should be only a supplementary factor and must not replace a judge’s own judgment.

The message from the ruling was essentially in that you can use the AI’s recommendation, but the human judge is still responsible for the decision.

That seems to be a critical point. So far, even the most ambitious experiments usually leave a human with some liability. For instance, China allows appeals to a human judge if someone disagrees with the AI outcome.

The vision of completely replacing judges in all cases remains more of a thought experiment than a reality in 2026. However, every year, the line nudges forward.

Just recently, I saw news of two U.S. judges who admitted their staff had used ChatGPT-style AI tools to draft portions of judicial orders, with disastrously erroneous results that slipped through. This caused quite a stir, prompting calls for clearer rules on how judges and clerks may use AI.

Indeed, it is a reminder that even if we are not handing the gavel to an online judge today, AI is already seeping into the judicial process in bits and pieces, for better or worse.

Blind Justice or Biased Algorithms?

Before we all warm up to the inevitable, we need to discuss frankly about the serious concerns and limitations of AI as a Judge.

The promise of impartiality from an AI is not a given at all. Yes, an AI comes without human emotions, but it inherits the biases of its data and programming.

That risk is present. In the United States, the use of COMPAS and similar sentencing algorithms has become a cautionary tale. Investigative journalists discovered that COMPAS was far more likely to falsely label Black defendants as high-risk future criminals compared to white defendants. Think about that; a supposedly objective tool was doubling the rate of false “future crime” flags for Black individuals.

Meanwhile it was more often underestimating risk for white defendants, incorrectly giving them low risk scores.

The bias was not deliberate in the sense of someone programming racism openly; it emerged from patterns in the underlying data and how the algorithm was developed.

Should we regulate the developers or the AI model? Read our newsletter to learn more about regulatory approaches:

Technology Law

Regulate the AI Developers, Not the AI

AI systems are getting more powerful, but the real risk often lies with the companies behind them. In this research spotlight, we discuss a scholarly article “Entity-Based Regulation in Frontier AI Governance” published on the Carnegie Endowment for International Peace website. It explores why current rules that focus on AI tools themselves are missing …

Read more

a year ago · 9 likes · 2 comments · Technology Law

From the perspective of the defendant who is denied bail because a computer indicated so, the distinction does not matter, it just feels like algorithmic prejudice.

This is a nightmare scenario for automated justice, that we might replace human bias with a hidden, harder-to-challenge bias embedded in code.

Another glaring issue is transparency and the right to explanation. In a courtroom, a human judge is expected to explain their reasoning in a judgment. How do you question an algorithm’s reasoning?

Many AI models, especially advanced machine learning ones, operate as a “black box”. They crunch inputs and produce outputs, and not even the developers can easily explain the exact decision path.

This was a core of Mr. Loomis’s complaint in the Wisconsin case as he had no way to challenge the COMPAS algorithm because its inner workings were proprietary and opaque.

It is fundamentally troubling to imagine standing in court, hearing “the computer says you are high risk, so you get a harsher sentence,” and not being able to assess that computer’s logic.

Due process in many countries includes the right to review and contest evidence, but does an algorithm’s output count as evidence? If so, can the defendant demand access to the source code?

These legal questions are largely unresolved. There is a growing movement insisting that “algorithmic accountability” and transparency must accompany any use of AI in government decisions affecting rights.

Without transparency, an AI judge would be an inscrutable authority, which undermines a fundamental principle of justice. Decisions must not only be fair, but be seen to be fair and reasoned.

We also have to consider empathy and moral judgment, qualities that we expect, or at least hope, human judges will possess.

A judge in a courtroom can look a defendant in the eye, can consider pleas for mercy, can weigh intangible factors like remorse. Can an AI do that? Not really, not yet.

An algorithm scores what it is given to score. It might be great at parsing legal texts and past cases, but justice is more than black letter law application.

There are fears that an automated judge would be ultra-strict, after all, a computer won’t bend a rule or overlook a nuance unless explicitly programmed to.

It has been argued that mercy, context, and human intuition are indispensable to justice, and these are things no AI can replicate. I find it hard to imagine an AI automated system exercising equitable discretion or interpreting a law in light of evolving social values.

At best, it will do what it’s told; at worst, it might rigidly enforce even unjust laws without question.

A chilling thought is that an authoritarian government could program an AI judge to enforce oppressive laws to the letter, with flawless efficiency and no dissent. Human judges can resist immoral orders; AI might not have that capacity.

The accountability problem looms large too. If a human judge makes a grievous error or is biased, there are mechanisms (imperfect as they are) to appeal, to seek review, even to impeach or discipline the judge.

If an AI judge makes an error, say, convicts an innocent person due to a glitch or biases, who is responsible? The company that developed the software? The government officials who deployed it? It becomes a blame-shifting fiasco.

Also, how would such an error even be discovered? If all judges were algorithms applying the same model, a systemic flaw could go unnoticed for a long time, affecting thousands of cases before anyone realizes. That scenario should keep anyone up at night more than we care to admit!

Collision Course with the Law

You might be wondering whether governments even legally hand over judging to AI? In many places, this idea runs into legal roadblocks, and rightly so.

For example, in Europe there are strong legal guarantees of a fair trial and human accountability. The European Union’s data protection law (GDPR) explicitly gives people the right not to be subject to a decision based solely on automated processing if it has significant effects on them.

What is the future of European courts with the integration of AI in the judicial process? Find out more:

Technology Law

The Digital Future of European Courts

The European Commission is drafting a new strategy to bring courts into the digital age by 2030. These reforms will involve faster case hearings, fewer delays, smarter tools (e.g., AI) and less paperwork. The European Commission intends to fix outdated, expensive and slow justice systems…

Read more

a year ago · 4 likes · Technology Law

A judgment in court is arguably the most significant decision one could face.

This means that under current EU law, you can insist on a human review of an automated decision.

A fully AI judge with no human involvement would be at variance with that right, unless EU countries carve out an exception in law. Indeed, the EU is actively working on regulations for AI.

The EU Artificial Intelligence Act classifies any AI used in judicial decision-making as “high-risk”, recognizing the profound impact on rule of law and individual rights.

The EU lawmakers have even inserted a clear principle in the latest draft: AI may support judges but must not replace them, the final decision must always be made by a human.

In other words, European policy is drawing a red line that no matter how advanced AI gets, an actual person should be the one delivering the verdict when it comes to dispensing justice.

Are lawyers losing control to AI? Is the legal profession at risk of AI proliferation and to what extent? Read our newsletter to find out more:

Technology Law

The Legal Profession Is Losing Control To AI

The legal profession is outsourcing its thinking. AI is already writing arguments, summarising cases and drafting contracts, often without human intervention. Is this an erosion of legal practice? If the law becomes automated guesswork, then justice becomes optional. The silence from regulators and educators is not only strange, but it is dangerous…

Read more

a year ago · 11 likes · 1 comment · Technology Law

This aligns with the prevailing view in international human rights law that everyone is entitled to have their case heard by a “competent, independent and impartial tribunal”, phrases which presume a human judge sitting and listening.

Outside Europe, these debates are just as alive. In the United States, there is no single law like the GDPR’s Article 22, but the judiciary itself is proceeding cautiously. A U.S. federal judicial task force recently warned judges not to delegate core judicial functions to AI, especially not the act of adjudicating a case.

The concern is that even if AI can help with research or drafting, the judge must remain fully responsible and engaged in the decision.

Influential voices in the legal community are emphasizing that AI should assist, not replace human judgment.

Even China, for all its tech enthusiasm, maintains a fig leaf of human involvement, as noted, one can appeal an AI court’s decision to a human judge, and Chinese officials portray their Smart Courts as enhancing efficiency while still maintaining human oversight.

The official line is that technology should support the decision-making power of judges, but not supplant it.

Of course, the reality of how much human oversight is actually happening in China’s Internet Courts might be debatable, but at least on paper, they acknowledge a human backstop.

It is interesting that even governments keen on automation still feel the need to reassure the public that judges are not being entirely replaced.

That tells us something that there is a deeply ingrained cultural and constitutional importance to the human judge as a symbol of justice.

Replacing that human figure with a AI is bound to provoke resistance. Indeed, when the idea of the robot judge in Estonia made headlines, it sparked plenty of discussion in Europe about the ethics and legality of such a move.

The pushback from the legal community was swift, and as we saw, the government backed away, calling it misleading news.

Likewise, in France, instead of automating judges, the government went the other direction by banning the practice of statistical analysis of judges’ past decisions (to profile or predict their rulings).

A law was passed to protect human judges from being quantified by AI, ironically.

While some authorities fantasize about AI judges to streamline justice, others are enacting laws to shield the human element in judging.

A Careful Path Forward

As someone deeply fascinated by the intersection of law and technology, I understand both the temptation and the fear at play here. When talking to non-lawyers about this, I often find people initially intrigued. Who would not want faster and cheaper court cases?

