Governmental interest in automated AI judges is driven less by justice and more by administrative convenience, fiscal pressure, and institutional control. This newsletter exposes how AI promises speed, uniformity, and predictability while threatening transparency, accountability, and human judgment. The analysis challenges the assumption that efficiency improves justice, warning that delegating adjudication to AI risks transforming courts into instruments of bureaucratic optimisation rather than guardians of legal legitimacy.

Share

Newsletter Issue 88

The Administrative Fantasy of Justice Without Human Intervention

I might raise some eyebrows by saying this, but some governments appear eager to place your fate in the hands of an algorithm. In fact, in China, millions of legal cases have already been decided by “Internet courts” staffed with non-human judges operating entirely online.

These AI-driven cases handle everything from e-commerce disputes to loan defaults, and remarkably 98% of their rulings have been accepted without appeal.

It might be startling to learn that a court with no human judge present can ask questions, weigh evidence, and issue verdicts via a holographic avatar, as demonstrated in Hangzhou’s Internet Court.

The system even runs 24 hours a day, 7 days a week – a round-the-clock justice delivery that no human judge could ever match.

When I first heard about this, I felt equal parts fascinated and uneasy. I want to talk to you about why some governments are so tempted by the idea of AI judges, and what it means for the future of justice.

The Allure of Automated Justice

I have spent enough time around the legal system to know that efficiency is the magic word that every government loves to hear. Courtrooms around the world face crushing case backlogs and slow proceedings. The notion of an AI “robot judge” promises lightning-fast case processing, potentially clearing dockets that human judges struggle to manage.

Sometime ago, media reports breathlessly announced that Estonia was building exactly such a robot judge to handle small claims disputes and help clear its backlog. Officials supposedly wanted an algorithm to analyze documents and reach decisions on claims under €7,000, which a human judge would then simply review.

The project was touted as one of the most advanced examples of AI in the judiciary, justice by artificial intelligence. What exactly was the promise? Quicker resolutions, lower costs, and no more waiting months for a court date.

We later learned that this story was more hype than reality. In 2022 the Estonian Ministry of Justice felt compelled to clarify it never had any project or even ambition to replace human judges with AI.

That did not stop the idea from capturing imaginations. And frankly, it is easy to see why the idea is seductive.

Automating routine court decisions could free up human judges for the hardest cases and eliminate mundane tasks.

In theory, an AI judge might churn through straightforward disputes with the detached precision. One enthusiastic commentator described the potential “cost savings” as “astronomical”, noting that an AI system could issue a preliminary decision in under a month, and unlike a human it “is not hungry or tired”.

Governments hear things like that and start picturing leaner budgets and ultra-efficient courts.

Consistency and objectivity are another part of the allure. Ask any lawyer and they will tell you that different judges can reach very different outcomes on similar facts.

Humans are fallible and sometimes inconsistent, but an AI algorithm can be replicated and standardized nationwide. In China, the ruling Communist Party has explicitly embraced “Smart Courts” as a way to improve consistency in judicial outcomes and increase public trust in the courts.

From the perspective of central authorities, if every courtroom uses the same AI system, you eliminate rogue judges who might deviate from policy and you ensure each defendant is subject to the same decision criteria everywhere.

The temptation here is control: AI systems can be centrally updated or monitored, giving governments more oversight over the judicial process.

In an authoritarian system, that consistency also conveniently enables centralized oversight and intervention in cases when needed.

Even in democracies, one can see the appeal of a tool that might render justice more predictable – no more “judge lottery” where your fate depends on who happens to preside.

There is also a public perception angle. Many people have stories of judicial errors, biases, or high-profile miscarriages of justice. An AI, on the surface, carries none of the human baggage; it does not have bad days, it does not hold grudges, it does not get star-struck or prejudiced.

Some technocrat policymakers genuinely believe that a well-designed AI could be more impartial than a human judge. For example, in traffic or parking fine disputes, an algorithm might decide purely on data (Was the car parked too long? Did the camera catch the license plate?) without being swayed by a defendant’s attitude or appearance.

We have already seen glimpses of this: a UK-developed chatbot lawyer app famously overturned 160,000 parking tickets by automatically generating appeals, exploiting the system’s own rules.

If an AI can beat humans at following legal rules for parking fines, why not let it decide them in the first place?

Also, let us not forget speed and accessibility. A digital judge could in theory handle cases via video or online submissions, delivering rulings in hours rather than weeks.

During the COVID-19 pandemic, courts around the world turned to Zoom and online systems out of necessity. This accelerated acceptance of online disputes resolution.

Tech-forward nations like China took it further. Their Internet courts allow citizens to file cases online, attend hearings by video chat, and receive judgments electronically.

Such systems can dramatically lower the barrier to accessing justice, especially for people in remote areas or with small claims not worth a costly legal battle.

Proponents say AI judges are a natural next step to make justice system more user-friendly. No intimidating courthouse, just an app on your phone that issues a ruling.

In Beijing’s Internet Court, the average case reportedly concludes in just 40 days, with hearings under an hour on average.

Imagine a civil claim being filed, argued, and resolved in a matter of weeks entirely through an online platform. That is the vision.

Reality Check: Experiments in AI Judging

We should acknowledge that so far, fully automated judges remain mostly experimental.

China is the clear frontrunner. Since 2017, its specialized Internet Courts have been operating in cities like Hangzhou, Beijing, and Guangzhou.

The “judges” in these courts are effectively AI-powered decision systems with a virtual judge interface. They handle a surge of cases tied to the digital economy (online commerce disputes, copyright for online content, etc.), and by all accounts the volume is immense.

In just a six-month period in 2019, users conducted over 3.1 million legal activities through the Hangzhou Internet Court platform.

One striking statistic from Beijing is that over a million people have used the system, yet appeals are extraordinarily rare, nearly all parties accept the AI’s verdict.

The platform even populates a life-like avatar of a judge, a 3D modelled person in judge’s robes, who can ask the litigants questions on screen. Chinese reporters have sat in on these virtual hearings and watched a holographic judge guide the proceedings.

Other countries have flirted with AI judging in narrower contexts. You might have heard of proposals to use AI for small claims and disputes.

While Estonia’s “robot judge” turned out to be a myth, the very idea sparked global discussion.

There is a kernel of reality in these ideas: Online dispute resolution (ODR) systems are growing, and they often involve automated decision-making for low-stakes issues.

For instance, Canada has experimented with ODR for simple civil claims and certain tribunals, where an algorithm or guided system helps the parties reach a resolution or even renders a proposed outcome.

These systems stop short of a final binding judgment by AI, but they inch close. If an AI mediator proposes an outcome and both sides accept, effectively the AI “decided” the case.

In the United States, meanwhile, we see a different path to using AI to assist judges rather than replace them, at least for now. American courtrooms in several states have started integrating algorithmic risk assessment tools to guide decisions on things like bail and sentencing.

These programs, such as the well-known COMPAS system, generate scores predicting a defendant’s likelihood of reoffending. Judges then consider those scores when deciding whether someone gets bail or how long a sentence to give.

In theory it is just advisory, but in practice it can heavily sway outcomes. This approach has been contentious – I will get to the controversies in a moment – but it shows how even in a justice system that values jury trials and human judges, some decision-making is being handed to algorithms.

In fact, the Wisconsin Supreme Court confronted this issue in a notable case: State v. Loomis 881 N.W.2d 749 (Wis. 2016). In that case a defendant argued it was unfair that an opaque algorithm helped determine his prison sentence.

The court upheld the sentence but cautioned that such risk scores should be only a supplementary factor and must not replace a judge’s own judgment.

The message from the ruling was essentially in that you can use the AI’s recommendation, but the human judge is still responsible for the decision.

That seems to be a critical point. So far, even the most ambitious experiments usually leave a human with some liability. For instance, China allows appeals to a human judge if someone disagrees with the AI outcome.

The vision of completely replacing judges in all cases remains more of a thought experiment than a reality in 2026. However, every year, the line nudges forward.

Just recently, I saw news of two U.S. judges who admitted their staff had used ChatGPT-style AI tools to draft portions of judicial orders, with disastrously erroneous results that slipped through. This caused quite a stir, prompting calls for clearer rules on how judges and clerks may use AI.

Indeed, it is a reminder that even if we are not handing the gavel to an online judge today, AI is already seeping into the judicial process in bits and pieces, for better or worse.

Blind Justice or Biased Algorithms?

Before we all warm up to the inevitable, we need to discuss frankly about the serious concerns and limitations of AI as a Judge.

The promise of impartiality from an AI is not a given at all. Yes, an AI comes without human emotions, but it inherits the biases of its data and programming.

That risk is present. In the United States, the use of COMPAS and similar sentencing algorithms has become a cautionary tale. Investigative journalists discovered that COMPAS was far more likely to falsely label Black defendants as high-risk future criminals compared to white defendants. Think about that; a supposedly objective tool was doubling the rate of false “future crime” flags for Black individuals.

Meanwhile it was more often underestimating risk for white defendants, incorrectly giving them low risk scores.

The bias was not deliberate in the sense of someone programming racism openly; it emerged from patterns in the underlying data and how the algorithm was developed.

Should we regulate the developers or the AI model? Read our newsletter to learn more about regulatory approaches:

Technology Law

Regulate the AI Developers, Not the AI

AI systems are getting more powerful, but the real risk often lies with the companies behind them. In this research spotlight, we discuss a scholarly article “Entity-Based Regulation in Frontier AI Governance” published on the Carnegie Endowment for International Peace website. It explores why current rules that focus on AI tools themselves are missing …

Read more

9 months ago · 9 likes · 2 comments · Technology Law

From the perspective of the defendant who is denied bail because a computer indicated so, the distinction does not matter, it just feels like algorithmic prejudice.

This is a nightmare scenario for automated justice, that we might replace human bias with a hidden, harder-to-challenge bias embedded in code.

Another glaring issue is transparency and the right to explanation. In a courtroom, a human judge is expected to explain their reasoning in a judgment. How do you question an algorithm’s reasoning?

Many AI models, especially advanced machine learning ones, operate as a “black box”. They crunch inputs and produce outputs, and not even the developers can easily explain the exact decision path.

This was a core of Mr. Loomis’s complaint in the Wisconsin case as he had no way to challenge the COMPAS algorithm because its inner workings were proprietary and opaque.

It is fundamentally troubling to imagine standing in court, hearing “the computer says you are high risk, so you get a harsher sentence,” and not being able to assess that computer’s logic.

Due process in many countries includes the right to review and contest evidence, but does an algorithm’s output count as evidence? If so, can the defendant demand access to the source code?

These legal questions are largely unresolved. There is a growing movement insisting that “algorithmic accountability” and transparency must accompany any use of AI in government decisions affecting rights.

Without transparency, an AI judge would be an inscrutable authority, which undermines a fundamental principle of justice. Decisions must not only be fair, but be seen to be fair and reasoned.

We also have to consider empathy and moral judgment, qualities that we expect, or at least hope, human judges will possess.

A judge in a courtroom can look a defendant in the eye, can consider pleas for mercy, can weigh intangible factors like remorse. Can an AI do that? Not really, not yet.

An algorithm scores what it is given to score. It might be great at parsing legal texts and past cases, but justice is more than black letter law application.

There are fears that an automated judge would be ultra-strict, after all, a computer won’t bend a rule or overlook a nuance unless explicitly programmed to.

It has been argued that mercy, context, and human intuition are indispensable to justice, and these are things no AI can replicate. I find it hard to imagine an AI automated system exercising equitable discretion or interpreting a law in light of evolving social values.

At best, it will do what it’s told; at worst, it might rigidly enforce even unjust laws without question.

A chilling thought is that an authoritarian government could program an AI judge to enforce oppressive laws to the letter, with flawless efficiency and no dissent. Human judges can resist immoral orders; AI might not have that capacity.

The accountability problem looms large too. If a human judge makes a grievous error or is biased, there are mechanisms (imperfect as they are) to appeal, to seek review, even to impeach or discipline the judge.

If an AI judge makes an error, say, convicts an innocent person due to a glitch or biases, who is responsible? The company that developed the software? The government officials who deployed it? It becomes a blame-shifting fiasco.

Also, how would such an error even be discovered? If all judges were algorithms applying the same model, a systemic flaw could go unnoticed for a long time, affecting thousands of cases before anyone realizes. That scenario should keep anyone up at night more than we care to admit!

Collision Course with the Law

You might be wondering whether governments even legally hand over judging to AI? In many places, this idea runs into legal roadblocks, and rightly so.

For example, in Europe there are strong legal guarantees of a fair trial and human accountability. The European Union’s data protection law (GDPR) explicitly gives people the right not to be subject to a decision based solely on automated processing if it has significant effects on them.

What is the future of European courts with the integration of AI in the judicial process? Find out more:

Technology Law

The Digital Future of European Courts

The European Commission is drafting a new strategy to bring courts into the digital age by 2030. These reforms will involve faster case hearings, fewer delays, smarter tools (e.g., AI) and less paperwork. The European Commission intends to fix outdated, expensive and slow justice systems…

Read more

10 months ago · 4 likes · Technology Law

A judgment in court is arguably the most significant decision one could face.

This means that under current EU law, you can insist on a human review of an automated decision.

A fully AI judge with no human involvement would be at variance with that right, unless EU countries carve out an exception in law. Indeed, the EU is actively working on regulations for AI.

The EU Artificial Intelligence Act classifies any AI used in judicial decision-making as “high-risk”, recognizing the profound impact on rule of law and individual rights.

The EU lawmakers have even inserted a clear principle in the latest draft: AI may support judges but must not replace them, the final decision must always be made by a human.

In other words, European policy is drawing a red line that no matter how advanced AI gets, an actual person should be the one delivering the verdict when it comes to dispensing justice.

Are lawyers losing control to AI? Is the legal profession at risk of AI proliferation and to what extent? Read our newsletter to find out more:

Technology Law

The Legal Profession Is Losing Control To AI

The legal profession is outsourcing its thinking. AI is already writing arguments, summarising cases and drafting contracts, often without human intervention. Is this an erosion of legal practice? If the law becomes automated guesswork, then justice becomes optional. The silence from regulators and educators is not only strange, but it is dangerous…

Read more

8 months ago · 11 likes · 1 comment · Technology Law

This aligns with the prevailing view in international human rights law that everyone is entitled to have their case heard by a “competent, independent and impartial tribunal”, phrases which presume a human judge sitting and listening.

Outside Europe, these debates are just as alive. In the United States, there is no single law like the GDPR’s Article 22, but the judiciary itself is proceeding cautiously. A U.S. federal judicial task force recently warned judges not to delegate core judicial functions to AI, especially not the act of adjudicating a case.

The concern is that even if AI can help with research or drafting, the judge must remain fully responsible and engaged in the decision.

Influential voices in the legal community are emphasizing that AI should assist, not replace human judgment.

Even China, for all its tech enthusiasm, maintains a fig leaf of human involvement, as noted, one can appeal an AI court’s decision to a human judge, and Chinese officials portray their Smart Courts as enhancing efficiency while still maintaining human oversight.

The official line is that technology should support the decision-making power of judges, but not supplant it.

Of course, the reality of how much human oversight is actually happening in China’s Internet Courts might be debatable, but at least on paper, they acknowledge a human backstop.

It is interesting that even governments keen on automation still feel the need to reassure the public that judges are not being entirely replaced.

That tells us something that there is a deeply ingrained cultural and constitutional importance to the human judge as a symbol of justice.

Replacing that human figure with a AI is bound to provoke resistance. Indeed, when the idea of the robot judge in Estonia made headlines, it sparked plenty of discussion in Europe about the ethics and legality of such a move.

The pushback from the legal community was swift, and as we saw, the government backed away, calling it misleading news.

Likewise, in France, instead of automating judges, the government went the other direction by banning the practice of statistical analysis of judges’ past decisions (to profile or predict their rulings).

A law was passed to protect human judges from being quantified by AI, ironically.

While some authorities fantasize about AI judges to streamline justice, others are enacting laws to shield the human element in judging.

A Careful Path Forward

As someone deeply fascinated by the intersection of law and technology, I understand both the temptation and the fear at play here. When talking to non-lawyers about this, I often find people initially intrigued. Who would not want faster and cheaper court cases?

Then arrives the viscerally uncomfortable thought of an AI driven robot pronouncing a prison sentence or deciding a child custody dispute. That discomfort is healthy. It means we recognize something vital that justice is not merely computational. The rule of law is as much about process and trust as it is about outcomes.

We trust a human judge to hear us, even if they might err, because we ascribe legitimacy to that human deliberation. Transferring that trust to an AI is a huge leap.

Governments will likely continue to experiment with AI around the edges of the judicial process.

We will see more AI legal assistants that help judges research cases or draft routine parts of judgments.

We will see expanded online courts for minor issues, possibly with automated mediation and suggested resolutions.

Be that as it may, there is a long road from there to a world where you walk into a courthouse (or log into one) and face an AI judge as the final arbiter.

For the foreseeable future, fully autonomous AI judges remain a controversial proposition fraught with legal and moral peril.

Even the most advanced AI cannot yet replicate the full spectrum of human judgment, especially the qualities of compassion, wisdom, and public accountability that we expect from our judges.

I have confidence that many of the safeguards in law will hold, and that any use of AI in judging will be accompanied by the right to a human appeal or review.

International principles are already crystal clear on one thing: technology should serve humanity, not displace it in the courtroom.

So, is an AI judge coming for your day in court? The honest answer is that governments are tempted, yes, but also wary. They stand to gain efficiency and control, yet they risk losing the public’s faith in justice if they go too far.

For now, I am relieved that the consensus is to move carefully. We should demand nothing less. The day may come when AI takes its place on the bench, but if and when that happens, I suspect we will still want a human behind the gavel of justice.

Leave a comment

Disinformation laws are often drafted with a confidence that is not matched by their democratic legitimacy. Legal systems appear willing to trade precision, restraint, and procedural safeguards for speed and symbolic reassurance, even when the subject matter sits at the core of political expression. This trend deserves sustained criticism, not because false information is harmless, but because law that intervenes too broadly in public discourse alters how democratic power is exercised, delegated, and justified.

Share

Newsletter Issue 87

The Legal Campaign Against Disinformation and Its Democratic Risks

The current generation of laws meant to counter falsehood in the digital world carries a real risk of weakening the very democratic values they claim to defend. It is easy to accept the impulse behind these laws. False information can corrode trust, deepen division, and influence the course of public decision making in ways that are harmful to societies.

Nonetheless, the responses that legal systems are adopting raise questions about freedom of speech, accountability, and the role of government and private technology companies in controlling what citizens are allowed to know and say.

Governments are passing statutes and regulators are enforcing rules with significant consequences. Individuals are being asked to adapt to legal frameworks that touch on fundamental liberties while technology platforms are being pressed into roles that shape political discourse.

This newsletter will trace legislative frameworks, highlight relevant legal developments globally, and critically assess how these laws are playing out as real world tools that interact with technology and civil liberties.

The Rise of Disinformation Regulation

In recent years, the response to disinformation has included a mix of statutory mandates and regulatory expectations. In the European Union, the Digital Services Act (Regulation of the European Parliament and of the Council of 19 October 2022) is central to how online content is regulated.

It imposes new responsibilities on very large online platforms and search engines aimed at enhancing transparency of content moderation and curbing harmful content including disinformation under certain conditions.

The European Commission has emphasised that this is part of broader efforts to protect democratic processes and strengthen public debate.

In the United Kingdom, the Online Safety Act 2023 creates an expansive set of obligations on providers of internet services to manage harmful content.

Civil liberties organisations have argued that the Act grants broad powers to regulate speech and encourages platforms to take down content pre emptively to avoid liability.

Critics such as the Open Rights Group and Article 19 have warned that such mechanisms risk impinging on freedom of expression and access to information.

Beyond Europe, legal frameworks are emerging that criminalise or civilly sanction the communication of false information. In the Indian state of Karnataka, a draft bill proposes jail terms for spreading so called fake news or content that is defined in vague terms, including anti feminist content and superstition. Free speech advocates warn that such legal language could sweep in a vast range of expression and be used inconsistently.

Singapore’s Protection from Online Falsehoods and Manipulation Act was passed in 2019 with the intention to counter deliberate online falsehoods while attempting to exclude opinion and satire, yet concerns remain about the broad discretion given to authorities and the potential chilling effect on legitimate discourse.

Ethiopia’s Hate Speech and Disinformation Prevention and Suppression Proclamation makes social media users and intermediaries criminally liable for posts deemed to disrupt public order, showing how legal tools can extend to severe penalties for online speech. Human rights organisations have criticised this law as infringing on fundamental expression rights.

These legislative efforts reflect the global urgency with which false information online is treated. However, the very design of these laws often places enormous discretionary power in the hands of regulators or platform operators to decide what content is permissible.

Democracies are rethinking how they legislate free speech in an environment where digital systems mediate so much of public discourse, but many of the legislative responses are bending longstanding protections in ways that deserve careful scrutiny.

The Legal and Constitutional Debate

The core tension at the heart of these laws is the balance between preventing harm and protecting freedom of expression. Democratic constitutions and human rights frameworks often guarantee robust rights to free speech.

In the United States, the First Amendment has been interpreted to protect even false statements in many contexts unless they harm specific individuals through defamation or similar legal channels.

Attempts at regulating deepfakes and election related speech have encountered immediate legal challenge on constitutional grounds. In 2025, X Corp filed a federal lawsuit to overturn Minnesota’s ban on political deepfakes arguing that the law penalises election related expression and violates First Amendment rights.

For a thoughtful discussion on the negative impact of deepfakes in our courts and society, please read our newsletter:

Technology Law

Why Deepfake Technology Forces Courts to Rethink The Reliability of Evidence

Courts can no longer credibly claim that evidentiary reliability is a settled problem managed through existing rules and judicial instinct. Deepfake technology has exposed how fragile long held assumptions about recorded truth really are, not because judges are inattentive, but because the legal system was never designed to verify authenticity in an env…

Read more

3 months ago · 11 likes · 7 comments

In Murthy v. Missouri, the United States Supreme Court addressed the ability of the federal government to communicate with social media companies about content moderation. The Court allowed government involvement regarding misinformation removal, but this itself sparked controversy about where the line is drawn between legitimate action against falsehoods and the government influencing the decisions of private platforms.

In Europe, freedom of expression is safeguarded under Article 10 of the European Convention on Human Rights and the EU Charter of Fundamental Rights. However, the EU’s regulatory approach does not explicitly define disinformation in statutory text, and enforcement under the Digital Services Act is tasked to both regulators and platforms to curtail disinformation and illegal content.

Scholars have raised serious questions about whether these approaches sufficiently protect free expression rights and whether they empower private companies to act as arbiters of political speech without due process.1

The German Network Enforcement Act, passed in 2017, obliges platforms to remove illegal content within strict timeframes or face steep fines. The law has been widely criticised for creating incentives for platforms to err on the side of removal to avoid penalties, which essentially pushes companies to make judgments about speech that ought to be matters for courts. Critics argue that this dynamic can lead to disproportionate censorship of legitimate expression.

