This paper analyses the European Union’s flagship initiative to become an international leader in AI: the 19 AI Factories, spread across 16 EU Member States. At the moment, a few large AI companies from the US (‘Big AI’) hold key parts of the AI market. Smaller European startups therefore struggle with barriers to entry, lock-in effects, and dependencies in the global ‘AI race’. The AI Factories try to respond to this – but to what extent can they achieve their high ambitions?By employing a doctrinal analysis of the relevant EU law and semi-structured interviews with nine industry experts (six AI startup representatives, two Big AI representatives, and one AIF representative), the study analyses the capacity of the AI Factories to function as public alternatives to Big AI.Our findings indicate that while the AI Factories – on paper – offer free access for startups to AI-optimised supercomputing, technical support, data services, and regulatory guidance, their real-world impact remains limited at this time. This is mainly due to limited awareness among startups, misalignment with startups’ commercialisation needs, and restrictions that limit AI Factory use to model training rather than deployment. Furthermore, the platform lock-in to Big AI further reduces startups’ willingness to ‘migrate’ and train their models with the AI Factories.The paper concludes that, as of now, the AI Factories alone are unlikely to reduce startups’ reliance on Big AI, but combined with stronger competition enforcement and targeted industrial policy, they could contribute to a more self-reliant European AI system.
Cryptographically relevant quantum computers would undermine widely deployed public-key mechanisms, while harvest now, decrypt later attacks separate the acquisition of encrypted material from its eventual exploitation. For personal data requiring long-term confidentiality, this raises a present question about appropriate protection under Articles 25 and 32 of the General Data Protection Regulation. Standardisation and deployment of post-quantum cryptography strengthen the practical basis for protective action. Its timing and scope depend on credible acquisition pathways, exposed cryptographic dependencies, the remaining confidentiality horizon, consequences for individuals, and the effectiveness and costs of available measures. A genomic biobank example applies this assessment to transmission, storage and key management, comparing targeted hybrid deployment with immediate security improvements and replacement of legacy systems. Preparation and selective deployment may become necessary before comprehensive migration is proportionate, while deferral requires continuing review. Court of Justice judgments inform the assessment of appropriateness, accountability and the separate conditions for compensation. NIS2, DORA and the Cyber Resilience Act support the transition through governance and product requirements within their respective scopes. A possible infringement rests on the inadequacy of the controller’s security measures in their contemporary circumstances, assessed through the exposure, available protection and reasons for the chosen timetable.
The global smart cockpit market is undergoing explosive growth, with AI-enabled functionalities emerging as core components of modern vehicles. However, the integration of AI in smart cockpits has introduced complex compliance challenges under the EU AI Act and the General Data Protection Regulation (GDPR). This paper adopts a three-dimensional analytical framework (regulatory, technical, industrial practice) to systematically explore the compliance landscape, key dilemmas, and actionable solutions for smart cockpit AI systems. First, the paper clarifies the core obligations of high-risk and limited-risk AI systems under the EU regulatory framework. It also analyzes cross-regional regulatory conflicts among the EU, China, and the U.S., highlighting differences in data localization, consent mechanisms, and conformity assessment requirements. Second, the paper identifies risk-tier-specific compliance challenges, including data bias, transparency deficits, cross-border data transfer risks, as well as lifecycle management burdens. Additionally, it addresses emerging challenges brought by the integration of large language models (LLMs) in in-vehicle ecosystems, such as training data copyright verification and generative content controllability. Finally, the paper proposes an integrated compliance strategy. This strategy encompasses technical paths, full-lifecycle management, and cross-regional modular design to adapt to divergent regulatory requirements. The research provides a standardized compliance framework and practical tools for global automakers, helping balance technical innovation, user experience, and regulatory compliance to drive the sustainable development of the intelligent automotive industry.
Online-game losses span contract, tort, consumer-law and computer-access doctrines across distinct legal relationships. This article asks how law should characterise and remedy destructive interference with virtual assets when technical access, contractual control or system-enabled capacity exists but authority to delete, consume, liquidate or irreversibly disable them is contested. The Qingyu Tpor incident supplies an inter-user illustration; J.A. v. 2K Games a publisher-side boundary test. A maximum-variation, multilevel comparison of China, selected United States pathways and European Union law supplemented by German law reveals a cross-doctrinal specification problem: existing routes protect distinct interests and treat consent, platform terms and technical capacity differently. The article develops a destructive-authority protocol for pleading and adjudication that identifies the relationship, route, route-specific interest or entitlement, sources of permission, and interference mechanics and consequences before applying each doctrine’s elements, burdens, defences and remedies. It prevents a conclusion under one relationship or route from deciding a legally distinct claim without that claim’s elements being tested. Deletion, consumption and forced in-system exchange form the core; appropriation and publisher discontinuation are adjacent boundary cases. Property torts depend on local recognition, while contract, consumer law, general tort or data-interference rules may apply elsewhere. Restoration and compensation require an established obligation and proven net loss.
The EU Digital Services Act (DSA) requires the largest online services to provide a repository of all advertising shown, including each ad’s content, its advertiser’s identity, and associated data on which user demographics were targeted, and how many users were eventually reached. Theoretically, mandated ad libraries provide unprecedented access and transparency and would be invaluable tools for advertising research and regulatory enforcement. However, these repositories must exist and be compliant with various disclosure obligations to be useful in practice. Only 17 of the 24 services that were obliged to comply in April 2026 (70.8%) ostensibly provided a publicly accessible online interface-based ad repository. We studied the capabilities of 12 repositories (as some services shared one). Basic data (e.g., ad content, display period, and advertiser identity) were reliably provided by most. However, as to more granular user targeting and reach metrics, the data provided were often insufficiently detailed, with only Meta (one of 12 repositories; 8.3%) providing the precise user demographic targeting criteria used and the exact number of users reached broken down by targeted demographic groups. Whilst the European Commission has proactively enforced other DSA obligations against many services, ad repository compliance has not been adequately enforced. Concerningly, seven of 24 obliged services (29.2%) failed to provide one at all. Stricter enforcement is necessary to ensure that the DSA achieves its legislative aims in practice by allowing the public (e.g., academic researchers and journalists) and regulators to properly scrutinise online advertising. Presently, for most purposes, we recommend first trying the generalist Meta Ad Library (covering Facebook and Instagram).