Then arrives the viscerally uncomfortable thought of an AI driven robot pronouncing a prison sentence or deciding a child custody dispute. That discomfort is healthy. It means we recognize something vital that justice is not merely computational. The rule of law is as much about process and trust as it is about outcomes.

We trust a human judge to hear us, even if they might err, because we ascribe legitimacy to that human deliberation. Transferring that trust to an AI is a huge leap.

Governments will likely continue to experiment with AI around the edges of the judicial process.

We will see more AI legal assistants that help judges research cases or draft routine parts of judgments.

We will see expanded online courts for minor issues, possibly with automated mediation and suggested resolutions.

Be that as it may, there is a long road from there to a world where you walk into a courthouse (or log into one) and face an AI judge as the final arbiter.

For the foreseeable future, fully autonomous AI judges remain a controversial proposition fraught with legal and moral peril.

Even the most advanced AI cannot yet replicate the full spectrum of human judgment, especially the qualities of compassion, wisdom, and public accountability that we expect from our judges.

I have confidence that many of the safeguards in law will hold, and that any use of AI in judging will be accompanied by the right to a human appeal or review.

International principles are already crystal clear on one thing: technology should serve humanity, not displace it in the courtroom.

So, is an AI judge coming for your day in court? The honest answer is that governments are tempted, yes, but also wary. They stand to gain efficiency and control, yet they risk losing the public’s faith in justice if they go too far.

For now, I am relieved that the consensus is to move carefully. We should demand nothing less. The day may come when AI takes its place on the bench, but if and when that happens, I suspect we will still want a human behind the gavel of justice.

Leave a comment

Disinformation laws are often drafted with a confidence that is not matched by their democratic legitimacy. Legal systems appear willing to trade precision, restraint, and procedural safeguards for speed and symbolic reassurance, even when the subject matter sits at the core of political expression. This trend deserves sustained criticism, not because false information is harmless, but because law that intervenes too broadly in public discourse alters how democratic power is exercised, delegated, and justified.

Share

Newsletter Edition 87

The Legal Campaign Against Disinformation and Its Democratic Risks

The current generation of laws meant to counter falsehood in the digital world carries a real risk of weakening the very democratic values they claim to defend. It is easy to accept the impulse behind these laws. False information can corrode trust, deepen division, and influence the course of public decision making in ways that are harmful to societies.

Nonetheless, the responses that legal systems are adopting raise questions about freedom of speech, accountability, and the role of government and private technology companies in controlling what citizens are allowed to know and say.

Governments are passing statutes and regulators are enforcing rules with significant consequences. Individuals are being asked to adapt to legal frameworks that touch on fundamental liberties while technology platforms are being pressed into roles that shape political discourse.

This newsletter will trace legislative frameworks, highlight relevant legal developments globally, and critically assess how these laws are playing out as real world tools that interact with technology and civil liberties.

The Rise of Disinformation Regulation

In recent years, the response to disinformation has included a mix of statutory mandates and regulatory expectations. In the European Union, the Digital Services Act (Regulation of the European Parliament and of the Council of 19 October 2022) is central to how online content is regulated.

It imposes new responsibilities on very large online platforms and search engines aimed at enhancing transparency of content moderation and curbing harmful content including disinformation under certain conditions.

The European Commission has emphasised that this is part of broader efforts to protect democratic processes and strengthen public debate.

In the United Kingdom, the Online Safety Act 2023 creates an expansive set of obligations on providers of internet services to manage harmful content.

Civil liberties organisations have argued that the Act grants broad powers to regulate speech and encourages platforms to take down content pre emptively to avoid liability.

Critics such as the Open Rights Group and Article 19 have warned that such mechanisms risk impinging on freedom of expression and access to information.

Beyond Europe, legal frameworks are emerging that criminalise or civilly sanction the communication of false information. In the Indian state of Karnataka, a draft bill proposes jail terms for spreading so called fake news or content that is defined in vague terms, including anti feminist content and superstition. Free speech advocates warn that such legal language could sweep in a vast range of expression and be used inconsistently.

Singapore’s Protection from Online Falsehoods and Manipulation Act was passed in 2019 with the intention to counter deliberate online falsehoods while attempting to exclude opinion and satire, yet concerns remain about the broad discretion given to authorities and the potential chilling effect on legitimate discourse.

Ethiopia’s Hate Speech and Disinformation Prevention and Suppression Proclamation makes social media users and intermediaries criminally liable for posts deemed to disrupt public order, showing how legal tools can extend to severe penalties for online speech. Human rights organisations have criticised this law as infringing on fundamental expression rights.

These legislative efforts reflect the global urgency with which false information online is treated. However, the very design of these laws often places enormous discretionary power in the hands of regulators or platform operators to decide what content is permissible.

Democracies are rethinking how they legislate free speech in an environment where digital systems mediate so much of public discourse, but many of the legislative responses are bending longstanding protections in ways that deserve careful scrutiny.

The Legal and Constitutional Debate

The core tension at the heart of these laws is the balance between preventing harm and protecting freedom of expression. Democratic constitutions and human rights frameworks often guarantee robust rights to free speech.

In the United States, the First Amendment has been interpreted to protect even false statements in many contexts unless they harm specific individuals through defamation or similar legal channels.

Attempts at regulating deepfakes and election related speech have encountered immediate legal challenge on constitutional grounds. In 2025, X Corp filed a federal lawsuit to overturn Minnesota’s ban on political deepfakes arguing that the law penalises election related expression and violates First Amendment rights.

For a thoughtful discussion on the negative impact of deepfakes in our courts and society, please read our newsletter:

Technology Law

Why Deepfake Technology Forces Courts to Rethink The Reliability of Evidence

Courts can no longer credibly claim that evidentiary reliability is a settled problem managed through existing rules and judicial instinct. Deepfake technology has exposed how fragile long held assumptions about recorded truth really are, not because judges are inattentive, but because the legal system was never designed to verify authenticity in an env…

Read more

6 months ago · 11 likes · 7 comments

In Murthy v. Missouri, the United States Supreme Court addressed the ability of the federal government to communicate with social media companies about content moderation. The Court allowed government involvement regarding misinformation removal, but this itself sparked controversy about where the line is drawn between legitimate action against falsehoods and the government influencing the decisions of private platforms.

In Europe, freedom of expression is safeguarded under Article 10 of the European Convention on Human Rights and the EU Charter of Fundamental Rights. However, the EU’s regulatory approach does not explicitly define disinformation in statutory text, and enforcement under the Digital Services Act is tasked to both regulators and platforms to curtail disinformation and illegal content.

Scholars have raised serious questions about whether these approaches sufficiently protect free expression rights and whether they empower private companies to act as arbiters of political speech without due process.1

The German Network Enforcement Act, passed in 2017, obliges platforms to remove illegal content within strict timeframes or face steep fines. The law has been widely criticised for creating incentives for platforms to err on the side of removal to avoid penalties, which essentially pushes companies to make judgments about speech that ought to be matters for courts. Critics argue that this dynamic can lead to disproportionate censorship of legitimate expression.

France’s Avia Law, aimed at combating hateful and illegal content, saw major portions struck down by the Constitutional Council because they infringed too broadly on freedom of expression. Yet, the law’s initial passage highlighted how national legislatures are grappling with the challenge of regulating online speech.

These legal debates involve core principles that structure democratic participation. The ability to hear opposing views, to criticise government action, and to engage in public debate are foundational to self governance.

When legal frameworks alter incentives for speech or create mechanisms that lead to over removal of content, there is a collateral effect on democratic engagement.

Democracy Beyond False Statements

It is vital to acknowledge that disinformation does cause harm in itself. False narratives and fake news about elections, public health, or civic processes can mislead citizens and erode trust in institutions.

Technical studies have shown that online propaganda and misinformation contribute to polarisation and societal division.2

At the same time, it is essential to differentiate the regulation of harmful and criminal speech from broad preventive laws that apply across wide categories of expression.

Democracies have long recognised that some kinds of speech such as incitement to violence or defamation can be subject to legal limits.

Nonetheless, new laws aimed at digital disinformation often lack clear definitions that distinguish between intentional manipulation and honest error or opinion.

Legal frameworks that do not ensure procedural safeguards or judicial oversight risk granting regulatory bodies or private entities the power to remove speech without sufficient justification.

If laws are designed in ways that blur these fundamental distinctions, then democracy itself suffers. Citizens are less exposed to the full range of perspectives and have diminished ability to challenge prevailing narratives. A society that cannot tolerate disagreement and dissent risks becoming less resilient, less informed, and ultimately less democratic.

Private Actors as Public Regulators

A critical concern in the modern legal regime on disinformation is the role of private technology companies. Laws like the EU digital services framework and the UK’s online safety model rely heavily on what platforms decide and how they enforce rules.

Platforms are required to act to avoid penalties. This effectively deputises private companies to enforce public norms about speech that historically were the domain of public law and independent courts.

Platforms have commercial incentives and policies that are not always transparent or consistent across jurisdictions. A decision to remove content or to label it as false is made within a corporate governance structure not accountable to the public in the same manner as a democratic legislature or a judicial body.

