We have now seen several instances where credible voices have expressed serious doubts about AI safety. In a recent statement, Anthropic said that it stopped AI potentially developing bioweapons. Insiders at Anthropic warned that tech advancement could cause human extinction. US government adviser and OpenAI board member, Paul Christiano, recently warned that OpenAI is not on track to reduce the risk of “catastrophic” loss of control to an acceptable level.

Anyone who has sat through a compliance planning meeting in the last two years will recognise the moment. Someone puts up a slide with the AI Act, NIS2 and the DSA in three columns, points to the words that appear in all three — risk assessment, governance, documentation, monitoring, supplier oversight — and asks the obvious question: surely we only have to do this once?

I have spent 25 years teaching in legal academia. Having completed my PhD in Cambridge, I have gone through all the usual steps (junior lecturer, associate professor, professor…) I have been lucky to have taught at Copenhagen Business School for the majority of my time as a teacher, an experience that kept me firmly grounded in reality, always asking how what I teach is relevant for the businesses and the public sector.

European lawmakers are rarely accused of ignorance in so many words. Parliamentary records reveal competing policy objectives, contested trade-offs and hard-fought compromises - not admissions that nobody in the room understood how the technology actually worked. And yet a review of two decades of EU digital legislation suggests that some of the most consequential failures of European internet policy were not failures of ambition or of values, but failures of technical modelling.

On 3 June 2026 the Commission unveiled the European Technological Sovereignty Package. The political framing was familiar — President von der Leyen's line that "we cannot afford to depend on others for the technologies that keep our hospitals running" could have come from any of the last five State of the Union addresses. The legal content is not familiar at all.

The EU AI Act is often described as a risk-based regulatory framework. That description is accurate, but incomplete. The real issue is not that the Act neglects risk. If anything, it does the opposite: risk is everywhere. It structures obligations, determines system classification, and anchors compliance duties. The entire architecture assumes that risk can be systematically identified, assessed, mitigated, and documented.

Modern AI models like “Mythos” – powerful generative systems effective at hacking – pose new cybersecurity challenges. Putting aside the rumours that dramatic announcements may be just a PR stunt, it seems that these systems are no longer just “risky” but truly dangerous. Mythos-like models can autonomously find software vulnerabilities, craft exploits, and even write malware or spear-phishing content.

The 2026 AI Index Report opens with a stark observation: artificial intelligence is advancing faster than the systems designed to govern it. This widening gap—between capability and control frames the global regulatory debate. Nowhere is that debate more developed than in the European Union, which has positioned itself as the leading jurisdiction for AI governance through the AI Act and its broader digital regulatory ecosystem.

The release of the National Policy Framework for Artificial Intelligence: Legislative Recommendations marks a significant evolution of the Trump administration’s digital strategy. When read alongside the earlier Cyber Strategy for America (see our blog post here), what emerges is no longer a set of parallel initiatives, but a coherent, if controversial, model of digital governance. If the cyber strategy articulated a doctrine of power, the AI framework provides its regulatory corollary.

The publication of Trump’s Cyber Strategy for America (March 2026) marks a decisive return to a muscular, sovereignty-driven conception of cybersecurity and technological power. The document is rhetorically forceful, strategically expansive, and explicitly geopolitical. It situates cyberspace not merely as an operational domain but as a theatre of ideological, economic, and military contestation. From a European Union perspective - particularly in light of the NIS2 Directive, the Cyber Resilience Act, the Digital Services Act (DSA), the Digital Markets Act (DMA), and the AI Act - the strategy presents serious normative divergences.

The European Commission’s Digital Omnibus package, published on 19 November 2025, has been described alternately as simplification, deregulation, and strategic recalibration. A recent European Parliament study, A Digital Omnibus: Identifying Interlinks and Possible Overlaps Between Different Legal Acts in the Field of Digital Legislation to Streamline Tech Rules, offers a detailed mapping of what is actually happening beneath the rhetoric.

The newly proposed Digital Networks Act (DNA), which I briefly covered in this blog post, has raised concerns that it negatively impacts net neutrality. It does not. I will briefly try to explain why in some fairly simple steps. 1) Net neutrality, in its simplest form, is the claim that ISPs ought to treat all internet traffic equally, without throttling some, prioritising other, etc.

