Towards a Different Taxonomy of Legal Knowledge – Why Legal Education Still Looks Like the Nineteenth Century

I have spent 25 years teaching in legal academia. Having completed my PhD in Cambridge, I have gone through all the usual steps (junior lecturer, associate professor, professor…) I have been lucky to have taught at Copenhagen Business School for the majority of my time as a teacher, an experience that kept me firmly grounded in reality, always asking how what I teach is relevant for the businesses and the public sector.

euinternetpolicy.wordpress.com

The Proxy Problem: Why Risk-Based Regulation Demands More Technology Knowledge, Not Less

European lawmakers are rarely accused of ignorance in so many words. Parliamentary records reveal competing policy objectives, contested trade-offs and hard-fought compromises - not admissions that nobody in the room understood how the technology actually worked. And yet a review of two decades of EU digital legislation suggests that some of the most consequential failures of European internet policy were not failures of ambition or of values, but failures of technical modelling.

euinternetpolicy.wordpress.com

Operationalising Digital Sovereignty in the EU: When Sovereignty Becomes a Legal Category

On 3 June 2026 the Commission unveiled the European Technological Sovereignty Package. The political framing was familiar — President von der Leyen's line that "we cannot afford to depend on others for the technologies that keep our hospitals running" could have come from any of the last five State of the Union addresses. The legal content is not familiar at all.

euinternetpolicy.wordpress.com

The AI Act’s Blind Spot: When Risk Becomes Guesswork

The EU AI Act is often described as a risk-based regulatory framework. That description is accurate, but incomplete. The real issue is not that the Act neglects risk. If anything, it does the opposite: risk is everywhere. It structures obligations, determines system classification, and anchors compliance duties. The entire architecture assumes that risk can be systematically identified, assessed, mitigated, and documented.

euinternetpolicy.wordpress.com

When AI Automates Hacking – Mythos, EU Cybersecurity Laws and Dangerous AI Models

Modern AI models like “Mythos” – powerful generative systems effective at hacking – pose new cybersecurity challenges. Putting aside the rumours that dramatic announcements may be just a PR stunt, it seems that these systems are no longer just “risky” but truly dangerous. Mythos-like models can autonomously find software vulnerabilities, craft exploits, and even write malware or spear-phishing content.

euinternetpolicy.wordpress.com

Regulating the AI Boom: Is the EU Getting It Right?

The 2026 AI Index Report opens with a stark observation: artificial intelligence is advancing faster than the systems designed to govern it. This widening gap—between capability and control frames the global regulatory debate. Nowhere is that debate more developed than in the European Union, which has positioned itself as the leading jurisdiction for AI governance through the AI Act and its broader digital regulatory ecosystem.

euinternetpolicy.wordpress.com

From Cyber Power to Regulatory Minimalism: The Consolidation of “America First” in AI and Cyberspace: An EU perspective on the second phase of the Trump administration’s digital strategy

The release of the National Policy Framework for Artificial Intelligence: Legislative Recommendations marks a significant evolution of the Trump administration’s digital strategy. When read alongside the earlier Cyber Strategy for America (see our blog post here), what emerges is no longer a set of parallel initiatives, but a coherent, if controversial, model of digital governance. If the cyber strategy articulated a doctrine of power, the AI framework provides its regulatory corollary.

euinternetpolicy.wordpress.com

America First in Cyberspace: An EU Perspective on Trump’s 2026 Cyber Strategy

The publication of Trump’s Cyber Strategy for America (March 2026) marks a decisive return to a muscular, sovereignty-driven conception of cybersecurity and technological power. The document is rhetorically forceful, strategically expansive, and explicitly geopolitical. It situates cyberspace not merely as an operational domain but as a theatre of ideological, economic, and military contestation. From a European Union perspective - particularly in light of the NIS2 Directive, the Cyber Resilience Act, the Digital Services Act (DSA), the Digital Markets Act (DMA), and the AI Act - the strategy presents serious normative divergences.

euinternetpolicy.wordpress.com

The EU’s Digital Omnibus and the Promise of Compliance Synergies

The European Commission’s Digital Omnibus package, published on 19 November 2025, has been described alternately as simplification, deregulation, and strategic recalibration. A recent European Parliament study, A Digital Omnibus: Identifying Interlinks and Possible Overlaps Between Different Legal Acts in the Field of Digital Legislation to Streamline Tech Rules, offers a detailed mapping of what is actually happening beneath the rhetoric.

euinternetpolicy.wordpress.com

Digital Networks Act: Misconceptions about Net Neutrality Explained

The newly proposed Digital Networks Act (DNA), which I briefly covered in this blog post, has raised concerns that it negatively impacts net neutrality. It does not. I will briefly try to explain why in some fairly simple steps. 1) Net neutrality, in its simplest form, is the claim that ISPs ought to treat all internet traffic equally, without throttling some, prioritising other, etc.

euinternetpolicy.wordpress.com

The Digital Networks Act: Is Europe’s Reset Ambitious Enough?

