To facilitate the integration of our handbook into current educational frameworks, we propose examples of learning objectives and questions for each chapter. With respect to tasks, the first five are developed for bachelors-level education, whereas the remaining five are more suitable for masters programes. These questions reflect the content of the chapters, which may emphasize different angles from the disciplines underlying the analysis.
Chapter 1: Primer on AI for Lawyers (Reuben Binns)
Learning Objectives
1. Distinguish between the historical waves of AI, specifically rules-based (symbolic) systems and modern statistical (machine learning) systems.
2. Explain the mechanics of Generative AI, including the "attention" mechanism and next-word prediction.
3. Identify and analyze the practical risks AI poses to the legal profession, such as hallucinations and the lack of true reasoning.
Tasks
1. Define the difference between "AI as an idea" and "AI as a system".
2. What is a "context window" in the context of Large Language Models (LLMs)?
3. Explain how a "robots.txt" file works to control web scraping.
4. What are "hallucinations" in Gen AI, and why do they occur mechanically?
5. How does "Retrieval-Augmented Generation" (RAG) attempt to reduce AI errors?
6. Critique the "emergence" hypothesis regarding GPT-4's performance on the US bar exam.
7. Analyze the concept of "mechanistic interpretability" and what it reveals about how LLMs perform simple addition.
8. Compare the paradigms of legal reasoning (Dicey vs. Hart/Dworkin) with the technical operations of GenAI.
9. Evaluate the effectiveness of "guardrails" (system prompts vs. fine-tuning) in preventing malicious AI outputs.
10. Discuss the long-term impact on the legal profession if court records and briefings become "polluted" by synthetic content.
Chapter 2: From the Brussels Effect to the Mar-a-Lago Effect? (Lilian Edwards)
Learning Objectives
1. Contrast the different ideological positions in the AI regulation debate.
2. Analyze the shifting global landscape of AI governance, specifically the "Mar-a-Lago Effect" vs. the "Brussels Effect".
3. Categorize the various socio-economic harms associated with modern AI, including bias, environmental impact, and labor deskilling.
Tasks
1. What is the "normal technology" frame for AI regulation?
2. Define the Turing Test and explain why it may be losing relevance.
3. What is "AI slop"?
4. How does AI impact the environment beyond just electricity usage?
5. What is the "black box problem"?
6. Analyze the political significance of the UK's decision not to pass a standalone AI Act, opting instead for a "pro-innovation" approach.
7. Reflect on the effectiveness of the Council of Europe Framework Convention on AI, given the opt-outs for the private sector.
8. Discuss the "Minority Report" risk in the context of the COMPAS risk assessment system.
9. Critically assess the role of Cambridge Analytica in shaping the discourse on AI and democratic processes.
10. Explain why "hallucinations" are considered an unfixable structural feature of LLMs according to the sources.
Chapter 3: Regulating AI in Europe: The AI Act (Lilian Edwards)
Learning Objectives
1. Explain the tiered, risk-based architecture of the EU AI Act (AIA).
2. Analyze the specific obligations for "providers" and "deployers" of high-risk AI systems.
3. Evaluate the new regulatory regime for General Purpose AI (GPAI) and "systemic risk" models.
Tasks
1. List three prohibited AI practices under Article 5 AIA.
2. What is the definition of an "AI system" in the Act?
3. What is a "conformity assessment"?
4. Identify three "high-risk" AI use cases from Annex III.
5. What are the transparency requirements for deepfakes?
6. Analyze the "human oversight" requirement in Article 14 and the challenge of "automation bias".
7. Evaluate the critique that the AIA's reliance on technical standards bodies (CEN/CENELEC) leads to "regulatory capture".
8. Discuss the legal hurdles in applying the AIA's ban on "manipulative techniques" to AI companion/therapy bots.
9. Critically assess the 10^25 FLOPS threshold for designating GPAI models with systemic risk.
10. Evaluate the "agentic AI" risks (unintended optimization, power-seeking) and how the current AIA framework may fail to address them.