On 21 January 2026, the European Commission tabled its proposal for a Digital Networks Act (DNA)—a sweeping reform of EU electronic communications law intended to complete the single market for connectivity, accelerate the transition to fibre and advanced wireless networks, and strengthen Europe’s strategic autonomy in digital infrastructure. If adopted, the DNA would repeal and replace the European Electronic Communications Code (

In January 2026, the European Commission presented its proposal for a revised Cybersecurity Act—commonly referred to as Cybersecurity Act 2 (CSA2). The proposal would repeal the previous Cybersecurity Act (Regulation (EU) 2019/881) and substantially redesign the Union’s approach to cybersecurity governance, certification, and ICT supply chain security. CSA2 should not be read as a mere technical update. It reflects a decisive shift in how the European Union conceptualises cybersecurity risk: …

Intro On January 7 ChatGPT announced its ChatGPT Health Service - “a dedicated experience in ChatGPT designed for health and wellness.” The service, which is not yet available in the EU, is meant to: securely connect medical records and wellness apps—like Apple Health, Function, and MyFitnessPal—so ChatGPT can help you understand recent test results, prepare for appointments with your doctor, get advice on how to approach your diet and workout routine, or understand the tradeoffs of different insurance options based on your healthcare patterns.

Europe’s digital regulatory environment is undergoing its most ambitious streamlining effort to date. We have already written in this blog about the first leaked draft of the data reform and the AI part of the Omnibus (see here and here). On 19 November 2025, the European Commission unveiled the full Digital Omnibus proposal, relating to streamlining the data protection part of legislation.

On November 19, 2025, the European Commission published a substantial proposal to adjust and streamline the implementation of the EU Artificial Intelligence Act (AI Act). Known as the Digital Omnibus on AI, this new regulation does not rewrite the AI Act, but it carefully “rebalances the machinery” behind it. Its mission is clear: reduce administrative burdens, accelerate compliance, and ensure that the EU’s landmark AI law is applied in a way that is proportionate, innovation-friendly, and feasible for industry and national authorities alike.

The European Commission’s leaked “Digital Omnibus” proposal — an internal draft of amendments to the GDPR and ePrivacy Directive — signals the most significant shake-up of Europe’s data protection framework since 2018. While framed as a “technical alignment” exercise, the proposed revisions could fundamentally weaken core GDPR principles, narrow data subject rights, and carve out broad exceptions for AI development and commercial data use.

Note: This is a very brief summary of some of the findings of the research project funded by Independent Research Fund Denmark entitled "The Data Driven Home: A Study of the Socio-Material and Legal Construction of the 21st Century Home." A full open-access article which Martin Friis Nielsen and myself have published in Information & Communications Technology Law is available…

The advent of generative AI raises profound questions about the ownership not only of data but also of data sets. European law has, in the main, sough…

‘Already after reading the Preface it is apparent how profound the insights of Savin are in the area of internet law. The richness is continued in the remainder of the book that covers all main areas ...

The Irish Data Protection Commission has today announced its final decision following an Inquiry into TikTok Technology Limited (“TikTok”).

The AI Act imposes unprecedented regulatory challenges on all categories of market actors. How the Act will affect companies depends on a number of factors including entity type, system modifications,...

The highly anticipated penalties are the first to be issued under the bloc’s Digital Markets Act.

Today, the European Commission sent two sets of preliminary findings to Alphabet for failing to comply with the Digital Markets Act (DMA), regarding two services for which it has been designated as a

Sen. Ron Wyden on the birth of a foundational speech law.

The Thomson Reuters decision has big implications for the battle between generative AI companies and rights holders.

Trump's VP on Tuesday warned global leaders and tech industry executives that too much control could cripple the rapidly growing artificial intelligence industry in a rebuke to European efforts to cur...

The secret order would give the UK access to encrypted backups belonging to any user — not just Brits.

Abstract: The advent of generative AI raises profound questions about the ownership not only of data but also of data sets. European law has, in the main, sough

Behind the alignment of X and Meta with Trump is a cold business logic — and a position of weakness rather than strength

I commented yesterday on how Elon Musk’s many questionable tweets become a problem when X’s algorithmic practices violate the EU Digital Services Act (DSA)’s obligations on risk identification and mitigation. The ink had barely dried before Meta announced that “starting in the US”, they will be ending their third-party fact-checking program and moving to an X-style “Community Notes”. Instead of independent fact-checkers, Meta will rely on a user-driven alert system where “the community” will decide what gets upvoted.

Lots of ink is spilled these days commenting Elon Musk’s posts on X on a variety of topics ranging from German elections to Denmark’s governance of Greenland. The question which poses itself is whether EU digital laws can be used to limit Musk’s interventions, which are perceived as being extremely right-wing and harmful to democratic processes in the EU. While EU position on free speech is significantly…

WhatsApp celebrates victory as judge finds Israeli company NSO Group violated state and federal US hacking laws

Tim Bernard is reading a selection of the Very Large Online Platform (VLOP) systemic risk assessments released in late November 2024.

By end of next year, the AI Office Units A2 and A3 should count over 200 staff, Axel Voss writes.

Trying to avoid antitrust suits, Google systematically told employees to destroy messages, avoid certain words and copy the lawyers as often as possible.

We will significantly reduce the price of Subscription for no ads, and offer people in the EU an additional new choice to use Facebook and Instagram for free with less personalized ads.

Podcast Episode · Better Offline · 13/11/2024 · 54m