France’s Avia Law, aimed at combating hateful and illegal content, saw major portions struck down by the Constitutional Council because they infringed too broadly on freedom of expression. Yet, the law’s initial passage highlighted how national legislatures are grappling with the challenge of regulating online speech.

These legal debates involve core principles that structure democratic participation. The ability to hear opposing views, to criticise government action, and to engage in public debate are foundational to self governance.

When legal frameworks alter incentives for speech or create mechanisms that lead to over removal of content, there is a collateral effect on democratic engagement.

Democracy Beyond False Statements

It is vital to acknowledge that disinformation does cause harm in itself. False narratives and fake news about elections, public health, or civic processes can mislead citizens and erode trust in institutions.

Technical studies have shown that online propaganda and misinformation contribute to polarisation and societal division.2

At the same time, it is essential to differentiate the regulation of harmful and criminal speech from broad preventive laws that apply across wide categories of expression.

Democracies have long recognised that some kinds of speech such as incitement to violence or defamation can be subject to legal limits.

Nonetheless, new laws aimed at digital disinformation often lack clear definitions that distinguish between intentional manipulation and honest error or opinion.

Legal frameworks that do not ensure procedural safeguards or judicial oversight risk granting regulatory bodies or private entities the power to remove speech without sufficient justification.

If laws are designed in ways that blur these fundamental distinctions, then democracy itself suffers. Citizens are less exposed to the full range of perspectives and have diminished ability to challenge prevailing narratives. A society that cannot tolerate disagreement and dissent risks becoming less resilient, less informed, and ultimately less democratic.

Private Actors as Public Regulators

A critical concern in the modern legal regime on disinformation is the role of private technology companies. Laws like the EU digital services framework and the UK’s online safety model rely heavily on what platforms decide and how they enforce rules.

Platforms are required to act to avoid penalties. This effectively deputises private companies to enforce public norms about speech that historically were the domain of public law and independent courts.

Platforms have commercial incentives and policies that are not always transparent or consistent across jurisdictions. A decision to remove content or to label it as false is made within a corporate governance structure not accountable to the public in the same manner as a democratic legislature or a judicial body.

This dynamic raises a question about legitimacy. Democracies rely on transparent and accountable institutions to define and enforce the legal bounds of expression. When private platforms operate in lieu of those institutions on matters that affect political speech, the democratic quality of that enforcement is uncertain at best.

Leave a comment

Legislative frameworks that push more power to platforms without robust oversight risk enabling forms of censorship that are neither subject to clear legal standards nor to democratic accountability.

Citizens often do not know why a piece of content is taken down. They have limited rights to appeal, and they encounter different outcomes depending on where they are located or how a platform interprets vague legal duties.

The International Ripple Effect

Legal approaches in one jurisdiction influence others. The European regulatory model, because of its size and market power, affects global platform behaviour.

US officials have openly criticised the EU Digital Services Act on grounds that it enables censorship beyond European borders and undermines free speech.

These critiques have become part of international diplomatic friction, with officials from one democracy publicly challenging another democracy’s approach to regulating digital speech.

At times, national courts take positions that reshape legal obligations. The Brazilian Supreme Court’s 2025 ruling that social media platforms can be held liable for user posts without judicial orders puts pressure on platforms to act quickly to remove harmful content or face legal risks. Such rulings create asymmetric incentives for moderation that may encourage broad content removal to mitigate liability, again with potential impacts on democratic debate.

Other countries, including in South Asia and Africa, are adopting laws that grant governments sweeping control over content under the pretext of security or misinformation control. These laws often intersect with broader patterns of suppression and have severe consequences for dissenting voices and civic freedoms.

The international proliferation of disinformation laws creates a patchwork of standards that technology companies must navigate.

In the absence of clear, globally accepted norms that respect free expression while addressing harm, there is a risk that legal models that prioritise control over speech will be adopted more widely, with negative consequences for democratic engagement.

What Democracy Requires

Democracy depends on open public discourse where ideas can compete and be tested against evidence and argument. The impulse to regulate falsehood is understandable, yet legal solutions must be calibrated carefully to respect foundational rights. Laws that are vague in definition, broad in scope, or lack adequate procedural protections risk being repurposed to silence dissent or to restrict controversial opinions that are essential to democratic deliberation.

Legal frameworks to counter disinformation should ideally operate with clear definitions, predictable procedures, and robust safeguards that protect legitimate political speech. They must uphold independent oversight and judicial review so that when speech is restricted, there is accountability and transparency in the process.

The current wave of disinformation regulation reflects a genuine concern about the impact of false information, but there is a real danger that in addressing this issue through broad legal authority, democracies may erode the very principles of free expression and accountability that make them resilient.

Links in this article reference public legal developments and reporting from credible sources. Readers are invited to examine the original materials themselves to further understand the content and context of the legislative and judicial activities discussed.

What are your thoughts about disinformation and fake news undermining democratic practices?

Leave a comment

Courts can no longer credibly claim that evidentiary reliability is a settled problem managed through existing rules and judicial instinct. Deepfake technology has exposed how fragile long held assumptions about recorded truth really are, not because judges are inattentive, but because the legal system was never designed to verify authenticity in an environment where fabrication is easy, convincing, and legally consequential.

Share

Newsletter Issue 86

Deepfakes Are Not Just a Tech Problem; They Are a Justice Problem!

Courts have always depended on evidence as the anchor of decision making. That dependence now sits under sustained pressure. This is not an abstract debate about future technology. It is a present reality that demands careful attention from anyone who cares about the rule of law, accountability, and fairness.

Video and audio that appear authentic can now be generated or altered in ways that defeat casual inspection and sometimes expert review. Courts have traditionally relied on a combination of common sense, procedural safeguards, and expert testimony to decide whether evidence is reliable. Deepfake technology places pressure on all three at the same time.

This newsletter looks at why this matters, how existing evidentiary principles are being strained, and why courts are being forced to reconsider assumptions that once felt stable.

What Deepfakes Really Do to Evidence

Deepfake technology undermines a basic assumption that has long guided judicial reasoning, which is that recorded audio and video tend to reflect real events unless there is a concrete reason to doubt them.

Courts never treated recordings as infallible, but there was an underlying confidence that fabrication required effort, expertise, and resources that were not widely available.

That confidence no longer holds. Software tools now allow realistic manipulation of facial movements, voice patterns, timing, and context using datasets that can be gathered from public sources.

Social media platforms, conference recordings, podcasts, and court filings themselves provide the raw material. The result is not simply the existence of fake content, but uncertainty about authentic content.

A recording can be genuine and still be challenged with credibility. A recording can be fake and still persuade. Courts must now consider not only whether evidence appears real, but whether appearance itself has lost probative value. This affects admissibility decisions, weight given to evidence, and the allocation of burdens between parties.

Traditional Evidentiary Safeguards Under Pressure

Legal systems rely on a layered approach to evidentiary reliability. Authentication rules require parties to show that evidence is what it claims to be. Cross examination allows weaknesses to be exposed. Expert witnesses provide technical insight, while judges and juries assess credibility in context.

Deepfakes complicate each layer. Authentication becomes harder when visual similarity and voice matching are no longer meaningful indicators of origin. Cross examination struggles when the witness did not create the content and cannot explain the manipulation. Expert evidence becomes contested when experts disagree or rely on tools that themselves produce probabilistic conclusions.

Interested in learning more the future of courts in the EU? Check out this newsletter:

Technology Law

Issue 15: The Digital Future of European Courts

The European Commission is drafting a new strategy to bring courts into the digital age by 2030. These reforms will involve faster case hearings, fewer delays, smarter tools (e.g., AI) and less paperwork. The European Commission intends to fix outdated, expensive and slow justice systems…

Read more

10 months ago · 4 likes · Technology Law

The law has always accepted that evidence can be forged. What is different now is scale and plausibility. Fabrication is easier, faster, and more convincing than before. This changes how much confidence can be placed in surface level indicators of truth.

Courts in several jurisdictions have already acknowledged this difficulty. Judicial opinions have begun to reference the risk of manipulated media, even where no deepfake allegation is proven. This shows that the issue is not limited to cases involving advanced forgery, but extends to general evidentiary assessment.

Criminal Justice and the Risk of Error

Criminal proceedings illustrate the stakes most clearly. Video evidence often carries strong persuasive force. Jurors tend to trust what they can see and hear. Prosecutors rely on recordings to establish presence, intent, or conduct. Defendants rely on recordings to show innocence, coercion, or misconduct by authorities.

Deepfakes introduce two risks at once. False inculpatory evidence may be introduced. Genuine exculpatory evidence may be dismissed as fake. Both risks undermine fairness.

Judicial systems have limited tolerance for error in criminal cases, yet procedural rules are slow to adapt. Judges must decide whether to admit recordings while knowing that their own ability to evaluate authenticity is constrained.

Excluding all contested recordings is not realistic. Admitting all recordings without deeper scrutiny is equally problematic.

Civil Litigation and Commercial Disputes

Civil courts are not insulated from these issues. Employment disputes may rely on recorded conversations. Commercial litigation may involve video meetings, voice messages, or recorded negotiations. Defamation claims increasingly involve manipulated content circulated online.

The evidentiary standard in civil cases is lower than in criminal cases, which increases exposure. A manipulated recording may tip the balance of probabilities even if doubts exist. This raises concerns about strategic misuse of deepfake material in high value disputes.

Judges must assess whether existing disclosure rules, expert evidence standards, and sanctions for misconduct are sufficient deterrents. There is growing recognition that technical manipulation can occur without leaving obvious traces, making post hoc remedies less effective.

Evidentiary Reliability as an Institutional Problem

Deepfakes force courts to confront evidentiary reliability as an institutional issue rather than a case specific anomaly. The problem is not limited to one dishonest party or one flawed expert. It is systemic.

Courts operate under time constraints, resource limits, and procedural fairness requirements. Judges cannot become forensic technologists. Jurors cannot be trained to detect synthetic media. Reliance on expert witnesses introduces cost and inequality, as well resourced parties can commission more persuasive testimony.

Several structural tensions become visible.

1. Authentication standards assume stable technical benchmarks.

2. Expert disagreement undermines judicial confidence.

3. Procedural equality is strained by asymmetric access to technical expertise.

These tensions are not resolved through better education alone. They require reconsideration of how evidentiary trust is constructed.

Regulatory and Policy Responses

Outside the courtroom, lawmakers and regulators are attempting to address deepfakes through criminalisation, labelling obligations, and platform duties. These measures indirectly affect evidentiary reliability by shaping how content is created, distributed, and preserved.

AI may be criminally liable, but only in some niche context. Read our deep-dive editorial on this topic:

Technology Law

Can AI Be Criminally Liable?

Around the world, prosecutors are circling, and in some cases, people are already being charged for what their AI systems did. World legal systems are catching up with reckless automation, and the consequences are real: injury, death, and yes, prison time. In this article, we explore how criminal liability is entering the AI age, what cases are already …

Read more

10 months ago · 12 likes · 8 comments · Technology Law

European Union policy discussions under the Digital Services Act and Artificial Intelligence Act acknowledge the evidentiary risks posed by synthetic media.

United States federal agencies have issued guidance on synthetic media risks, particularly in election integrity and fraud contexts, which has downstream relevance for courts assessing authenticity.

Regulation alone does not solve the courtroom problem, but it influences the ecosystem in which evidence arises. Courts must operate within that ecosystem rather than outside it.

Why Courts Cannot Rely on Intuition Anymore

Judicial intuition has always played a role in assessing evidence. Judges develop instincts through experience. Deepfakes undermine that reliance because realism is no longer a reliable cue.

A video that looks implausible may be authentic, and a video that looks ordinary may be entirely fabricated. This inversion destabilises confidence in visual reasoning. Courts must acknowledge that intuition is no longer sufficient when dealing with contested digital media.

This recognition is already visible in judicial training materials and appellate commentary. It does not imply judicial failure, but it reflects technological change that outpaces inherited methods of evaluation.

Evidentiary Reliability as a Public Trust Issue

Courts do not operate in isolation. Public confidence in judicial outcomes depends on the belief that evidence can be assessed fairly. If members of the public believe that any recording can be dismissed as fake or accepted uncritically, trust erodes.

Deepfakes create a credibility gap in that genuine victims may struggle to prove harm. Wrongdoers may exploit doubt, and courts become arbiters of technical disputes that the public cannot easily follow.

This is not an abstract concern since media reporting already reflects scepticism about video evidence. That scepticism spills into legal proceedings, influencing juror attitudes and public reaction to verdicts.

Where the Conversation Is Heading

Courts are beginning to recognise that evidentiary reliability in the age of deepfakes cannot rest on assumptions formed in earlier technological contexts. Procedural rules, judicial reasoning, and evidentiary doctrines are being tested in real cases rather than academic debate.

The conversation is moving toward deeper scrutiny of provenance, stronger emphasis on corroboration, and greater caution in assigning persuasive weight to recordings standing alone.

This topic deserves sustained attention from lawyers, technologists, judges, and the public. Discussion, critique, and shared understanding matter because evidentiary reliability is not merely technical but it is foundational to justice.

How do you see courts addressing this problem in practice?

Leave a comment

English law has spent more than a decade pretending that digital value could be economically real yet legally peripheral, and the Property (Digital Assets etc) Act 2025 exposes how unsustainable that posture had become. Treating cryptoassets as something to be tolerated rather than classified produced uncertainty that benefitted speculation while undermining credit, enforcement, and accountability. Legislative recognition arrives late, not visionary, and it reflects institutional pressure rather than conceptual enthusiasm.

Share

Newsletter Issue 85

Digital property is no longer a theoretical category reserved for academic debate or courtroom experiments at the edge of private law, and the Property (Digital Assets etc) Act 2025 confirms that reality with a clarity that many governments have avoided for years.

This legislation matters because it places digital assets within the paradigm of property law rather than treating them as contractual conveniences or technological curiosities, and that decision has consequences for credit, debt, and access to finance that extend well beyond England and Wales.

Readers who have followed cryptocurrency since its early years will recognise a long period where value existed without legal recognition as property, and that gap created friction in every interaction with the financial system, particularly where lending, security, insolvency, and enforcement were involved.

The Act addresses that gap directly, and it does so with implications that are global in scope.

What the Act actually does

The Property (Digital Assets etc) Act 2025 confirms that certain digital assets are capable of being objects of personal property even where they do not fit neatly within traditional categories such as choses in possession or choses in action.

That statement appears simple, yet it resolves a problem that has affected courts, lenders, insolvency practitioners, and investors for more than a decade.

English law has historically relied on categories that assume tangibility or enforceable rights against a person.

Cryptocurrencies and related digital assets sit awkwardly outside those assumptions. They exist, they hold value, they can be controlled, and they can be transferred, yet they do not depend on a counterparty in the conventional sense.

The Act acknowledges this reality and provides statutory confirmation that these assets are not legal outliers.

Several court decisions paved the way for this outcome.

AA v Persons Unknown [2019] EWHC 3556 (Comm) confirmed that cryptoassets could be treated as property for the purposes of granting proprietary injunctions.

Ion Science v Persons Unknown [2020] EWHC 3688 (Comm) reinforced the view that digital assets could attract proprietary remedies.

Tulip Trading v Bitcoin Association [2022] EWHC 667 (Ch) raised more difficult questions about control, duties, and decentralised governance, but it still accepted the premise that the assets themselves were capable of being property.

The Property (Digital Assets etc) Act 2025 consolidates this judicial direction and removes uncertainty that had persisted because those decisions rested on common law reasoning rather than legislative authority.

Subscribe now

Why property status matters for credit and debt

Property status determines whether an asset can be used as collateral, whether it can be seized, whether it can be traced, and whether it survives insolvency. These questions are not academic. They decide whether lenders extend credit and whether borrowers gain access to capital on workable terms.

Cryptocurrency markets have grown in value without integration into mainstream credit systems because lenders rely on enforceability. A bank does not care about technical novelty. A bank cares about priority, certainty, and recovery. Without clear property status, digital assets sit outside the risk models that underpin lending decisions.

The Act brings digital assets closer to those models.

Collateralisation becomes legally intelligible once an asset is recognised as property. Enforcement becomes conceptually coherent once courts can treat digital assets as things rather than abstractions. Insolvency treatment becomes predictable once assets can be identified, valued, and distributed.

None of this requires enthusiasm for cryptocurrency as a social project. The law does not need belief. The law needs classification.

Access to finance and developing countries

Access to finance remains one of the most persistent structural problems facing developing economies. Credit is expensive, collateral is scarce, and legal infrastructure often struggles to support complex financial arrangements. Digital assets have often been presented as a partial response to these problems, yet legal uncertainty has limited their practical use.

Recognition of digital assets as property under a major commercial legal system has effects that travel beyond its borders.

English law remains a preferred governing law for international finance, commodity trade, and cross border lending. Legal recognition under English law influences contract drafting, risk allocation, and enforcement strategies in transactions involving parties across Africa, Asia, and Latin America.

Once digital assets can be recognised as property under English law, they can be referenced more comfortably in security agreements, trust arrangements, and financing structures that rely on English legal concepts. That matters in jurisdictions where domestic law may lag behind technological practice but where English law still governs the underlying transaction.

The Property (Digital Assets etc) Act 2025 does not solve access to finance, yet it removes one of the barriers that made digital assets unusable as serious financial tools in cross border contexts.

Debt, default, and enforcement

Debt markets depend on predictable outcomes in default scenarios. Creditors extend funds based on assumptions about recovery, ranking, and control. Digital assets challenged those assumptions because enforcement did not fit neatly into established procedures.

Recognition as property allows courts to issue proprietary remedies with greater confidence. Freezing orders, tracing claims, and equitable relief become easier to justify when the asset in question sits within a recognised legal category.

This matters for creditors, but it also matters for debtors. Legal clarity reduces the scope for arbitrary outcomes and inconsistent treatment. A system where enforcement is uncertain tends to favour those with superior resources and technical sophistication.

Clear classification improves procedural fairness even when outcomes remain contested.

Cryptocurrency and philosophical discomfort

Cryptocurrency has always produced philosophical discomfort within legal systems built around central authority. Property law developed in contexts where ownership could be anchored to physical control or legal rights against identifiable persons. Digital assets challenge both assumptions.

The Act represents an acceptance that law must describe reality rather than insist on historical categories. Control over a digital asset may be exercised through cryptographic keys rather than physical possession, yet control remains control. Exclusion remains possible. Transfer remains meaningful.

This does not resolve deeper debates about decentralisation, governance, or power. It simply recognises that value exists and that law must account for it.

Philosophically, this approach treats law as an organising system rather than a moral referee. The Act does not endorse cryptocurrency as good or bad. It acknowledges existence and assigns legal consequences.

Do you know that there are currently no international uniform conflict of law rules governing crypto assets globally? Read our newsletter to find out more:

Technology Law

Issue 16: International Law Cannot Keep Up With Crypto Assets

The UK is undertaking a significant reform of outdated legal rules that impact cross-border disputes involving crypto, blockchain, and electronic trade documents. These digital assets are recognised across borders and there are no standalone rules that enable predictable mechanisms to resolve legal conflicts…

Read more

10 months ago · 5 likes · Technology Law

Many readers associate property law with land registries and conveyancing documents rather than digital wallets. The relevance becomes clearer once everyday interactions are considered.

Loss through fraud becomes a legal issue once assets are recognised as property.

Inheritance planning becomes coherent once digital assets can be treated as part of an estate.

Business balance sheets become more accurate once digital assets can be recognised as assets rather than accounting anomalies.

Employment disputes, marital property disputes, and insolvency proceedings increasingly involve digital assets. Legal recognition improves consistency across these contexts.

International implications

The Property (Digital Assets etc) Act 2025 contributes to an emerging consensus among advanced legal systems that digital assets require bespoke treatment within property law. That consensus affects regulatory coordination and private ordering.

Many countries seeking to attract investment often look to English law as a reference point. Legislative recognition creates a benchmark that others may follow, adapt, or resist.

Developing countries face a particular tension. Digital assets offer potential tools for inclusion, yet legal uncertainty increases risk. External legal frameworks often fill that gap. Recognition under English law provides a reference that can be leveraged even where domestic reform remains slow.

This does not impose English law on others. It influences contractual choices and dispute resolution preferences that already exist.

Cases that still matter

Despite legislative clarity, courts will continue to play a central role. Property status answers foundational questions but leaves many issues open.

Control and responsibility within decentralised systems remain contested.

Duties of developers and network participants remain uncertain.

Custody arrangements raise questions about bailment, trust, and fiduciary responsibility.

Tulip Trading case illustrates that property recognition does not resolve governance disputes. It frames them. Litigation will continue to define boundaries, particularly where losses occur and responsibility is disputed.

Interested in reading more about restitution and tort of conversion over crypto assets? Check out this newsletter:

Technology Law

Legal Update: The UK Just Reversed the Burden of Proof in Crypto Scam Cases and It’s a Big Deal

If you have ever worried about losing money to a crypto investment site, this one is for you, and it comes with a rare bit of good news. A crypto scammer thought he got away with over £500,000, until a new English law helped claw it all back. This is the first time victims have used a court power to recover stolen digital assets in full. Here's how it w…

Read more

a year ago · 3 likes · Technology Law

Key points from this new legislation

• Digital assets are now explicitly capable of being property under English law.

• Property status affects credit, collateral, restitution, trusts, insolvency, and enforcement.

• Legal clarity improves predictability without endorsing any technology.

• Cross border finance benefits from alignment with English legal concepts.

• Courts remain central in resolving unresolved governance questions.

Closing reflections

The Property (Digital Assets etc) Act 2025 places cryptocurrency within the machinery of private law rather than treating it as an exception that must be managed at the margins. That choice carries weight because property law structures economic life in ways that regulation alone cannot.

Recognition does not eliminate risk, volatility, or misuse. It reduces ambiguity. Ambiguity tends to favour insiders and penalise those without access to specialised expertise. Legal clarity distributes understanding more evenly, even when outcomes remain contested.

Property law has always been about allocating risk, value, and responsibility. Digital assets now sit within that framework, and the conversation about their role in credit, debt, and access to finance becomes more grounded as a result.

Comments are welcome on how recognition of digital assets as property may influence finance, responsibility, and legal coherence.

Leave a comment

European digital platforms have long treated user advertisements as harmless content that simply passes through their systems, yet this assumption has now reached its limit. The judgment in Russmedia Digital demonstrates that platforms have operated with an inflated sense of detachment from the personal data they publish. Courts are no longer willing to accept claims of neutrality when the harm caused to individuals is real, foreseeable, and preventable.

Share

Newsletter Issue 84

When Online Platforms Become Data Controllers

On 2 December 2025, the Court of Justice of the European Union delivered a significant judgment in Case C-492/23, Russmedia Digital and Inform Media Press. The Court’s decision marks an important clarification of responsibility under European data protection law.

