This contribution examines the legal intricacies surrounding law enforcement data collection practices in Bulgaria within the framework of the Law Enforcement Directive 2016/680 (LED) and relevant Court of Justice of the European Union (CJEU) rulings, particularly cases C-205/21 and C-80/23. The analysis underscores challenges in interpreting the concept of “strict necessity” and ensuring compliance with its provisions, in particular, Art. 10. Key findings reveal ambiguities in the LED’s application, particularly concerning judicial review and the scope of data collection. The subsequent Case C-80/23 further seeks clarification on the strict necessity standard and the scope of judicial review in the collection of biometric and genetic data. The outcome of both cases has broader implications for EU member states, highlighting the need for legislative alignment and underscoring the complexities and challenges in balancing effective law enforcement with the protection of fundamental rights.

The EU’s policies in the field of technology broadly defined are increasingly marked by a concern over strategic autonomy, and Europe’s place in the world. Regulatory interventions are framed in terms of “digital sovereignty,” with the Commission seeking to ensure that external dependencies are reduced with the aim of increasing the EU’s resilience to geopolitical instability and external shocks. Using the case study of semiconductors, the chips that power modern electronic devices, this article explores how technology policy in the EU sits at the economy–security nexus, in which economic goals and security goals are interdependent and inseparable. Focusing on the life cycle of the semiconductor supply chain from the control over natural resources through to the cybersecurity requirements placed on the finished products, this article demonstrates the increasing security logic embedded within a burgeoning industrial technology policy.

As part of its risk management system, aiming at the mitigation of so-called systemic risks on very large online platforms and very large online search engines (VLOPSEs), the DSA introduces data access rights for independent researchers. With this instrument, the legislator hopes to enable the production of evidence concerning possible threats to society and democracy that might be linked to these platforms or search engines. After an overview of the functioning of the risk management system in the DSA that is characterised by a collaborative governance framework and a learning-based approach, the article will explore the role of the researchers inside this framework. It thereby focuses on the legal significance the researchers’ evidence could have for the risk mitigation obligations imposed on the VLOPSEs in the DSA by interpreting the provisions of the DSA.

The European Union (EU) has extended the application of the EU emissions trading scheme to international shipping and the International Maritime Organization (IMO), and various countries are working on implementing instruments that put a price on greenhouse gas emissions (GHG) from this sector. Due to these policy developments, GHG emissions from shipping may become subject to multiple pricing instruments in the coming years. In response, stakeholders have voiced concerns over the potential negative impacts that this could have on both the shipping industry and international trade, and called for double pricing to be avoided. Against this background, this article discusses the potential pros and cons of double pricing GHG emissions from shipping and identifies options to reduce its negative impacts. Overall, the article finds that the case to avoid double pricing rests on a balance of competing interests, contextual factors, and instrument design. If policymakers aim to avoid double pricing, regulatory cooperation between policymakers working on shipping decarbonisation and border carbon adjustment mechanisms can provide important lessons on how to do so.

We argue it is efficient/desirable for central banks to operate retail Instant Payments (IP) schemes and infrastructure, considering that (i) payment service providers (PSPs) face a problem of collective action, which limits their capacity to deliver a cheap, fast, open-architecture and interoperable IP scheme; and (ii) this problem may be overcome by a central bank (economically neutral actor) with a dual role of regulator and operator of IP schemes, especially by mandating participation of large PSPs and ensuring that the low cost of infrastructure is passed on to consumers. We corroborate with data from Brazil’s Pix and India’s UPI, where the efficiencies of central bank-led IP schemes also led to social gains through financial inclusion.

Cell and gene therapies derive from a substantial manipulation of cells or the application of gene editing techniques. They are promising products because they enable therapy personalisation, are potentially helpful for treating rare or resistant diseases, and may become useful in future epidemics. Because of this strategic worth, the infrastructure needed for manufacturing these therapies is turning into a subdomain within the domain of critical infrastructures (CIs), understood as the structures whose operation is key for the integrity and security of a nation. This paper analyses why cell and gene therapy infrastructure can be considered as an emergent CI domain, stressing three aspects: automated manufacturing equipment; software solutions (including the growing adoption of artificial intelligence and cloud technology); and human expertise. These complex manufacturing systems, which are becoming increasingly automated and digitalised, may be surrounded by new risks and vulnerability points, which requires adequate regulatory solutions and governance initiatives. A comprehensive approach is therefore advanced here, where therapy manufacture has medical and technological relevance, but is equally crucial from the viewpoint of nations’ public health and internal stability.

