Cybersecurity is a concern to be tackled not only by individual States but also by the European Union as a whole. Building on the recent adoption of Regulation (EU) 2025/38, the so-called Cyber Solidarity Act, the study intends to analyse the creation of a supranational capacity to prevent and respond to cyber incidents, by answering the following questions: how and to what extent is solidarity concretely declined in the act in question? How do the mechanisms provided for by this act concretely interact with the Member States’ prerogatives in the broader security domain?

Scientific consensus links dietary choices to health outcomes, highlighting the urgency to prioritise healthy food production in food systems. At the EU level, however, defining healthy food and integrating it into food governance remains a challenge, particularly regarding the inclusion of health-related characteristics in food safety assessments. While the EU primarily relies on the risk analysis principle to address food safety concerns, the process still exhibits weaknesses that hinder its direct impact on fostering a healthier food production landscape. This review demonstrates how the risk analysis process, particularly scientific opinions in risk assessment and external factors (economic and political) in risk management, impact food governance and the healthiness of food systems. We find that while external factors play a crucial role in risk management decisions by incorporating non-food safety considerations, they often stem from an imbalance of power favouring major industry and political stakeholders. This imbalance disproportionately influences decision-making, often overshadowing nutritional and health aspects. To address these challenges, we recommend directing research towards filling knowledge gaps and exploring minority scientific findings, and separating external factors from risk management’s decision-making process, to ensure that food governance prioritises public health and healthy food production.

In the early 2000, cybersecurity breaches were classified as “Internet crimes” and therefore managed through the tools of the criminal justice system. The Budapest Convention on Cybercrime forged new incriminating provisions and new procedural guidelines, updating the categories of criminal law and criminal procedure for the digital age. This style, unfortunately, has proved to be insufficient. To face the growing number of threats, the EU has shifted towards a much more preemptive, administrative-law-based approach to cybersecurity, with a view to protect critical infrastructure and industries from disruptive attacks. The criminal layer, however, has not been replaced: the relevant, international instruments are still there, and they have been recently extended to cover more ground. The essay will examine the new wave of legislation on cybercrime such as the United Nations Cybercrime Treaty, trying to identify the interactions and the frictions between two different contrast strategies to abusive cyber operations.

The Digital Markets Act (DMA) is designed to ensure fair and contestable digital markets. With one of the key sources of market power of big tech being data, it is not surprising that it is the subject matter of a number of DMA provisions. Article 5(2) prohibits gatekeepers from engaging in forms of accumulation and cross-use of personal data, unless they receive users’ consent, defined by reference to the General Data Protection Regulation (GDPR).

Consent as defined by the GDPR suffers from a number of shortcomings, among other things, relating to whether consent can be truly freely given. The DMA tries to address some of the shortcomings by formulating a version of consent that seemingly goes beyond the GDPR. While a new version of consent may ensure greater effectiveness, it raises questions concerning the interaction and compatibility with the GDPR.

To shed light on this issue, the paper discusses the role and meaning of consent in the DMA vis-à-vis the GDPR and explores how to interpret consent under both the DMA and GDPR in a manner that is consistent with each other and that accounts for the characteristics of digital markets.

As part of its risk management system, aiming at the mitigation of so-called systemic risks on very large online platforms and very large online search engines (VLOPSEs), the DSA introduces data access rights for independent researchers. With this instrument, the legislator hopes to enable the production of evidence concerning possible threats to society and democracy that might be linked to these platforms or search engines. After an overview of the functioning of the risk management system in the DSA that is characterised by a collaborative governance framework and a learning-based approach, the article will explore the role of the researchers inside this framework. It thereby focuses on the legal significance the researchers’ evidence could have for the risk mitigation obligations imposed on the VLOPSEs in the DSA by interpreting the provisions of the DSA.