The case establishes that the operator of an online marketplace must be regarded as a controller under the General Data Protection Regulation when personal data appear in advertisements published on its platform.

The case arose in Romania, where a woman discovered an online advertisement offering sexual services under her name, using photographs and a telephone number without her consent.

The advertisement was placed on the website www.publi24.ro, operated by Russmedia Digital.

Although the company removed the advertisement within an hour of being notified, the material had already spread to other websites and continued to cause harm.

The woman brought proceedings for the violation of her privacy, honour, and personal data rights.

The local court awarded her damages, but an appellate court overturned that decision, reasoning that the platform was merely a hosting provider with no direct control over the content uploaded by users.

The Romanian Court of Appeal then referred the matter to Luxembourg for a preliminary ruling, asking the Court of Justice to clarify the obligations of an online marketplace under the GDPR and whether such an operator could rely on the liability exemptions of the EU e-Commerce Directive.

Interested in reading more cases about the application of EU law? Check out this case report newsletter:

Technology Law

Case Report: The Cost of Ignoring an EU Directive (Commission v. Bulgaria)

The European Union gave every country a clear deadline. Bulgaria missed it. Then came silence, excuses, and political delays. Eventually, the European Commission ran out of patience and took the matter to court. At the centre of it all was a law about public data that should have been simple to adopt. Instead, it ended in a financial penalty and a warni…

Read more

9 months ago · 4 likes · Technology Law

Defining Responsibility under the GDPR

The Court’s ruling provides a decisive interpretation of who controls personal data in online advertising.

It holds that an operator such as Russmedia Digital is not merely a passive intermediary but a controller within the meaning of Article 4(7) of the GDPR.

This status arises because the platform determines the technical and organisational means by which advertisements are published and made accessible to the public.

The advertisements exist on the internet solely through the platform’s intervention.

Accordingly, the operator bears responsibility for ensuring that personal data contained in advertisements are handled lawfully.

Subscribe now

This includes verifying whether the advertiser has the right to publish such data or whether the data subject has given explicit consent.

In the present case, the Court ruled that the marketplace must identify, before publication, any advertisement that includes sensitive data such as photographs, personal contact details, or references to sexual life.

Under Article 9 of the GDPR, such data receive heightened protection. Processing them is generally prohibited unless one of the narrowly defined exceptions applies.

The Court explained that a platform must put in place adequate technical and organisational measures to detect advertisements containing sensitive data before they go online.

These measures must also verify the authenticity of the advertiser’s identity. If the advertiser is not the person featured, the platform must ensure that the data subject has given explicit consent to publication.

To learn more about the operation of the GDPR in practice, check out our newsletter:

Technology Law

Issue 22: Serious AI Incidents, Child Privacy Reform, and Europe’s Digital Enforcement

Governments are no longer waiting for technology to self-regulate. This week, Europe wants AI developers to explain their mistakes, Australia plans to keep children off social media, and Italy is improving control of digital systems. Regulators are acting faster than many companies expected, and compliance will no longer be optional. From AI accountabil…

Read more

6 months ago · 9 likes · 1 comment · Technology Law

When neither condition is met, the operator must refuse to publish the advertisement. These obligations are not optional compliance suggestions; they form part of the core duties attached to the status of a data controller.

The decision demonstrates how the concept of control under the GDPR extends beyond traditional database management.

A platform’s active role in structuring, publishing, and disseminating user content transforms it from a neutral intermediary into an entity that participates in the determination of processing purposes and means.

The Court’s reasoning reinforces the principle that control follows function rather than form.

The question is not what the operator claims to be but what it does in practice.

Rejecting the e-Commerce Directive’s Safe Harbour

The company argued that it was entitled to rely on the liability exemptions under Articles 12 to 15 of the e-Commerce Directive, which protect providers of information society services from being held liable for unlawful user content when they act as neutral hosts.

The Court rejected that argument.

It found that the operator’s duties under the GDPR cannot be displaced or diminished by the Directive’s safe-harbour provisions.

The Court reasoned that the e-Commerce Directive governs liability in the context of information society services but does not affect the obligations imposed by the GDPR concerning data processing.

Subscribe now

These are two distinct legal frameworks serving different purposes. The Directive deals with intermediary liability, while the GDPR addresses the protection of personal data.

When an online marketplace processes personal data contained in advertisements, it acts not merely as a conduit but as a controller subject to independent obligations.

Therefore, a platform cannot shield itself by asserting that it merely stores third-party content. Once it publishes or facilitates the publication of content that includes personal data, it becomes directly responsible for compliance with the GDPR.

This position aligns with the principle that fundamental rights, such as privacy and data protection, take precedence over economic exemptions designed for intermediary services.

Leave a comment

The Court further emphasised that an operator’s responsibilities extend beyond initial publication.

It must also take reasonable steps to prevent the further dissemination of unlawful content. When sensitive data are unlawfully published, the operator should implement measures to prevent those materials from being copied or republished elsewhere.

Do you want to know how search engine platform regulations impact us? Our newsletter explains the intricacies of these regulations.

Technology Law

Law Reform: Your Online Freedom May Be About To End

New rules are transforming how online platforms and search services must operate in the United Kingdom. Age checks are now compulsory for services with adult content and strict obligations apply to anything that children can access. Some see this as protection and others see it as control. These rules will change what people see, how they join online pl…

Read more

8 months ago · 11 likes · 3 comments · Technology Law

The duty to act does not end once an advertisement is taken down; it includes ongoing prevention through appropriate security and technical safeguards.

This interpretation expands the operational expectations placed on online marketplaces. They are no longer viewed as passive technical platforms but as active participants in the publication and persistence of content that contains personal data.

The ruling sets a higher bar for compliance by tying the concept of responsibility to the real impact of data processing on individuals’ rights.

Implications for Online Platforms and Compliance Practice

The judgment carries direct consequences for online marketplaces, advertising platforms, and digital intermediaries across the European Union.

By categorising platform operators as data controllers when they publish user-generated advertisements containing personal data, the Court has introduced a tougher standard of care.

Operators must design internal processes capable of detecting sensitive content before it is published. This obligation requires both technical and procedural innovation.

Platforms will need automated systems capable of identifying personal data such as names, phone numbers, or images, combined with manual review for complex cases.

In addition, there must be reliable mechanisms for verifying that the advertiser is the data subject or that explicit consent has been granted.

These steps may appear demanding, but they represent the necessary cost of handling personal data in a digital environment governed by fundamental rights.

The judgment also highlights the importance of transparency and traceability.

Platforms should maintain records of verification procedures, consent documentation, and the steps taken to prevent unauthorised reuse of sensitive materials.

When disputes arise, these records will serve as evidence of compliance.

Furthermore, the Court’s reference to preventing further publication introduces a forward-looking duty. Once a platform becomes aware that an advertisement contains unlawful personal data, it must act not only reactively but also proactively.

Technical safeguards such as content fingerprinting, URL blocking, or watermarking may help limit replication. However, each platform will need to determine proportionate measures that align with the GDPR’s accountability principle.

This ruling effectively narrows the margin of neutrality previously enjoyed by hosting providers.

Operators must reassess their classification under data protection law and adapt compliance programmes accordingly.

In practice, many intermediaries will now fall within the controller category for at least part of their operations.

The Russmedia Digital case thus redefines the balance between innovation, user autonomy, and protection.

It invites operators, policymakers, and citizens to understand that personal data protection is not an external constraint on digital activity but a foundational condition for its legitimacy.

The message is clear: accountability in the digital era begins with recognising that every act of publication is also an act of data processing, and with that recognition comes responsibility.

This judgment invites reflection on the responsibilities that digital platforms now carry. You are welcome to share thoughts or practical experiences that might enrich future discussions and help build stronger understanding of accountability in online environments.

Leave a comment

Predictive policing has turned suspicion into a routine administrative category that follows people long before any conduct occurs, and it is astonishing how easily this practice has been accepted as a normal feature of public safety. The idea that an algorithm can pre-assign risk to entire neighbourhoods and individuals has been absorbed into policing culture with little discomfort, even though the practice alters long standing assumptions about fairness, due process and the meaning of community trust. The technology has not simply introduced new methods but it has redefined the threshold at which suspicion begins, and it has done so without meaningful and transparent legal scrutiny.

Share

Newsletter Issue 83

I want to spend time on an issue that has been growing in scale and consequence, yet it still feels misunderstood in public debate.

I am referring to predictive policing, a set of technologies that use large pools of data to indicate where law enforcement attention should concentrate.1

I have observed governments, police forces, and private vendors speak about predictive policing as if it represents a neutral and objective way to allocate resources.

I have also watched the public absorb these narratives with a mixture of curiosity and unease.

I want to offer clarity about why this technology matters, how it transforms the experience of living in a community, and why it normalises suspicion long before any crime is committed.

The way predictive policing works has a direct influence on how neighbourhoods are perceived, how people are categorised, and how law enforcement behaves.

It is important to understand that predictive policing does not operate as a futuristic idea. It exists today in different countries and in many cities across the world. It is not an idea waiting to be tested. It is already being deployed.

I approach this subject as someone who studies and also teaches the relationship between law, technology, and society.

I spend a considerable amount of time reading legal documentation, technical reports, and implementation stories about these tools.

The system processes this information and produces indications about where police officers should patrol or who they should focus on.

It presents these outputs as neutral observations.

A police department may receive a notification that a particular neighbourhood might experience crime within a certain period or that a particular individual might be at risk of involvement in criminal activity.

This may seem harmless and appear like a helpful tool.

In fact, it looks like data is offering support to public safety professionals.

The story becomes more complicated when we examine how the data is produced, how the system interprets it, and how the outputs transform behaviour.

Historical crime data is rarely a clean record of events.

It is influenced by years of policing patterns, community interactions, and institutional priorities.

If a community receives disproportionate police attention, the data will reflect that increased presence.

Increased presence results in increased arrests, even when the actual level of crime might not be higher than neighbouring communities.

The data feeds back into the system, which then tells the police to return to the same neighbourhood. The loop continues.

In many countries, predictive policing amplifies historical patterns without critically evaluating them. This is how suspicion becomes normalised long before anything happens.

I want you to imagine how it feels to live in an area that appears frequently in these predictions.

I said imagine rather than picture an analogy because this is not a metaphor.

Residents begin to notice police officers spending more time near their homes, walking on their streets, and conducting more stops. Police presence gradually becomes part of daily life.

People begin to feel observed. Some might feel safer at first, but many begin to feel targeted.

Subscribe now

Teenagers walking to school are questioned. Adults leaving for work notice patrol vehicles lingering.

The message embedded in these actions is that the neighbourhood requires surveillance. It affects how residents understand themselves.

It affects how they think others see them.

Suspicion moves from the environment to individuals.

Certain predictive policing systems produce lists of people who are classified as likely to be involved in criminal activity.2 These individuals may not have committed a crime.

Their names appear because they have friends or relatives who have been arrested or because they live in areas with high levels of police activity.

Some systems categorise them because of past incidents that have nothing to do with future behaviour.

People on these lists often do not know they have been categorised in this manner.

They experience unexpected visits from law enforcement. They feel pressure to account for their movement.

They sense that their name carries an invisible mark created by a machine.

I want you to see how suspicion becomes embedded. A community or a person is identified through a technical process that appears neutral.

Police officers can act on this information. Their actions create more data. The system absorbs the data and produces a similar outcome.

Each time this cycle repeats, suspicion appears more legitimate. People begin to say that these neighbourhoods always have crime.

People begin to say that certain individuals seem to be involved in suspect activities.

People forget that the perception was constructed through a technical loop rather than emerging from an independent assessment of facts.

It is important to understand that predictive policing does not emerge from malicious intent!

Many police departments genuinely believe the technology will help them.

They believe it will reduce crime, help them allocate limited resources, and reduce guesswork.

Technology companies promote these tools as solutions that draw on modern computational methods and data analysis.

The result is a set of practices that police officers come to trust without fully understanding how the predictions are constructed. This trust gives the system authority.

Once a system has authority, it becomes very difficult to challenge.

I have spoken with individuals who believe predictive policing simply automates what police departments already do.

It is true that police officers often rely on intuition and local knowledge when allocating resources.

Intuition can be biased. Data driven tools appear more objective. This is where the danger resides.

When a biased dataset is presented as objective intelligence, the entire system becomes insulated against critique.

It becomes harder to point out that the underlying data reflects years of unequal attention. It also becomes harder to question the conclusions. People begin to think the technology has independent insight.

Law plays an important role here.

Predictive policing does not live outside the structure of legal rules. It must comply with constitutional principles, human rights protections, procedural fairness, and public accountability mechanisms.

Legal systems are not always ready to review how predictive tools categorise individuals.

Subscribe now

Courts often see predictive tools as internal police processes.3

The legal system does not always require disclosure of how predictions are created.

Individuals who are affected by these predictions often have no avenue to challenge the categorisation.

This is how predictive policing gradually normalises the idea that suspicion can arise without any clear demonstration of wrongdoing.

Some communities see an increase in tension between residents and law enforcement. Others experience a gradual erosion of trust.

When a community feels that policing is based on algorithmic assumptions rather than lived experiences, relationships deteriorate.

Community members feel watched rather than supported. Police officers feel justified in their presence because the system gave them a reason to be there. Each group begins to misunderstand the other.

The misunderstanding is amplified each time the system reinforces the same prediction.

Individuals who are placed on predictive lists experience a more personal form of harm. They lose control over how they are perceived.

Their classification follows them in the background. It influences how officers interact with them. It influences how others talk about them.

This classification often has no clear path for removal. People live with an unspoken sense of scrutiny. This scrutiny can create emotional and psychological strain.

They carry the feeling that something external has defined them without their participation.

I want to highlight that predictive policing is not only a policing issue. It is a societal issue.

When communities begin to internalise the idea that some individuals are suspicious before they act, social cohesion weakens.

People feel pressure to distance themselves from individuals who might attract police attention.

People begin to self censor. They worry about where they go, who they speak with, or how they conduct simple daily routines.

The awareness that an algorithm might interpret these patterns differently adds an invisible layer of anxiety.

These systems also introduce a form of administrative opacity. Decisions made by predictive tools are often explained through abstract descriptions of risk.

People cannot see the complete dataset. They cannot examine the model. They cannot review the reasoning.

Police departments may not understand the model themselves.

Technology companies mischievously protect their algorithms as intellectual property.

Courts often accept these explanations, especially in early stages of deployment.

This lack of transparency restricts accountability. Accountability becomes difficult when individuals and communities do not know how the system reaches its conclusions.

When police officers rely on predictive tools, their actions seem more defensible.

A patrol in a neighbourhood becomes routine. A stop becomes part of the standard procedure. An investigation into a listed individual becomes an expected task.

Suspicion becomes embedded into everyday policing. This is how predictive policing normalises suspicion long before any crime occurs.4

The process unfolds gently but consistently. It alters behavioural expectations. It modifies community interactions. It changes the experience of being a citizen.

I approach this subject with a recognition that technology will continue to influence public safety practices.

Predictive policing is one expression of a broader trend in the integration of data driven decision making in public institutions.

I believe people should understand predictive policing clearly, not with exaggeration or fear, but with careful attention to how the technology functions and how it influences society.

Understanding gives communities the ability to participate in discussions about appropriate use, oversight, and accountability.

I am not offering advice, but rather inviting constructive thoughts.

Predictive policing raises significant questions about fairness, transparency, trust, and the lived experience of communities. These questions deserve an open discussion.

People should be part of these conversations.

When people understand how predictive systems work, they can reflect on how the technology influences their daily lives.

Leave a comment

Artificial intelligence governance is developing in a manner that exposes an uncomfortable truth about contemporary regulatory ambition, which is that states are now asserting control over digital systems with an intensity previously reserved for physical infrastructure. This trajectory reflects neither technological optimism nor pessimism. It reflects a growing insistence that AI must fit within existing structures of authority even when those structures are under strain.

Share

Newsletter Issue 82

United States: H.R. 5885 - GAIN AI Act of 2025

In the United States, the House of Representatives introduced the GAIN AI Act of 2025 on 31 October, under bill number H.R. 5885.

The text mandates that entities seeking export licences for advanced artificial-intelligence-related chips must provide certification that United States persons enjoy priority access to those chips.

The bill was referred to the House Committee on Foreign Affairs.

What this measure highlights is the increasing linkage between export controls, chip supply chains, and the governance of AI.

The bill reflects a recognition that advanced semiconductors and AI hardware count as strategic assets, and that policy-makers are prepared to place conditions on their export in order to safeguard national interest.

At the same time, the certification requirement implies that firms will need to structure their compliance mechanisms and their internal disclosure processes to satisfy governmental oversight.

Though still at an early stage in the legislative process, this bill tells us that AI regulation in the United States is no longer confined to model behaviour or data privacy, but is extending into hardware, supply-chain resilience, and the conditions under which AI capacities are exchanged internationally.

It would be prudent for organisations engaged in AI hardware design, export, or supply-chain logistics to monitor not only the final outcome of the bill but also its drafting of licence-criteria, definitions of “advanced AI chips,” geographic scope of “countries of concern,” and how priority access is defined and enforced.

European Union: Artificial Intelligence Act (EU) and monitoring of EU law

The European Parliament’s Policy Department for Justice, Civil Liberties and Institutional Affairs published a study dated 30 October 2025, entitled “AI and monitoring the application of EU law”.

The report surveys how AI techniques are being used, and might be used to support the monitoring and enforcement of EU law, including in legislative drafting, transposition of directives, administrative decisions, compliance tracking, and social-behavioural governance.

This work draws attention to the fact that regulation of AI is not only about controlling AI systems themselves but also about using AI systems as regulatory tools.

The symmetry is significant: AI becomes both the object of governance and a means of governance.

The study points out that while there are existing AI-monitoring applications in EU law enforcement and administrative practice, the potential for more advanced deployment remains under-analysed, including how fundamental rights and legal principles should be respected when AI assists regulatory monitoring.

This suggests two key observations. First, regulated entities in the EU should anticipate that AI governance may include oversight via AI-driven monitoring, meaning that their compliance processes may themselves become subject to enhanced scrutiny through technological means.

Second, the EU’s legislative timetable for AI regulation and related frameworks, such as the risk-based classification and obligations under the AI Act, continue to generate implications for how AI can be deployed in public-administration and regulatory enforcement settings.

Subscribe now

United Kingdom: Judicial Guidance on AI Use by the Judiciary

In England and Wales, the Judiciary of England & Wales (courts and tribunals) published updated guidance on 31 October 2025, addressing the use of AI by judicial office-holders.

The document replaces the April 2025 edition, enlarging the glossary of terms, expanding sections on bias in training data and “hallucinations” (incorrect or misleading outputs), and emphasising confidentiality obligations: judicial officers are reminded not to input private or non-public information into publicly accessible AI tools, and to treat any inadvertent disclosure as a data incident.

The guidance underlines that any use of AI by or on behalf of the judiciary must be consistent with its overarching obligation to protect the integrity of the administration of justice and to uphold the rule of law.

Lord Justice Birss, Lead Judge for Artificial Intelligence, emphasised the personal responsibility of judicial office-holders for material produced in their name.

This means that even within the judicial context, where the use of AI might appear less commercially oriented and more internal or procedural, strong guidelines are being imposed.

The guidance shows that where AI is used, it must be carefully controlled, with human accountability non-negotiable.

As AI enters institutional and public sectors, the threshold for documentation, oversight, verification, and risk mitigation increases.

While the guidance is directed at judicial office-holders, its principles may serve as a benchmark for other professions engaged in regulatory or public functions.

Netherlands: Autoriteit Persoonsgegevens (AP) Warns of Biased Voting Chatbots

In the Netherlands, the data-protection authority issued a warning on 21 October 2025 that AI chatbots used as voting-aid tools produced highly distorted and biased results.

The AP’s study involved four major chatbot platforms tested against various fictional voter profiles. It found that the systems often offered advice heavily favouring just two political parties, regardless of user input.

While such tools may appear to offer impartial guidance, the AP concluded that they present a threat to electoral integrity and democratic participation.

The experiment revealed that the chatbots, contrasted with established voting-advice applications, lacked representativeness of all parties and funnelled users disproportionately to the same two options.

The AP labelled the advice “unreliable and clearly biased.”

This development is quite significant because it touches on the intersection of automated systems, political influence, transparency, and fairness.

The findings reflect risks associated with using generative-AI tools or chatbots in sensitive contexts such as elections, where the decisions impacted are inherently public and governed by principles of fairness and neutrality.

Organisations operating chatbots or AI-based recommendation systems in civic or electoral domains will need to consider how these systems are designed, how their outputs are audited, and how they are communicated to users.

Final Thoughts

These developments, while distinct in jurisdiction and focus, together map out an important dimension of current tech-law development: regulation and governance of AI are expanding beyond traditional domains of data privacy and algorithmic fairness to include hardware exports, institutional use of AI within justice systems, monitoring of regulatory compliance via AI, and algorithmic impact on democratic processes.

What emerges is a reminder of the importance of governance frameworks that address the full lifecycle of AI, from hardware and supply-chain, through software and model training, to public-deployment and institutional adoption.

What remains clear is that the legal and regulatory environment for AI remains multifaceted including export-control law, public-sector AI governance, electoral regulation, fundamental-rights frameworks, and compliance monitoring are all part of the field.

Leave a comment

I will close this edition here with an invitation to continue the discussion. Readers who wish to reflect on any part of this analysis are encouraged to share considered thoughts in the comments so that future editions benefit from a wider range of perspectives.

Europe has regulated AI into a corner. The Artificial Intelligence Act, though hailed as a global benchmark, exemplifies the tension between ambition and practicality that defines modern EU digital regulation. Several laws also promise data protection and AI innovation, however together they form an administrative maze that risks stifling the very technological progress Europe claims to champion.

Share

Access our EU AI Tracker here to monitor the latest developments in EU artificial intelligence laws and regulations.

Newsletter Issue 81

The AI Act and Europe’s Digital Legal Framework

When the European Union adopted the Artificial Intelligence Act in June 2024, it presented the world’s first comprehensive attempt to regulate artificial intelligence in a structured and rights-based way.

The AI Act’s ambition is significant. It aims to ensure that AI systems placed on the European market are trustworthy, safe, and compliant with fundamental rights.

Nonetheless, this new framework operates alongside a web of other digital laws that already govern data protection, cybersecurity, market competition, and digital services.

The study prepared for the European Parliament’s Committee on Industry, Research and Energy (ITRE) examines this web in detail.

Its findings are important for everyone.

At the core of the study lies a simple insight that every law in the EU digital framework is individually well designed, but together they create a structure that is heavy, overlapping, and sometimes unclear.

The AI Act was intended to complete the EU’s digital single market, yet its interactions with other frameworks have introduced a new kind of complexity.

Understanding the Purpose and Logic of the AI Act

The AI Act rests on a risk-based approach.