This dynamic raises a question about legitimacy. Democracies rely on transparent and accountable institutions to define and enforce the legal bounds of expression. When private platforms operate in lieu of those institutions on matters that affect political speech, the democratic quality of that enforcement is uncertain at best.

Leave a comment

Legislative frameworks that push more power to platforms without robust oversight risk enabling forms of censorship that are neither subject to clear legal standards nor to democratic accountability.

Citizens often do not know why a piece of content is taken down. They have limited rights to appeal, and they encounter different outcomes depending on where they are located or how a platform interprets vague legal duties.

The International Ripple Effect

Legal approaches in one jurisdiction influence others. The European regulatory model, because of its size and market power, affects global platform behaviour.

US officials have openly criticised the EU Digital Services Act on grounds that it enables censorship beyond European borders and undermines free speech.

These critiques have become part of international diplomatic friction, with officials from one democracy publicly challenging another democracy’s approach to regulating digital speech.

At times, national courts take positions that reshape legal obligations. The Brazilian Supreme Court’s 2025 ruling that social media platforms can be held liable for user posts without judicial orders puts pressure on platforms to act quickly to remove harmful content or face legal risks. Such rulings create asymmetric incentives for moderation that may encourage broad content removal to mitigate liability, again with potential impacts on democratic debate.

Other countries, including in South Asia and Africa, are adopting laws that grant governments sweeping control over content under the pretext of security or misinformation control. These laws often intersect with broader patterns of suppression and have severe consequences for dissenting voices and civic freedoms.

The international proliferation of disinformation laws creates a patchwork of standards that technology companies must navigate.

In the absence of clear, globally accepted norms that respect free expression while addressing harm, there is a risk that legal models that prioritise control over speech will be adopted more widely, with negative consequences for democratic engagement.

What Democracy Requires

Democracy depends on open public discourse where ideas can compete and be tested against evidence and argument. The impulse to regulate falsehood is understandable, yet legal solutions must be calibrated carefully to respect foundational rights. Laws that are vague in definition, broad in scope, or lack adequate procedural protections risk being repurposed to silence dissent or to restrict controversial opinions that are essential to democratic deliberation.

Legal frameworks to counter disinformation should ideally operate with clear definitions, predictable procedures, and robust safeguards that protect legitimate political speech. They must uphold independent oversight and judicial review so that when speech is restricted, there is accountability and transparency in the process.

The current wave of disinformation regulation reflects a genuine concern about the impact of false information, but there is a real danger that in addressing this issue through broad legal authority, democracies may erode the very principles of free expression and accountability that make them resilient.

Links in this article reference public legal developments and reporting from credible sources. Readers are invited to examine the original materials themselves to further understand the content and context of the legislative and judicial activities discussed.

What are your thoughts about disinformation and fake news undermining democratic practices?

Leave a comment

Courts can no longer credibly claim that evidentiary reliability is a settled problem managed through existing rules and judicial instinct. Deepfake technology has exposed how fragile long-held assumptions about recorded truth really are, not because judges are inattentive, but because the legal system was never designed to verify authenticity in an environment where fabrication is easy, convincing, and legally consequential.

Share

Newsletter Edition 86

Deepfakes Are Not Just a Tech Problem; They Are a Justice Problem!

Courts have always depended on evidence as the anchor of decision-making. That dependence now sits under sustained pressure. This is not an abstract debate about future technology. It is a present reality that demands careful attention from anyone who cares about the rule of law, accountability, and fairness.

Video and audio that appear authentic can now be generated or altered in ways that defeat casual inspection and, in some cases, expert review. Courts have traditionally relied on a combination of common sense, procedural safeguards, and expert testimony to decide whether evidence is reliable. Deepfake technology puts pressure on all three at once.

This newsletter looks at why this matters, how existing evidentiary principles are being strained, and why courts are being forced to reconsider assumptions that once felt stable.

What Deepfakes Really Do to Evidence

Deepfake technology undermines a basic assumption that has long guided judicial reasoning, which is that recorded audio and video tend to reflect real events unless there is a concrete reason to doubt them.

Courts never treated recordings as infallible, but there was an underlying confidence that fabrication required effort, expertise, and resources that were not widely available.

That confidence no longer holds. Software tools now allow realistic manipulation of facial movements, voice patterns, timing, and context using datasets that can be gathered from public sources.

Social media platforms, conference recordings, podcasts, and court filings themselves provide the raw material. The result is not simply the existence of fake content, but uncertainty about authentic content.

A recording can be genuine and still be challenged with credibility. A recording can be fake and still persuade. Courts must now consider not only whether evidence appears real, but whether appearance itself has lost probative value. This affects admissibility decisions, weight given to evidence, and the allocation of burdens between parties.

Traditional Evidentiary Safeguards Under Pressure

Legal systems rely on a layered approach to evidentiary reliability. Authentication rules require parties to show that evidence is what it claims to be. Cross examination allows weaknesses to be exposed. Expert witnesses provide technical insight, while judges and juries assess credibility in context.

Deepfakes complicate each layer. Authentication becomes harder when visual similarity and voice matching are no longer meaningful indicators of origin. Cross examination struggles when the witness did not create the content and cannot explain the manipulation. Expert evidence becomes contested when experts disagree or rely on tools that themselves produce probabilistic conclusions.

Interested in learning more the future of courts in the EU? Check out this newsletter:

Technology Law

Issue 15: The Digital Future of European Courts

The European Commission is drafting a new strategy to bring courts into the digital age by 2030. These reforms will involve faster case hearings, fewer delays, smarter tools (e.g., AI) and less paperwork. The European Commission intends to fix outdated, expensive and slow justice systems…

Read more

a year ago · 4 likes · Technology Law

The law has always accepted that evidence can be forged. What is different now is scale and plausibility. Fabrication is easier, faster, and more convincing than before. This changes how much confidence can be placed in surface level indicators of truth.

Courts in several jurisdictions have already acknowledged this difficulty. Judicial opinions have begun to reference the risk of manipulated media, even where no deepfake allegation is proven. This shows that the issue is not limited to cases involving advanced forgery, but extends to general evidentiary assessment.

Criminal Justice and the Risk of Error

Criminal proceedings illustrate the stakes most clearly. Video evidence often carries strong persuasive force. Jurors tend to trust what they can see and hear. Prosecutors rely on recordings to establish presence, intent, or conduct. Defendants rely on recordings to show innocence, coercion, or misconduct by authorities.

Deepfakes introduce two risks at once. False inculpatory evidence may be introduced. Genuine exculpatory evidence may be dismissed as fake. Both risks undermine fairness.

Judicial systems have limited tolerance for error in criminal cases, yet procedural rules are slow to adapt. Judges must decide whether to admit recordings while knowing that their own ability to evaluate authenticity is constrained.

Excluding all contested recordings is not realistic. Admitting all recordings without deeper scrutiny is equally problematic.

Civil Litigation and Commercial Disputes

Civil courts are not insulated from these issues. Employment disputes may rely on recorded conversations. Commercial litigation may involve video meetings, voice messages, or recorded negotiations. Defamation claims increasingly involve manipulated content circulated online.

The evidentiary standard in civil cases is lower than in criminal cases, which increases exposure. A manipulated recording may tip the balance of probabilities even if doubts exist. This raises concerns about strategic misuse of deepfake material in high value disputes.

Judges must assess whether existing disclosure rules, expert evidence standards, and sanctions for misconduct are sufficient deterrents. There is growing recognition that technical manipulation can occur without leaving obvious traces, making post hoc remedies less effective.

Evidentiary Reliability as an Institutional Problem

Deepfakes force courts to confront evidentiary reliability as an institutional issue rather than a case specific anomaly. The problem is not limited to one dishonest party or one flawed expert. It is systemic.

Courts operate under time constraints, resource limits, and procedural fairness requirements. Judges cannot become forensic technologists. Jurors cannot be trained to detect synthetic media. Reliance on expert witnesses introduces cost and inequality, as well resourced parties can commission more persuasive testimony.

Several structural tensions become visible.

1. Authentication standards assume stable technical benchmarks.

2. Expert disagreement undermines judicial confidence.

3. Procedural equality is strained by asymmetric access to technical expertise.

These tensions are not resolved through better education alone. They require reconsideration of how evidentiary trust is constructed.

Regulatory and Policy Responses

Outside the courtroom, lawmakers and regulators are attempting to address deepfakes through criminalisation, labelling obligations, and platform duties. These measures indirectly affect evidentiary reliability by shaping how content is created, distributed, and preserved.

AI may be criminally liable, but only in some niche context. Read our deep-dive editorial on this topic:

Technology Law

Can AI Be Criminally Liable?

Around the world, prosecutors are circling, and in some cases, people are already being charged for what their AI systems did. World legal systems are catching up with reckless automation, and the consequences are real: injury, death, and yes, prison time. In this article, we explore how criminal liability is entering the AI age, what cases are already …

Read more

a year ago · 12 likes · 8 comments · Technology Law

European Union policy discussions under the Digital Services Act and Artificial Intelligence Act acknowledge the evidentiary risks posed by synthetic media.