The increasing use of Artificial Intelligence (AI)-based surveillance technologies such as facial recognition for national and public security purposes in the area of law enforcement raises serious concerns regarding the potential risks of abuse and arbitrariness it might entail, in the absence of adequate safeguards. At an international level, the impact of biometric identification systems on the protection and promotion of human rights and fundamental freedoms has been consistently emphasised by international organisations, human rights monitoring mechanisms and the civil society, particularly with regards to the risk of mass surveillance possibly resulting in the infringement upon the right of privacy and freedom of assembly. This contribution will assess the international human rights and standards applicable to the use of these technologies for national security purposes especially in the context of peaceful protest by assessing the position of the European Court of Human Rights in Glukhin v Russia (11519/20) and recent regulatory attempts.

One of the pillars on which product liability law is based is the defence for development risks. According to this defence, the producer is not liable for the damage caused to the injured party if, at the time the product was put into circulation, the state of scientific and technical knowledge did not allow the existence of the defect to be discovered. The Proposal for a Directive drafted by the European Commission and published on 28 September 2022 continues to provide, in Article 10.1.e), the defence for development risks. The Proposal for a Directive refers to this particular issue in Recital 39, which introduces some requirements for the assessment of such defence.

However, despite this recognition, does this defence fit into the digital paradigm, and how can it be applied to damage caused by defects in products with digital elements that incorporate artificial intelligence?

Toxic substances and endocrine disruptors are present in consumer goods on the European Union (EU) market, such as in food contact materials like cookware. This article investigates whether a legal recall obligation of such products exists in EU law, and in the absence of such an obligation, how the EU legislature has ensured that such products are disposed of in a manner that does not compromise human health and the environment when they become waste. For this purpose, this Article analyses recall obligations for food contact materials containing persistent organic pollutants, as well as their waste regulations. It focuses on a class of substances with non-stick properties, some of them formerly used in cookware, such as pentadecafluorooctanoic acid (PFOA) and perfluorooctane sulfonic acid (PFOS). We show that there is no single legal recall obligation; rather, many legal obligations are scattered among different provisions of EU law. When read together, they form a complex web of obligations, which may lead to recall measures for most of these products. However, doubts over the feasibility and effectiveness of such recalls remain.

In the European Union (EU), novel foods and Genetically Modified Organisms (GMOs) are subject to long and costly authorisation procedures and post-marketing requirements. The regulatory frameworks applicable to novel foods and GMOs come into effect based on perceived factors of risk. These “risk triggers” are characteristics of novel foods and GMOs which differentiate them from traditional foods, creating a presumption of risk. Within the EU, consumer acceptance of genetically modified foods and novel foods like insects or cultivated meat is shaped by heuristics and biases, mainly focusing on the “novelty” and “unnaturalness” of these products, resulting in a predominantly negative perception. This paper investigates the close connection between cognitive biases identified in consumer perception literature and the implementation of specific risk triggers in the regulation of novel foods and GMOs in the EU. It subsequently raises concerns about the appropriateness of these risk triggers in forming a presumption of risk for these innovative products.

Regulation is nothing without enforcement. This particularly holds for the dynamic field of emerging technologies. Hence, this article has two ambitions. First, it explains how the EU’s new Artificial Intelligence Act (AIA) may be implemented and enforced by various institutional bodies, thus clarifying the governance framework of the AIA. Second, it proposes a normative governance model, providing recommendations to ensure uniform and coordinated execution of the AIA and the fulfillment of the legislation. The article explores how the AIA may be implemented by national and EU institutional bodies, encompassing longstanding bodies, such as the European Commission, and those newly established under the AIA, such as the AI Office. It investigates their roles across supranational and national levels, emphasising how EU regulations influence institutional structures and operations. These regulations may not only directly dictate the structural design of institutions but also indirectly request administrative capacities needed to enforce the AIA.

The 2022–2023 Qatargate scandal – which entailed the widespread undermining of Union democracy by members of the European Parliament acting on behalf of third countries – has rocked the European Union to its core. The proposal by the Commission aimed at establishing transparency and accountability surrounding such activities cannot therefore come at a more appropriate time. But does the proposal live up to its objectives? Here, this piece casts doubt on whether that is the case, with this piece exploring Qatargate as an example, as well as the content, constitutionality, and criticism of the proposal. This Article also makes comparisons to Union-based representation activities and the Commission’s approach to antidumping, and shines light on the Commission’s treatment of third-country actors and representatives thereof.