It prohibits a narrow category of AI practices that are deemed unacceptable, imposes strict controls on high-risk systems, and sets transparency duties for low- and medium-risk uses such as chatbots or generative tools.

It also creates separate obligations for general-purpose AI models that are powerful enough to have systemic effects.

This tiered logic mirrors the EU’s long-standing product safety regime but extends it to an entirely new domain.

The study explains that this approach was a deliberate choice.

Before the AI Act, artificial intelligence was largely unregulated, and Member States risked introducing divergent national laws.

The new regulation harmonises the internal market by setting a single framework.

Nonetheless, that harmonisation comes at a cost.

The report highlights that the AI Act stretches the boundaries of traditional product regulation.

It asks conformity assessment bodies to evaluate not only technical safety but also respect for fundamental rights and societal values.

That task, the authors note, may prove difficult because human rights compliance cannot easily be reduced to technical checklists.

Subscribe now

For high-risk systems, the obligations are extensive.

Providers must establish risk management systems, data governance protocols, technical documentation, human oversight, and quality management frameworks.

They must demonstrate accuracy, robustness, and cybersecurity, and affix the familiar CE marking.

These are familiar requirements in manufacturing but novel in software development.

The study observes that while the AI Act promotes trust, it also places significant compliance responsibilities on providers and deployers alike, particularly smaller businesses without specialised legal teams.

An additional layer applies to general-purpose AI models, known as GPAIs.

These are the large, adaptable models that underpin tools for text, image, or speech generation.

The AI Act introduces transparency, copyright compliance, and cybersecurity duties for all GPAI providers, and enhanced obligations for those with systemic risk.

The report notes that a model trained with computing power above a specific threshold is presumed to be of systemic importance.

This presumption was designed to ensure oversight of the most powerful systems but may prove too static as technology progresses.

The Act also includes innovation measures.

Open-source AI systems are mostly exempt from its scope, and each Member State must establish a regulatory sandbox to allow experimentation under supervision.

The study recognises these as positive steps but cautions that their success will depend on national authorities’ willingness to interpret the rules in an enabling way.

Intersections Across the Digital Legal Framework

The central part of the study examines how the AI Act interacts with other EU digital laws.

The most significant areas of intersection involve the GDPR, the Data Act, the Cyber Resilience Act, the Digital Services Act, the Digital Markets Act, and the NIS2 Directive.

Each of these laws is vital in its own domain, but together they form a dense compliance environment that can be difficult to understand.

Technology Law

EU Artificial Intelligence Tracker

This EU Artificial Intelligence tracker monitors key dates and information on legal and policy developments surrounding artificial intelligence in the EU. It covers major legislative initiatives, law reforms and policy updates impacting artificial intelligence in the European Union…

Read more

7 months ago · 10 likes · Technology Law

Under the GDPR, many AI systems that process personal data already fall within an existing legal structure that emphasises lawfulness, transparency, and accountability.

The AI Act introduces additional assessments, particularly the Fundamental Rights Impact Assessment (FRIA), which often overlaps with the Data Protection Impact Assessment (DPIA) required under the GDPR.

The study observes that both tools serve legitimate goals but differ in supervision and procedure.

As a result, organisations may find themselves conducting two separate yet similar evaluations for the same system.

The report recommends aligning these assessments through joint guidance and mutual recognition.

The Data Act establishes rules for access to and sharing of data generated by connected products and services.

AI providers who hold or use such data may therefore face obligations under both Acts.

For instance, they must ensure that data is shared in a fair and secure way while also maintaining compliance with AI risk and transparency duties.

The study points out that these cumulative requirements could discourage experimentation and impose a heavy administrative load, especially in cross-border contexts or when data flows from third countries.

In the field of cybersecurity, the Cyber Resilience Act imposes mandatory security standards for digital products.

Many of these overlap with the AI Act’s own cybersecurity and robustness requirements.

Although the CRA allows for a presumption of compliance under certain conditions, the partial alignment of the two frameworks can still produce uncertainty.

The report suggests that greater coordination between the responsible authorities would help prevent duplicated audits or inconsistent expectations.

For large online platforms and search engines, the Digital Services Act and the Digital Markets Act add yet another layer.

These instruments require transparency and accountability for algorithmic systems used in content moderation, advertising, or recommender functions.

The study notes that such platforms might be subject to simultaneous risk assessments under both the AI Act and the DSA.

Moreover, gatekeepers under the DMA must meet obligations relating to data access and interoperability, which could overlap with AI governance duties.

While the DMA does not yet classify AI systems as core platform services, their growing economic role makes such an intersection increasingly relevant.

The NIS2 Directive, which focuses on network and information security, introduces reporting and risk management obligations for essential and important entities.

Many of these entities will also deploy AI systems covered by the AI Act.

The report finds that the incident reporting and supply-chain management requirements of both frameworks often intersect, potentially creating parallel channels of compliance.

Across all these examples, the study reaches a consistent conclusion: the EU’s digital regulatory framework has become internally complex.

Each law serves a clear purpose, but their cumulative effect risks slowing innovation and discouraging smaller actors from entering the market.

Governance and Implementation Challenges

A key section of the study analyses the institutional architecture created by the AI Act.

At its centre stands the European AI Office, which operates within the European Commission.

The AI Office is responsible for supervising general-purpose AI models, supporting regulatory sandboxes, and coordinating national authorities.

It works alongside the European AI Board and interacts with data protection authorities, market surveillance bodies, and other sectoral regulators.

This structure reflects an attempt to balance central oversight with national autonomy.

However, the study raises concerns about potential overlaps of competence.

The AI Office’s mandate intersects with that of existing regulators, yet it lacks a distinct legal personality and depends on Commission resources.

Subscribe now

Without sufficient independence or capacity, its effectiveness could be limited.

The authors warn that fragmented governance may lead to inconsistent enforcement and uncertainty for businesses seeking to comply across multiple jurisdictions.

At the national level, market surveillance authorities will play a key role in enforcing the AI Act’s provisions.

These bodies are accustomed to monitoring tangible goods such as machinery or medical devices.

The report suggests that applying the same methods to algorithmic systems will require substantial training, technical expertise, and coordination.

Inconsistent capacity among Member States could produce uneven application of the law.

The study also identifies the importance of cooperation among supervisory authorities.

Given that AI systems often implicate personal data, cybersecurity, and consumer rights simultaneously, regulators must establish clear protocols for joint inspections and shared investigations.

The report encourages the development of consistent EU-level guidance to avoid contradictory interpretations.

Toward a More Coherent Digital Future

The final section of the study turns from analysis to reflection.

It recognises that the EU’s digital legislative framework represents an extraordinary achievement in scope and ambition.

However, the authors argue that the cumulative regulatory weight could unintentionally hinder innovation, particularly among small and medium-sized enterprises.

Short-term progress, they suggest, can come through practical coordination.

Supervisory bodies should publish joint guidance, share expertise, and recognise equivalent compliance efforts.

For instance, if a company completes a DPIA under the GDPR that already covers the relevant risks, it should not be required to repeat the process for a FRIA under the AI Act.

Similarly, Member States could align their sandbox procedures to ensure consistent conditions for testing and experimentation across borders.

In the medium term, modest legislative clarifications could help.

These might include refining definitions of high-risk systems, clarifying the interaction between cybersecurity obligations, and specifying the responsibilities of different actors in the AI supply chain.

The goal would not be to weaken regulation but to make it more understandable and executable.

Over the longer term, the study recommends a more strategic review of the EU’s digital architecture.

It argues that Europe should consider consolidation and simplification of its legal instruments, aiming for coherence rather than volume.

The authors envision a framework where data, AI, cybersecurity, and digital market rules operate as complementary parts of a single ecosystem rather than as separate compartments.

This integrated model would better support agile compliance while preserving the Union’s core values of trust, rights, and safety.

Technology Law

Case Report: EU-US Data Privacy Framework Survives Attack In Court (Latombe v. Commission)

The latest controversial judgment of the General Court in Latombe v Commission represents a decisive moment in the ongoing contest over transatlantic data transfers between the US and EU. The Court has endorsed the European Commission’s adequacy decision, validating the EU-US Data Privacy Framework. Critics will argue that the Court has accepted surveil…

Read more

7 months ago · 13 likes · 5 comments · Technology Law

The report concludes with a broader reflection on competitiveness.

The European Union’s AI investment levels remain lower than those of the United States and China.

The authors caution that complex regulation may further reduce the continent’s ability to attract and retain AI innovation.

Simplification, coordinated enforcement, and strategic alignment are therefore not merely administrative improvements; they are essential to ensuring that the EU can sustain a globally competitive AI industry.

A Framework in Need of Balance

The European Parliament’s study makes one theme clear: the AI Act embodies both the promise and the challenge of Europe’s digital governance.

It is unprecedented in global regulation, but its effectiveness will depend on how well it integrates with surrounding laws and institutions.

Each layer of the digital framework; privacy, data access, cybersecurity, and platform regulation, serves a vital purpose, but the combined system must remain useful, especially for innovators and smaller enterprises that form the backbone of Europe’s technology sector.

Achieving that balance requires coordination, clarity, and a shared vision of digital policy.

The authors’ recommendations are measured and pragmatic.

They do not call for deregulation but for coherence.

They remind policymakers that trust and innovation are not mutually exclusive.

By streamlining its legal framework and ensuring consistent enforcement, the EU can maintain its commitment to fundamental rights while enabling a dynamic and competitive AI ecosystem.

In essence, the study offers a roadmap for governance that is both principled and practical. It recognises that the challenge is not the existence of rules but their integration.

If the EU succeeds in aligning its digital laws, the AI Act could stand not only as a regulatory milestone but also as the foundation of a genuinely coherent European digital future.

The questions raised by the AI Act’s complexity deserve sustained discussion. Readers are invited to share perspectives or industry experiences that can inform future editions.

Leave a comment

Welcome to this week’s edition of the Technology Law Newsletter. This week looks closely at four significant updates: the AAA-ICDR’s plan to launch an AI-native arbitrator, the ISO’s new policy brief on responsible AI standards, the EU’s AI Act Compliance Checker, and the JRC’s new framework for classifying modified general-purpose AI models.

Share

1. The Launch of an AI-Native Arbitrator by American Arbitration Association: International Centre for Dispute Resolution (AAA-ICDR)

A significant development in the dispute-resolution domain has taken place: AAA-ICDR has announced that it will launch an “AI-native” arbitrator, initially applied to documents-only construction cases from November 2025.

The AI legal tool is trained on more than 1,500 construction law awards and refined with expert-labelled examples, to ground its decision-making in prior arbitrator reasoning.

The system uses a structured legal prompt library and conversational AI to deliver draft awards and recommendations, but it is explicitly embedded within a “human-in-the-loop” framework: human arbitrators review and validate outcomes before any final award is issued.

Initially, the deployment is limited to documents-only construction cases where the volume is high and the process largely transactional. Further roll-out to insurance and other dispute types is indicated.

Significance of this development

From a legal-operational perspective, this shows that ADR providers are embracing advanced AI systems not merely as adjuncts, but as central to the adjudication workflow.

This development raises immediate considerations: how does one draft arbitration clauses that anticipate AI-native arbitrators?

How do parties assess fairness, transparency, and evidential parity when an algorithmic actor participates in a legally binding decision?

The human-in-the-loop framing addresses the duty of care, but questions of explainability, bias, data governance and procedural fairness remain salient.

Moreover, the focus on high-volume, document-only contexts suggests a deployment model where cost-efficiency and speed are drivers, a marker for where “AI first” approaches may get traction in legal services.

• Ethical obligations for arbitrators and counsel remain unchanged: competence, impartiality, confidentiality and independence remain foundational. The association’s own principles reinforce that technology must not supplant these duties.

• Data provenance and model training become part of the governance equation: the tool was trained on prior arbitral awards, but parties might ask how representative that dataset is, how the model reasons, whether there is auditability and recourse.

• Liability questions will emerge: though humans review the output, reliance on a draft generated by an AI raises potential issues around decision-making attribution and oversight.

• Contract drafting and dispute resolution strategy will adjust: parties may want to negotiate explicitly on how an AI arbitrator is used, what review rights exist, whether a traditional arbitrator may override, and how reasoning transparency is ensured.

The AAA-ICDR announcement marks a milestone in legal-tech integration: AI moves from adjunct tool to core component of dispute resolution.

Legal professionals should prepare for change in ADR protocols, model training and contract drafting.

2. International Organization for Standardization (ISO) Policy Brief on Standards for Responsible AI Development and Governance

ISO has issued a policy brief titled Harnessing International Standards for Responsible AI Development and Governance (Publication 100498) that underlines the role of standards in bridging the gap between high-level principles and operational implementation.

The policy brief emphasises that standards provide a common language for developers, governments, regulators and users, helping to translate abstract ethical and policy objectives (such as transparency, fairness, accountability) into technical requirements, benchmarks and conformity-assessment frameworks.

It discusses the socio-technical nature of AI-systems: the interaction of algorithms, data, hardware, institutions, human users and societal norms.

It highlights existing standards under the ISO/IEC umbrella (such as ISO/IEC 42001: AI management system; ISO/IEC 42005: AI system impact assessment; ISO/IEC TS 12791: treatment of unwanted bias) and emphasises that while the pace of AI development is fast, consensus-based standards create a reliable baseline.

The document provides targeted recommendations for policymakers, standards bodies, industry stakeholders and civil society.

While adherence to standards remains voluntary in many jurisdictions, regulators often use standard-referencing as a mechanism to define due-care, conformity, and safety benchmarks.

Subscribe now

In contracts, procurement, governance frameworks and compliance assessments, referencing ISO standards will enhance legal robustness.

For organisations deploying AI systems, the policy brief offers a roadmap: not just to comply with regulation, but to implement management systems, assess impacts, mitigate bias, manage data quality, ensure transparency, and enable oversight.

The emphasis on lifecycle (from conception to retirement) is useful for legal counsel advising on AI governance frameworks or vendor contracts.

Legal-governance take-aways

• Organisations should evaluate whether they are aligning with AI standards: e.g., has an AI management system been documented and maintained? Are impact assessments conducted? Are bias-mitigation controls in place?

• Tendering, procurement and vendor contracts should include provisions linking to relevant standards (e.g., ISO/IEC 42001) to clarify responsibilities and bench-marks.

• Regulators may rely on standard-referencing to define compliance thresholds; hence organisations should map standard-coverage to regulatory obligations to reduce surprise risk.

• Legal teams should monitor updates to key standards and how they are referenced in national laws or sector-specific regulation, particularly in high-stakes sectors such as finance, healthcare, or transport.

The ISO policy brief reinforces the rising importance of standardisation in AI governance and clarifies how legal frameworks and corporate governance will increasingly lean on standards as reference points.

3. The Launch of the EU Artificial Intelligence Act Compliance Checker Tool

The European Commission and associated bodies have made available an interactive tool (often labelled the “EU AI Act Compliance Checker”) to help organisations determine whether their AI systems fall under the Act, and what obligations may apply.

The tool guides users through a series of questions to identify: the user’s role (provider, deployer, importer, distributor), the nature of the AI system (general-purpose, high-risk, limited risk), whether the system is used within the EU market, and then provides an indication of applicable legal obligations under the AI Act.

The interface is designed for embedding and broad use; it is described as a “simplified” instrument, offering early assessment rather than definitive legal advice.

Why it is relevant

For any organisation that develops, supplies or deploys AI systems, and for their legal advisers, the availability of a self-assessment tool is a helpful entry point to compliance preparation.

It reflects the regulatory intention to impose clear obligations by role and risk category rather than a one-size-fits-all model.

The availability of such a tool shows that compliance will be actively scrutinised, and that preparedness will likely become expected.

Courts or regulators may view use of such tools (or documented assessment) as evidence of a compliance-minded approach.

While the tool is useful, legal practitioners will need to caution users that self-assessment does not replace legal advice, documentation, or the full suite of compliance obligations under the AI Act.

The questions answered by the tool form a baseline; organisations will need to move from assessment into detailed documentation, governance updates, risk assessments, supplier/contractor reviews and perhaps certification (or future equivalent).

The tool also emphasises that each AI system must be assessed individually—if an organisation utilises multiple systems, each may have differing obligations.

Summary

The release of the compliance checker tool represents a practical aid to organisations utilising the AI Act.

Legal advisors should treat this as a platform of regulatory maturity: readiness is advantageous, and it becomes sensible to integrate structured assessments, role-based obligations and system-by-system reviews into compliance workflows.

4. The Joint Research Centre (JRC) Report: “A Framework to Categorise Modified General-Purpose AI Models as New Models Based on Behavioural Changes” (JRC143257)

The JRC has published a scientific study that addresses how modifications of general-purpose AI models (GPAI) may give rise to what should be recognised as new models for regulatory purposes under the AI Act.

The report presents two approaches for assessing when a modified GPAI has become a “new model” rather than a variant of the original:

1. Direct measurement of differences in capability profiles or instance-level answers;

2. Use of proxy metrics related to the modification process (for example fine-tuning, data-usage, computational resources).

The study underlines that distinguishing between an ‘updated’ version and a truly new model is critical because under the AI Act, different obligations may apply depending on how a model is categorised (for instance registration, transparency, higher oversight).

Subscribe now

The report emphasises methodological challenges in measurement, the need for clear definitions, and the implication that model providers may need to document modifications and behavioural change metrics.

Implications for regulation and contracts

This report has several implications:

• Vendor contracts and procurement instruments involving AI models should consider the possibility that a provider’s “update” may trigger new obligations under the AI Act if the modification results in behavioural change beyond a defined threshold.

• Model governance frameworks need to include versioning, baseline behaviour metrics and documentation of modifications, along with change-logs that enable comparison of behaviour before and after fine-tuning or data updates.

• Organisations using GPAI models must be aware that compliance obligations may not cease once version 1 is covered; subsequent modifications may constitute “new models” and thus restart regulatory timelines or obligations.

• Legal risk assessment frameworks should incorporate the possibility that an AI provider may have to treat an updated model as a new product, with downstream liability or regulatory reporting implications.

The JRC report adds depth to the interpretive infrastructure of the AI Act by mapping how behavioural change and model modification intersect with regulatory categorisation.

Practitioners should build into their advisory frameworks the need for versioning, modification documentation and contract provisions dealing with “material change” in AI models.

Final Remarks

The four developments reviewed this week highlight a clear pattern: legal frameworks, standards and technology architectures are increasingly intersecting in tangible ways, rather than remaining abstract.

Organisations and their tech advisors are well-advised to make operational and contractual preparations now: governance frameworks need attention, system-by-system assessment is becoming essential, and documentation of AI model changes and their implications will be a necessary part of compliance.

Thank you for reading this week’s newsletter. I hope these insights help you stay informed.

Leave a comment

I would love to hear your thoughts or experiences on any of these developments; feel free to share your comments or reply directly to this email.

Governments are no longer waiting for technology to self-regulate. This week, Europe wants AI developers to explain their mistakes, Australia plans to keep children off social media, and Italy is improving control of digital systems. Regulators are acting faster than many companies expected, and compliance will no longer be optional. From AI accountability to data protection, this week’s updates reveal a clear turn in technology law toward power, oversight, and strict responsibility.

Share

Technology Law Weekly Review: Europe’s AI Guidance, Australia’s Social Media Age Rule, Quantum Regulation, and More.

This week has been marked by significant legal and policy developments in the regulation of digital technologies and data governance.

From the European Commission’s draft guidance on serious AI incidents to Australia’s proposal for a minimum social media age, regulators are expanding the boundaries of how technology, responsibility, and accountability should coexist.

The relationship between existing frameworks such as the GDPR and new instruments like the Digital Markets Act continues to raise questions about enforcement and harmonisation.

Meanwhile, Italy has introduced a major legislative update addressing cybersecurity and digital infrastructure, and the European Commission has released a notable competition enforcement report highlighting the implementation of the Digital Markets Act.

Finally, a new academic call for papers invites contributions on the regulation of quantum computing, signalling the next frontier in technology law.

AI Regulation: The European Commission’s Draft Guidance on Serious AI Incidents

The European Commission has issued a draft guidance document and a reporting template for “serious AI incidents,” a crucial component in the implementation of the forthcoming AI Act.

The document, now open for public consultation, outlines the procedures that providers, users, and other entities will be expected to follow when reporting incidents linked to artificial intelligence systems.

The focus is on ensuring early detection of risks and building a coherent framework for incident response and transparency.

The guidance identifies serious incidents as events or malfunctions of AI systems that result in harm to health, safety, or fundamental rights.

It proposes a harmonised template for notification to competent authorities, requiring detailed descriptions of the incident, its effects, and the remedial measures undertaken.

This process aims to strengthen oversight and allow for consistent regulatory monitoring across Member States.

This initiative is necessary because it addresses one of the most complex aspects of the AI Act: translating high-level principles into operational compliance mechanisms.

The guidance shows that the obligation to report extends not only to providers but also to users where applicable, marking a shared responsibility model that could influence how AI liability is understood across jurisdictions.

Subscribe now

Organisations developing or deploying AI systems in Europe should now begin reviewing their internal compliance structures, especially incident management procedures, to ensure alignment with the upcoming requirements.

The consultation also offers an opportunity for industry participants and academic experts to influence how “seriousness” is defined in the context of AI-related harms.

This is essential, as early-stage interpretations may set precedents for how regulators treat accountability under the AI Act once enforcement begins in 2026.

Privacy and Child Protection: Australia’s Move Toward a Social Media Age Requirement

The Office of the Australian Information Commissioner (OAIC) has opened consultations on a proposed legislative framework to introduce a minimum age for social media users.

The initiative follows years of debate about the intersection between child protection, data privacy, and commercial digital practices.

It is expected to establish that children under a specified age, likely 16, will require parental consent before using social media services.

The OAIC’s proposal is grounded in principles of privacy protection and informed consent.

The regulator argues that children are often unable to understand the consequences of data sharing on social platforms and therefore need stronger legal safeguards.

The draft framework also contemplates obligations for service providers to verify user ages, implement risk assessments, and maintain transparency about their data-handling practices.

If adopted, the Australian regime could position itself alongside similar child online safety frameworks in the European Union and the United Kingdom.

Its approach blends privacy law with child protection objectives, an area where global regulators are increasingly converging.

However, the practicalities of age verification remain contentious.

Industry stakeholders have raised concerns about feasibility, privacy implications of identification systems, and the risk of excluding young users from digital participation.

The OAIC’s effort reflects a broader trend toward placing greater responsibility on platforms to ensure that their design, algorithms, and engagement mechanisms are not exploitative or harmful to minors.

The proposal invites reflection on how international data protection norms might evolve toward harmonised standards, even without formal treaty coordination.

Legal advisors will need to monitor this development closely, as cross-border compliance between European and Australian regimes could soon become more complex for global social media companies.