United States federal agencies have issued guidance on synthetic media risks, particularly in election integrity and fraud contexts, which has downstream relevance for courts assessing authenticity.

Regulation alone does not solve the courtroom problem, but it influences the ecosystem in which evidence arises. Courts must operate within that ecosystem rather than outside it.

Why Courts Cannot Rely on Intuition Anymore

Judicial intuition has always played a role in assessing evidence. Judges develop instincts through experience. Deepfakes undermine that reliance because realism is no longer a reliable cue.

A video that looks implausible may be authentic, and a video that looks ordinary may be entirely fabricated. This inversion destabilises confidence in visual reasoning. Courts must acknowledge that intuition is no longer sufficient when dealing with contested digital media.

This recognition is already visible in judicial training materials and appellate commentary. It does not imply judicial failure, but it reflects technological change that outpaces inherited methods of evaluation.

Evidentiary Reliability as a Public Trust Issue

Courts do not operate in isolation. Public confidence in judicial outcomes depends on the belief that evidence can be assessed fairly. If members of the public believe that any recording can be dismissed as fake or accepted uncritically, trust erodes.

Deepfakes create a credibility gap in that genuine victims may struggle to prove harm. Wrongdoers may exploit doubt, and courts become arbiters of technical disputes that the public cannot easily follow.

This is not an abstract concern since media reporting already reflects scepticism about video evidence. That scepticism spills into legal proceedings, influencing juror attitudes and public reaction to verdicts.

Where the Conversation Is Heading

Courts are beginning to recognise that evidentiary reliability in the age of deepfakes cannot rest on assumptions formed in earlier technological contexts. Procedural rules, judicial reasoning, and evidentiary doctrines are being tested in real cases rather than academic debate.

The conversation is moving toward deeper scrutiny of provenance, stronger emphasis on corroboration, and greater caution in assigning persuasive weight to recordings standing alone.

This topic deserves sustained attention from lawyers, technologists, judges, and the public. Discussion, critique, and shared understanding matter because evidentiary reliability is not merely technical but it is foundational to justice.

How do you see courts addressing this problem in practice?

Leave a comment

English law has spent more than a decade pretending that digital value could be economically real yet legally peripheral, and the Property (Digital Assets etc) Act 2025 exposes how unsustainable that posture had become. Treating cryptoassets as something to be tolerated rather than classified produced uncertainty that benefitted speculation while undermining credit, enforcement, and accountability. Legislative recognition arrives late, not visionary, and it reflects institutional pressure rather than conceptual enthusiasm.

Share

Newsletter Edition 85

Digital property is no longer a theoretical category reserved for academic debate or courtroom experiments at the edge of private law, and the Property (Digital Assets etc) Act 2025 confirms that reality with a clarity that many governments have avoided for years.

This legislation matters because it places digital assets within the paradigm of property law rather than treating them as contractual conveniences or technological curiosities, and that decision has consequences for credit, debt, and access to finance that extend well beyond England and Wales.

Readers who have followed cryptocurrency since its early years will recognise a long period where value existed without legal recognition as property, and that gap created friction in every interaction with the financial system, particularly where lending, security, insolvency, and enforcement were involved.

The Act addresses that gap directly, and it does so with implications that are global in scope.

What the Act actually does

The Property (Digital Assets etc) Act 2025 confirms that certain digital assets are capable of being objects of personal property even where they do not fit neatly within traditional categories such as choses in possession or choses in action.

That statement appears simple, yet it resolves a problem that has affected courts, lenders, insolvency practitioners, and investors for more than a decade.

English law has historically relied on categories that assume tangibility or enforceable rights against a person.

Cryptocurrencies and related digital assets sit awkwardly outside those assumptions. They exist, they hold value, they can be controlled, and they can be transferred, yet they do not depend on a counterparty in the conventional sense.

The Act acknowledges this reality and provides statutory confirmation that these assets are not legal outliers.

Several court decisions paved the way for this outcome.

AA v Persons Unknown [2019] EWHC 3556 (Comm) confirmed that cryptoassets could be treated as property for the purposes of granting proprietary injunctions.

Ion Science v Persons Unknown [2020] EWHC 3688 (Comm) reinforced the view that digital assets could attract proprietary remedies.

Tulip Trading v Bitcoin Association [2022] EWHC 667 (Ch) raised more difficult questions about control, duties, and decentralised governance, but it still accepted the premise that the assets themselves were capable of being property.

The Property (Digital Assets etc) Act 2025 consolidates this judicial direction and removes uncertainty that had persisted because those decisions rested on common law reasoning rather than legislative authority.

Subscribe now

Why property status matters for credit and debt

Property status determines whether an asset can be used as collateral, whether it can be seized, whether it can be traced, and whether it survives insolvency. These questions are not academic. They decide whether lenders extend credit and whether borrowers gain access to capital on workable terms.

Cryptocurrency markets have grown in value without integration into mainstream credit systems because lenders rely on enforceability. A bank does not care about technical novelty. A bank cares about priority, certainty, and recovery. Without clear property status, digital assets sit outside the risk models that underpin lending decisions.

The Act brings digital assets closer to those models.

Collateralisation becomes legally intelligible once an asset is recognised as property. Enforcement becomes conceptually coherent once courts can treat digital assets as things rather than abstractions. Insolvency treatment becomes predictable once assets can be identified, valued, and distributed.

None of this requires enthusiasm for cryptocurrency as a social project. The law does not need belief. The law needs classification.

Access to finance and developing countries

Access to finance remains one of the most persistent structural problems facing developing economies. Credit is expensive, collateral is scarce, and legal infrastructure often struggles to support complex financial arrangements. Digital assets have often been presented as a partial response to these problems, yet legal uncertainty has limited their practical use.

Recognition of digital assets as property under a major commercial legal system has effects that travel beyond its borders.

English law remains a preferred governing law for international finance, commodity trade, and cross border lending. Legal recognition under English law influences contract drafting, risk allocation, and enforcement strategies in transactions involving parties across Africa, Asia, and Latin America.

Once digital assets can be recognised as property under English law, they can be referenced more comfortably in security agreements, trust arrangements, and financing structures that rely on English legal concepts. That matters in jurisdictions where domestic law may lag behind technological practice but where English law still governs the underlying transaction.

The Property (Digital Assets etc) Act 2025 does not solve access to finance, yet it removes one of the barriers that made digital assets unusable as serious financial tools in cross border contexts.

Debt, default, and enforcement

Debt markets depend on predictable outcomes in default scenarios. Creditors extend funds based on assumptions about recovery, ranking, and control. Digital assets challenged those assumptions because enforcement did not fit neatly into established procedures.

Recognition as property allows courts to issue proprietary remedies with greater confidence. Freezing orders, tracing claims, and equitable relief become easier to justify when the asset in question sits within a recognised legal category.

This matters for creditors, but it also matters for debtors. Legal clarity reduces the scope for arbitrary outcomes and inconsistent treatment. A system where enforcement is uncertain tends to favour those with superior resources and technical sophistication.

Clear classification improves procedural fairness even when outcomes remain contested.

Cryptocurrency and philosophical discomfort

Cryptocurrency has always produced philosophical discomfort within legal systems built around central authority. Property law developed in contexts where ownership could be anchored to physical control or legal rights against identifiable persons. Digital assets challenge both assumptions.

The Act represents an acceptance that law must describe reality rather than insist on historical categories. Control over a digital asset may be exercised through cryptographic keys rather than physical possession, yet control remains control. Exclusion remains possible. Transfer remains meaningful.

This does not resolve deeper debates about decentralisation, governance, or power. It simply recognises that value exists and that law must account for it.

Philosophically, this approach treats law as an organising system rather than a moral referee. The Act does not endorse cryptocurrency as good or bad. It acknowledges existence and assigns legal consequences.

Do you know that there are currently no international uniform conflict of law rules governing crypto assets globally? Read our newsletter to find out more:

Technology Law

Issue 16: International Law Cannot Keep Up With Crypto Assets

The UK is undertaking a significant reform of outdated legal rules that impact cross-border disputes involving crypto, blockchain, and electronic trade documents. These digital assets are recognised across borders and there are no standalone rules that enable predictable mechanisms to resolve legal conflicts…

Read more

a year ago · 5 likes · Technology Law

Many readers associate property law with land registries and conveyancing documents rather than digital wallets. The relevance becomes clearer once everyday interactions are considered.

Loss through fraud becomes a legal issue once assets are recognised as property.

Inheritance planning becomes coherent once digital assets can be treated as part of an estate.

Business balance sheets become more accurate once digital assets can be recognised as assets rather than accounting anomalies.

Employment disputes, marital property disputes, and insolvency proceedings increasingly involve digital assets. Legal recognition improves consistency across these contexts.

International implications

The Property (Digital Assets etc) Act 2025 contributes to an emerging consensus among advanced legal systems that digital assets require bespoke treatment within property law. That consensus affects regulatory coordination and private ordering.