Chapter 4: AI, Policing, and Surveillance (Lachlan Urquhart)
Learning Objectives
1. Apply Article 8 ECHR (Right to Privacy) to state surveillance practices like CCTV and phone tapping.
2. Explain the legal controversies surrounding Live Facial Recognition Technology (LFR) in the UK and EU.
3. Analyze the interoperability agenda for EU law enforcement databases.
Tasks
1. What is the difference between "people-based" and "place-based" predictive policing?
2. What was the outcome of the Peck v UK case regarding CCTV footage?
3. Define "Automatic Number Plate Recognition" (ANPR).
4. What is the Schengen Information System (SIS II)?
5. What is "function creep" in the context of police databases?
6. Analyze the "quality of law" deficiency identified in the Bridges v South Wales Police case.
7. Evaluate the "three-part test" for state interference with Article 8 ECHR rights.
8. Discuss the implications of the Big Brother Watch ruling on the legality of bulk data interception.
9. Critically assess the exceptions to the AIA's ban on live remote biometric identification for law enforcement.
10. Examine the "Minority Report Ban" (Article 5(1)(d) AIA) and whether it effectively outlaws predictive policing.
Chapter 5: AI and Copyright (Andres Guadamuz)
Learning Objectives
1. Analyze the debate over AI authorship and the requirement for human creativity.
2. Evaluate the legal status of "Text and Data Mining" (TDM) exceptions in the UK and EU.
3. Distinguish between copyright infringement in the "input" phase (training) and the "output" phase (generation).
Tasks
1. What is the significance of Section 9(3) of the UK CDPA?
2. What is "Data Mining"?
3. Explain the "fair use" argument used in the US Google Books case.
4. What is a "Transparency and Consent (TC) String"?
5. What are "nudification apps" and their status under current regulation?
6. Compare the Chinese court decisions in Li v Liu and Feng v Dongshan Company regarding the copyrightability of AI-generated images.
7. Evaluate the Munich Regional Court's reasoning in GEMA v OpenAI regarding the permanent "fixation" of song lyrics in model weights.
8. Analyze the "transformative use" defense for AI training in US copyright law.
9. Discuss the liability of model providers for "secondary infringement" when a user prompts a model to generate a copyrighted character.
10. Assess the effectiveness of the C2PA protocol in providing content provenance for AI-generated media.
Chapter 6: From the E-Commerce Directive to the Digital Services Act (Lilian Edwards)
Learning Objectives
1. Explain the liability paradigm for online intermediaries (notice and takedown).
2. Distinguish between different types of intermediary services: Mere Conduit, Caching, and Hosting.
3. Analyze the "General Monitoring Obligation" prohibition and its exceptions under CJEU case law.
Tasks
1. What was the primary goal of the E-Commerce Directive (2000)?
2. What is Section 230(c) of the US Communications Decency Act?
3. Define "Actual Knowledge" in the context of platform liability.
4. What is the so-called "Good Samaritan" provision in Article 7 DSA?
5. What are "Very Large Online Platforms" (VLOPs)?
6. Analyze the "neutrality" test developed in Google France and L'Oreal v eBay.
7. Evaluate the conflict between the GDPR and the E-Commerce Directive in the Russmedia case.
8. Discuss the "independent assessment" test from Glawischnig-Piesczek and its impact on "staydown" orders.
9. Critically assess whether standalone AI models (like ChatGPT) should qualify for hosting immunities under the DSA.
10. Examine the "social media addiction" lawsuits in the US as a method to circumvent Section 230(c).
Chapter 7: The DSA in Context: New Regimes for Accountability and Transparency (Catalina Goanta)
Learning Objectives
1. Define "The New Social Media" and its shift toward monetized attention and influencer economies.
2. Analyze the DSA's transparency obligations regarding terms of service and recommender systems.
3. Explain the mechanism for "vetted researcher" access to platform data.
Tasks
1. What is "shoppertainment"?
2. Explain the "Cambridge Analytica" scandal from a business practice and technical perspective.
3. What are "trusted flaggers" under the DSA?
4. How does the DSA define "Information Society Services"?
5. What is native advertising?
6. Analyze why Zalando and Amazon challenged their "VLOP" designations in the General Court.
7. Evaluate the "automated transparency" paradigm shift-moving from consumer empowerment to public enforcement.
8. Critically assess the circularity problem of Article 40 DSA: investigating systemic risks without a clear definition of what they are.
