Blog

Disclosure: the author was a member of the Applicant’s counsel team

Introduction

This post concerns a question which ought to be of concern to all who practise in or study EU law:  does the EU administrative law acquis provide the Union’s courts with the tools they need to supervise the exercise of Union power across a range of competences which were simply not in contemplation at the time the acquis was developed?  There are two prompts for this post.

The first prompt is Joana Mendes’ recent (European Constitutional Law Review. 2022;18(4):706-736) and persuasive demonstration of how the current EU administrative law acquis grew up as a result of a “symbiosis of judicial and scholarly developments” in the pre-Maastricht era. The result was that, by the late 1980s there was a consensus that the subjugation of EU institutions to administrative law constraints (as then understood and theorised) had become “an essential aspect of the EC’s legitimacy”. Mendes argues (again persuasively) that this consensus and the principles which underlay it were the product of (amongst other things) the “institutional and legal reality” of what was then the European Community – i.e. “a functional polity whose interventionist institutional and decision-making structures were created for the establishment and functioning of a common market”. Mendes concludes by urging scholarly (and, perhaps, judicial) “self-reflection” as to whether this framework for analysis remains “fit for purpose” in an EU with competences far beyond what those pioneering scholars and jurists had conceived of.

The second prompt is the General Court’s recent decision in Case T-426/21 Nizar Assaad v Council ECLI:EU:T:2023:114. Here, the Court was asked to apply two core components of the administrative law acquis (the principles legitimate expectation and legal certainty)  in a context which would have been inconceivable to the Court at the time the underlying legal principles were developed – targeted economic sanctions introduced to further a foreign policy objective of the Union as a whole. The Assaad decision provides an opportunity for reflection of the type urged by Mendes and, it is argued, indicates that the Court is capable standing back and interrogating the principles which underlay the early decisions establishing the EU administrative law framework, and how they ought to apply in the much changed context of the Union activity in the Lisbon era.

Background to the Assaad case

The Applicant in the Nizar Assaad case was Mr Nizar Assaad, a dual citizen of Canada and Syria. Mr Assaad was a prominent businessman who resided in Syria until the uprising in 2011 when he left and relocated to Beirut and Dubai. As will become apparent, Mr Assaad was never involved in politics and had no connection to the Syrian regime. Mr Assaad’s business interests from 2000 onwards were largely outside Syria, and he had no business connections in Syria at all following the 2011 uprising. Rather, he had the ill-fortune to have a surname which bore (in English transliteration) a passing similarity to that of the Syrian president Bashar al-Assad.

The story begins in August 2011 when the Council added an individual identified as “Nizar Al-Assaad” as “entry 36” to the list of those subject to the EU’s Syrian sanctions regime, which is set out in Annex II to Regulation (EU) No 36/2012concerning restrictive measures in view of the situation in Syria. The Applicant knew that entry 36 could not relate to him as he had not done any of the things suggested in the accompanying reasons, nor did he satisfy any of the listing criteria.  However, since the Council had (it might be said, in dereliction of its duty to list individuals in compliance with the principle of legal certainty) given no identifying information, there was a real risk that third parties would conclude that he was the person listed at entry 36. Unsurprisingly, this was of the utmost concern to the Applicant, not least because he risked the severe reputational impact of third parties misapprehending that he was associated with President Assad’s regime. Furthermore, there was a risk that third parties would (wrongly) conclude that he was subject to the strictures of the sanctions regime, including the far-reaching consequences of a complete EU wide freezing of all his assets and economic resources and of being prevented from entering or travelling through any EU Member State.

The Applicant’s representatives tried repeatedly to contact the Council with a view to clarification, but to no avail. The Applicant then brought an application for annulment in respect of entry 36, on the basis that he was self-evidently not the person referred to. The Council did not dispute this. Rather, the Council wrote to the Applicant confirming that “the targeted person is President Al-Assad’s cousin” and that the Applicant was “not the subject of the listing”, although he has a “similar name”. Entry 36 was clarified, and the General Court concluded that the annulment application was inadmissible as the Applicant was not the addressee of the measure: Assaad v Council(T‑550/11, not published, EU:T:2012:266).