This article examines the regulatory landscape of financial data access within the European Union, emphasising the implications and effectiveness of recent legislative initiatives. It provides an in-depth analysis of the Financial Data Access Regulation (FIDA) proposal and its relationship with existing laws, focusing on the possibilities for data access and utilisation in the context of Open Finance. The discussion evaluates the regulatory framework for automated decision-making (ADM) in European financial law, highlighting its strengths and identifying areas for improvement. By exploring the intersections of tech resilience, financial regulation, and data protection, the article aims to clarify the practical implications of current and proposed rules, emphasising effective practices and areas needing further legislative attention.

Digital assets have burst onto global markets as a new class of assets for investment, trade and finance. Their growing popularity and economic relevance have been, however, accompanied by legal uncertainties and regulatory concerns. Together with domestic and regional responses, a strong case for international harmonisation is to be made. This Paper explores the emergence of principles and best practices on proprietary rights, insolvency and enforcement as a crucial process of international legal harmonisation of rules for digital assets.

If the consumer is insured under the group insurance contract and becomes a party to that contract, the consumer shall enjoy the protection envisaged under the Unfair Terms Directive. As a result, the consumer shall be allowed to get acquainted with the terms of the contract, otherwise the consumer is entitled to rely on protection against unfair terms even if they relate to the insurance cover (author’s summary).

This paper examines the impact that the finally approved Artificial Intelligence Act (AIA) will have on European public authorities when developing, acquiring and using AI systems. It argues that, despite the initial disappointment that the Act may cause when approaching it from an administrative law perspective, and despite the fact that some of the solutions that have been finally chosen are questionable, it represents a remarkable step forward, duly addressing many of the problems raised in the literature in relation to the automation of administrative decisions and the use of AI systems by public authorities.

The expansion of EU regulatory governance in the financial sector since the end of the global financial crisis 2008 has given rise to the need to examine regulatory consistency in the volumes of financial regulation that may have cross-cutting implications. In this light, this article examines the effectiveness of the Regulation of ESG infomediaries through the lens of “functional regulatory consistency” with other infomediary regulations, for credit rating agencies and stock market benchmarks. It argues that this lens most aptly reveals the three key weaknesses of the regulatory regime for ESG infomediaries. These relate to sub-optimal coverage of scope, over-inclusiveness in the application of regulatory standards and under-inclusiveness where appropriate governance is not provided. the sub-optimal coverage of scope raises the question of whether ESG stock market index providers should indeed be regulated as ESG infomediaries or as stock market benchmarks more generally falling within the Benchmarks Regulation 2016. Over-inclusiveness and under-inclusiveness in the regulatory provision reflects blind spots in applying functional regulatory consistency, where it is inappropriate due to distinguishing features in business models, market structures or market relations.

Following the contemporary debate surrounding two alternative perspectives on compliance – enforcement and management – this article suggests an analysis through the lens of the rule of law crisis. Specifically, the financial and techno-managerial strategy developed by the EU for the indirect protection of the rule of law relies on mechanisms that combine characteristics from both the enforcement and management approaches. This article will identify these mechanisms, namely the European Semester, the Conditionality regulation, the European Structural Investment Funds and the Recovery and Resilience Facility, in order to determine their nature, features, and tools for ensuring compliance with the rule of law. The hypothesis of this article relies on the idea that the EU’s tools are characterised by a mismatch between the causes of the identified problems and the chosen solutions. Considering that the deployment of the above measures has not re-established compliance, the EU strategy toes between inducing rule conformity on the one hand and deterring rule of law violations on the other. However, it seems that only the former can restore the rule of law, as the latter is considered ill-equipped to reverse or at least halt instances of backsliding. This mismatch explains why the Justice Scoreboard, the Framework, and the Review Cycle with its Annual Report have not made any difference, and more generally, why management strategies are unfit for dealing with deliberate backsliding.1

Regulation is nothing without enforcement. This particularly holds for the dynamic field of emerging technologies. Hence, this article has two ambitions. First, it explains how the EU’s new Artificial Intelligence Act (AIA) may be implemented and enforced by various institutional bodies, thus clarifying the governance framework of the AIA. Second, it proposes a normative governance model, providing recommendations to ensure uniform and coordinated execution of the AIA and the fulfillment of the legislation. The article explores how the AIA may be implemented by national and EU institutional bodies, encompassing longstanding bodies, such as the European Commission, and those newly established under the AIA, such as the AI Office. It investigates their roles across supranational and national levels, emphasising how EU regulations influence institutional structures and operations. These regulations may not only directly dictate the structural design of institutions but also indirectly request administrative capacities needed to enforce the AIA.