Compared to previous secondary legislation, Article 11 of the Digital Covid Certificates regulations was remarkably explicit in its requirement for Member States to consider scientific evidence when restricting free movement for the certificate holders. However, we argue in this Article that the regulations achieved a partial codification of the existent case law of the CJEU rather than imposing any additional requirements. Namely, the case law had already required Member States to rely on scientific evidence that reflects the international consensus, that is relevant and up to date, and that the evidence had to demonstrate by means of a risk assessment a real risk to the public health. We also discuss these findings in the light of the proportionality and precautionary principles and suggest that understanding the evolution of the EU legal order’s evidentiary requirements is useful in the light of the legislator’s claim of objective and rational policy-making procedures in public health and other crises.

The analysis of liability aspects facing Artificial Intelligence (‘AI’)-generated outputs under copyright and related rights has been overlooked compared to other issues connected to the development and use of AI. This study fills this gap by exploring pertinent questions under international, EU and UK law. Specifically, the study tackles actionable reproduction, allocation of liability, and availability of defences. The analysis ultimately shows that, while it is clear that each case will need to be decided on its own merits, the generative AI output phase raises several profiles of liability under copyright law. If the goal of policymakers and relevant stakeholders is to ensure the balanced and sustainable development of AI, then the issues related to the generation and dissemination of AI outputs need to be given ample attention and a greater role in the debate than what has been the case so far, whether it is in the context of risk assessment and compliance, licensing initiatives, or in contentious scenarios.

The expansion of EU regulatory governance in the financial sector since the end of the global financial crisis 2008 has given rise to the need to examine regulatory consistency in the volumes of financial regulation that may have cross-cutting implications. In this light, this article examines the effectiveness of the Regulation of ESG infomediaries through the lens of “functional regulatory consistency” with other infomediary regulations, for credit rating agencies and stock market benchmarks. It argues that this lens most aptly reveals the three key weaknesses of the regulatory regime for ESG infomediaries. These relate to sub-optimal coverage of scope, over-inclusiveness in the application of regulatory standards and under-inclusiveness where appropriate governance is not provided. the sub-optimal coverage of scope raises the question of whether ESG stock market index providers should indeed be regulated as ESG infomediaries or as stock market benchmarks more generally falling within the Benchmarks Regulation 2016. Over-inclusiveness and under-inclusiveness in the regulatory provision reflects blind spots in applying functional regulatory consistency, where it is inappropriate due to distinguishing features in business models, market structures or market relations.

We argue it is efficient/desirable for central banks to operate retail Instant Payments (IP) schemes and infrastructure, considering that (i) payment service providers (PSPs) face a problem of collective action, which limits their capacity to deliver a cheap, fast, open-architecture and interoperable IP scheme; and (ii) this problem may be overcome by a central bank (economically neutral actor) with a dual role of regulator and operator of IP schemes, especially by mandating participation of large PSPs and ensuring that the low cost of infrastructure is passed on to consumers. We corroborate with data from Brazil’s Pix and India’s UPI, where the efficiencies of central bank-led IP schemes also led to social gains through financial inclusion.

This article discusses the EU supply chain legislation, by virtue of the recently adopted Corporate Sustainability Due Diligence Directive (CSDDD) which aims to reduce negative sustainability impacts in global supply chains with regard to a list of human rights and environmental standards specified in its Annex I of the CSDDD.

We argue that the CSDDD marks a fundamental change on the EU level, from disclosure duties to mandating prevention of, and compensation for, adverse sustainability impacts in supply chains.