There the story should have ended. Indeed, there was every indication that it would. For the subsequent decade, whenever there was any confusion as to who was identified in entry 36, the Council made clear that it was not the Applicant. Occasionally, this confusion was the result of administrative errors by the Council. While this was a matter of unneeded stress and inconvenience to the Applicant, the Council always responded by making clear that the Applicant was not the man referred to in entry 36.

Against that background (and at the risk of understatement), it was a matter of surprise to the Applicant when in February 2021 the Council wrote to him maintaining that, contrary to everything it had said to him, the Court, and the world at large over the previous decade, the Council had decided that he was in fact been the person who had been listed since 2011. Furthermore, the Council asserted that it was “maintaining” his listing, and that it would be amending the published statement of reasons to make this clear.

The application for annulment

The Applicant immediately brought an application for annulment, the primary ground being that the Council had made a manifest error of assessment. The Applicant established that he was not a person to whom the Syrian sanctions regime could apply: he was not associated with the Syrian regime, did not have any ties (professional or personal) to either President Assad’s family or the Makhlouf family and did not have business interests in Syria at all (still less in a prominent capacity). The Court agreed, and annulled the listing on the basis that it could not be supported in fact (even given the very large margin that the Court accords to the Council in such matters).

The Court did not, however, let matters rest there. The Court went on to find that the Council’s conduct had been breach of the applicant’s legitimate expectations and of the related principle of legal certainty. It is the Court’s approach to these issues which presents an opportunity for reflection of the kind urged by Mendes. 

Assessment of the Court’s approach

As Mendes notes the principles of legitimate expectation came to form part of the corpus of EU administrative law as a result of the “transplanting” into EU law of principles deriving from the domestic administrative law of member states. Following that transplant, the underlying EU legal principles of legitimate expectation were settled in a line of pre-Maastricht decisions which establish that, where a Union institution considers that it has adopted an “incorrect position”, it will be permitted to resile from that position within a reasonable period, but only where that would not frustrate the legitimate expectations of the individual concerned (or those of third parties) who had been led to rely on the lawfulness of their conduct. Where a Union institution “finds that a measure which it has just adopted is tainted by illegality” it will have a right to withdraw that only “within a reasonable period”. Even then “that right may be restricted by the need to fulfil the legitimate expectations of a beneficiary of the measure, who has been led to rely on the lawfulness thereof”: Case C-365/89 Cargill v Produktschap voor Margarine, Vetten en Oliën paragraph 18, citing Case 14/81 Alpha Steel v Commission.

All very well in circumstances where the contested act concerned steel quotas (Alpha Steel) or agricultural subsidies to a legal person (Cargill). But how does the principle apply where the Union contends that it was previously mistaken as to a matter as serious as whether the Applicant was a supporter or beneficiary of the Syrian regime who is to be treated as, in effect, persona non grata? Does one apply the same approach? Does one give the Council a greater freedom to correct what it contends are errors? Does one weigh the interests of the affected individual differently?

Returning to the Nizar Assaad case, the Council (for its part) denied that there was any retrospectivity at all. The Council’s argument was that because economic sanctions operated only prospectively, there could be no question of retrospectivity. In their telling, it was only if the contested measure could be said to have retrospective economicconsequences that the principle would bite. One can see the logic of the Council’s position, having regard to the circumstances of the (pre-Maastricht) cases which established this principle.

The Court’s reasons, however, evince a sensitivity to the quite different context of the case before them, and in particular what one might call the human context of the contested measure. This is evident in the terms in which the Court rejected the Council’s restrictive approach, concluding that while it was “true that, in principle, the funds of a person or entity may be frozen only for the future”, this was not a principled answer to the Applicant’s claim. Accordingly the Court went on (at para 198) to hold that “confining the effects of the 2021 measures solely to the freezing of the applicant’s funds and economic resources, or to restrictions on admission to the territory of the Member States, wrongly disregards the effects which the adoption of those measures has had on the applicant’s overall legal situation and, in particular, on his reputation and integrity”. This was undoubtedly correct – as the Court went on to explain at para 200: “in establishing, by means of the 2021 measures, that the applicant’s name has been included on the lists at issue since the 2011 measures, the Council asserts that, since that date, the applicant has had links with the Syrian regime and has carried out the various acts which justified his name being entered on the lists at issue and retained since then. Such an assertion is sufficient to alter retroactively the applicant’s legal situation, quite beyond the freezing of his funds alone.”