Many countries seeking to attract investment often look to English law as a reference point. Legislative recognition creates a benchmark that others may follow, adapt, or resist.

Developing countries face a particular tension. Digital assets offer potential tools for inclusion, yet legal uncertainty increases risk. External legal frameworks often fill that gap. Recognition under English law provides a reference that can be leveraged even where domestic reform remains slow.

This does not impose English law on others. It influences contractual choices and dispute resolution preferences that already exist.

Cases that still matter

Despite legislative clarity, courts will continue to play a central role. Property status answers foundational questions but leaves many issues open.

Control and responsibility within decentralised systems remain contested.

Duties of developers and network participants remain uncertain.

Custody arrangements raise questions about bailment, trust, and fiduciary responsibility.

Tulip Trading case illustrates that property recognition does not resolve governance disputes. It frames them. Litigation will continue to define boundaries, particularly where losses occur and responsibility is disputed.

Interested in reading more about restitution and tort of conversion over crypto assets? Check out this newsletter:

Technology Law

Legal Update: The UK Just Reversed the Burden of Proof in Crypto Scam Cases and It’s a Big Deal

If you have ever worried about losing money to a crypto investment site, this one is for you, and it comes with a rare bit of good news. A crypto scammer thought he got away with over £500,000, until a new English law helped claw it all back. This is the first time victims have used a court power to recover stolen digital assets in full. Here's how it w…

Read more

a year ago · 3 likes · Technology Law

Key points from this new legislation

• Digital assets are now explicitly capable of being property under English law.

• Property status affects credit, collateral, restitution, trusts, insolvency, and enforcement.

• Legal clarity improves predictability without endorsing any technology.

• Cross border finance benefits from alignment with English legal concepts.

• Courts remain central in resolving unresolved governance questions.

Closing reflections

The Property (Digital Assets etc) Act 2025 places cryptocurrency within the machinery of private law rather than treating it as an exception that must be managed at the margins. That choice carries weight because property law structures economic life in ways that regulation alone cannot.

Recognition does not eliminate risk, volatility, or misuse. It reduces ambiguity. Ambiguity tends to favour insiders and penalise those without access to specialised expertise. Legal clarity distributes understanding more evenly, even when outcomes remain contested.

Property law has always been about allocating risk, value, and responsibility. Digital assets now sit within that framework, and the conversation about their role in credit, debt, and access to finance becomes more grounded as a result.

Comments are welcome on how recognition of digital assets as property may influence finance, responsibility, and legal coherence.

Leave a comment

European digital platforms have long treated user advertisements as harmless content that simply passes through their systems, yet this assumption has now reached its limit. The judgment in Russmedia Digital demonstrates that platforms have operated with an inflated sense of detachment from the personal data they publish. Courts are no longer willing to accept claims of neutrality when the harm caused to individuals is real, foreseeable, and preventable.

Share

Newsletter Edition 84

When Online Platforms Become Data Controllers

On 2 December 2025, the Court of Justice of the European Union delivered a significant judgment in Case C-492/23, Russmedia Digital and Inform Media Press. The Court’s decision marks an important clarification of responsibility under European data protection law.

The case establishes that the operator of an online marketplace must be regarded as a controller under the General Data Protection Regulation when personal data appear in advertisements published on its platform.

The case arose in Romania, where a woman discovered an online advertisement offering sexual services under her name, using photographs and a telephone number without her consent.

The advertisement was placed on the website www.publi24.ro, operated by Russmedia Digital.

Although the company removed the advertisement within an hour of being notified, the material had already spread to other websites and continued to cause harm.

The woman brought proceedings for the violation of her privacy, honour, and personal data rights.

The local court awarded her damages, but an appellate court overturned that decision, reasoning that the platform was merely a hosting provider with no direct control over the content uploaded by users.

The Romanian Court of Appeal then referred the matter to Luxembourg for a preliminary ruling, asking the Court of Justice to clarify the obligations of an online marketplace under the GDPR and whether such an operator could rely on the liability exemptions of the EU e-Commerce Directive.

Interested in reading more cases about the application of EU law? Check out this case report newsletter:

Technology Law

Case Report: The Cost of Ignoring an EU Directive (Commission v. Bulgaria)

The European Union gave every country a clear deadline. Bulgaria missed it. Then came silence, excuses, and political delays. Eventually, the European Commission ran out of patience and took the matter to court. At the centre of it all was a law about public data that should have been simple to adopt. Instead, it ended in a financial penalty and a warni…

Read more

a year ago · 4 likes · Technology Law

Defining Responsibility under the GDPR

The Court’s ruling provides a decisive interpretation of who controls personal data in online advertising.

It holds that an operator such as Russmedia Digital is not merely a passive intermediary but a controller within the meaning of Article 4(7) of the GDPR.

This status arises because the platform determines the technical and organisational means by which advertisements are published and made accessible to the public.

The advertisements exist on the internet solely through the platform’s intervention.

Accordingly, the operator bears responsibility for ensuring that personal data contained in advertisements are handled lawfully.

Subscribe now

This includes verifying whether the advertiser has the right to publish such data or whether the data subject has given explicit consent.

In the present case, the Court ruled that the marketplace must identify, before publication, any advertisement that includes sensitive data such as photographs, personal contact details, or references to sexual life.

Under Article 9 of the GDPR, such data receive heightened protection. Processing them is generally prohibited unless one of the narrowly defined exceptions applies.

The Court explained that a platform must put in place adequate technical and organisational measures to detect advertisements containing sensitive data before they go online.

These measures must also verify the authenticity of the advertiser’s identity. If the advertiser is not the person featured, the platform must ensure that the data subject has given explicit consent to publication.

To learn more about the operation of the GDPR in practice, check out our newsletter:

Technology Law

Issue 22: Serious AI Incidents, Child Privacy Reform, and Europe’s Digital Enforcement

Governments are no longer waiting for technology to self-regulate. This week, Europe wants AI developers to explain their mistakes, Australia plans to keep children off social media, and Italy is improving control of digital systems. Regulators are acting faster than many companies expected, and compliance will no longer be optional. From AI accountabil…

Read more

9 months ago · 9 likes · 1 comment · Technology Law

When neither condition is met, the operator must refuse to publish the advertisement. These obligations are not optional compliance suggestions; they form part of the core duties attached to the status of a data controller.

The decision demonstrates how the concept of control under the GDPR extends beyond traditional database management.

A platform’s active role in structuring, publishing, and disseminating user content transforms it from a neutral intermediary into an entity that participates in the determination of processing purposes and means.

The Court’s reasoning reinforces the principle that control follows function rather than form.

The question is not what the operator claims to be but what it does in practice.

Rejecting the e-Commerce Directive’s Safe Harbour

The company argued that it was entitled to rely on the liability exemptions under Articles 12 to 15 of the e-Commerce Directive, which protect providers of information society services from being held liable for unlawful user content when they act as neutral hosts.

The Court rejected that argument.

It found that the operator’s duties under the GDPR cannot be displaced or diminished by the Directive’s safe-harbour provisions.

The Court reasoned that the e-Commerce Directive governs liability in the context of information society services but does not affect the obligations imposed by the GDPR concerning data processing.

Subscribe now

These are two distinct legal frameworks serving different purposes. The Directive deals with intermediary liability, while the GDPR addresses the protection of personal data.

When an online marketplace processes personal data contained in advertisements, it acts not merely as a conduit but as a controller subject to independent obligations.

Therefore, a platform cannot shield itself by asserting that it merely stores third-party content. Once it publishes or facilitates the publication of content that includes personal data, it becomes directly responsible for compliance with the GDPR.

This position aligns with the principle that fundamental rights, such as privacy and data protection, take precedence over economic exemptions designed for intermediary services.

Leave a comment

The Court further emphasised that an operator’s responsibilities extend beyond initial publication.

It must also take reasonable steps to prevent the further dissemination of unlawful content. When sensitive data are unlawfully published, the operator should implement measures to prevent those materials from being copied or republished elsewhere.

Do you want to know how search engine platform regulations impact us? Our newsletter explains the intricacies of these regulations.

Technology Law

Law Reform: Your Online Freedom May Be About To End

New rules are transforming how online platforms and search services must operate in the United Kingdom. Age checks are now compulsory for services with adult content and strict obligations apply to anything that children can access. Some see this as protection and others see it as control. These rules will change what people see, how they join online pl…

Read more

a year ago · 11 likes · 3 comments · Technology Law

The duty to act does not end once an advertisement is taken down; it includes ongoing prevention through appropriate security and technical safeguards.

This interpretation expands the operational expectations placed on online marketplaces. They are no longer viewed as passive technical platforms but as active participants in the publication and persistence of content that contains personal data.

The ruling sets a higher bar for compliance by tying the concept of responsibility to the real impact of data processing on individuals’ rights.

Implications for Online Platforms and Compliance Practice

The judgment carries direct consequences for online marketplaces, advertising platforms, and digital intermediaries across the European Union.

By categorising platform operators as data controllers when they publish user-generated advertisements containing personal data, the Court has introduced a tougher standard of care.