Interlinking Frameworks: The Digital Markets Act and the GDPR

The European Commission and the European Data Protection Board have launched a consultation on draft joint guidelines clarifying the link between the Digital Markets Act (DMA) and the General Data Protection Regulation (GDPR).

This document represents a critical interpretative effort to ensure coherence between two of Europe’s most ambitious regulatory instruments.

The DMA targets structural imbalances in digital markets by imposing obligations on large online platforms designated as “gatekeepers.”

These obligations often intersect with data protection principles under the GDPR, particularly regarding consent, data portability, and user profiling.

The new joint guidelines seek to articulate how gatekeepers can comply with both frameworks simultaneously without creating conflicts or loopholes.

The consultation draft emphasises that compliance with the GDPR does not automatically imply compliance with the DMA, and vice versa.

It demonstrates that consent under the GDPR must be freely given and cannot be conditioned on access to services controlled by gatekeepers.

It also clarifies that data minimisation and purpose limitation under the GDPR must guide the way gatekeepers combine data across services.

The joint initiative is noteworthy for several reasons.

First, it demonstrates growing regulatory coordination within the European Union, signalling that data protection and competition law are no longer treated as distinct silos.

Second, it may shape future enforcement actions, particularly where data concentration is used to entrench market dominance.

Third, it sets the tone for how emerging technologies such as artificial intelligence and quantum analytics might be treated under combined regulatory frameworks.

Stakeholders are invited to comment on the consultation until early 2026, with final guidelines expected later that year.

In the meantime, gatekeepers and large digital firms should revisit their data governance structures to ensure that business practices comply with both legal instruments in substance rather than in form.

Italy’s New Law on Cybersecurity and Digital Governance

Italy has enacted Law No. 132 of 2025, a comprehensive measure aimed at enhancing the country’s digital infrastructure, cybersecurity preparedness, and public sector digital transformation.

The law consolidates multiple initiatives under a single framework, creating a unified governance model for cybersecurity oversight and digital public services.

Among its most important provisions, the law establishes a national cybersecurity coordination authority with expanded investigative and regulatory powers.

It reinforces requirements for critical infrastructure operators, public administrations, and digital service providers to implement robust security measures and report significant incidents.

The legislation also promotes the development of national cloud infrastructure, aligning Italy more closely with the European Union’s digital sovereignty agenda.

From a legal perspective, Law No. 132 reflects the increasing integration of cybersecurity regulation with broader principles of administrative law and data protection.

It creates an obligation for public authorities to ensure interoperability and transparency in digital service delivery, an approach that could enhance public trust in e-government platforms.

The Italian reform also represents an important case study in how Member States are adapting their domestic laws to support European objectives such as the Cyber Resilience Act and the NIS2 Directive.

The implications are equally significant for the private sector. Companies engaged in digital services or cloud computing in Italy will face new compliance requirements, including tougher contractual terms for data processing and cross-border transfers.

European Commission Competition Report: Enforcement under the Digital Markets Act

The European Commission has released a new report summarising progress under the Digital Markets Act, highlighting the designation of gatekeepers and the first wave of enforcement actions.

The report notes that several major technology firms have already been required to adjust their practices, particularly concerning data interoperability, default settings, and advertising transparency.

The European Commission emphasises that the DMA’s objective is to ensure fairness and contestability in digital markets, with a particular focus on protecting business users and consumers.

Enforcement has centred on the assessment of compliance reports submitted by designated gatekeepers, as well as ongoing dialogue with national competition authorities to coordinate oversight.

The report also draws attention to the role of civil society and academia in monitoring DMA implementation.

Subscribe now

It calls for continued collaboration between regulators and researchers to assess whether the regulation effectively enhances market openness and innovation.

While the European Commission acknowledges challenges in interpretation and enforcement, it stresses that the early phase of the DMA has already produced measurable improvements in user choice and interoperability.

The report offers insight into how enforcement priorities are being determined. The focus on transparency and verifiable compliance may prompt gatekeepers to develop more detailed internal reporting systems, similar to those required under the AI Act.

The European Commission’s clear emphasis on measurable outcomes, rather than abstract principles, could influence how compliance assessments are structured in the coming years.

This report confirms that the European Union is not only legislating but also enforcing its digital laws with increasing precision.

It reinforces the expectation that non-compliance will attract significant penalties and reputational consequences.

Call for Papers: Quantum Computing and the Regulation of Law

The International Review of Law, Cyber Technology & Regulation (IRLCT) has issued a call for papers for a forthcoming special issue titled Quantum Computing and the Regulation of Law.

The issue, to be published in late 2026 or early 2027, invites scholarly contributions addressing the legal and regulatory dimensions of quantum technologies.

The editors, Professor James Griffin and Dr Chunping Bush of the University of Exeter, seek submissions exploring themes such as quantum advantage, regulatory frameworks for quantum hardware and software, intellectual property, quantum-safe cryptography, and liability for quantum systems.

The call also welcomes interdisciplinary research spanning law, computer science, philosophy, and public policy.

Abstract submissions are due by 15 January 2026, with full manuscripts expected by 1 May 2026. The issue aims to catalyse academic dialogue around how legal systems can respond to the disruptive potential of quantum computing.

Of particular interest are discussions on governance and accountability in a post-quantum world, where traditional encryption and privacy safeguards may become obsolete.

The significance of this call lies in its recognition that quantum computing is transitioning from theoretical research to practical deployment.

Regulators and legal scholars are beginning to anticipate the challenges this technology will pose to existing frameworks governing privacy, security, and intellectual property.

Submitting a paper could provide an opportunity to contribute to early thought leadership in an area that will likely dominate the next generation of technology regulation debates.

Conclusion

This week’s developments reinforce that technology regulation is entering a phase of consolidation.

The European Commission’s AI incident reporting guidance and DMA-GDPR interplay consultation both shows an effort to ensure regulatory consistency.

Italy’s comprehensive digital law and Australia’s proposal for a minimum social media age show that national regulators are equally active in strengthening accountability and user protection.

The coming months will require attention to detail, engagement with consultation processes, and preparation for implementation.

Those working in technology policy, law and regulation should seize these moments of regulatory definition to ensure that their organisations and clients remain not only compliant but also informed participants in influencing the norms of digital governance.

✨ Key Deadlines and Actions

• European Commission AI incident reporting consultation: open now.

• DMA-GDPR joint consultation: submissions accepted until early 2026.

• Australia’s OAIC social media age consultation: currently open for feedback.

• IRLCT Quantum Computing & Regulation of Law abstract deadline: 15 January 2026.

I would love to hear your thoughts on these developments and how they may influence your work or research. Share your comments, insights, or questions. Your perspectives help keep this newsletter grounded in real conversations.

Leave a comment

The drive to regulate quantum computing reveals a profound tension between legitimate security concerns and the need for scientific freedom, exposing how the wrong policy decisions could either hinder a transformative technology or fail to address genuine risks. Advocates and critics alike often oversimplify the debate, ignoring the complex issues of international collaboration, nascent research, and geopolitical interests that define this contentious subject.

Share

In this newsletter, we will cover:

1. Quantum computing is still in its infancy; imposing regulations risks choking off international collaboration, supply chains and the scientific freedom that has driven technological breakthroughs.

2. Export controls and classifications hinder research by slowing equipment imports, compliance costs and greatly discouraging foreign partnerships needed for quantum companies and laboratories to thrive.

3. Security concerns are valid but should be addressed through targeted measures and quantum cryptography standards than sweeping regulations that slow innovation and harm legitimate research.

4. Standards bodies like ISO, IEC and NIST provide flexible frameworks for terminology, interoperability and security that evolve with quantum technologies without imposing rigid, obsolete mandates.

5. Policymakers should invest in research, education and collaboration, adopting application specific oversight rather than broad prohibitions to protect national security while promoting quantum innovation sustainably.

The Demerits of Quantum Computing Regulation

The controversial debate over whether quantum computing should be regulated has become increasingly intense as governments, industry leaders and commentators grapple with the implications of this emerging technology.

On one side stand those who argue that quantum computers and related technologies pose profound security and economic risks that justify pre‑emptive regulation; on the other side are those who believe that premature regulation will stifle innovation, fragment global research networks and undermine the potential benefits that quantum technologies promise.

This editorial aligns with the latter view, arguing that the current push to regulate quantum computing is misguided, grounded in a distorted perception of risk, and driven by motives that have little to do with safeguarding innovation or national security.

Drawing on a range of academic research, policy analyses and government reports, this editorial critically examines the arguments for regulation and highlights the dangers of a regulatory rush.

There is the question of whether quantum computing is sufficiently mature to warrant legal and economic controls.

Quantum technologies remain at an early stage; most devices are experimental, and their capabilities are limited to specific problems.

Yet, some policymakers have moved to classify quantum computers as critical technologies and impose export controls on their components.

In the United States, the Department of Commerce extended export controls to quantum computing and other emerging technologies in 2024, requiring companies to obtain licenses when selling or transferring quantum hardware, software or services.

Subscribe now

The official justification was national security: regulators fear that countries like China might use advanced quantum systems to break encryption and gain military advantages.

However, this justification rests on speculative scenarios rather than present realities.

As the Center for Strategic and International Studies (CSIS) notes, quantum computers capable of performing such decryption are still many years away, and overbroad restrictions risk cutting off U.S. companies from international research networks and markets.

The consequences of misclassifying quantum computing as a mature, high‑risk technology are immediate and far‑reaching.

Export controls, by design, restrict the flow of hardware, software and knowledge across borders.

For quantum research, which relies on globally distributed expertise and equipment, such restrictions are particularly harmful.

A panel discussion at the recently emphasised that quantum laboratories depend on cryogenics, photonics and other components sourced from multiple countries.

When governments treat these instruments as strategic commodities, they risk creating choke points that disrupt supply chains, increase costs and delay research.

These regulatory interventions also undermine academic and commercial collaboration in quantum research.

Aziz Huq, a constitutional law scholar, has argued that export controls focus on restricting the flow of ideas, capital and goods across borders rather than building the infrastructure and norms needed to leverage innovation for national benefit.

By placing hardware and research data under the same restrictions as military equipment, policymakers fail to recognise that innovation flourishes through open exchange.

The result is a chilling effect: universities hesitate to partner with foreign institutions, startups struggle to secure funding and cross‑border projects are postponed or cancelled.

In the name of national security, regulators may be inadvertently weakening their own countries’ positions in the global quantum race.

Subscribe now

The United Kingdom’s Regulatory Horizons Council (RHC) has taken a different approach, one that emphasises caution and proportion.

In a February 2024 report, the RHC noted that quantum technologies are at various stages of development and argued that it is too early to jump to legally based regulation.

The report acknowledged that discussions and planning are necessary but cautioned against imposing rules before the applications and risks are fully understood.

The UK government’s response agreed, stating that regulation must be introduced at the right time so that it supports rather than stifles innovation.

This measured stance stands in stark contrast to the regulatory zeal seen in other regions, suggesting that effective governance can be more nuanced and less reactive.

Academics who study export controls and innovation policy share the RHC’s concerns.

Anh Nguyen of the University of Amsterdam has argued that current quantum export control proposals are unprecedented attempts to restrict a future technology and that performance thresholds used to trigger controls often exceed the capabilities of existing devices.

Nguyen and others warn that overbroad restrictions risk creating regulatory choke points and weakening global research networks.

Therefore, by treating quantum components like conventional dual‑use items, policymakers ignore the fact that many parts of quantum systems have purely civilian or benign applications.

For example, precision lasers used in quantum experiments are also used in medical diagnostics and manufacturing; cryogenic systems are essential for high‑energy physics and neuroscience. Classifying these items as strategic risks freezing entire sectors.

Think tanks and policy institutes provide further evidence that regulation could backfire.

A 2022 RAND Corporation report recommended that policymakers should not impose export controls on quantum computers or communications systems, noting that the eventual applications and timelines are highly uncertain and that restrictions could limit the exchange of ideas and slow technological progress.

The CSIS has echoed this view, highlighting that overly restrictive technology transfer policies would cut off access to the global quantum research community and harm startups.

These analyses share a common conclusion: premature regulation threatens to undermine innovation and leadership more than it protects security.

The debate is not confined to the United States and the United Kingdom alone.

In Europe, the drive for digital sovereignty has spurred proposals to create a “Quantum Act” that would place quantum computing under a regulatory regime similar to other critical infrastructures.

The European Centre for International Political Economy (ECIPE) has criticised this approach, pointing out that quantum technologies have emerged from global scientific interdependence and that regulation can support innovation only when grounded in a clear understanding of how a technology is likely to develop.

The authors warn that Europe risks stifling its own industry by over regulating too early and argue that a coordinated effort should allow member states to cultivate strengths in their own domains.

Overly prescriptive legislation for quantum computing could lead to uneven enforcement and further fragmentation,

These concerns are compounded by the fact that almost every key component of a quantum computer is sourced internationally.

Trying to build a fully domestic supply chain is unrealistic and could isolate Europe from global innovation.

Voluntary international standards offer the most promising framework for governing quantum technologies.

According to this view, standards bodies such as the International Organization for Standardization (ISO), the International Electrotechnical Commission (IEC), the Institute of Electrical and Electronics Engineers (IEEE) and the U.S. National Institute of Standards and Technology (NIST) are already developing frameworks for terminology, interoperability, security and risk management.

These standards are faster to update than laws, apply across borders and provide shared benchmarks without imposing legal mandates.

They build trust, reduce ambiguity and lay a foundation for eventual regulation without stifling innovation during early development.

Standardisation efforts are already yielding tangible results.

The ISO/IEC Joint Technical Committee on Quantum Technologies, established in 2024, coordinates terminology, benchmarks and interoperability standards across the quantum ecosystem.

NIST has finalised Federal Information Processing Standards that specify algorithms designed to resist attacks from quantum computers.

These standards enable organisations to prepare for quantum risks without the need for sweeping legislative action.

They also foster international collaboration, providing a common language and set of expectations for researchers, developers and regulators.

This standards‑first approach is a pragmatic alternative to immediate regulation, offering flexibility and adaptability as the technology evolves.

The U.K. Regulatory Horizons Council’s recommendation of a “regulation by application” model aligns with the standards‑first perspective.

It proposes that regulators focus on specific use cases rather than imposing blanket rules across the entire quantum domain. Under this model, legislation would apply only when a technology’s applications are clearly understood and when risks are concrete and measurable.

The U.K. government’s response supports this approach, emphasising that discussions, upskilling and international standardisation should precede any legislative requirements.

By upskilling regulators and engaging with industry through forums and workshops, governments can ensure that regulatory interventions are informed, targeted and proportionate.

Critics of regulation also stress the importance of international cooperation.

The Chicago Quantum Exchange event highlighted existing partnerships between the United States, Japan, France and Switzerland, underscoring that cross‑border collaboration is essential for quantum progress.

Scholars argue that building solid infrastructure and shared norms is crucial for nations to derive economic benefits from quantum innovation.

These norms include commitments to responsible research, ethical standards and open exchange of knowledge.

Targeted controls on malicious use cases may be necessary for national security, but blanket regulations would cut researchers off from the global ecosystem.

For innovation to flourish, governments must foster, not inhibit, these international networks.

Proponents of immediate regulation often portray critics as naive or indifferent to security concerns.

Such characterisations are unfair and ignore the fact that targeted measures are already in place.

The argument for regulation also often conflates worst‑case scenarios with imminent threats.

The possibility that quantum computers might one day break classical encryption does not justify imposing controls on research equipment or software today.

As RAND and CSIS highlight, the timeline for practical, scalable quantum computers remains uncertain.

Even if quantum computers eventually pose a security threat, the appropriate response is not to restrict research but to accelerate the development of quantum‑resistant cryptography and security practices.

Therefore, by investing in mitigation strategies and adaptive governance, policymakers can prepare for the quantum future without hampering innovation.

Economic considerations further undermine the case for regulation.

Quantum technologies are expected to create new industries and markets, driving job growth and attracting investment.

Restrictive regulation could deter venture capital and corporate investment, as companies may perceive a hostile environment for quantum research. In contrast, countries that adopt supportive, flexible policies are likely to attract talent and capital.

The CSIS report emphasises the need to increase support for research through funding, tax incentives and programs that nurture startups.

It calls for bolstering technological cooperation with allies and developing common policies on technology transfer to avoid cutting off access to the global research community.

These recommendations highlight that economic leadership in quantum technologies requires openness and collaboration, not isolation and control.

The ethical dimension of quantum regulation cannot be ignored.

Quantum technologies have the potential to revolutionise medicine, climate science, finance and logistics.

They could enable early detection of diseases, optimise supply chains and model complex chemical reactions.

Premature regulation that delays these innovations is not merely a missed economic opportunity; it is an ethical failure.

When policymakers restrict research based on speculative fears, they risk denying society the benefits that quantum computing could bring.

Given the urgency of global challenges, pandemics, climate change, resource management, the responsible course is to encourage research while putting in place mechanisms to address specific risks as they arise.

In the final analysis, the case against regulating quantum computing at this stage is compelling.

The technology is still maturing, and its capabilities and risks remain uncertain.

National security concerns, while legitimate, are better addressed through targeted measures, investment in cryptographic resilience and international cooperation than through sweeping export controls.

The misclassification of quantum hardware as inherently dual use ignores the civilian applications of many components and disrupts supply chains.

In conclusion, regulating quantum computing now would be a mistake.

The risks that proponents of regulation highlight are real but speculative and can be mitigated through targeted, flexible approaches.

Sweeping controls on components and knowledge threaten to undermine the global research collaborations that drive innovation and could delay the development of applications with enormous social and economic benefits.

Governments should resist the impulse to regulate for regulation’s sake. Instead, they should invest in research, support standardisation, engage with international partners and apply regulation only when applications and risks are clearly understood.

If you have thoughts or experiences on this debate, I welcome your contributions; please share your perspective, questions, or critiques; civil discourse enriches understanding and helps ensure policies are informed by diverse voices and informed analysis and encourages thoughtful engagement.

Leave a comment

International cooperation in science and technology is rarely as straightforward. The Technology Prosperity Deal between the United States and the United Kingdom is framed as a landmark agreement, yet its ambitions expose unresolved questions of governance, accountability, and national interest.

Share

The Technology Prosperity Deal: A New Era of US–UK Cooperation

On 18 September 2025, the governments of the United States and the United Kingdom signed a Memorandum of Understanding establishing what is called the Technology Prosperity Deal.

This agreement represents a structured partnership to deepen cooperation in science and technology.

It builds on a long history of collaboration between the two countries and sets out a framework for cooperation in areas such as artificial intelligence, nuclear technologies, and quantum research.

The deal involves creating tangible outcomes for citizens by aligning legal, regulatory, and research structures.

It also ensures that both countries remain influential leaders in the development of science and technology in ways that safeguard values of security, prosperity, and innovation.

Artificial Intelligence

Artificial intelligence is given priority attention within the agreement.

Both governments have committed to expanding access to compute infrastructure, supporting the development of shared datasets, and establishing flagship research programs in AI-enabled science.

These will cover areas such as biotechnology, cancer research, rare and chronic diseases, and energy research including fusion.

The agreement establishes a pathway for U.S. and UK research institutions, such as the Department of Energy, the National Science Foundation, and the UK Research and Innovation body, to coordinate joint funding, joint use of compute resources, and collaboration on new AI models.

There will be efforts to advance automated laboratory technologies, expand opportunities for joint research, and strengthen AI applications in space exploration through links between NASA and the UK Space Agency.

An important institutional link is also planned between the U.S. Center for AI Standards and Innovation and the UK AI Security Institute.

Their cooperation will include joint work on standards, research into advanced AI capabilities, and talent exchanges.

This is intended to establish a framework for trusted AI adoption while also supporting industry export opportunities, particularly in semiconductors, data centers, and models.

For citizens and businesses, this offers the possibility of more collaborative projects, greater employment opportunities in AI-related roles, and access to stronger infrastructure supporting scientific advancement.

Civil Nuclear Energy

The memorandum also recognises nuclear technologies as central to the future of energy, security, and industrial competitiveness.

The governments of the United States and the United Kingdom aim to accelerate development in advanced nuclear reactors and fuels, ensure secure supply chains, and establish independence from Russian nuclear fuel by the end of 2028.

The document is explicit about improving regulatory timelines, with targets such as completing reactor design reviews within two years and site licensing within one year.

The aim is to give industry greater certainty while ensuring high standards of safety, security, and non-proliferation.

Collaboration will also extend into fusion energy research. Both countries have committed to pursuing harmonised policy and regulation to support a global market for fusion energy led by the United States and the United Kingdom.

The memorandum also leaves open possibilities for civil maritime nuclear applications and for nuclear-powered resilience in defence facilities.

These provisions are not abstract; they mean practical efforts to reduce costs, accelerate projects, and strengthen energy resilience for both societies.

Subscribe now

Quantum Technologies

The agreement addresses quantum technologies as a central frontier in science and innovation.

The text identifies cooperation in quantum information science, quantum computing, and secure quantum communications.

It commits to supporting collaborative research, developing standards, and encouraging workforce development.

Although the memorandum does not prescribe detailed technical objectives, it provides a basis for cross-governmental and cross-agency partnerships.

This creates the foundation for long-term leadership in quantum research and for coordinated policy frameworks that can support adoption by businesses and research institutions.

Subscribe now

Strategic Importance

The memorandum emphasises that the United States and the United Kingdom share deep-rooted expertise, strong security partnerships, and complementary regulatory regimes.

By agreeing to this structured partnership, both governments are positioning themselves to influence global standards, develop joint responses to strategic challenges, and support domestic industries in highly technical fields.

For the general public, the implications are clear. Access to new energy technologies, new medical applications of AI, and more resilient infrastructure are not distant policy concepts but elements that can affect jobs, healthcare, and national security in direct ways.

The memorandum offers opportunities to participate in collaborative projects, benefit from streamlined regulatory processes, and enter export markets supported by joint government frameworks.

Why This Matters

The Technology Prosperity Deal shows that governments are prepared to create structured and ambitious frameworks for science and technology cooperation.

It signals that innovation is not only about industry leadership but also about government-led coordination, standards, and infrastructure.

Practical measures such as joint funding, shared access to compute, regulatory streamlining, and supply chain security will directly influence how technologies develop over the next decade.

Individuals who are part of research communities, industry associations, or educational institutions should be aware of the opportunities to engage with collaborative projects supported by this deal.

Businesses involved in nuclear, AI, or quantum sectors should pay attention to the new export and regulatory provisions that may open doors for participation.

This memorandum of understanding is a reminder that science and technology progress most effectively when supported by structured international partnerships.

The United States and the United Kingdom have chosen to formalise their cooperation with clarity on purpose, scope, and timelines.

Citizens, businesses, and institutions in both countries should be attentive to the opportunities and responsibilities that follow.

The Technology Prosperity Deal is a practical document with clear commitments.

It represents a deliberate effort to coordinate resources, policies, and expertise in order to deliver benefits for people in both countries and to support leadership in technologies that will define the coming decades.