Compared to previous secondary legislation, Article 11 of the Digital Covid Certificates regulations was remarkably explicit in its requirement for Member States to consider scientific evidence when restricting free movement for the certificate holders. However, we argue in this Article that the regulations achieved a partial codification of the existent case law of the CJEU rather than imposing any additional requirements. Namely, the case law had already required Member States to rely on scientific evidence that reflects the international consensus, that is relevant and up to date, and that the evidence had to demonstrate by means of a risk assessment a real risk to the public health. We also discuss these findings in the light of the proportionality and precautionary principles and suggest that understanding the evolution of the EU legal order’s evidentiary requirements is useful in the light of the legislator’s claim of objective and rational policy-making procedures in public health and other crises.

This contribution analyses the EU’s new data acts. Interoperability is a common denominator of the EU’s new data acts. This paper demonstrates that the new data acts provide various approaches or concepts of collaborative governance to regulate interoperability. Although the EU’s new data acts are far from a uniform governance concept, we detected certain institutional arrangements organising the collaboration between private self-regulatory bodies, other private stakeholders and public bodies to lay down rules for interoperability.

Toxic substances and endocrine disruptors are present in consumer goods on the European Union (EU) market, such as in food contact materials like cookware. This article investigates whether a legal recall obligation of such products exists in EU law, and in the absence of such an obligation, how the EU legislature has ensured that such products are disposed of in a manner that does not compromise human health and the environment when they become waste. For this purpose, this Article analyses recall obligations for food contact materials containing persistent organic pollutants, as well as their waste regulations. It focuses on a class of substances with non-stick properties, some of them formerly used in cookware, such as pentadecafluorooctanoic acid (PFOA) and perfluorooctane sulfonic acid (PFOS). We show that there is no single legal recall obligation; rather, many legal obligations are scattered among different provisions of EU law. When read together, they form a complex web of obligations, which may lead to recall measures for most of these products. However, doubts over the feasibility and effectiveness of such recalls remain.

In the European Union (EU), novel foods and Genetically Modified Organisms (GMOs) are subject to long and costly authorisation procedures and post-marketing requirements. The regulatory frameworks applicable to novel foods and GMOs come into effect based on perceived factors of risk. These “risk triggers” are characteristics of novel foods and GMOs which differentiate them from traditional foods, creating a presumption of risk. Within the EU, consumer acceptance of genetically modified foods and novel foods like insects or cultivated meat is shaped by heuristics and biases, mainly focusing on the “novelty” and “unnaturalness” of these products, resulting in a predominantly negative perception. This paper investigates the close connection between cognitive biases identified in consumer perception literature and the implementation of specific risk triggers in the regulation of novel foods and GMOs in the EU. It subsequently raises concerns about the appropriateness of these risk triggers in forming a presumption of risk for these innovative products.

One of the pillars on which product liability law is based is the defence for development risks. According to this defence, the producer is not liable for the damage caused to the injured party if, at the time the product was put into circulation, the state of scientific and technical knowledge did not allow the existence of the defect to be discovered. The Proposal for a Directive drafted by the European Commission and published on 28 September 2022 continues to provide, in Article 10.1.e), the defence for development risks. The Proposal for a Directive refers to this particular issue in Recital 39, which introduces some requirements for the assessment of such defence.

However, despite this recognition, does this defence fit into the digital paradigm, and how can it be applied to damage caused by defects in products with digital elements that incorporate artificial intelligence?

The Covid-19 crisis provided an opportunity for the European Union to offer an alternative regulatory response to the crisis of values by systemically linking European funding to respect for the rule of law. A rule of law conditionality mechanism for spending was introduced in the Recovery and Resilience Facility and in Regulation 2020/2092. It is both positive – in that it encourages Member States to implement reforms and investments aimed at improving the rule of law – and negative – in that it takes the form of financial sanctions. However, the development of the rule of law conditionality is leading to an economisation of the concept of the rule of law, insofar as it mainly concerns those dimensions of the rule of law that are conducive to growth – such as justice systems and the fight against corruption. As a result, it could paradoxically exacerbate the very crisis it is designed to resolve.

The Digital Markets Act (DMA) is designed to ensure fair and contestable digital markets. With one of the key sources of market power of big tech being data, it is not surprising that it is the subject matter of a number of DMA provisions. Article 5(2) prohibits gatekeepers from engaging in forms of accumulation and cross-use of personal data, unless they receive users’ consent, defined by reference to the General Data Protection Regulation (GDPR).

Consent as defined by the GDPR suffers from a number of shortcomings, among other things, relating to whether consent can be truly freely given. The DMA tries to address some of the shortcomings by formulating a version of consent that seemingly goes beyond the GDPR. While a new version of consent may ensure greater effectiveness, it raises questions concerning the interaction and compatibility with the GDPR.

To shed light on this issue, the paper discusses the role and meaning of consent in the DMA vis-à-vis the GDPR and explores how to interpret consent under both the DMA and GDPR in a manner that is consistent with each other and that accounts for the characteristics of digital markets.