The same sensitivity is evident in the Court’s treatment of the Council’s alternative submission, which was that any retrospectivity or frustration of the Applicant’s legitimate expectations could be justified by reference to the Council’s objectives. Again, the objectives relied upon (“consolidating and supporting human rights and international humanitarian law”) were of a nature far removed from the economic context in which the Court’s general principles were settled. The Court accepted that correction of errors in sanctioning measures could contribute to this aim, and that this was in the general interest (para 219). Nevertheless, the Court concluded that the Council “failed to have due regard for the applicant’s legitimate expectations by adopting restrictive measures with retroactive effect against him” (para 241). Here, again, the Court demonstrated an acute awareness of the human situation before it, reasoning (at para 246) that the Council’s error correction prerogative was “subject to limits, namely observance of the principle of the protection of legitimate expectations”, cautioning that “the compliance with which is all the more important” in the sanctions context“since the consequences for the legal situation of the persons and entities concerned by the restrictive measures are not insignificant”. The Court’s assessment, like the author’s above, might, perhaps be accused of understatement.

Conclusion

Standing back, the Court’s approach in the instant case is – it is suggested – an instance of the kind of self-reflection urged by Mendes. Faced with a situation far removed from that considered in the leading authorities, the Court stood back and interrogated what principles underlay those decisions, and how they ought to apply in the much changed context of the Union activity in issue in the particular case before it. To return to one of Mendes’ themes, such introspection (judicial and scholarly) is not only welcome, but also essential to the continued legitimacy of the EU legal order.

This blogpost is dedicated to legal questions arising from the ongoing ‘coalition crisis’ in Austria, following Environment Minister Leonore Gewessler’s decision to vote in favour of the Regulation on Nature Restoration despite the opposing will of Austria’s Chancellor Karl Nehammer and 7 out of 9 Regional Governments(Bundesländer). While Nehammer is of the opinion that this violates Austrian constitutional law (‘The constitution applies to climate activists as well.’) and has filed an abuse of office complaint, the question arises if the announced action for annulment before the CJEU – if not supported by all members of the government – would be admissible and who else could challenge the law in Luxembourg.

A quick reminder on the facts of the case: The Council adopted the Nature Restoration Law on 17 June 2024, with Gewessler’s (The Greens) vote being the decisive one as otherwise the required number of EU residents would not have been met (Article 16(4) Treaty on European Union, TEU). However, the second party in Austria’s coalition, the Austrian People’s Party (‘ÖVP’) and Chancellor Nehammer were not amused about Gewessler going rogue. When Gewessler announced her intention to support the law in the EU Council of Ministers one day before the vote, Nehammer sent a letter to the Belgium Presidency arguing that Gewessler was ‘not entitled to commit the Republic of Austria according to Art 16 (2) TEU in this regard’ due to a binding uniform opinion of the Regional Governments. Nevertheless, the Council confirmed that the vote would hold, and Brussels capital-regions Environment Minister Alain Maron, who chaired the talks, referred to an ‘internal controversy in Austria’. Notwithstanding the law’s passing, for now, Gewessler attracted harsh criticism from her coalition partners, accusing her of having ‘trampled federalism underfoot’. Even if the ÖVP is committed to maintaining the coalition (since legislative elections in September are approaching), this did not stop them from announcing their will to submit an action for annulment in addition to the criminal charges already filed.