Operators must design internal processes capable of detecting sensitive content before it is published. This obligation requires both technical and procedural innovation.

Platforms will need automated systems capable of identifying personal data such as names, phone numbers, or images, combined with manual review for complex cases.

In addition, there must be reliable mechanisms for verifying that the advertiser is the data subject or that explicit consent has been granted.

These steps may appear demanding, but they represent the necessary cost of handling personal data in a digital environment governed by fundamental rights.

The judgment also highlights the importance of transparency and traceability.

Platforms should maintain records of verification procedures, consent documentation, and the steps taken to prevent unauthorised reuse of sensitive materials.

When disputes arise, these records will serve as evidence of compliance.

Furthermore, the Court’s reference to preventing further publication introduces a forward-looking duty. Once a platform becomes aware that an advertisement contains unlawful personal data, it must act not only reactively but also proactively.

Technical safeguards such as content fingerprinting, URL blocking, or watermarking may help limit replication. However, each platform will need to determine proportionate measures that align with the GDPR’s accountability principle.

This ruling effectively narrows the margin of neutrality previously enjoyed by hosting providers.

Operators must reassess their classification under data protection law and adapt compliance programmes accordingly.

In practice, many intermediaries will now fall within the controller category for at least part of their operations.

The Russmedia Digital case thus redefines the balance between innovation, user autonomy, and protection.

It invites operators, policymakers, and citizens to understand that personal data protection is not an external constraint on digital activity but a foundational condition for its legitimacy.

The message is clear: accountability in the digital era begins with recognising that every act of publication is also an act of data processing, and with that recognition comes responsibility.

This judgment invites reflection on the responsibilities that digital platforms now carry. You are welcome to share thoughts or practical experiences that might enrich future discussions and help build stronger understanding of accountability in online environments.

Leave a comment

Predictive policing has turned suspicion into a routine administrative category that follows people long before any conduct occurs, and it is astonishing how easily this practice has been accepted as a normal feature of public safety. The idea that an algorithm can pre-assign risk to entire neighbourhoods and individuals has been absorbed into policing culture with little discomfort, even though the practice alters long standing assumptions about fairness, due process and the meaning of community trust. The technology has not simply introduced new methods but it has redefined the threshold at which suspicion begins, and it has done so without meaningful and transparent legal scrutiny.

Share

Newsletter Edition 83

I want to spend time on an issue that has been growing in scale and consequence, yet it still feels misunderstood in public debate.

I am referring to predictive policing, a set of technologies that use large pools of data to indicate where law enforcement attention should concentrate.1

I have observed governments, police forces, and private vendors speak about predictive policing as if it represents a neutral and objective way to allocate resources.

I have also watched the public absorb these narratives with a mixture of curiosity and unease.

I want to offer clarity about why this technology matters, how it transforms the experience of living in a community, and why it normalises suspicion long before any crime is committed.

The way predictive policing works has a direct influence on how neighbourhoods are perceived, how people are categorised, and how law enforcement behaves.

It is important to understand that predictive policing does not operate as a futuristic idea. It exists today in different countries and in many cities across the world. It is not an idea waiting to be tested. It is already being deployed.

I approach this subject as someone who studies and also teaches the relationship between law, technology, and society.

I spend a considerable amount of time reading legal documentation, technical reports, and implementation stories about these tools.

The system processes this information and produces indications about where police officers should patrol or who they should focus on.

It presents these outputs as neutral observations.

A police department may receive a notification that a particular neighbourhood might experience crime within a certain period or that a particular individual might be at risk of involvement in criminal activity.

This may seem harmless and appear like a helpful tool.

In fact, it looks like data is offering support to public safety professionals.

The story becomes more complicated when we examine how the data is produced, how the system interprets it, and how the outputs transform behaviour.

Historical crime data is rarely a clean record of events.

It is influenced by years of policing patterns, community interactions, and institutional priorities.

If a community receives disproportionate police attention, the data will reflect that increased presence.

Increased presence results in increased arrests, even when the actual level of crime might not be higher than neighbouring communities.

The data feeds back into the system, which then tells the police to return to the same neighbourhood. The loop continues.

In many countries, predictive policing amplifies historical patterns without critically evaluating them. This is how suspicion becomes normalised long before anything happens.

I want you to imagine how it feels to live in an area that appears frequently in these predictions.

I said imagine rather than picture an analogy because this is not a metaphor.

Residents begin to notice police officers spending more time near their homes, walking on their streets, and conducting more stops. Police presence gradually becomes part of daily life.

People begin to feel observed. Some might feel safer at first, but many begin to feel targeted.

Subscribe now

Teenagers walking to school are questioned. Adults leaving for work notice patrol vehicles lingering.

The message embedded in these actions is that the neighbourhood requires surveillance. It affects how residents understand themselves.

It affects how they think others see them.

Suspicion moves from the environment to individuals.

Certain predictive policing systems produce lists of people who are classified as likely to be involved in criminal activity.2 These individuals may not have committed a crime.

Their names appear because they have friends or relatives who have been arrested or because they live in areas with high levels of police activity.

Some systems categorise them because of past incidents that have nothing to do with future behaviour.

People on these lists often do not know they have been categorised in this manner.

They experience unexpected visits from law enforcement. They feel pressure to account for their movement.

They sense that their name carries an invisible mark created by a machine.

I want you to see how suspicion becomes embedded. A community or a person is identified through a technical process that appears neutral.

Police officers can act on this information. Their actions create more data. The system absorbs the data and produces a similar outcome.

Each time this cycle repeats, suspicion appears more legitimate. People begin to say that these neighbourhoods always have crime.

People begin to say that certain individuals seem to be involved in suspect activities.

People forget that the perception was constructed through a technical loop rather than emerging from an independent assessment of facts.

It is important to understand that predictive policing does not emerge from malicious intent!

Many police departments genuinely believe the technology will help them.

They believe it will reduce crime, help them allocate limited resources, and reduce guesswork.

Technology companies promote these tools as solutions that draw on modern computational methods and data analysis.

The result is a set of practices that police officers come to trust without fully understanding how the predictions are constructed. This trust gives the system authority.

Once a system has authority, it becomes very difficult to challenge.

I have spoken with individuals who believe predictive policing simply automates what police departments already do.

It is true that police officers often rely on intuition and local knowledge when allocating resources.

Intuition can be biased. Data driven tools appear more objective. This is where the danger resides.

When a biased dataset is presented as objective intelligence, the entire system becomes insulated against critique.

It becomes harder to point out that the underlying data reflects years of unequal attention. It also becomes harder to question the conclusions. People begin to think the technology has independent insight.

Law plays an important role here.

Predictive policing does not live outside the structure of legal rules. It must comply with constitutional principles, human rights protections, procedural fairness, and public accountability mechanisms.

Legal systems are not always ready to review how predictive tools categorise individuals.

Subscribe now

Courts often see predictive tools as internal police processes.3

The legal system does not always require disclosure of how predictions are created.

Individuals who are affected by these predictions often have no avenue to challenge the categorisation.

This is how predictive policing gradually normalises the idea that suspicion can arise without any clear demonstration of wrongdoing.

Some communities see an increase in tension between residents and law enforcement. Others experience a gradual erosion of trust.

When a community feels that policing is based on algorithmic assumptions rather than lived experiences, relationships deteriorate.

Community members feel watched rather than supported. Police officers feel justified in their presence because the system gave them a reason to be there. Each group begins to misunderstand the other.

The misunderstanding is amplified each time the system reinforces the same prediction.

Individuals who are placed on predictive lists experience a more personal form of harm. They lose control over how they are perceived.

Their classification follows them in the background. It influences how officers interact with them. It influences how others talk about them.

This classification often has no clear path for removal. People live with an unspoken sense of scrutiny. This scrutiny can create emotional and psychological strain.

They carry the feeling that something external has defined them without their participation.

I want to highlight that predictive policing is not only a policing issue. It is a societal issue.

When communities begin to internalise the idea that some individuals are suspicious before they act, social cohesion weakens.

People feel pressure to distance themselves from individuals who might attract police attention.

People begin to self censor. They worry about where they go, who they speak with, or how they conduct simple daily routines.

The awareness that an algorithm might interpret these patterns differently adds an invisible layer of anxiety.

These systems also introduce a form of administrative opacity. Decisions made by predictive tools are often explained through abstract descriptions of risk.

People cannot see the complete dataset. They cannot examine the model. They cannot review the reasoning.

Police departments may not understand the model themselves.

Technology companies mischievously protect their algorithms as intellectual property.

Courts often accept these explanations, especially in early stages of deployment.

This lack of transparency restricts accountability. Accountability becomes difficult when individuals and communities do not know how the system reaches its conclusions.

When police officers rely on predictive tools, their actions seem more defensible.

A patrol in a neighbourhood becomes routine. A stop becomes part of the standard procedure. An investigation into a listed individual becomes an expected task.