We further find that the CSDDD is a legal transplant combining the principles laid down in the OECD Guidelines for Multinational Enterprises on Responsible Business and those of the UN Guiding Principles on Business and Human Rights, along with elements of French supply chain legislation from 2017 (which relies on a private enforcement model) and the German supply chain law from 2021 (which is based on a public enforcement model). Like all legal transplants, the resulting legal text generally prompts questions about consistency and specifically raises doubts as to whether combining all of the components of a private and a public enforcement model is proportionate for the purpose of the CSDDD which is to ensure that companies take effective steps to counter violations of human rights and environmental standards in global supply chains. The scope provisions (including smaller in-scope EU firms while leaving non-EU peers of a similar size aside) paired with significant high compliance burden provide grounds to argue that the CSDDD impacts on the competitiveness of these smaller in-scope EU companies, and thus the EU economy at large.

During the COVID-19 pandemic, the European Union (EU) observed a major centralisation of competence in public health policy – the EU Vaccines Strategy. Yet increased centralisation or integration is not always desirable because the EU lacks a layer of democratic control to ensure transparency and accountability. This feature highlights the need to better understand and assess the EU’s actions during the pandemic. This paper aims to assess the effectiveness of the EU Vaccines Strategy and contributes to the wider debate on the centralisation of power at Union level. The joint procurement of COVID-19 vaccines is considered a success, as it avoided a “vaccine scramble” by the EU Member States. However, the fact that the Member States were obliged to purchase more than they needed and the lack of transparency in the negotiations with companies on the procurement of vaccines have raised questions about the integrity of the Commission’s exercise of executive power.

The EU’s policies in the field of technology broadly defined are increasingly marked by a concern over strategic autonomy, and Europe’s place in the world. Regulatory interventions are framed in terms of “digital sovereignty,” with the Commission seeking to ensure that external dependencies are reduced with the aim of increasing the EU’s resilience to geopolitical instability and external shocks. Using the case study of semiconductors, the chips that power modern electronic devices, this article explores how technology policy in the EU sits at the economy–security nexus, in which economic goals and security goals are interdependent and inseparable. Focusing on the life cycle of the semiconductor supply chain from the control over natural resources through to the cybersecurity requirements placed on the finished products, this article demonstrates the increasing security logic embedded within a burgeoning industrial technology policy.

The impact of the European Union (EU) in strengthening nanotechnology risk regulation in non-EU countries is still an under-researched topic. This article focuses on the EU’s influence on its trading partners, using the case study of Israel, which in 2023 adopted restrictions on nanotechnology in cosmetics products following the EU. It is argued that EU risk regulation have been both a trigger and a formative factor for the development of Israeli nanomaterials restrictions. The importance and economic interdependence in the EU market for cosmetics has prompted a response from Israeli policymakers. In addition, the EU regulatory capacity through its expertise and sanctioning authority have influenced the Israeli regulatory agenda. The article shows that the impact of EU regulation also coincided with domestic economic factors, concerns about technology policy and policymakers’ preference for stringent standards. Israel’s risk regulation of nanomaterials in cosmetics provides a useful case study for analyzing the EU’s regulatory impact on its trading partners. Once again, stricter EU’s health and safety regulation drives those of its trading partner upward.

This paper introduces a unique phenomenon with a distinctive Chinese regulatory approach. Since 1994, the Consumer Rights Protection Law has afforded consumers the right to seek punitive damages in instances of fraudulent practices. This has given rise to a special profession with Chinese characteristics: professional consumers. Their status as enigmatic figures is a consequence of the fluctuating stance of public authorities. Thirty years of consistent inconsistency has been a rarity in China’s legislative history. The year 2024 marks the 30th anniversary of the enactment of the CRPL, China’s Consumer Rights Protection Law and the birth of its implementing regulation. It is an opportune moment to reassess the regulatory system that enabled this group and reconstruct it for the future. This paper presents a comprehensive regulatory review of the emergence, growth, and projected decline of professional consumers. It examines the reasons for this long-standing regulatory inconsistency through a detailed investigation of China’s legal system. It concludes by projecting two upcoming legal positions. The first is the transformation under the state’s co-governance strategy. The second is the displacement by procuratorial public interest litigation. Although seemingly contradictory, these two positions exemplify a distinctive Chinese approach to the co-governance strategy, which is characterized by the preponderance of public authority.