Regarding the merits of the case, there are better arguments that an action for annulment would likely not succeed. This is also reflected by discussions in Austria and Germany together with a recently published Verfassungsblog. The contribution on Verfassungsblog convincingly demonstrates that even if Council members may be bound by additional national guidelines during votes (just as the ÖVP claimed that Gewessler was bound by national law to the uniform opinion of the provinces according to Article 23d Federal Constitutional Act (Bundes-Verfassungsgesetz, B-VG)) this does not affect the validity of votes on the EU-level since the CJEU is only bound to the (formal) requirements of Article 16(2) TEU, which are firstly a representative on ministerial level who is secondly able to commit the government in question. Within these limits, it is up to each Member State to determine how it is represented in the Council (see also Annex I Council’s Rules of Procedure (2009/937/EU). Article 73(2) B-VG stipulates that Austria is represented in the Council by the competent Minister, who, considering the Federal Ministries Act is Leonore Gewessler in matters of the environment, leaving no doubt that she could commit her government (with no further authorization needed). According to the authors, the letter sent by Nehammer to Alexander De Croo, does not lead to a different legal assessment – even in the light of Article 4(3) TEU. One could also question the presence of a ‘manifest’ violation of a national provision of ‘fundamental importance’ in view of the ongoing discussion in Austria right now whether Article 23d has been violated as two Länder withdrew from the former uniform opinion that proves the controversy of the issue (see the comments by Prof. Hipold). Another unfavourable point could be the wording of Nehammer’s letter (‘in this regard’). Although it would be conceivable to withdraw a minister’s power of representation – for example, by dismissing her – acting ministers have the power to speak for a country in the Council (see points raised by Prof. Ruffert).

However, another question implied by Austrian Prof. Bußjäger is whether one minister alone can submit an action for annulment (on behalf of the state). Against this background, the question arises of whether such an action would even pass the formal barriers of Article 263 Treaty on the Functioning of the European Union (TFEU).

According to Art. 263(2) TFUE the Court shall have jurisdiction in

‘actions brought by a Member State, the European Parliament, the Council or the Commission on grounds of lack of competence, infringement of an essential procedural requirement, infringement of the Treaties or of any rule of law relating to their application, or misuse of powers.’ (emphasis added)

Contrary to the non-privileged applicants in paragraph four of the same article, the standing of these so-called privileged applicants is not dependent on anything else, such as individual or direct concern. The Court argued in Italy v Council that even the fact that the act in question was voted for in the Council by the representative of a Member State does not hinder its application for annulment (see also: Lenaerts et al., EU Procedural Law (para. 7.77)). This being made clear, the question remains, who can fulfil the Member State notion.

The answer – according to settled case law – is that the term ‘Member States’ refers to ‘government authorities of the Member States’ (see, for example, Région wallonne v Commission (para. 6.)). Therefore, infra-State authorities – such would be in the current case of Austria one or more Bundesländer – do not satisfy this condition. The only way for them to apply for an action for annulment would be the ‘hard way’ by proofing that they are directly and individually concerned by the contested measure. In fact, this has already been the case in an action for annulment by the Austrian region Oberösterreich in Land Oberösterreich v Commission. In its judgment, the General Court had to assess whether the Land Oberösterreich was individually affected by a Commission decision addressed to the Republic of Austria, which concerned the denial of a request for derogation from a directive in favour of a draft law of the Land Oberösterreich. This led the Court to affirm its locus standi as the contested decision had the effect of preventing the exercise of its own powers conferred on it by the Austrian constitutional order.

It can be concluded that even if a Bundesland itself is unable to submit an action for annulment relying on Article 263(2) TFEU, the Court does indeed consider infra-state conferral of power when it comes to the fulfilment of the criteria of paragraph four, which can ultimately lead to an admissible application for annulment (see also Alves (p. 249 f.)). Nevertheless, it is doubtful that the CJEU will grant standing to one of the Bundesländer that were against the EU Nature Restoration Law since, in the present case, the reviewable act would be the regulation itself (and not as in the above-mentioned case, a decision of the Commission that affects the measure by the Bundesland) which expands the circle of potentially affected applicants and would most definitely contradict the assumption of individual concern under Plaumann. In addition, as made clear above, there is no consensus as to whether there has been a breach of national constitutional law that would affect the constitutional powers of the Länder (even if the regulation would, of course, limit the Länder in the exercise of their conferred powers that include nature conservation).