The Deal in Perspective

The Deal between the United States and the United Kingdom is presented as a landmark framework for cooperation on artificial intelligence, nuclear energy, and quantum technologies.

Yet the memorandum offers more political symbolism than substantive detail.

The text highlights ambitions such as accelerated nuclear licensing timelines, joint AI research programs, and secure supply chains, but it avoids addressing deeper questions of accountability, governance, and the distribution of benefits.

In nuclear energy, the proposed two year reactor review and one year site licensing targets may satisfy industry demand for certainty, but they risk compromising the independence of regulatory oversight.

In AI, the rhetoric of shared compute access and datasets sounds progressive, yet there is no clear plan for public accountability in developing and deploying models that may influence health, security, and data systems.

The agreement also elevates government-led standards without meaningful consideration of global participation.

By presenting the memorandum as a neutral framework, both governments appear to sidestep the political reality that technology standards are instruments of power.

The deal therefore risks becoming less about prosperity and more about reinforcing influence.

The absence of mechanisms for public scrutiny should concern anyone invested in long term democratic governance of technology.

Leave a comment

The Technology Prosperity Deal raises important questions about governance, industry participation, and long-term accountability. We welcome your reflections and perspectives on what this agreement could mean in practice. Reply to share your thoughts.

International space law has become an uneven patchwork of commitments, voluntary guidelines, and contested interpretations, and yet the newly released United Nations treaty booklet presents it as a comprehensive and reliable framework. Such presentation conceals persistent gaps in compliance, the limits of enforcement, and the reality that non-binding guidelines are increasingly treated with the authority of binding treaties.

Share

UNOOSA Updates Treaty Booklet: International Space Law Instruments for Today and Tomorrow

The United Nations Office for Outer Space Affairs (UNOOSA) has released the latest edition of its treaty booklet International Space Law: United Nations Instruments (New York, 2025).

This updated volume brings together the cornerstone treaties, principles, and related resolutions that govern activities in outer space.

It also incorporates the Guidelines for the Long-term Sustainability of Outer Space Activities adopted by the Committee on the Peaceful Uses of Outer Space.

The publication continues a tradition of more than two decades of producing accessible and authoritative resources for practitioners, policymakers, academics, and industry actors who navigate the expanding frontier of outer space activities.

The booklet provides an essential consolidation of the legal instruments that form the backbone of international space law.

It is both a collection of treaties and a reflection of the collective effort of States within the United Nations to provide predictability, transparency, and cooperation in an increasingly complex domain.

Its release in 2025 is indeed a moment in which outer space activities have grown far beyond the capacities of early spacefaring nations and have become a shared area of interest for developed and developing States alike.

International Law for a Shared Domain

The Director of UNOOSA, Aarti Holla-Maini, introduced the updated booklet by describing it as the most comprehensive and up-to-date compilation of instruments under the auspices of the United Nations.

These instruments continue to form the principal body of international space law, designed to provide a reliable framework for peaceful exploration and use of outer space.

The booklet reminds us that the year 1967 marked a milestone in space history with the entry into force of the Outer Space Treaty, which remains the foundational legal instrument in this field.

Since then, the United Nations has facilitated a series of treaties, principles, and resolutions that together articulate responsibilities, rights, and expectations for States.

The new edition integrates the Guidelines for the Long-term Sustainability of Outer Space Activities, presenting them as a contemporary counterpart to the traditional treaty framework.

Part One: United Nations Treaties

The booklet opens with the five core treaties of international space law:

1. The Outer Space Treaty (1967). This treaty sets the foundation for all space activities, affirming that exploration and use of outer space shall be carried out for the benefit of all countries and that space is free for exploration without discrimination. It prohibits the placement of nuclear weapons in orbit or on celestial bodies and establishes outer space as the province of all humankind.

2. The Rescue Agreement (1968). This treaty elaborates on the obligations of States to assist astronauts in distress and to ensure the safe return of both astronauts and space objects.

3. The Liability Convention (1972). This treaty addresses responsibility and liability for damage caused by space objects, ensuring that States remain accountable for the consequences of activities carried out under their jurisdiction.

4. The Registration Convention (1976). This treaty obliges States to register space objects launched into outer space, reinforcing transparency and accountability.

5. The Moon Agreement (1979). This treaty extends the principles of the Outer Space Treaty to the Moon and other celestial bodies, focusing on cooperative exploration and equitable benefit sharing.

Together, these treaties continue to form the backbone of international space law.

The updated booklet provides full texts, depositary information, and context for each treaty, making it a comprehensive reference for both new and experienced practitioners.

Subscribe now

Part Two: General Assembly Principles

Beyond treaties, the United Nations has adopted principles that reflect international consensus on specific areas of space activity.

These include the Declaration of Legal Principles Governing the Activities of States in the Exploration and Use of Outer Space, principles on remote sensing, principles relevant to the use of nuclear power sources in outer space, and a declaration on international cooperation in exploration and use of outer space for the benefit of all States.

While not legally binding, these principles provide interpretive guidance and reinforce the cooperative ethos underlying international space law.

TechLaw

Research Spotlight: Space Is Full of Trash

Rocket launches are booming, but so is the junk they are leaving behind. This research spotlight breaks down a sharp and timely legal analysis by Matthew Lumia, who argues that rocket reusability is a legal and ethical necessity. In a world where orbital debris is piling up and regulations are stuck in the past, the article makes the case that current p…

Read more

10 months ago · 3 likes · 2 comments · TechLaw

Part Three: Related Resolutions

The booklet also compiles key General Assembly resolutions that have supported the legal regime, including the foundational resolution 1721 (XVI) B of 1961, which established the practice of registering space objects, and resolution 68/74 of 2013, which provided recommendations on national legislation relevant to peaceful exploration and use of outer space.

These resolutions have played a critical role in supporting consistent national implementation and promoting wider participation in space governance.

Part Four: Other Documents

This section of the booklet contains important guidelines and frameworks that complement the treaty regime.

Among them are the Space Debris Mitigation Guidelines, the Safety Framework for Nuclear Power Source Applications in Outer Space, and most recently, the Guidelines for the Long-term Sustainability of Outer Space Activities.

The Guidelines on sustainability, adopted in 2019, are voluntary but carry strong political and practical weight.

They are designed to support States and international organizations in ensuring that outer space remains accessible, safe, and usable for current and future generations.

They stress that outer space is a finite resource that requires careful management to avoid risks associated with debris, interference, and overcrowding.

The Guidelines for Long-term Sustainability of Outer Space Activities

The inclusion of these guidelines in the 2025 treaty booklet signals their importance as a reference point for national regulators and international cooperation.

The guidelines define long-term sustainability as the ability to maintain space activities indefinitely in a way that ensures equitable access to the benefits of exploration and use for peaceful purposes.

They emphasize a number of areas, including:

• The adoption and revision of national regulatory frameworks to reflect international obligations.

• The need for States to supervise both governmental and non-governmental activities in accordance with Article VI of the Outer Space Treaty.

• International cooperation, capacity-building, and sharing of information through the Committee on the Peaceful Uses of Outer Space.

• Measures to ensure equitable and efficient use of the radio-frequency spectrum and orbital slots.

• Promotion of scientific research and development of sustainable technologies.

• Consideration of new methods to manage the long-term challenge of space debris.

By consolidating these guidelines within the treaty booklet, UNOOSA has ensured that they are no longer treated as an annex to discussions but as an integral component of the international legal framework.

Subscribe now

Technical and operational measures

On the technical side, the guidelines include detailed expectations for the design, operation, and disposal of space objects.

They recommend that satellites be designed for trackability and that operators consider methods that facilitate accurate orbital determination.

They also encourage measures to address risks associated with uncontrolled re-entry, including designing systems for controlled disposal.

Debris management is a recurring theme.

The guidelines call for States and international organizations to investigate and adopt new measures to manage debris, such as collision avoidance, spacecraft passivation, and design improvements that support disintegration during re-entry.

These measures are not meant to impose undue costs, particularly on emerging space actors, but rather to promote a fair and inclusive system of sustainability.

The guidelines also address space weather, calling for the development of standards to mitigate adverse effects on satellites, training to improve knowledge transfer, and the design of spacecraft that can withstand or recover from harmful space weather events.

Conclusion: A Foundation for Future Action

UNOOSA’s updated treaty booklet arrives at a time when outer space activities are expanding in scale and scope.

The booklet consolidates the foundational treaties that have guided the peaceful use of outer space since 1967 and integrates contemporary guidelines that address modern challenges such as debris, congestion, and equitable access.

It shows that international space law is not static but continues to develop through treaties, resolutions, and guidelines that reflect shared commitments.

The booklet is a tool for engagement with the future of space activities.

Whether working on satellite communications, liability frameworks, insurance, or national legislation, the booklet equips professionals with the core instruments for this complex field.

The UNOOSA treaty booklet is therefore not only a record of past commitments, but also a platform for future cooperation.

It provides States and organizations with the resources needed to ensure that outer space remains open, safe, and accessible for the benefit of all humankind.

As outer space law continues to expand through treaties, resolutions, and guidelines, your perspective is essential.

Leave a comment

Share your thoughts on how these developments affect technology, business, and governance. Reply with comments, and let us advance this discussion together.

European institutions claim to prioritise transparency in data handling, yet the recent ruling in case C-413/23 P exposes a troubling inconsistency. The treatment of pseudonymised data demonstrates how formal legal safeguards can fracture under operational pressures. Stakeholders were left uncertain about who accessed their information, raising doubts about the credibility of institutional commitments to meaningful accountability in digital governance.

Share this post with others

🏛️ Court: Court of Justice of the European Union (CJEU)
🗓️ Judgment Date: 4 September 2025
🗂️ Case Number: C-413/23 P

Access our EU AI Tracker here to monitor the latest developments in EU artificial intelligence laws and regulations.

Court of Justice Clarifies the Status of Pseudonymised Data in the SRB–EDPS Dispute

On 4 September 2025, the Court of Justice of the European Union delivered a judgment in case C-413/23 P that directly addresses the boundaries of what constitutes personal data when pseudonymisation is involved.

The decision arises from an appeal by the European Data Protection Supervisor (EDPS) against a judgment of the General Court that had annulled one of its enforcement decisions against the Single Resolution Board (SRB).

The case touches the intersection between banking resolution procedures, large-scale data collection from affected shareholders and creditors, and the responsibilities of Union institutions when handling sensitive information.

The Court’s findings matter to any organisation processing information that has been stripped of identifiers yet still carries a potential link back to individuals.

Background of the dispute

The events giving rise to the case can be traced back to the resolution of Banco Popular Español SA in June 2017.

The Single Resolution Board (SRB), acting under the Single Resolution Mechanism Regulation, determined that the bank was failing and adopted a resolution scheme.

This included the write-down and conversion of capital instruments and the transfer of shares to a purchaser, a decision which was subsequently approved by the European Commission.

Following this resolution, the regulation required an assessment of whether shareholders and creditors would have been treated more favourably had the bank undergone normal insolvency proceedings.

Deloitte was appointed by the SRB to carry out this valuation, referred to as Valuation 3.

Deloitte delivered its findings in June 2018, and on the basis of this work, the SRB launched a procedure to determine whether compensation was owed.

To ensure fairness and compliance with the right to be heard under the EU Charter of Fundamental Rights, the SRB invited affected shareholders and creditors to participate in a consultation.

The process was divided into two distinct stages.

First came the registration stage, which required each interested party to submit evidence of their identity as well as proof of ownership of relevant capital instruments at the time of resolution.

Identity documents and ownership records were uploaded directly to the SRB, which then verified eligibility.

This stage was critical because only verified individuals could proceed to the second stage.

Subscribe now

The consultation stage followed, in which verified participants were invited to provide comments on the SRB’s preliminary decision and Deloitte’s valuation.

Submissions were made through an online form that posed a series of structured questions.

The SRB collected more than 23,000 comments from over 2,800 participants.

To manage this volume securely and efficiently, each submission was assigned a randomly generated alphanumeric code.

These codes ensured that comments could be tracked and audited without exposing the names or personal identifiers of the individuals.

The SRB retained the database containing the registration information, including identity documents and ownership proofs, and separately stored the comments linked by codes.

Staff members responsible for reviewing comments had no access to the registration data, which remained under restricted control.

As a result, the comments were pseudonymised, meaning that Deloitte, which was later asked to evaluate the submissions relevant to its valuation, only received files containing codes and the substantive responses.

Deloitte never had access to the underlying registration data and could not by itself identify the individuals behind the comments.

Nevertheless, the SRB still held the means to re-identify participants by linking the alphanumeric codes back to the registration records.

The codes were designed to allow auditability and to demonstrate that each comment had been considered, especially in the event of legal proceedings.

This arrangement prompted complaints to the European Data Protection Supervisor (EDPS).

Several participants argued that the transmission of their pseudonymised comments to Deloitte amounted to the disclosure of personal data.

They contended that Deloitte should have been identified in the SRB’s privacy notice as a recipient under Article 15 of Regulation 2018/1725, which obliges EU institutions to inform individuals when their personal data are shared and to specify the recipients or categories of recipients.

The complainants claimed that the omission breached their right to be informed about how their data were handled.

In essence, the SRB viewed its transfer of pseudonymised data as secure and compliant, while the complainants argued that pseudonymisation did not erase the personal character of their information, since the SRB could still re-establish the link.

This disagreement laid the foundation for the legal proceedings that followed.

The EDPS findings and General Court annulment

The EDPS initially concluded that the SRB had violated its obligations because Deloitte was a recipient of personal data and had not been identified as such.

The reasoning rested on the understanding that pseudonymised information remained personal data since the SRB held the key that could re-identify individuals.

The SRB challenged this finding before the General Court, which annulled the EDPS decision in April 2023.

The General Court held that the EDPS had not assessed whether the information constituted personal data from Deloitte’s perspective.

Since Deloitte lacked access to the re-identification key and could not reasonably obtain it, the comments could not be regarded as personal data for Deloitte.

The Court emphasised that the obligation to inform under Article 15 extends only where a recipient is indeed receiving personal data.

The EDPS appealed to the Court of Justice, arguing that pseudonymised data should be treated as personal data in all circumstances, regardless of the specific capacities of recipients.

The Court of Justice ruling

The Court of Justice rejected the EDPS appeal and upheld the General Court’s judgment. The ruling contains several important clarifications:

• Pseudonymisation does not automatically mean that data remains personal in relation to every party. The decisive factor is whether the person concerned is identifiable for the recipient, considering all reasonably available means of re-identification.

• For the SRB itself, the data clearly retained its personal character because it possessed the linking information. However, for Deloitte, the combination of technical and organisational measures prevented identification. The Court recognised that pseudonymisation can, in certain circumstances, effectively deprive data of its personal nature for third parties.

• The EDPS obligation to assess a violation cannot be satisfied by a blanket presumption that pseudonymised data always amounts to personal data. The assessment must examine whether the recipient has access to or can reasonably obtain the necessary information to re-identify individuals.

• The wide interpretation of “personal data” in Union law does not eliminate the requirement that someone must be identifiable. Obligations such as providing information to data subjects cannot apply where an entity has no way of identifying them.

By confirming that pseudonymisation can change the legal status of data depending on the actor, the Court has set a precedent with far-reaching implications.

TechLaw

Case Report: EU-US Data Privacy Framework Survives Attack In Court (Latombe v. Commission)

The latest controversial judgment of the General Court in Latombe v Commission represents a decisive moment in the ongoing contest over transatlantic data transfers between the US and EU. The Court has endorsed the European Commission’s adequacy decision, validating the EU-US Data Privacy Framework. Critics will argue that the Court has accepted surveil…

Read more

7 months ago · 13 likes · 3 comments · TechLaw

Why this matters for data protection practice

This judgment demonstrates that the qualification of information as personal data is contextual.

It does not exist in abstraction but depends on who is processing it and what means are realistically available for identification.

Organisations handling pseudonymised data must therefore evaluate their own position carefully.

This legal decision clarifies that organisations cannot automatically treat all pseudonymised information as personal data when transmitting it to third parties.

The analysis must consider the technical and organisational safeguards that accompany the transfer.

At the same time, controllers must remember that if they themselves retain the ability to re-identify, the data remains personal for them, with all corresponding obligations.

For companies acting as processors or recipients, this ruling provides assurance that where pseudonymisation is implemented effectively, and there is no access to the re-identification key, the information they receive may not be subject to the full regime of data protection law.

Nevertheless, this does not authorise complacency.

The measures must genuinely prevent re-identification, and any possibility of combining data with other accessible sources must be addressed.

Subscribe now

Organisations engaged in large projects involving sensitive financial or technical information can draw several lessons from the Court’s reasoning:

1. Context matters: Always assess whether the data in your possession relates to an identifiable person in your specific circumstances, not in the abstract.

2. Pseudonymisation is not anonymity: The Court acknowledged that pseudonymisation reduces risk but does not automatically render data anonymous. The possibility of re-identification must be considered for each individual involved.

3. Transparency obligations remain strict: For entities like the SRB that hold the keys to re-identify individuals, pseudonymised data continues to be personal. These entities must ensure that privacy notices accurately list all potential recipients.

4. Technical and organisational measures are decisive: Safeguards such as separate storage of linking information, restricted access, and clear contractual limits on use can make the difference between data being personal or not for recipients.

5. Legal arguments must be precise: Supervisory bodies, controllers, and processors should avoid absolute positions. The Court has required nuance and factual analysis rather than blanket statements.

Broader significance

Although this case arose in the context of the banking union and the resolution of a financial institution, the principle has broader relevance.

Many technology companies, research institutions, and public authorities rely on pseudonymisation to share or analyse data while seeking to reduce privacy risks.

This judgment will likely be cited in future disputes to argue that pseudonymised information may fall outside the scope of personal data obligations when recipients cannot reasonably identify individuals.

At the same time, organisations should be cautious. The Court did not suggest that pseudonymised data is generally exempt from data protection law.

Instead, it emphasised careful examination of whether identification is possible in practice. The decision therefore encourages both innovation in data handling and accountability in ensuring that protective measures are robust.

Final thoughts

The Court’s judgment in C-413/23 P strengthens the legal understanding of pseudonymisation in European Union law.

It confirms that whether data counts as personal depends on the circumstances and on who holds the means of re-identification.

As data flows continue to underpin financial oversight, research, and digital services, this ruling will stand as a reference point for years ahead.

Organisations would be wise to review their current pseudonymisation practices and privacy notices in light of the Court’s guidance.

This judgment forces us to reconsider how institutions and private actors handle pseudonymised information within regulatory frameworks. Its implications extend beyond financial resolution into the broader practice of data governance.

Leave a comment

I would welcome your thoughts on whether this reasoning strengthens trust or complicates compliance. Reply directly to share your perspective, and let us continue the discussion together.

The latest controversial judgment of the General Court in Latombe v Commission represents a decisive moment in the ongoing contest over transatlantic data transfers between the US and EU. The Court has endorsed the European Commission’s adequacy decision, validating the EU-US Data Privacy Framework. Critics will argue that the Court has accepted surveillance safeguards that remain contested and has closed its eyes to fundamental weaknesses.

Share

🏛️ Court: Court of Justice of the European Union (CJEU)
🗓️ Date: 3 September 2025
🗂️ Case Number: Case T-553/23

EU Court Confirms Validity of the New EU-US Data Privacy Framework

The General Court of the European Union has delivered its judgment in Latombe v Commission (T-553/23), a case that challenged the legality of the European Commission’s adequacy decision for personal data transfers to the United States.

The Court’s ruling on 3 September 2025 confirms the continued validity of the EU-US Data Privacy Framework, which had been adopted by the Commission in July 2023.

This case is significant because it represents the latest legal examination of transatlantic data flows following the high-profile annulments of previous frameworks in Schrems I (2015) and Schrems II (2020).

In contrast to those earlier judgments, the General Court has chosen not to intervene this time.

Organisations engaged in cross-border data transfers and individuals concerned about privacy rights, will be reassured with this court decision.

Here is why.

Background to Latombe v Commission

The protection of personal data is enshrined in Article 8 of the Charter of Fundamental Rights of the European Union and Article 16 of the Treaty on the Functioning of the European Union.

These provisions underpin the General Data Protection Regulation (GDPR), which sets out rules for data transfers outside the Union.

Under the GDPR, the European Commission may issue an adequacy decision if it determines that a third country ensures a level of protection essentially equivalent to that within the Union.

Such a decision allows personal data to flow without additional authorisation.

The contested adequacy decision of July 2023 was adopted after the United States introduced new safeguards.

In particular, Executive Order 14086 and an Attorney General regulation created a new oversight body, the Data Protection Review Court (DPRC), and restructured rules governing intelligence agencies’ access to personal data.

These reforms were intended to address the concerns identified in Schrems II, where the Court of Justice of the European Union (CJEU) invalidated the Privacy Shield framework on the grounds that US law did not provide adequate safeguards against surveillance practices.

The Challenge by Philippe Latombe

Philippe Latombe, a French national and regular user of online platforms that process and transmit his personal data to the United States, challenged the European Commission’s adequacy decision of 10 July 2023.

His legal action before the General Court sought annulment of the decision, arguing that the newly established framework failed to guarantee the protection of his rights under EU law.

Latombe advanced two principal claims.

First, he maintained that the Data Protection Review Court (DPRC), the oversight mechanism created under Executive Order 14086 and subsequent Attorney General regulation, lacked genuine independence.

In his view, the DPRC was embedded in the executive branch of the US government and therefore subject to political or institutional pressures.

He argued that such dependence would prevent the body from serving as an impartial tribunal capable of safeguarding the rights of EU citizens whose data is transferred overseas.

Second, Latombe raised concerns about the powers of US intelligence agencies.

He contended that their ability to engage in bulk collection of data in transit from the European Union was not bounded by clear and precise rules.

According to him, the absence of prior authorisation from an independent court or administrative authority rendered these surveillance practices unlawful and incompatible with the standard of fundamental rights protection demanded under EU law.

Latombe’s challenge was firmly rooted in the history of transatlantic data transfers.

Both the Safe Harbour and Privacy Shield frameworks had previously been annulled in the Schrems I and Schrems II cases, precisely because US surveillance powers were considered excessive and inadequately checked.

By drawing parallels, he sought to persuade the Court that the European Commission’s new adequacy decision suffered from the same structural flaws and that individuals’ personal data remained exposed to disproportionate collection and insufficient judicial protection.

Subscribe now

The General Court’s Reasoning

The General Court dismissed the action in its entirety.

On the independence of the DPRC, the Court emphasised that the appointment and functioning of its judges are subject to safeguards designed to prevent undue influence.

Judges may only be dismissed for cause, and neither the Attorney General nor intelligence agencies may improperly interfere in their work.

On that basis, the Court concluded that the DPRC enjoys sufficient independence and impartiality.

On the question of bulk data collection, the Court clarified that nothing in Schrems II required prior authorisation of such collection by an independent authority.