Suspicion becomes embedded into everyday policing. This is how predictive policing normalises suspicion long before any crime occurs.4

The process unfolds gently but consistently. It alters behavioural expectations. It modifies community interactions. It changes the experience of being a citizen.

I approach this subject with a recognition that technology will continue to influence public safety practices.

Predictive policing is one expression of a broader trend in the integration of data driven decision making in public institutions.

I believe people should understand predictive policing clearly, not with exaggeration or fear, but with careful attention to how the technology functions and how it influences society.

Understanding gives communities the ability to participate in discussions about appropriate use, oversight, and accountability.

I am not offering advice, but rather inviting constructive thoughts.

Predictive policing raises significant questions about fairness, transparency, trust, and the lived experience of communities. These questions deserve an open discussion.

People should be part of these conversations.

When people understand how predictive systems work, they can reflect on how the technology influences their daily lives.

Leave a comment

Artificial intelligence governance is developing in a manner that exposes an uncomfortable truth about contemporary regulatory ambition, which is that states are now asserting control over digital systems with an intensity previously reserved for physical infrastructure. This trajectory reflects neither technological optimism nor pessimism. It reflects a growing insistence that AI must fit within existing structures of authority even when those structures are under strain.

Share

Newsletter Edition 82

United States: H.R. 5885 - GAIN AI Act of 2025

In the United States, the House of Representatives introduced the GAIN AI Act of 2025 on 31 October, under bill number H.R. 5885.

The text mandates that entities seeking export licences for advanced artificial-intelligence-related chips must provide certification that United States persons enjoy priority access to those chips.

The bill was referred to the House Committee on Foreign Affairs.

What this measure highlights is the increasing linkage between export controls, chip supply chains, and the governance of AI.

The bill reflects a recognition that advanced semiconductors and AI hardware count as strategic assets, and that policy-makers are prepared to place conditions on their export in order to safeguard national interest.

At the same time, the certification requirement implies that firms will need to structure their compliance mechanisms and their internal disclosure processes to satisfy governmental oversight.

Though still at an early stage in the legislative process, this bill tells us that AI regulation in the United States is no longer confined to model behaviour or data privacy, but is extending into hardware, supply-chain resilience, and the conditions under which AI capacities are exchanged internationally.

It would be prudent for organisations engaged in AI hardware design, export, or supply-chain logistics to monitor not only the final outcome of the bill but also its drafting of licence-criteria, definitions of “advanced AI chips,” geographic scope of “countries of concern,” and how priority access is defined and enforced.

European Union: Artificial Intelligence Act (EU) and monitoring of EU law

The European Parliament’s Policy Department for Justice, Civil Liberties and Institutional Affairs published a study dated 30 October 2025, entitled “AI and monitoring the application of EU law”.

The report surveys how AI techniques are being used, and might be used to support the monitoring and enforcement of EU law, including in legislative drafting, transposition of directives, administrative decisions, compliance tracking, and social-behavioural governance.

This work draws attention to the fact that regulation of AI is not only about controlling AI systems themselves but also about using AI systems as regulatory tools.

The symmetry is significant: AI becomes both the object of governance and a means of governance.

The study points out that while there are existing AI-monitoring applications in EU law enforcement and administrative practice, the potential for more advanced deployment remains under-analysed, including how fundamental rights and legal principles should be respected when AI assists regulatory monitoring.

This suggests two key observations. First, regulated entities in the EU should anticipate that AI governance may include oversight via AI-driven monitoring, meaning that their compliance processes may themselves become subject to enhanced scrutiny through technological means.

Second, the EU’s legislative timetable for AI regulation and related frameworks, such as the risk-based classification and obligations under the AI Act, continue to generate implications for how AI can be deployed in public-administration and regulatory enforcement settings.

Subscribe now

United Kingdom: Judicial Guidance on AI Use by the Judiciary

In England and Wales, the Judiciary of England & Wales (courts and tribunals) published updated guidance on 31 October 2025, addressing the use of AI by judicial office-holders.

The document replaces the April 2025 edition, enlarging the glossary of terms, expanding sections on bias in training data and “hallucinations” (incorrect or misleading outputs), and emphasising confidentiality obligations: judicial officers are reminded not to input private or non-public information into publicly accessible AI tools, and to treat any inadvertent disclosure as a data incident.

The guidance underlines that any use of AI by or on behalf of the judiciary must be consistent with its overarching obligation to protect the integrity of the administration of justice and to uphold the rule of law.

Lord Justice Birss, Lead Judge for Artificial Intelligence, emphasised the personal responsibility of judicial office-holders for material produced in their name.

This means that even within the judicial context, where the use of AI might appear less commercially oriented and more internal or procedural, strong guidelines are being imposed.

The guidance shows that where AI is used, it must be carefully controlled, with human accountability non-negotiable.

As AI enters institutional and public sectors, the threshold for documentation, oversight, verification, and risk mitigation increases.

While the guidance is directed at judicial office-holders, its principles may serve as a benchmark for other professions engaged in regulatory or public functions.

Netherlands: Autoriteit Persoonsgegevens (AP) Warns of Biased Voting Chatbots

In the Netherlands, the data-protection authority issued a warning on 21 October 2025 that AI chatbots used as voting-aid tools produced highly distorted and biased results.

The AP’s study involved four major chatbot platforms tested against various fictional voter profiles. It found that the systems often offered advice heavily favouring just two political parties, regardless of user input.

While such tools may appear to offer impartial guidance, the AP concluded that they present a threat to electoral integrity and democratic participation.

The experiment revealed that the chatbots, contrasted with established voting-advice applications, lacked representativeness of all parties and funnelled users disproportionately to the same two options.

The AP labelled the advice “unreliable and clearly biased.”

This development is quite significant because it touches on the intersection of automated systems, political influence, transparency, and fairness.

The findings reflect risks associated with using generative-AI tools or chatbots in sensitive contexts such as elections, where the decisions impacted are inherently public and governed by principles of fairness and neutrality.

Organisations operating chatbots or AI-based recommendation systems in civic or electoral domains will need to consider how these systems are designed, how their outputs are audited, and how they are communicated to users.

Final Thoughts

These developments, while distinct in jurisdiction and focus, together map out an important dimension of current tech-law development: regulation and governance of AI are expanding beyond traditional domains of data privacy and algorithmic fairness to include hardware exports, institutional use of AI within justice systems, monitoring of regulatory compliance via AI, and algorithmic impact on democratic processes.

What emerges is a reminder of the importance of governance frameworks that address the full lifecycle of AI, from hardware and supply-chain, through software and model training, to public-deployment and institutional adoption.

What remains clear is that the legal and regulatory environment for AI remains multifaceted including export-control law, public-sector AI governance, electoral regulation, fundamental-rights frameworks, and compliance monitoring are all part of the field.

Leave a comment

I will close this edition here with an invitation to continue the discussion. Readers who wish to reflect on any part of this analysis are encouraged to share considered thoughts in the comments so that future editions benefit from a wider range of perspectives.

Europe has regulated AI into a corner. The Artificial Intelligence Act, though hailed as a global benchmark, exemplifies the tension between ambition and practicality that defines modern EU digital regulation. Several laws also promise data protection and AI innovation, however together they form an administrative maze that risks stifling the very technological progress Europe claims to champion.

Share

Newsletter Edition 81

The AI Act and Europe’s Digital Legal Framework

When the European Union adopted the Artificial Intelligence Act in June 2024, it presented the world’s first comprehensive attempt to regulate artificial intelligence in a structured and rights-based way.

The AI Act’s ambition is significant. It aims to ensure that AI systems placed on the European market are trustworthy, safe, and compliant with fundamental rights.

Nonetheless, this new framework operates alongside a web of other digital laws that already govern data protection, cybersecurity, market competition, and digital services.

The study prepared for the European Parliament’s Committee on Industry, Research and Energy (ITRE) examines this web in detail.

Its findings are important for everyone.

At the core of the study lies a simple insight that every law in the EU digital framework is individually well designed, but together they create a structure that is heavy, overlapping, and sometimes unclear.

The AI Act was intended to complete the EU’s digital single market, yet its interactions with other frameworks have introduced a new kind of complexity.

Understanding the Purpose and Logic of the AI Act

The AI Act rests on a risk-based approach.

It prohibits a narrow category of AI practices that are deemed unacceptable, imposes strict controls on high-risk systems, and sets transparency duties for low- and medium-risk uses such as chatbots or generative tools.

It also creates separate obligations for general-purpose AI models that are powerful enough to have systemic effects.

This tiered logic mirrors the EU’s long-standing product safety regime but extends it to an entirely new domain.

The study explains that this approach was a deliberate choice.

Before the AI Act, artificial intelligence was largely unregulated, and Member States risked introducing divergent national laws.

The new regulation harmonises the internal market by setting a single framework.

Nonetheless, that harmonisation comes at a cost.

The report highlights that the AI Act stretches the boundaries of traditional product regulation.

It asks conformity assessment bodies to evaluate not only technical safety but also respect for fundamental rights and societal values.

That task, the authors note, may prove difficult because human rights compliance cannot easily be reduced to technical checklists.