While the CJEU clarified that only the state government can submit an action for annulment, Article 263(2) TFEU does not state further criteria. One needs to have a closer look at the Austrian constitution to understand the Government’s internal decision-making process. According to Article 69(1) B-VG the Federal Government consists of the Federal Chancellor, the Vice-Chancellor and all the other Federal Ministers. Every one of them is considered a ‘highest organ’, which means there is no hierarchy between them. Until recently, the question of which majority requirements were necessary for a government resolution was unresolved – even if the prevailing opinion was that unanimity was required. However, this changed with the second COVID-19-law when a third paragraph was added stating that ‘the Federal Government shall pass its resolutions unanimously’ (see also: Muzak, B-VG, Art. 69). In other words, under Austrian constitutional law, a unanimous decision by all ministers is required for the collegial body of the Federal Government to adopt a decision. Hence, in the absence of a specific provision that, to the author’s knowledge, applies to the present case, an action for annulment needs the approval of all the members of the government, which is impossible, as Minister Gewessler (and probably the other five Green coalition members) will not consent. Even if the Austrian Government is represented before the CJEU by the Constitutional Service, a solo effort by the responsible Minister for the EU and Constitution would go against Austrian constitutional law (for the effects on the EU level see below). Again, as with action brought by regional entities, one or several ministers can still submit an action through Article 263(4) TFEU (while, of course, needing to prove direct and individual concern).

However, two possible scenarios remain of how a ‘privileged’ action for annulment might succeed after all. The first possibility (and it is not really one): ÖVP could wait until parliament elections on 29 September 2024 and the renewed government. If the Greens go into opposition and a conservative coalition is formed, there is a good chance that unanimity will be found among the new members of the government. Nonetheless, there is a reason why this alternative is of a very theoretical nature. Even though the EU Nature Restoration Law has not yet been published in the OJ, it will soon be. Once published, an action for annulment can be brought within two months and ten days (Article 263(6) TFEU and Article 51 of the Rules of Procedure of the Court of Justice). Hence, it is hard to imagine that the deadline for bringing an action will not have expired by the time the new Government is formed. The second (and more likely) scenario would be that Austrian Chancellor Nehammer and/or his constitutional Minister decide to submit an action for annulment on behalf of the government (without the consent of the entire government), infringing Austrian constitutional law. In the case that the action is brought by the aforementioned Constitutional Service, it will still be considered admissible by the CJEU as the internal decision-making process is (again) a question of domestic constitutional law and not amongst the requirements of Article 263(2) that bind the Court. However, there is a certain irony as Nehammer’s approach would fulfil precisely what he and his party are now accusing Gewessler of: An offence against national constitutional provisions.

Given the above, the case in question would undoubtedly represent a novelty before the CJEU, and many questions (both of a formal and substantive nature) still need to be conclusively clarified. However, one needs to await if and who of the Austrian Government (or, less likely, Regional Governments) submits an action for annulment in the two months following the publication of the Nature Restoration law. Suppose one fears similar coups during EU legislation procedures will soon occur in other Member States. In that case, one can confidently argue that the actors were presumably politically motivated in their respective actions and that the existence of all the necessary factors (national pre-election campaign mood, vote of a country that is decisive in a Council vote, etc.) will probably not be repeated so quickly. When it comes to climate activists, those who have in the past stood up for a reinterpretation of the individual concern criteria under Plaumann by the CJEU may feel a certain satisfaction if the Court – even if granting standing for the Member State – will most likely (albeit for different reasons) dismiss the action as unfounded.

The author would like to thank Robert Mosters, LL.M. for his helpful comments. All errors and omissions remain her own.

The industry has tricked us; Scientists and regulators have failed us. AI is developing not individually (as humans become individuals) but collectively. A huge collective hive to collect, store and process all of humanity’s information; a single entity (or a few, interoperability as an open issue today as their operation itself) to process all our questions, wishes and knowledge. The AI Act that has just been released ratifies, for the moment at least, this approach: EU’s ambitious attempt to regulate AI deals with it as if it was simply a phenomenon in need of better organisation, without granting any rights (or participation, thus a voice) to individuals. This is not only a missed opportunity but also a potentially risky approach; while we may not be building Skynet as such, we are accepting an industry-imposed shortcut that will ultimately hurt individual rights, if not individual development per se.