What is essential is that ex post judicial review must be available.

According to the Court, US law provides that oversight through the DPRC, which can review decisions and ensure compliance.

As a result, the Court found that US practices do not fall below the standard of essential equivalence with EU law.

The Court also stressed that the Commission remains under a duty to monitor developments in US law.

If future changes undermine the adequacy of protection, the European Commission has the power to suspend, amend, or repeal the decision.

Why This Case Matters

This judgment has immediate implications for businesses, regulators, and individuals.

Companies engaged in transatlantic commerce gain reduced uncertainty from the confirmation of the framework, which allows data transfers to continue under a recognised legal basis.

The ruling reinforces for regulators the idea that adequacy decisions must be continuously monitored rather than treated as permanent guarantees.

The decision also demonstrates a more pragmatic approach by the EU courts after the strict stance in Schrems I and Schrems II.

The General Court accepted the European Commission’s assessment that new US safeguards are sufficient for now.

This suggests a recognition of the diplomatic and economic importance of stable data transfer mechanisms.

Further Points to Consider

Several points deserve attention:

• Legal certainty: The judgment means that transfers under the EU-US Data Privacy Framework remain valid. Businesses relying on this mechanism can proceed with greater confidence.

• Ongoing compliance: Adequacy does not relieve controllers or processors from their responsibilities under the GDPR. Technical and organisational safeguards must remain in place, and accountability mechanisms must be maintained.

• Risk awareness: The Court’s reliance on ex post oversight rather than prior authorisation means that individuals may still be subject to surveillance before any review occurs. Businesses must be mindful of public concerns and reputational risks even if the framework is legally valid.

• Future challenges: The possibility of an appeal to the CJEU remains open. Moreover, civil society organisations or individuals may continue to test the resilience of the framework through further litigation.

The judgment illustrates how fundamental rights are assessed in a practical context.

The Court did not deny the existence of surveillance practices but accepted the safeguards as adequate in light of EU standards.

Awareness of how personal data may circulate internationally is essential for users of digital platforms.

While the General Court has provided clarity, the issue is unlikely to disappear.

An appeal limited to points of law may be filed before the Court of Justice within two months and ten days.

If such an appeal is made, the CJEU will again scrutinise whether the level of protection in the United States truly matches that required under EU law.

Even if the adequacy decision survives, it will remain subject to continuous review by the European Commission.

The transatlantic dialogue on data protection will continue, shaped by legal, political, and technological developments.

For now, the ruling allows stakeholders on both sides of the Atlantic to operate with a recognised framework in place.

The importance of data transfers for trade, research, and innovation means that this outcome provides stability that is both welcome and necessary.

Conclusion

The Latombe v Commission judgment demonstrates the General Court’s acceptance of the European Commission’s assessment of the new US safeguards.

By confirming the adequacy of protection, the Court has upheld a vital mechanism for international data flows.

The decision reflects a careful balance between rights and realities, law and practice.

The key message is to engage constructively with these frameworks, respect GDPR obligations, and remain prepared for further legal or regulatory developments.

The Court’s judgment does not end the debate, but it does provide a workable legal basis at a time when certainty is essential.

Businesses should continue to document their data transfer practices, review their compliance programmes, and monitor the European Commission’s periodic assessments.

Individuals should remain informed about their rights and the mechanisms available to exercise them.

Regulators should maintain vigilance to ensure that the adequacy decision continues to meet the high standard of protection required by EU law.

This ruling will not end the debate on transatlantic data transfers, and its implications will continue to unfold. Legal arguments, policy choices, and commercial realities remain tightly bound. I welcome your thoughts on whether the Court has drawn the right line between privacy and practicality. Share your reflections in the comments and join the conversation.

Leave a comment

• Access our EU AI Tracker here to monitor the latest developments in EU artificial intelligence laws and regulations.

This EU Artificial Intelligence tracker monitors key dates and information on legal and policy developments surrounding artificial intelligence in the EU. It covers major legislative initiatives, law reforms and policy updates impacting artificial intelligence in the European Union.

Share

We are delighted to share with you a new free tool to support you in following developments in the regulation of artificial intelligence in the European Union.

Our EU Artificial Intelligence Tracker has been developed for monitoring law, regulation and policy affecting artificial intelligence.

It provides insights into how governments and regulators in the European Union are modernising the rules of the AI economy.

This broader context underlines why our focused resource on artificial intelligence matters.

With AI technology advancing faster than legal frameworks can adapt, staying informed has become crucial for businesses, policymakers, developers, lawyers and researchers.

EU AI Tracker

The volume and complexity of regulatory materials can be overwhelming, and many organisations are seeking an accessible way to understand how and when new policies may influence their work.

Our EU Artificial Intelligence tracker responds to this need by bringing information together in a structured way, making it easier for readers to keep up to date and understand what is happening in this critically important area.

It is part of our commitment to provide clear context and reliable guidance in a field that is increasingly important to society and industry.

Instead of expecting readers to piece together updates from multiple sources, our EU Artificial Intelligence tracker brings these developments together in one place.

When you visit the tracker you will see a list of sections dedicated to different elements of the regulatory programme, including the EU AI Act, a future EU AI tracker covering developments from 2025 onwards, an archive of the EU AI tracker covering 2021 to 2024, an even earlier archive covering 2014 to 2020, an entry on the EU AI liability directive (now withdrawn) and a section on the framework convention.

Subscribe now

Each of these sections is curated with the same care and attention to detail.

By structuring the tracker in this way, we aim to provide a convenient path through the information without requiring any specialist knowledge for our readers.

Readers can simply select the section that is relevant to them and see the chronology of updates (based on the dates of events).

One of the highlights of the tracker is its coverage of the EU AI Act, which is arguably the most significant piece of legislation on artificial intelligence in the European Union so far.

Our EU AI Act tracker provides a clear and reliable overview of developments surrounding this landmark legislation. It brings together structured updates on the AI Act’s progress, status and key provisions.

We know that not everyone who is interested in artificial intelligence policy is a lawyer, so we have worked to ensure that the entries are written in straightforward language and that the chronology of events is easy to follow.

The tracker is updated regularly to help readers stay informed.

This means that as soon as there are official announcements, publications or policy statements, they will be reflected in the tracker with a note explaining their significance and a link to the official document.

Our aim is to ensure that you have a trusted source to consult whenever you need to know what has happened and when, without needing to wade through legal jargon or inconsistent secondary reporting from other unreliable sources.

The importance of following these developments cannot be overstated.

Laws and regulations on artificial intelligence influence product design, risk management, data governance, procurement strategies, investment decisions and research agendas.

Our EU AI Tracker can help identify compliance obligations early on, allowing time to plan resources and align processes.

It offers insight into how the European Union is setting standards and how different institutions are coordinating.

It provides a timeline that can frame scholarly work and ensures that analyses reflect the most up to date information.

It is also designed to be intuitive so that people who are new to the topic can start exploring without feeling overwhelmed.

While the EU AI Act is currently the most prominent component of the tracker, the other sections are equally valuable.

The EU AI tracker covering developments from 2025 onwards will capture future changes and provide a forward looking view.

The section on the liability directive, although the directive has been withdrawn, preserves information about that proposal and allows readers to understand why it was proposed and why it has been set aside.

The AI framework convention section records updates relating to broader conventions or agreements on artificial intelligence within the European Union.

The archives covering 2021 to 2024 and 2014 to 2020 provide historical context, showing how policy thinking about artificial intelligence has developed over time.

We have meticulously maintained the archive so that the tracker allows readers to trace the line of legal and policy developments across a decade of debate and reflection.

This historical perspective is important because it offers insight into how priorities have changed, which may help readers anticipate future areas of focus.

Subscribe now

The clear separation of sections also makes it simple to access the periods or topics that matters most to you, whether you are analysing a specific regulatory instrument or looking at the bigger picture.

Behind the scenes, we will update the EU AI tracker on a weekly basis, ensuring it remains accurate.

Each entry includes the date of the development, a brief description of its nature and a link to the official source.

We do not summarise or interpret the content of the laws or regulations themselves; instead we provide enough information to help you identify whether a development is relevant to you and where you can find the official text.

This approach respects the complexity of legal documents while still offering a helpful guide.

We invite you to explore the EU AI tracker and to share this free tool with your wider network, encouraging them to subscribe to our newsletter so they don’t miss any updates.

Share TechLaw

Your feedback will help us improve our EU AI tracker; if you have suggestions for features or notice any missing developments, we would be pleased to hear from you.

This collaborative approach reflects our broader mission to demystify technology law and to make it accessible to a general audience, ensuring that our readers feel empowered to engage with regulations and law in a constructive way.

The introduction of the EU Artificial Intelligence tracker represents an important step in making complex policy developments understandable and accessible.

We are in the process of developing an EU Cybersecurity Tracker and also an EU Privacy Tracker. Look out for announcements in the coming weeks.

Leave a comment

Most governments talk tough on digital markets yet deliver fragile rules and weak institutions without proper enforcement mechanisms. The World Bank’s GRIDMAP exposes these gaps with a hard scoring system that strips away excuses. Regulators can no longer hide behind lip service. Markets need action, not declarations, and this GRIDMAP framework shows who is serious and who is not.

Share

In this newsletter, we will cover:

1. Why the World Bank’s GRIDMAP Toolkit matters for every country trying to protect consumers, regulate data markets, and create trustworthy institutions that can actually enforce the rules they write.

2. How the Maturity Assessment Profile (MAP) measures regulatory progress, from nascent beginnings to advanced readiness, and why this scoring system gives governments no excuse to hide weak laws or poor enforcement.

3. The practical tools inside GRIDMAP that help policymakers and regulators compare themselves to peers, identify gaps, and take concrete actions that strengthen markets, lower compliance costs, and build genuine trust with businesses and citizens.

4. The urgent lessons for digital markets: without robust legal frameworks, capable institutions, and visible enforcement, rules are meaningless, and how GRIDMAP offers a structured pathway to close these gaps before abuse and fraud spread further.

GRIDMAP

The World Bank has released a new methodology designed to help countries understand how prepared they are to regulate digital and traditional markets in ways that protect consumers, strengthen institutions, and ensure enforcement.

The framework is called the Global Regulations, Institutional Development, and Market Authorities Perspective Toolkit, or GRIDMAP.

At the centre of this framework sits the Maturity Assessment Profile, known as MAP.

The idea behind GRIDMAP is straightforward but powerful.

Emerging markets and developing economies often face similar challenges: uneven legal frameworks, weak institutions, and inconsistent enforcement.

These gaps make it difficult to foster trust in markets, particularly in areas like consumer protection and data governance.

GRIDMAP provides a minimum package of rules, institutions, and practices that any country can aim for, and MAP provides the methodology to measure how close a country is to achieving that package.

Rather than offering a single set of fixed rules, GRIDMAP acknowledges that every country will travel its own path.

It provides a structured way to identify where strengths exist, where weaknesses remain, and where reforms might deliver the greatest benefits.

The Three Pillars of GRIDMAP

The framework rests on three pillars. Each one is necessary, but none is sufficient alone.

Together, they create the minimum package for building safe and trustworthy markets.

Pillar One: The Legal Framework
Countries need laws and regulations that clearly define rights, obligations, and standards. These are the building blocks of a contestable market where participants understand the rules.

Pillar Two: Institutional Arrangements
Having laws on paper is not enough. Authorities must exist to implement those laws, staffed with adequate resources, empowered with clear roles, and capable of cooperating across borders.

Pillar Three: Implementation and Enforcement
Authorities must use their powers consistently and visibly. Trust only grows when participants see rules enforced, breaches addressed, and compliance facilitated.

Each pillar feeds into the others.

Laws without institutions remain symbolic. Institutions without enforcement lack authority. Enforcement without clear legal foundations risks arbitrariness.

GRIDMAP’s strength is to hold these three together.

Tools to Build Capacity

GRIDMAP provides seven tools that countries can use in a modular way. At the heart is the definition of the Minimum Package.

This package represents international good practices but is flexible. It is not a single threshold, but a range of acceptable outcomes.

A country might meet the lower range of the package and still have space to reach more advanced practices in the upper range.

The other tools help gather data, populate a global database, conduct assessments, and create dashboards for comparison.

Importantly, GRIDMAP also maintains a Bank of Good Practices, offering examples of how different authorities around the world have solved similar problems.

Subscribe now

MAP: The Maturity Assessment Profile

The MAP methodology translates this framework into a practical assessment. It divides maturity into four levels.

• Nascent (0–24 percent of possible points): Early stages, missing many key regulatory elements. Trust is limited, and international alignment is minimal.

• Developing (25–49 percent): Progress is underway, with partial frameworks and some growing trust.

• Emerging (50–74 percent): Most regulatory components are in place, market trust has improved, and alignment with international standards is significant.

• Advanced (75–100 percent): Full frameworks exist, practices are robust, and the country participates in setting international standards.

This clear structure matters because it avoids the trap of viewing regulatory development as binary.

It is not a question of having a law or lacking one. Instead, it measures progress across pillars, categories, and components.

How the Methodology Works

The assessment follows a detailed process.

First, weighted scores are calculated for each component.

Not all elements are equally important, so weights reflect expert views gathered from regulators, international organizations, and academic specialists.

Categories are then scored, normalized, and aggregated into pillar scores.

Second, the results are compared to the Minimum Package.

A country that reaches at least half of the maximum points in a category or pillar is considered to have reached the lower range of the package.

Reaching the upper range signals a higher level of maturity.

Third, maturity levels are assigned. Each pillar, category, and component is placed into one of the four levels.

Fourth, results are visualized in graphs.

For example, a country’s institutional arrangements in data markets can be compared with its peers in the same region or income group.

These visual comparisons make it easier to identify strengths and challenges.

Finally, authorities interpret results.

They can see which components are above the benchmark and which are lagging.

For example, a country may score well in personal data breach responses but remain weak in cross border cooperation or financial resources.

This nuanced view helps target reforms.

Why MAP Matters for Digital Markets

The document emphasizes consumer protection and data markets as priority modules.

This focus is deliberate.

In many developing economies, consumers face significant risks: excessive data collection, bias from automated decision making, unfair commercial practices, fraud, and breaches of data security.

Small and medium enterprises also face difficulties because of information gaps and power imbalances with larger firms.

Without credible regulation, trust falters, and markets stagnate.

MAP allows countries to measure their progress against global standards and identify practical steps forward.

For a regulator, this can mean knowing whether to prioritize strengthening enforcement, building institutional resources, or aligning legal frameworks with international norms.

Subscribe now

Practical Implications for Policymakers and Practitioners

1. Benchmarking Performance: Countries can use MAP to see where they stand compared to peers. This evidence allows policymakers to communicate clearly with citizens, businesses, and international partners.

2. Prioritizing Reforms: Because MAP highlights specific gaps, resources can be directed efficiently. For example, if clear processes or cross border cooperation score low, targeted reforms can be designed.

3. Enhancing Trust: Transparency in assessment increases market confidence. When participants see evidence based evaluations, they are more likely to trust institutions and engage in markets.

4. Encouraging Collaboration: The framework allows countries to learn from one another. By looking at the Bank of Good Practices, authorities can adopt proven solutions rather than starting from scratch.

A Toolkit for Everyone

For readers outside government, GRIDMAP and MAP may seem technical. Yet the principles are universal.

Trust in markets matters to every consumer.

When institutions lack capacity, individuals suffer from fraud, misuse of personal data, or weak protection.

When enforcement is absent, rules become meaningless.

The MAP methodology offers a pathway for governments to diagnose weaknesses, but it also creates expectations for transparency.

Citizens and businesses can demand to know where their country stands.

Policymakers can no longer claim progress without evidence.

The GRIDMAP methodology is still developing.

Over time, feedback from regulatory authorities and experts will refine the components and expand the modules.

As this occurs, countries will have access to more precise assessments, more detailed comparisons, and more actionable recommendations.

What remains constant is the goal: to provide emerging markets and developing economies with a credible, evidence based toolkit for building safe, trustworthy, and competitive digital markets.

As digitalization deepens across the globe, the need for trustworthy regulation only grows.

GRIDMAP and MAP provide countries with the means to assess themselves honestly, learn from one another, and take concrete steps toward stronger institutions and safer markets.

Your views on how regulatory maturity should be assessed, communicated, and applied are invaluable. I invite you to share your thoughts, experiences, or questions in the comments.

Leave a comment

The past weeks have brought an unusual convergence of debates across the world on the limits of artificial intelligence and digital governance. From London to Bonn, from Buenos Aires to the APEC ministerial in Singapore, regulators and lawmakers are grappling in reforms never before seen. These developments are in tandem with how the world is trying to hold together common principles of accountability while responding to very different political and institutional pressures.

Share

In this newsletter, we will cover:

1. How the UK regulator confronted the Metropolitan Police over live facial recognition, warning that surveillance without strict human rights safeguards risks losing legitimacy in the very society it claims to protect.

2. Why Germany’s data protection authority is asking hard questions about memorised data in large AI models, challenging the tech industry to prove that rights of access, correction, and deletion are not an illusion.

3. Argentina’s attempt to regulate artificial intelligence with transparency rules, risk categories, and a public registry of high-risk systems, setting a precedent that other countries in the region may not be ready to follow.

4. The latest APEC ministerial statement on digital and AI governance, where member states agreed on trust and inclusivity yet stopped short of enforceable commitments, leaving many to wonder what cooperation without accountability really achieves.

Facial Recognition and Human Rights in the United Kingdom

The Equality and Human Rights Commission in the United Kingdom has issued a clear warning to the Metropolitan Police on its use of live facial recognition technology.

The regulator state that this form of surveillance cannot exist outside the framework of human rights law and that the Met Police must be able to show compliance with requirements of necessity, proportionality, and legality.

The Commission’s position is significant because it places responsibility not only on the technology itself but also on the operational and policy decisions around deployment.

The Commission pointed out that facial recognition is not simply a tool that operates neutrally; it raises profound concerns about privacy, discrimination, and due process.

This is not a call for a ban. Rather, it is a reminder that in the United Kingdom, any policing technology that identifies people in public spaces must be embedded within the legal guarantees of the Human Rights Act.

The Met Police has defended the usefulness of facial recognition for public safety, but the regulator has set a marker: effectiveness cannot override the need for safeguards.

The Commission insists that legitimacy depends on transparency and accountability, not only efficiency.

In the immediate future, law enforcement agencies in Europe will face increasing scrutiny when they rely on biometric technologies.

Public trust will be fragile if these systems are not transparent.

The Commission’s insistence on embedding rights-based principles into everyday policing shows that human rights law can be a practical check on algorithmic surveillance.

Germany’s Consultation on Data Protection and AI Models

Germany’s Federal Data Protection Commissioner has launched a public consultation on how personal data is handled in large language models and similar artificial intelligence systems.

The document recognises what is now widely discussed but still unresolved: when models memorise data, including fragments of personal information, what obligations arise under data protection law.

The consultation raises questions about whether training data can ever be truly anonymised, whether differential privacy or deduplication techniques can sufficiently mitigate risks, and whether the outputs of a model that has memorised personal data constitute a form of processing under Article 4(2) of the GDPR.

Subscribe now

Importantly, the consultation acknowledges that affected individuals have rights of access, rectification, and erasure, yet it admits that enforcing those rights against the architecture of current models is extremely difficult.

How can someone demand deletion of their personal data if no one can locate it within billions of parameters?

Germany is opening the door for civil society, academia, and industry to provide practical evidence and technical assessments before regulatory approaches harden.

The questions are deliberately wide-ranging, covering anonymity, memorisation, and privacy attacks.

By doing so, the consultation highlights the tension between innovation and compliance with the GDPR.

The deeper story is that Europe is beginning to test the limits of its flagship data protection regime against new forms of artificial intelligence.

The GDPR was drafted before large language models were devised at scale.

Now, regulators are asking whether rights like deletion and access can be operationalised in practice.

Argentina’s Proposed AI Data Protection Law

In Argentina, a Bill has been introduced in the Chamber of Deputies to regulate the use of personal data in artificial intelligence systems.

The proposal covers developers, providers, and operators, and applies to any AI system that processes personal data in Argentina or targets individuals in the country.

The draft law sets out obligations of transparency, requiring that operators explain in accessible language the purpose, logic, and level of automation in AI systems.

It mandates risk assessments for all systems, with categories ranging from low to high risk.

High-risk systems in sensitive sectors such as health, finance, education, and justice will be subject to special controls.

Perhaps most notably, the bill creates a National Registry of AI Systems. Medium and high-risk systems must be registered with details of the developer, risk evaluation, and data protection policies.

Subscribe now

The registry will be public, establishing a form of democratic oversight.

The law also grants the regulator power to demand audits, suspend systems posing grave risks, and impose significant fines proportional to business revenues.

The proposal aligns Argentina with emerging trends in international regulation, drawing inspiration from the European GDPR and the proposed EU AI Act.

Yet, it is also tailored to local specificities, inviting provinces and the city of Buenos Aires to adhere.

What stands out is the insistence that AI development cannot be a private domain of companies alone.

Argentina is asserting that AI is a matter of public interest.

The bill sends a message that technological innovation must advance alongside accountability to citizens.

The APEC Digital and AI Ministerial Statement

At the Asia-Pacific Economic Cooperation meeting from 4-6 August 2025, ministers adopted a Digital and AI Ministerial Statement that seeks to set a cooperative agenda across member economies.

The statement stresses trust, inclusion, and sustainable growth in the digital economy.

It acknowledges the opportunities of artificial intelligence while calling for frameworks that manage risks, safeguard human rights, and ensure interoperability across borders.

While the statement is political rather than binding, it represents a collective effort to maintain common ground among economies with very different regulatory traditions.

It refers to the need for responsible AI governance, cross-border data flows with trust, and capacity building for smaller economies.

APEC’s strength is that it creates consensus language that can guide regional cooperation. However, its weakness is that it rarely sets enforceable obligations.

The ministerial statement does not commit members to specific laws, but it shows that even in a diverse region, governments recognise the need to discuss responsible AI and digital governance in the same breath as economic development.

The interesting point here is that Asia-Pacific economies are asserting their priorities in terms of trust and inclusivity, while avoiding the prescriptive model of the European Union.

This could produce a distinct regional voice that emphasises voluntary cooperation rather than strict uniform rules.

Artificial intelligence is not advancing in a legal vacuum. In reality, it is advancing in defiance of rules that were never built to contain it. Governments are scrambling to retrofit protections, yet corporations exploit loopholes faster than regulators can respond. The result is a precarious bargain with public trust.

We welcome your reflections and experiences on these developments. Reply to this newsletter or leave a comment. Your perspective will help sharpen the debates that matter most.

If you think your boss tracking your bathroom breaks is about productivity, think again. Digital surveillance in the workplace has become a tool of control, not efficiency. Surveillance may be seen as an institutionalised distrust masquerading as digital progress. Employers are watching, but who is watching them?