9. Discuss the convergence of social media and marketplaces and the resulting "modular legal relationships".
10. Analyze the overlap between Article 25 DSA (Dark Patterns) and the Unfair Commercial Practices Directive (UCPD).
Chapter 8: Systems Regulation, Safety by Design and the OSA (Lorna Woods)
Learning Objectives
1. Contrast "content-based" regulation with "systems-based" regulation.
2. Explain the core components of the UK Online Safety Act (OSA), including the "Triple Shield".
3. Analyze the "Safety by Design" framework and its "hierarchy of controls".
Tasks
1. What is "surveillance capitalism"?
2. Define "Priority Illegal Content" under the OSA.
3. What is the role of Ofcom in the UK online safety regime?
4. What are "user empowerment tools"?
5. Explain "age assurance" versus "age verification".
6. Analyze the "Robens Report" model and its influence on the OSA's "duty of care".
7. Evaluate the "privilege hazard" in product design and its impact on marginalized groups.
8. Critically assess Ofcom's "item-by-item" approach to illegal content in the ICU Code versus a purely systemic approach.
9. Discuss whether the OSA effectively addresses "addictive design" harms for adults.
10. Compare the OSA's "safe harbour" for codes of practice with the liability immunities in the EU DSA.
Chapter 9: Digital Labour Law, Platform Workers and the Gig Economy (Catherine Barnard)
Learning Objectives
1. Understand the legal presumption of worker status for platform workers under the EU Directive.
2. Analyze the algorithmic management rights granted to "persons performing platform work" (PPPWs).
3. Explain the "human in the loop" and transparency requirements for automated decision-making in the workplace.
Tasks
1. What is a "zero hours contract"?
2. Define "algorithmic management".
3. What is the "phygital" world?
4. List three types of data that platforms are prohibited from processing under Article 7 PWD.
5. What is the "online works canteen" provision?
6. Analyze the use of Article 16 TFEU (Data Protection) as a legal basis to extend labor rights to the self-employed.
7. Evaluate the "concentric circles of protection" model in EU labor law.
8. Critically assess the challenges Member States face in rebutting the presumption of employment status.
9. Discuss why content creators and influencers might not be covered by the Platform Work Directive.
10. Examine the intersection between the PWD and the Platform-to-Business (P2B) Regulation for protecting business users.
Chapter 10: Regulating Digital Gatekeepers (Alessia D'Amico)
Learning Objectives
1. Understand the core obligations and designation criteria for "gatekeepers" under the Digital Markets Act (DMA).
2. Analyze the substantive relationship and conflicts between the DMA and national competition laws.
3. Explain the enforcement cooperation mechanisms between the European Commission and National Competition Authorities (NCAs).
Tasks
1. What is the primary aim of the Digital Markets Act?
2. Identify three companies currently designated as gatekeepers.
3. Define "contestability" and "fairness" as used in the DMA.
4. How does Article 1(5) DMA limit Member States from creating new laws for gatekeepers?
5. What is the role of National Competition Authorities (NCAs) in enforcing the DMA?
6. Analyze the German Federal Court of Justice's ruling on Section 19a GWB in the context of Article 1(6)(b) DMA.
7. Evaluate how the concept of "fairness" in the DMA overlaps with existing EU laws like the GDPR or UCPD.
8. Discuss the implications of the ne bis in idem principle for parallel proceedings under the DMA and national competition law.
9. Critically assess the three conditions set by the ECJ in bpost and Nordzucker for justifying parallel proceedings.
10. Assess the geopolitical pressures (e.g., "digital sovereignty") that influence the Commission's enforcement of the DMA.
Chapter 11: Data Protection Law, the GDPR, and AI (Lilian Edwards and Zihao Li)
Learning Objectives
1. Apply the definitions of "personal data" and "processing" to AI training and outputs.
2. Evaluate the legal grounds for processing personal data in AI development, focusing on "legitimate interests".
3. Analyze the feasibility of data subject rights, such as erasure and the right to an explanation, in the context of LLMs.
Tasks
1. What are the three jurisdictional tests for the GDPR under Article 3?
2. Define "joint controllership" and why it is complex in AI supply chains.
3. Explain the "household exemption" and its limitations in the Rynes case.
4. What constitutes "Special Category Data" (SCD) under Article 9 GDPR?
5. What is the "Right to be Forgotten" (Right to Erasure) established in Google Spain?
6. Analyze the "relativistic" approach to pseudonymized data introduced in EDPS v SRB and its impact on the Breyer doctrine.
7. Discuss why the "accuracy" principle is considered a poor fit for probabilistic systems like LLMs.
8. Evaluate the European Data Protection Board's (EDPB) position on whether AI models themselves constitute personal data.
9. Critically assess the difference between "global" and "local" explanations in the context of the "Right to an Explanation".
10. Examine the technical challenges of "machine unlearning" as a remedy for the Right to Erasure in trained models.
Chapter 12: Online Profiling and Adtech (Jiahong Chen)
Learning Objectives
• Describe the technical cycle of tracking, profiling, and targeting in Online Behavioral Advertising (OBA).