This mode of AI development has been a result of short-termism: an, immediate, need to get results quickly and to make a ‘fast buck’. Unlimited (and unregulated, save for the GDPR) access to whatever information is available for processing obviously speeds things up – and keeps costs down. Data-hungry AI models learn faster through access to as-large-as-possible repositories of information; then, improvements can be fed into next-generation AI models, that are even more data-hungry than their predecessors. The cycle can be virtuous or vicious, depending how you see it.

In 1984 iconic film The Terminator humans fought against Skynet, “an artificial neural network-based conscious group mind and artificial general superintelligence system”. Skynet was a single, collective intelligence (“group mind”) that quickly learned everything that humans knew and controlled all of the machines. Machines (including, Terminators) did not develop independently, but as units within a hive, answering to and controlled by a single, omnipresent and omnipotent entity – Skynet.

Isn’t this exactly what we are doing today? Are we not happy to let Siri, Alexa, ChatGPT (or whatever other AI entity the industry and scientists launch) process as a single entity, a single other-party with which each one of us interacts, all of our information through our daily queries and interactions with them? Are we not also happy to let them control, using that same information, all of our smart devices at home or at the workplace? Are we not, voluntarily, building Skynet? 

But, I do not want to be talking to (everybody’s) Siri!

All our AI end-user software (or otherwise automated software assistants) is designed and operates as a single, global entity. I may be interacting with Siri on my iPhone (or Google Assistant, Alexa, Cortana etc.), asking it to carry out various tasks for me, but the same do millions of other people on the planet. In essence, Siri is a single entity interacting simultaneously with each one of us. It is learning from us and with us. Crucially, however, the improvement from the learning process goes to the one, global, Siri. In other words, each one of us is assisted individually through our interaction with Siri, but Siri develops and improves itself as a one and only entity, globally.

The same is the case today with any other AI-powered or AI-aspiring entity. ChatGPT answers any question or request that pops in one’s mind, however this interaction assists each one of us individually but develops ChatGPT itself globally, as a single entity. Google Maps drives us (more or less) safely home but at the same time it catalogues how all of us are able to move on the planet. Amazon offers us suggestions on books or items we may like to buy, and Spotify on music we may like to listen to, but at the same time their algorithms learn what humans need or how they appreciate art.

Basically, if one wanted to trace this development back, they would come across the moment that software transformed from a product to a service. In the beginning, before prevalence of the internet, software was a product: one bought it off-the-shelf, installed it on their computer and used it (subject to the occasional update) without having anything to do with the manufacturer. However, when each and every computer and computing device on the planet became interconnected, the software industry, on the pretence of automated updates and improved user experience, found an excellent way to increase its revenue: software became not a product but a service, payable in monthly instalments that apparently will never stop. Accordingly, in order to (lawfully) remain a service, software needed to remain constantly connected to its manufacturer/provider, feeding it at all times with details on our use and other preferences.

No user was ever asked about the “software-as-a-service” transformation (governments, particularly from tax-havens, happily obliged, offering tax residencies for such services against competitive taxation). Similarly, no user has been asked today whether they want to interact with (everybody’s) Siri. One AI-entity to interact with all of humanity is a fundamentally flawed assumption. Humans  act individually, each one at their own initiative, not as units within a hive. The tools they invent to assist them they use individually. Of course it is true that each one’s personal self-improvement when added up within our respective societies leads to overall progress, however, still, humanity’s progress is achieved individually, independently and in unknown and frequently surprising directions.

On the contrary, scientists and the industry are offering us today a single tool  (or, in any case, very few, interoperability among them still an open issue) to be used by each one of us in a recordable and processable (by that tool, not by us!) manner. This is unprecedented in humanity’s history. The only entity so far to, in its singularity, interact with each one of us separately, to be assumed omnipresent and omnipotent, is God.