Share

In this newsletter, we discuss:

1. Workplace surveillance tech, often without employees knowing, and why it is being normalised across industries without legal clarity or consent.

2. How global legal systems, especially European courts, are assessing employee privacy; explaining what is legal, what is not, and where employers are walking dangerously close to the edge.

3. The difference between monitoring and surveillance, and why confusing the two lets employers justify intrusive practices that treat workers more like data points than human beings.

4. What landmark cases like Köpke, Copland, and Bărbulescu reveal about the balance of power in the workplace.

5. Actionable principles for ethical monitoring: what responsible employers should do, what employees must know, and why protecting privacy is not just a legal issue, but a human one.

Employee Monitoring and Digital Surveillance

The paper by Olena Y. Lutsenko, Dmytro A. Hryhorenko and their colleagues scrutinizes the relationship between management, technology and personal dignity.

The paper discusses the tension between the promise of efficiency and the right to be left alone. The authors begin by reminding readers that the practice of watching workers did not spring from the use of modern computers.

They trace a lineage from eighteenth‑century factory designs through Marx and Weber to the digital workplace, showing that control has always been part of the employment relationship.

This historical prelude sets the tone for the research that is both critical of intrusive practices and aware that some degree of oversight is necessary.

The abstract situates the article in the present, noting that employee monitoring has become increasingly important as digital innovation expands the range of tools that can collect and analyse data.

Remote work, the COVID‑19 pandemic and the ubiquity of machine learning algorithms have dramatically accelerated this trend.

What follows is not a descriptive catalogue but an attempt to chart a middle course between security and privacy.

The authors propose a “balanced approach” that protects personal data without undermining productivity or organisational interests, and they weave that theme through every section of the paper.

To support their argument the authors rely on a comparative methodology, regulatory analysis and predictive reasoning.

By comparing decisions from the European Court of Human Rights to international instruments and domestic laws they identify trends across jurisdictions.

Subscribe now

One of the paper’s central contributions is its clear distinction between surveillance and monitoring.

Surveillance is described as the systematic collection and analysis of information with the aim of influencing those being watched. Monitoring, by contrast, is portrayed as a methodical process embedded in human‑resources management, involving the collection and analysis of data about workers in order to manage performance, ensure safety and promote compliance with company policies.

It is more holistic than mere observation because it involves real‑time responses and is integrated into broader management processes.

By drawing this distinction, the authors show that the mere act of collecting data is not the same as using that data to shape behaviour and that the latter raises distinct ethical and legal questions.

The discussion of monitoring technologies is particularly vivid.

Readers are walked through video surveillance, email and internet monitoring, GPS tracking and biometric access controls.

The paper explains how machine‑learning‑driven behavioural analysis can flag anomalies such as an employee logging in at unusual hours, sending alerts to management and enabling swift intervention.

While such tools can boost productivity and protect assets, they come at a cost to privacy.

The authors do not shy away from the advantages either. They note that systematic monitoring may lead to fairer evaluations and can detect safety hazards early.

Nevertheless, the table of “Advantages and disadvantages” reveals a sobering picture: surveillance can violate personal rights, create stress and erode trust.

For many workers, the feeling of being constantly watched is itself a harm, leading to demotivation and a deterioration of corporate culture.

Here the authors’ balanced approach is evident. They acknowledge the organisational benefits but insist that these must be weighed against human costs.

The authors situate monitoring within international law, starting with Article 12 of the Universal Declaration of Human Rights and Article 17 of the International Covenant on Civil and Political Rights, which prohibit arbitrary interference with privacy.

They explain that these broad guarantees have been translated into more specific rules on data protection, notably the EU General Data Protection Regulation (GDPR), which obliges employers to inform individuals about monitoring and to justify such processing.

The GDPR, along with the e‑Privacy Directive and the Council of Europe’s Convention 108 on automated data processing, sets out requirements such as data minimisation, purpose limitation and security of processing.

The authors emphasise that these instruments have a harmonising effect, encouraging consistent standards across jurisdictions while still allowing national variations.

By showing how local rules fit into a global network of norms, they offer a roadmap for organisations operating across borders.

Case law from the European Court of Human Rights adds nuance to this legal picture. The Köpke v. Germany case involved covert video surveillance of a supermarket cashier suspected of theft.

The court considered the absence of prior notification and the broad dissemination of the footage and concluded that such measures might infringe the right to private life if not strictly necessary.

Even though the court ultimately allowed the surveillance because the employer’s property interests and the administration of justice were at stake, it warned that newer technologies might require a different balance in the future.

In Copland v. the United Kingdom the court condemned the monitoring of an employee’s telephone calls, emails and internet use because there were no clear legal safeguards and the employee had not been informed.

The judgment demonstrated that workers must be told about monitoring measures and that adequate protections against misuse must exist.

Finally, the Bărbulescu v. Romania case dealt with a firm that monitored an engineer’s Yahoo Messenger communications.

The Grand Chamber held that the employee’s privacy had been violated because he had not been given sufficient notice and the monitoring was not limited to what was necessary.

The court distilled the elements of transparency, information, limitation, proportionality and necessity, establishing a framework that any employer wishing to monitor must respect.

The paper stresses that adherence to these principles is not only a legal obligation but also essential for building trust.

Employers who respect these guidelines are more likely to foster a workplace where security and productivity coexist with respect for personal dignity.

The later sections explore the theoretical and practical challenges of balancing data security with privacy.

The authors describe privacy as an inalienable right that must be preserved even as businesses adopt tools such as artificial intelligence, the Internet of Things, biometric authentication and cloud computing.

They note that while these technologies can streamline processes and improve safety, they also raise the spectre of biased algorithmic decisions and the invisible collection of personal data.

Legal frameworks must therefore be adaptive and flexible, capable of keeping pace with innovation without compromising basic freedoms.

Ethical approaches should reinforce notions of dignity and autonomy, ensuring that employees are treated as individuals rather than data points.

Technological solutions, such as encryption and anonymisation, can mitigate risks but only if organisations commit to using them.

In the discussion, the authors situate their work within broader scholarship.

They draw on a comprehensive literature review from the EU that catalogues the psychological and organisational impacts of monitoring and highlights its potential to reduce job satisfaction and increase stress.

According to the authors, studies shows that remote employees experience higher levels of monitoring and that poorly designed systems can hinder rather than help performance.

The paper paints a rich picture of a field in flux, driven by globalisation and rapid technological change.

The authors observe that efforts to harmonise data protection law are complicated by differing cultural attitudes toward privacy.

They predict that regulation will grow more complex as technology develops, and they call for innovation in both policy and practice to meet these challenges.

Subscribe now

The conclusion reinforces the idea that monitoring and surveillance are not interchangeable and that careful differentiation is essential.

Monitoring may enhance efficiency and safety, but it can also create stress and erode trust.

Organisations are urged to develop clear policies, inform workers about data collection and use, limit data gathering to legitimate purposes and invest in security technologies.

Employees, in turn, are encouraged to familiarise themselves with monitoring policies, secure their own devices and protect their information.

The paper ultimately argues that the coexistence of security and privacy is possible when both sides embrace transparency, fairness and accountability.

That vision is encapsulated in the authors’ call for mutual respect and cooperation.

When employers and employees work together, data security and privacy rights can be safeguarded, creating workplaces that are both efficient and humane.

TL;DL

1. Employee monitoring is no longer just a managerial tool. It is now deeply embedded in digital systems, raising serious questions about privacy, ethics, and legality. Surveillance technologies increasingly blur the line between performance assessment and personal intrusion.

2. Legal frameworks like the GDPR and rulings from the European Court of Human Rights require that monitoring be proportionate, transparent, and respectful of workers’ rights. Yet, many employers implement invasive practices with little regard for consent, fairness, or the right to privacy.

3. The article highlights case law such as Köpke v. Germany and Bărbulescu v. Romania, which clarify when and how surveillance crosses legal boundaries. Monitoring is not prohibited but must follow the correct safeguards to avoid violating employee dignity and data protection laws.

4. To strike a fair balance, companies must set clear policies, minimise data collection, and respect employee feedback. Workers, meanwhile, must stay informed and protect their own data. Ethical monitoring is necessary to preserve trust in digital workplaces.

What is your take on workplace digital surveillance? Is it a necessary oversight or overreach? Reply to this newsletter with your thoughts and experiences.

Dark web monitoring is praised as a powerful tool for uncovering cyber threats, yet it walks a fine line with the law. Some techniques risk breaching privacy rules or crossing into illegal territory. This editorial explores the legal boundaries that everyone should know.

Share

In this newsletter editorial, we will cover:

1. The hidden legal traps of dark web monitoring: From GDPR pitfalls to the Computer Misuse Act, discover the laws that could turn a well-meaning cybersecurity scan into a costly legal nightmare.

2. How law enforcement monitors the dark web: Explore the Investigatory Powers Act, surveillance warrants, and global treaties like the Budapest Convention that govern dark web intelligence across borders.

3. When intelligence gathering becomes illegal: Learn the fine line between proactive cyber defence and unauthorised access, and how crossing it could invite criminal charges or regulatory sanctions.

4. Enforcement trends: Recent investigations, prosecutions, and corporate missteps to understand how regulators and courts are applying the rules for cyber threat intelligence in 2025.

5. A compliance-first strategy for tech professionals: Gain actionable steps, risk-mitigation tactics, and governance frameworks to legally conduct dark web monitoring while protecting your organisation’s reputation and avoiding legal problems.

Dark Web Monitoring

Dark web monitoring is sold as cybersecurity’s secret weapon, yet too often it tiptoes past legality, blurring the line between protection and prosecution in ways few dare to admit.

In the mid‑1990s, researchers working for the U.S. Naval Research Laboratory developed The Onion Router (Tor) to conceal the routing of sensitive communications.

When Tor was released to the public, a subterranean layer of the Internet, now known as the dark web, began to flourish.

The dark web consists of services reachable only through specialised tools such as Tor or I2P and is intentionally hidden from search engines.

Simply accessing the dark web is not illegal; however, activities such as trading stolen credit card numbers or purchasing weapons can lead to criminal prosecution.

Despite its notoriety, the dark web also serves legitimate purposes: it provides safe channels for journalists and whistleblowers operating under repressive regimes and enables privacy-centric communications.

When organisations seek to protect their brands, customers and intellectual property, they can invest in dark web monitoring.

Tools and services scan hidden forums, marketplaces and chat rooms for stolen credentials, leaked data and chatter about upcoming exploits.

Yet, the very act of monitoring these spaces raises questions about privacy, unauthorised access and cross‑border surveillance.

This newsletter editorial explores the legal boundaries of dark web monitoring in 2025.

Drawing on UK, U.S. and international frameworks, it surveys the relevant legislation, highlights legal and ethical challenges and offers practical guidance for compliance and risk management.

The Case for Dark Web Monitoring

Modern enterprises face relentless cyber threats. Data breaches frequently surface first on the dark web, where criminals sell stolen credentials, compromised databases or pre‑built malware kits.

Dark web monitoring helps organisations detect breaches early, mitigate risks, protect brand integrity and ensure compliance with regulations like GDPR.

Dark web monitoring aims to reduce the time between breach and discovery.

A structured monitoring process involves identifying assets, choosing the right tools, mapping relevant sources, collecting data, matching patterns, validating authenticity and issuing real‑time alerts.

Continuous monitoring integrates these insights into a broader cybersecurity strategy and includes employee training and periodic reviews.

The business case is clear: early intelligence can prevent or limit financial loss, reputational damage and regulatory penalties.

However, it is important to emphasise that dark web monitoring should never justify illegal activities.

Subscribe now

Privacy and Data Protection

GDPR, POPIA and HIPAA

Privacy laws form the first legal boundary for dark web monitoring. The General Data Protection Regulation (GDPR) in the EU (retained in UK law post‑Brexit) and similar frameworks, such as South Africa’s Protection of Personal Information Act (POPIA) and the U.S. Health Insurance Portability and Accountability Act (HIPAA), impose strict obligations on organisations that process personal data.

Dark web monitoring should be conducted in a way that respects these regulations and ensures that personally identifiable information (PII) is handled appropriately.

In practice, this means identifying a lawful basis for processing (e.g., legitimate interest in protecting systems), minimising the amount of data collected, anonymising where possible and implementing robust data‑retention policies.

Under GDPR, organisations must also provide transparency about data processing and offer data subjects certain rights, including the right to access, rectify or erase their data.

While the dark web often contains illegally obtained PII, processing such information to alert customers or revoke credentials may be justified under the vital interests or legitimate interests grounds.

However, storing or disseminating the data beyond what is necessary could lead to heavy penalties.

POPIA and HIPAA impose similar obligations.

Health‑care providers using dark web monitoring to detect stolen patient records must handle any recovered data in accordance with HIPAA’s privacy and security rules.

They may also be required to notify affected individuals and regulators under U.S. state breach notification laws.

Data Retention and Bulk Personal Datasets

The Investigatory Powers Act 2016 (IPA) in the UK provides a statutory framework for data retention and surveillance.

Recent independent reviews propose creating a light‑touch regulatory regime for the retention and examination of bulk personal datasets (BPDs) where individuals have a low expectation of privacy.

The review recommends that placing datasets into the low/no privacy category should require approval by an independent Judicial Commissioner.

Another proposal involves amending the use of Internet Connection Records (ICRs) to facilitate target discovery.

These discussions illustrate that even governments must balance surveillance powers with oversight and privacy safeguards.

For private organisations, they highlight the importance of minimising data collection and obtaining clear authorisation when dealing with bulk datasets.

Unauthorised Access and Computer Misuse

Computer Misuse Act 1990 (UK)

The Computer Misuse Act 1990 (CMA) criminalises unauthorised access to computer systems.

The CMA, introduced after a high‑profile hacking case, has been amended several times but its core offences remain:

Section 1 is broad: it criminalises any attempt or achievement of access when the actor knows it is unauthorised.

This includes using another person’s credentials or exploring parts of a system without proper authority.

Because dark web monitoring often involves accessing closed forums or markets, organisations must ensure they do not violate this law.

For example, creating or buying fraudulent accounts to infiltrate a criminal marketplace could be deemed unauthorised access.

Similarly, scraping data behind loginwalls may be illegal if the terms of service prohibit such access.

Computer Fraud and Abuse Act (U.S.)

The Computer Fraud and Abuse Act (CFAA) (18 U.S.C. § 1030) is the primary federal statute governing unauthorised computer access in the United States.

Enacted in 1986 and amended multiple times, the CFAA criminalises a variety of actions, including:

• Intentionally accessing a computer without authorisation or exceeding authorised access and obtaining information from a financial institution or government computer.

• Knowingly causing the transmission of code that damages a protected computer.

• Trafficking in passwords or similar items that facilitate unauthorised access.

• Extorting money by threatening to damage or obtain information from a computer.

The law originally applied to so‑called protected computers (e.g., government or financial institution systems), but amendments have expanded its scope so broadly that it now covers any computer used in or affecting interstate commerce.

The CFAA has been criticised for its vague definition of “unauthorised access,” but a 2021 Supreme Court decision (Van Buren v. United States) adopted a narrower interpretation, making it harder to criminalise violations of terms of service alone.

Nonetheless, organisations conducting dark web monitoring must avoid intentionally accessing non‑public computers without permission.

Criminalising Tools and Services

Both the CMA and CFAA have provisions that criminalise the distribution of tools or services designed for computer misuse.

Section 3A of the CMA (added by the Police and Justice Act 2006) targets those who make, supply or obtain articles for use in computer misuse offences.

Under the CFAA, trafficking in passwords or tools facilitating unauthorised access is illegal.

Companies should therefore evaluate their monitoring tools to ensure they are not inadvertently distributing or using illegal hacking utilities.

Surveillance and Intelligence Gathering

Investigatory Powers Act 2016 (UK)

The Investigatory Powers Act 2016 (IPA), sometimes dubbed the Snoopers’ Charter, consolidates and expands the surveillance powers of UK intelligence agencies and law enforcement.

It authorises the interception of communications, equipment interference (hacking), the acquisition and retention of communications data and bulk personal datasets.

The IPA allows the government to require service providers to intercept communications or retain data, effectively compelling private companies to assist surveillance.

Powers may only be exercised with a warrant approved by a Judicial Commissioner, but critics argue the criteria for warrants are subjective and enable mass surveillance.

Subscribe now

Under the IPA, several authorities, including the Metropolitan Police, GCHQ, HM Revenue & Customs, the Financial Conduct Authority and the Serious Fraud Office, can access internet connection records (metadata showing which services an individual has connected to) without a warrant.

Therefore, this means that dark web monitoring can sometimes intersect with government surveillance.

While companies cannot lawfully perform targeted interception without a warrant, they may receive data or requests from authorities.

Cooperation with law enforcement should be handled carefully, ensuring that any disclosure complies with data protection laws and court orders.

U.S. Surveillance and Electronic Communications

In the U.S., surveillance law is governed by a patchwork of statutes, including the Electronic Communications Privacy Act (ECPA), the Foreign Intelligence Surveillance Act (FISA) and various state wiretap laws.

These laws regulate when government agencies can intercept communications, place restrictions on private interception and set standards for data retention.

Unlike the IPA, there is no single statute authorising broad bulk data collection.

However, under FISA and its amendments (e.g., Section 702), intelligence agencies may collect foreign communications data with assistance from service providers.

Organisations must be cautious not to engage in surveillance that could violate these laws; unauthorised interception of communications can result in civil and criminal liability.

Ethical and Operational Boundaries

Dark web monitoring must avoid entrapment, unauthorised access or interactions that could breach ethical boundaries.

Ethical considerations are just as important as legal compliance.

The following principles can help organisations set ethical boundaries:

1. Purpose limitation – Monitor only for clearly defined security purposes; avoid curiosity‑driven exploration of illicit content.

2. Minimisation – Collect the minimal amount of data needed to achieve the purpose and discard irrelevant information quickly.

3. Non‑intrusion – Do not facilitate or encourage illegal transactions or participate in activities that could constitute entrapment or provocation.

4. Transparency and oversight – Document monitoring activities, involve legal counsel and make sure senior leadership understands the methods and risks.

5. Security – Protect any data obtained from the dark web using strong technical controls and limit access to need‑to‑know personnel.

Authorisation and Consent

Before engaging in dark web monitoring, organisations should consider obtaining legal authorisation or consent.

Unauthorised access to certain areas of the dark web may violate laws and that obtaining explicit permission is crucial.

Authorisation may come in several forms:

• Terms of service – Some platforms allow research or monitoring if users agree to abide by certain rules. Review the terms before engaging.

• Client consent – If monitoring involves customer data (e.g., scanning for leaked employee credentials), obtain explicit consent through contractual clauses or privacy policies.

• Law enforcement coordination – Work with authorities to ensure monitoring efforts do not impede investigations or cross legal lines.

Note that many dark web marketplaces are criminal enterprises. Seeking consent from site operators is neither feasible nor desirable.

Instead, organisations should focus on ensuring that their own methods (e.g., using open search tools or threat‑intelligence feeds) do not involve unauthorised access.

Cross‑Border Challenges and International Cooperation

The dark web is not bound by national borders; servers and users may be located anywhere.

Cross‑border investigations therefore require cooperation between jurisdictions. The Budapest Convention on Cybercrime is the first international treaty addressing cybercrime.

It aims to harmonise national laws, improve investigative techniques and increase cooperation among nations.

As of June 2025, 80 states have ratified the Budapest Convention, while others (including India and South Africa) have signed but not ratified it.

Therefore, evidence or intelligence may need to be shared with foreign law enforcement under Mutual Legal Assistance Treaties (MLATs).

Companies should ensure their monitoring activities comply with the laws of the jurisdictions in which they operate and where data is processed.

Different countries may restrict the use of anonymity tools or regulate encryption.

For instance, Russia and Iran have pressured ISPs to block the Tor network, while the United States has generally allowed Tor use.

China’s “Great Firewall” similarly blocks Tor relays.

Organisations with global operations must be aware of local restrictions and adapt their monitoring accordingly.

Incident Response and Notification Obligations

Dark web monitoring is part of a broader incident‑response strategy.

When a company discovers stolen credentials or confidential data on the dark web, it must act swiftly to mitigate harm.

Key steps include:

1. Validate the data – Ensure the leaked information is authentic and relevant.

2. Assess risk – Determine the potential impact of the leak on financial, operational and reputational aspects.

3. Contain and remediate – Reset compromised accounts, patch vulnerabilities, notify affected third parties and remove malicious listings. Real‑time alerts are essential.

4. Notify authorities and affected individuals – Under GDPR, HIPAA and many state breach‑notification laws, organisations must report breaches to regulators and notify individuals if there is a risk of harm.

5. Document and improve – Record actions taken, evaluate what went wrong and refine monitoring and security procedures.

Organisations should also consider cyber‑insurance coverage.

Policies often cover incident‑response costs and legal liabilities but may exclude events arising from certain unauthorised monitoring practices.

Reviewing policy exclusions in light of dark web monitoring is prudent.

Emerging Trends and Future Regulations (2025 and Beyond)

AI and Automated Threat Intelligence

Artificial intelligence is transforming cyber threat intelligence. Machine learning algorithms can sift through vast amounts of dark web data, identify patterns and even predict emerging threats.

However, AI introduces new legal questions.

Training models on illicitly obtained data could raise privacy issues under GDPR.

Moreover, using AI to interact autonomously with forums may blur the line between passive monitoring and active engagement.

Future regulations may address how AI tools may be used for threat intelligence and the accountability of decisions made by algorithms.

Post‑Quantum Encryption and Quantum Threats

Quantum computing promises to break many of today’s encryption schemes. As a result, there is growing interest in post‑quantum encryption.

Dark web actors may exploit quantum techniques sooner than expected to enhance anonymity or crack stolen data.

Regulatory bodies are beginning to discuss standards for post‑quantum encryption, and companies should monitor these developments.

Amendments to Surveillance Laws

The Investigatory Powers (Amendment) Act 2024 reflects ongoing efforts to refine UK surveillance law.

Independent reviews (such as the Anderson Report) suggest further reforms to create agility for intelligence agencies and law enforcement, including new regimes for bulk personal datasets and improved definitions of internet connection records.

Similar debates are happening in the U.S., where reauthorisation of Section 702 of FISA and proposals to limit data brokers are central topics in 2025.

These changes will affect how private companies cooperate with authorities and may impose new compliance requirements.

Global Data‑Transfer Restrictions

Cross‑border data flows are under increased scrutiny. The U.S. and EU recently adopted new data-transfer frameworks (e.g., the EU–U.S. Data Privacy Framework), but these face court challenges.

Simultaneously, Executive Order 14117 (February 2024) prohibits certain transfers of Americans’ bulk sensitive personal data to countries of concern and may require companies to vet foreign partners.

Dark web monitoring providers should watch these developments because sending threat intelligence abroad could trigger export controls or data‑localisation rules.

Leave a comment

What challenges or questions do you face in this dark web monitoring space? Share your thoughts, experiences, or insights.