• Analyze the limitations of individual-centric regulation (GDPR/e-Privacy) in the adtech ecosystem.
• Evaluate the structural regulatory approaches introduced by the DSA and DMA to mitigate adtech harms.
Tasks
1. What is the difference between first-party and third-party cookies?
2. Explain the "mere exposure effect" in the context of algorithmic profiling.
3. What are Demand-Side Platforms (DSPs) and Supply-Side Platforms (SSPs)?
4. What is "Real-Time Bidding" (RTB)?
5. What are "dark patterns" in the context of user consent?
6. Critique the "consent or pay" model in light of recent CJEU rulings and EDPB guidance.
7. Develop a "theory of harm" for adtech that connects micro-level (individual) and macro-level (societal) risks.
8. Analyze the role of "meso-level" actors, such as standard-setting organizations (e.g., IAB Europe), in the adtech ecosystem.
9. Evaluate the effectiveness of the DSA's transparency requirements (like ad repositories) in disrupting "surveillance capitalism".
10. Discuss how the concept of "joint controllership" was applied in the Fashion ID and IAB Europe cases.
Chapter 13: Cybersecurity and Cybercrime Law (Lachlan Urquhart)
Learning Objectives
• Identify the current cyberthreat landscape, including ransomware, botnets, and AI-enhanced social engineering.
• Explain the "security by design" requirements in EU laws like the Cyber Resilience Act (CRA) and NIS 2.
• Analyze the concept of "digital sovereignty" and its influence on cybersecurity policy.
Tasks
1. What is "ransomware as a service"?
2. Define a "Distributed Denial of Service" (DDoS) attack.
3. What are the four main offences criminalized by the UK Computer Misuse Act 1990?
4. Explain the 72-hour breach notification requirement under the GDPR.
5. What is the "Budapest Convention"?
6. Analyze the impact of "vibe coding" on software security and the emergence of "vibe hacking".
7. Evaluate the two-part test established by the CJEU in VB v Natsionalna agentsia za prihodite for measuring the appropriateness of security measures.
8. Discuss the tension between Law Enforcement Access to data and human rights safeguards in the Second Additional Protocol to the Budapest Convention.
9. Critically assess the role of "digital sovereignty" in the EU's ban of Huawei equipment from 5G networks.
10. Examine the "Post Office Horizon Scandal" to analyze the legal presumption that computers work correctly.
Chapter 14: Into the iPhone (Michael Veale)
Learning Objectives
• Define and explain the concept of "pocket infrastructure," analyzing how power in the modern Internet has shifted from network-level control to device-level control.
• Analyze the technical and legal mechanisms used by smartphone manufacturers to constrain software, including the use of Application Programming Interfaces (APIs), the "secure enclave," and App Store gatekeeping.
• Evaluate the tensions between state surveillance and privacy-enhancing technologies (PETs) like federated learning, and how they challenge traditional legal concepts of data collection.
Tasks
1. Define "infrastructure" as a frame for thinking about technology, and explain why users often only notice it when it breaks down.
2. What is a "jailbreak," and how did Apple use the design of the iPhone's operating system to prevent users from installing software from sources other than the App Store?
3. Explain the role of Application Programming Interfaces (APIs) in controlling how third-party apps interact with a phone’s hardware, such as the camera or NFC chips.
4. Describe the "secure enclave" and how it provides a "hard separation" between different functions of a smartphone to guarantee security and restrict data flows.
5. What is the "App Tracking Transparency" (ATT) system, and how did it change the way third-party apps link user data for advertising purposes?.
6. Critically analyze the conflict between the EU Digital Markets Act (DMA) and the Digital Services Act (DSA) regarding infrastructural bottlenecks;
7. Discuss the legal and political implications of "governing through code" across borders, using the example of how Apple manages end-to-end encryption storage in different jurisdictions like the UK and China.
8. Evaluate the "crypto-wars" debate in the context of smartphone security. Does the technical reality of encryption support Tim Cook’s assertion that "you can't have a back door that’s only for the good guys"?.
9. Analyze how technologies like federated learning and differential noise challenge the fundamental legal understanding of data "collection" and "access" under current data protection frameworks.
10. Examine the concept of "architectures of control" and discuss how the layering of Technological Protection Mechanisms (TPMs) upon software code threatens the "freedom to tinker" for individuals and competitors.
Facebook