The AI Act: A half-baked GDPR mimesis phenomenon

The biggest shortcoming of the recently published AI Act, and EU’s approach to AI overall, is that it deals with it only as a technology that needs, better, organisation. The EU tries to map and catalogue AI, and then to apply a risk-based approach to reduce its negative effects (while, hopefully, still allowing it to, lawfully, develop in regulatory sandboxes etc.). To this end the EU employs organisational and technical measures to deal with AI, complete with a bureaucratic mechanism to monitor and apply them in practice.

The similarity of this approach to the GDPR’s approach, or a GDPR-mimesis phenomenon, has already been identified. The problem is that, even under this overly protective and least-imaginative approach, the AI Act is only a half-baked GDPR mimesis example. This is because the AI Act fails to follow the GDPR’s fundamental policy option to include the users (data subjects) in its scope. On the contrary, the AI Act leaves users out.

The GDPR’s policy option to include the users may appear self-evident now, in 2024, however it is anything but. Back in the 1970s, when the first data protection laws were being drafted in Europe, the pendulum could have swinged towards any direction: legislators may well have chosen to deal with personal data processing as a technology only in need of better organisation, too. They could well have chosen to introduce only high-level principles on how controllers should process personal data. However, importantly, they did not. They found a way to include individuals, to grant them rights, to empower them. They did not leave personal data processing only to organisations and bureaucrats to manage.

This is something that the AI Act is sorely missing. Even combined with the AI Liability Directive, still it leaves users out of the AI scene. This is a huge omission: users need to be able to participate, to actively use and take advantage of AI, and to be afforded with the means to protect themselves from it, if needed.

In urgent need: A (people’s) right to AI individualisation

It is this need for users to participate in the AI scene that a right to AI individualisation would serve. A right to AI individualisation would allow users to use AI in the way each one sees fit, deliberately, unmonitored and unobserved by the AI manufacturer. The link with the provider, that today is always-on and feeds all of our innermost thoughts, wishes and ideas back to a collective hive, needs to be broken. In other words, we only need the technology, the algorithm alone, to train it and use it ourselves without anybody’s interference. This is not a matter simply of individualisation of the experience on the UX end, but, basically, on the backend.-The ‘connection with the server’, that has been forced upon us through the Software-as-a-Service transformation, needs to be severed and control, of its own, personalised AI, should be given back to the user. In other words,  We need to be afforded the right to move from (everybody’s) Siri to each one’s Maria, Tom, or R2-D2.

Arguably, the right to data protection serves this need already, granting us control over processing of our personal data by third parties. However, the right to data protection involves  the, known, nuances of, for example, various legal bases permitting the processing anyway or technical-feasibility limitations of rights afforded to individuals. After all, it is under this existing regulatory model, that remains in effect, that today’s model of AI development was allowed to take place anyway. A specific, explicitly spelled-out right to AI individualisation would address exactly that; closing existing loopholes that the industry was able to take advantage of, while placing users in the centre.

A host of other considerations would follow the introduction of such a right. Principles such as data portability (art. 20 of the GDPR), interoperability (art. 6 of EU Directive 2009/24/EC) or, even, a right to be forgotten (art. 17 of the GDPR) would have to be revisited. Basically, our whole perspective would be overturned: users would be transformed from passive recipients to active co-creators, and AI itself from a single-entity monolith to a billion individualised versions, same as the number of the users it serves.

As such, a right to AI individualisation would need to be embedded in systems’ design, similar to privacy by-design and by-default requirements. This is a trend increasingly noticeable in contemporary law-making: while digital technologies permeate our lives, legislators find that sometimes it is not enough to regulate the end-result, meaning human behaviour, but also the tools or methods that led to it, meaning software. Soon, software development and software systems’ architecture will have to pay close attention to (if not be dictated by) a large array of legal requirements, found in personal data protection, cybersecurity, online platforms and other fields of law. In essence, it would appear that, contrary to an older belief that code is law, at the end of the day (it is) law (that) makes code.