Subscribe now

For high-risk systems, the obligations are extensive.

Providers must establish risk management systems, data governance protocols, technical documentation, human oversight, and quality management frameworks.

They must demonstrate accuracy, robustness, and cybersecurity, and affix the familiar CE marking.

These are familiar requirements in manufacturing but novel in software development.

The study observes that while the AI Act promotes trust, it also places significant compliance responsibilities on providers and deployers alike, particularly smaller businesses without specialised legal teams.

An additional layer applies to general-purpose AI models, known as GPAIs.

These are the large, adaptable models that underpin tools for text, image, or speech generation.

The AI Act introduces transparency, copyright compliance, and cybersecurity duties for all GPAI providers, and enhanced obligations for those with systemic risk.

The report notes that a model trained with computing power above a specific threshold is presumed to be of systemic importance.

This presumption was designed to ensure oversight of the most powerful systems but may prove too static as technology progresses.

The Act also includes innovation measures.

Open-source AI systems are mostly exempt from its scope, and each Member State must establish a regulatory sandbox to allow experimentation under supervision.

The study recognises these as positive steps but cautions that their success will depend on national authorities’ willingness to interpret the rules in an enabling way.

Intersections Across the Digital Legal Framework

The central part of the study examines how the AI Act interacts with other EU digital laws.

The most significant areas of intersection involve the GDPR, the Data Act, the Cyber Resilience Act, the Digital Services Act, the Digital Markets Act, and the NIS2 Directive.

Each of these laws is vital in its own domain, but together they form a dense compliance environment that can be difficult to understand.

Technology Law

EU Artificial Intelligence Tracker

This EU Artificial Intelligence tracker monitors key dates and information on legal and policy developments surrounding artificial intelligence in the EU. It covers major legislative initiatives, law reforms and policy updates impacting artificial intelligence in the European Union…

Read more

10 months ago · 10 likes · Technology Law

Under the GDPR, many AI systems that process personal data already fall within an existing legal structure that emphasises lawfulness, transparency, and accountability.

The AI Act introduces additional assessments, particularly the Fundamental Rights Impact Assessment (FRIA), which often overlaps with the Data Protection Impact Assessment (DPIA) required under the GDPR.

The study observes that both tools serve legitimate goals but differ in supervision and procedure.

As a result, organisations may find themselves conducting two separate yet similar evaluations for the same system.

The report recommends aligning these assessments through joint guidance and mutual recognition.

The Data Act establishes rules for access to and sharing of data generated by connected products and services.

AI providers who hold or use such data may therefore face obligations under both Acts.

For instance, they must ensure that data is shared in a fair and secure way while also maintaining compliance with AI risk and transparency duties.

The study points out that these cumulative requirements could discourage experimentation and impose a heavy administrative load, especially in cross-border contexts or when data flows from third countries.

In the field of cybersecurity, the Cyber Resilience Act imposes mandatory security standards for digital products.

Many of these overlap with the AI Act’s own cybersecurity and robustness requirements.

Although the CRA allows for a presumption of compliance under certain conditions, the partial alignment of the two frameworks can still produce uncertainty.

The report suggests that greater coordination between the responsible authorities would help prevent duplicated audits or inconsistent expectations.

For large online platforms and search engines, the Digital Services Act and the Digital Markets Act add yet another layer.

These instruments require transparency and accountability for algorithmic systems used in content moderation, advertising, or recommender functions.

The study notes that such platforms might be subject to simultaneous risk assessments under both the AI Act and the DSA.

Moreover, gatekeepers under the DMA must meet obligations relating to data access and interoperability, which could overlap with AI governance duties.

While the DMA does not yet classify AI systems as core platform services, their growing economic role makes such an intersection increasingly relevant.

The NIS2 Directive, which focuses on network and information security, introduces reporting and risk management obligations for essential and important entities.

Many of these entities will also deploy AI systems covered by the AI Act.

The report finds that the incident reporting and supply-chain management requirements of both frameworks often intersect, potentially creating parallel channels of compliance.

Across all these examples, the study reaches a consistent conclusion: the EU’s digital regulatory framework has become internally complex.

Each law serves a clear purpose, but their cumulative effect risks slowing innovation and discouraging smaller actors from entering the market.

Governance and Implementation Challenges

A key section of the study analyses the institutional architecture created by the AI Act.

At its centre stands the European AI Office, which operates within the European Commission.

The AI Office is responsible for supervising general-purpose AI models, supporting regulatory sandboxes, and coordinating national authorities.

It works alongside the European AI Board and interacts with data protection authorities, market surveillance bodies, and other sectoral regulators.

This structure reflects an attempt to balance central oversight with national autonomy.

However, the study raises concerns about potential overlaps of competence.

The AI Office’s mandate intersects with that of existing regulators, yet it lacks a distinct legal personality and depends on Commission resources.

Subscribe now

Without sufficient independence or capacity, its effectiveness could be limited.

The authors warn that fragmented governance may lead to inconsistent enforcement and uncertainty for businesses seeking to comply across multiple jurisdictions.

At the national level, market surveillance authorities will play a key role in enforcing the AI Act’s provisions.

These bodies are accustomed to monitoring tangible goods such as machinery or medical devices.

The report suggests that applying the same methods to algorithmic systems will require substantial training, technical expertise, and coordination.

Inconsistent capacity among Member States could produce uneven application of the law.

The study also identifies the importance of cooperation among supervisory authorities.

Given that AI systems often implicate personal data, cybersecurity, and consumer rights simultaneously, regulators must establish clear protocols for joint inspections and shared investigations.

The report encourages the development of consistent EU-level guidance to avoid contradictory interpretations.

Toward a More Coherent Digital Future

The final section of the study turns from analysis to reflection.

It recognises that the EU’s digital legislative framework represents an extraordinary achievement in scope and ambition.

However, the authors argue that the cumulative regulatory weight could unintentionally hinder innovation, particularly among small and medium-sized enterprises.

Short-term progress, they suggest, can come through practical coordination.

Supervisory bodies should publish joint guidance, share expertise, and recognise equivalent compliance efforts.

For instance, if a company completes a DPIA under the GDPR that already covers the relevant risks, it should not be required to repeat the process for a FRIA under the AI Act.

Similarly, Member States could align their sandbox procedures to ensure consistent conditions for testing and experimentation across borders.

In the medium term, modest legislative clarifications could help.

These might include refining definitions of high-risk systems, clarifying the interaction between cybersecurity obligations, and specifying the responsibilities of different actors in the AI supply chain.

The goal would not be to weaken regulation but to make it more understandable and executable.

Over the longer term, the study recommends a more strategic review of the EU’s digital architecture.

It argues that Europe should consider consolidation and simplification of its legal instruments, aiming for coherence rather than volume.

The authors envision a framework where data, AI, cybersecurity, and digital market rules operate as complementary parts of a single ecosystem rather than as separate compartments.

This integrated model would better support agile compliance while preserving the Union’s core values of trust, rights, and safety.

Technology Law

Case Report: EU-US Data Privacy Framework Survives Attack In Court (Latombe v. Commission)

The latest controversial judgment of the General Court in Latombe v Commission represents a decisive moment in the ongoing contest over transatlantic data transfers between the US and EU. The Court has endorsed the European Commission’s adequacy decision, validating the EU-US Data Privacy Framework. Critics will argue that the Court has accepted surveil…

Read more

10 months ago · 13 likes · 5 comments · Technology Law

The report concludes with a broader reflection on competitiveness.

The European Union’s AI investment levels remain lower than those of the United States and China.

The authors caution that complex regulation may further reduce the continent’s ability to attract and retain AI innovation.

Simplification, coordinated enforcement, and strategic alignment are therefore not merely administrative improvements; they are essential to ensuring that the EU can sustain a globally competitive AI industry.

A Framework in Need of Balance

The European Parliament’s study makes one theme clear: the AI Act embodies both the promise and the challenge of Europe’s digital governance.

It is unprecedented in global regulation, but its effectiveness will depend on how well it integrates with surrounding laws and institutions.

Each layer of the digital framework; privacy, data access, cybersecurity, and platform regulation, serves a vital purpose, but the combined system must remain useful, especially for innovators and smaller enterprises that form the backbone of Europe’s technology sector.

Achieving that balance requires coordination, clarity, and a shared vision of digital policy.

The authors’ recommendations are measured and pragmatic.

They do not call for deregulation but for coherence.

They remind policymakers that trust and innovation are not mutually exclusive.

By streamlining its legal framework and ensuring consistent enforcement, the EU can maintain its commitment to fundamental rights while enabling a dynamic and competitive AI ecosystem.

In essence, the study offers a roadmap for governance that is both principled and practical. It recognises that the challenge is not the existence of rules but their integration.

If the EU succeeds in aligning its digital laws, the AI Act could stand not only as a regulatory milestone but also as the foundation of a genuinely coherent European digital future.

The questions raised by the AI Act’s complexity deserve sustained discussion. Readers are invited to share perspectives or industry experiences that can inform future editions.

Leave a comment