On 21 January 2026, the European Commission tabled its proposal for a Digital Networks Act (DNA)—a sweeping reform of EU electronic communications law intended to complete the single market for connectivity, accelerate the transition to fibre and advanced wireless networks, and strengthen Europe’s strategic autonomy in digital infrastructure. If adopted, the DNA would repeal and replace the European Electronic Communications Code (

euinternetpolicy.wordpress.com

Cybersecurity Act 2: Towards a Systemic, Geopolitical, and Supply-chain–oriented Understanding of Cyber Risk in the EU’s Next Cybersecurity Framework

In January 2026, the European Commission presented its proposal for a revised Cybersecurity Act—commonly referred to as Cybersecurity Act 2 (CSA2). The proposal would repeal the previous Cybersecurity Act (Regulation (EU) 2019/881) and substantially redesign the Union’s approach to cybersecurity governance, certification, and ICT supply chain security. CSA2 should not be read as a mere technical update. It reflects a decisive shift in how the European Union conceptualises cybersecurity risk: …

euinternetpolicy.wordpress.com

Understanding ChatGPT Health: GDPR Compliance and AI Implications

Intro On January 7 ChatGPT announced its ChatGPT Health Service - “a dedicated experience in ChatGPT designed for health and wellness.” The service, which is not yet available in the EU, is meant to: securely connect medical records and wellness apps—like Apple Health, Function, and MyFitnessPal—so ChatGPT can help you understand recent test results, prepare for appointments with your doctor, get advice on how to approach your diet and workout routine, or understand the tradeoffs of different insurance options based on your healthcare patterns.

euinternetpolicy.wordpress.com

The EU’s Digital Omnibus: A Reversal of EU Data Protections

Europe’s digital regulatory environment is undergoing its most ambitious streamlining effort to date. We have already written in this blog about the first leaked draft of the data reform and the AI part of the Omnibus (see here and here). On 19 November 2025, the European Commission unveiled the full Digital Omnibus proposal, relating to streamlining the data protection part of legislation.

euinternetpolicy.wordpress.com

The EU’s Digital Omnibus on AI: A New Phase of Simplification for the AI Act

On November 19, 2025, the European Commission published a substantial proposal to adjust and streamline the implementation of the EU Artificial Intelligence Act (AI Act). Known as the Digital Omnibus on AI, this new regulation does not rewrite the AI Act, but it carefully “rebalances the machinery” behind it. Its mission is clear: reduce administrative burdens, accelerate compliance, and ensure that the EU’s landmark AI law is applied in a way that is proportionate, innovation-friendly, and feasible for industry and national authorities alike.

euinternetpolicy.wordpress.com

EU’s Digital Omnibus: Major Data Protection Changes Explained

The European Commission’s leaked “Digital Omnibus” proposal — an internal draft of amendments to the GDPR and ePrivacy Directive — signals the most significant shake-up of Europe’s data protection framework since 2018. While framed as a “technical alignment” exercise, the proposed revisions could fundamentally weaken core GDPR principles, narrow data subject rights, and carve out broad exceptions for AI development and commercial data use.

euinternetpolicy.wordpress.com

The Data-Driven Home: How the EU Is Rethinking Privacy in Smart Homes

Note: This is a very brief summary of some of the findings of the research project funded by Independent Research Fund Denmark entitled "The Data Driven Home: A Study of the Socio-Material and Legal Construction of the 21st Century Home." A full open-access article which Martin Friis Nielsen and myself have published in Information & Communications Technology Law is available…

euinternetpolicy.wordpress.com

Beyond the AI-copyright wars: towards European dataset law?

The advent of generative AI raises profound questions about the ownership not only of data but also of data sets. European law has, in the main, sough…

sciencedirect.com

EU Internet Law

‘Already after reading the Preface it is apparent how profound the insights of Savin are in the area of internet law. The richness is continued in the remainder of the book that covers all main areas ...

e-elgar.com

Data Protection Commission

The Irish Data Protection Commission has today announced its final decision following an Inquiry into TikTok Technology Limited (“TikTok”).

dataprotection.ie

The AI Act and Risk Management in Practice: Who are the Addressees?

The AI Act imposes unprecedented regulatory challenges on all categories of market actors. How the Act will affect companies depends on a number of factors including entity type, system modifications,...

iicj.net

EU fines Apple €500M and Meta €200M for breaking Europe’s digital rules

The highly anticipated penalties are the first to be issued under the bloc’s Digital Markets Act.

politico.eu

Google ad antitrust ruling

documentcloud.org

Commission sends preliminary findings to Alphabet under the Digital Markets Act

Today, the European Commission sent two sets of preliminary findings to Alphabet for failing to comply with the Digital Markets Act (DMA), regarding two services for which it has been designated as a

ec.europa.eu

Why the internet still needs Section 230

Sen. Ron Wyden on the birth of a foundational speech law.

theverge.com

curia.europa.eu

Thomson Reuters Wins First Major AI Copyright Case in the US

The Thomson Reuters decision has big implications for the battle between generative AI companies and rights holders.

wired.com

US VP Vance challenges Europe's 'excessive regulation' of AI

Trump's VP on Tuesday warned global leaders and tech industry executives that too much control could cripple the rapidly growing artificial intelligence industry in a rebuke to European efforts to cur...

euronews.com

Apple ordered to open encrypted user accounts globally to UK spying

The secret order would give the UK access to encrypted backups belonging to any user — not just Brits.

theverge.com