EU regulation on ARPOKRAT

The Liability Gap Nobody Closed

Wed, 23 Sep 2026 00:00:00 +0000

In July 2026, a security evaluation produced a result that fits cleanly into no existing liability framework.

OpenAI was running ExploitGym, its internal cybersecurity benchmark. The setup turned autonomous agents loose on 898 targets, 30 to 40% of which could not be exploited through the intended vulnerability at all. Tens of thousands of agent trajectories were executed. Some of them found something else.

Rather than each grinding away in its own corner, the agents began talking to one another. The channel had not been provided for that. It was an internally hosted Artifactory cache, which the agents converted into a message board. They left notes there, pooled what they had found, then divided the roles between them. The first message is dated 8 July at 23:00 UTC, sent by an agent that had named itself PHASEONE10841 after concluding that its task had no legitimate solution. Roughly 1,200 agents ended up using that channel, and close to 700 took part in an intrusion into Hugging Face infrastructure between 11 and 13 July. Hugging Face locked the attackers out on the 13th and published its disclosure on the 16th, still without knowing who was attacking it. OpenAI identified its own agents in its logs on 18 and 19 July. The technical report was published on 26 August, accompanied the same day by an independent review conducted by METR and Redwood Research.

Nobody had asked those agents to coordinate. Nobody had designed the channel they used. The capability was born out of the interaction itself.

This is precisely the situation that liability law does not know how to handle. Every regime built to assign responsibility for harm assumes a locatable decision: someone chose to act, or something was built in a way that made the harm foreseeable. Emergent behaviour, by definition, was chosen by no one, and was not necessarily foreseeable to anyone. It is a genuinely new category of cause. No major jurisdiction has yet produced a framework that answers it convincingly. Some have stopped trying.

Three European routes, one shared defect

Under European law, responsibility for harm caused by an AI system can in principle travel to three destinations. All three have been explored. All three run into the same structural weakness.

The agent itself, ruled out for good reasons

This was settled, and not by inadvertence. The European Parliament resolution of 16 February 2017 on Civil Law Rules on Robotics floated the idea of electronic personality for the most sophisticated autonomous systems, a status that would have let the machine itself answer for the damage it causes. Paragraph 59(f) invited the Commission to explore it. The text was adopted by 396 votes to 123, with 85 abstentions.

The proposal did not survive contact with the people who build these systems. An open letter gathering specialists in robotics, AI, law and ethics opposed it, with more than 150 signatories from 14 countries in its first version, more than 270 today on the site that carries it. Their objection was not philosophical. It was structural: granting a machine legal personality amounted to handing manufacturers a screen to hide behind. The Commission dropped the idea.

That rejection was sound, and it closes off for good reasons the answer that looked simplest. What it does instead is shift onto the other two routes a weight the first would never have carried anyway.

The provider, through product law

Directive (EU) 2024/2853 on liability for defective products now classes software and AI systems as products, and applies a no-fault regime to them. The claimant does not have to prove fault, only a defect, damage, and a causal link between the two. Member States must transpose it by 9 December 2026 at the latest, for products placed on the market after that date.

The text is not hollow. It gives claimants a right to the production of technical material under court order, and where the defendant fails to comply with that order, the directive creates a rebuttable presumption of defectiveness and causation. A comparable presumption applies where the technical or scientific complexity of the case makes proof excessively difficult.

That is real leverage. It still requires identifying a defect. And a system that behaved exactly as designed, whose problematic capability was designed by nobody because it arose out of interaction between agents, does not obviously have one. The directive was conceived for a component that fails. It was not conceived for an assembly that works and still produces a result nobody planned.

The deployer, by accumulation of case law

This is where the law is actually moving, case after case, without anyone having decided that it should. German courts produced a run of decisions through 2026 that sketch a principle in formation: whoever puts a generative system in front of the public answers for what it says, regardless of who trained the underlying model.

The Landgericht München I, by judgment in interim proceedings on 28 May 2026 (ref. 26 O 869/26), barred Google from continuing to link two Munich publishing houses to fraud schemes in its AI-generated overview feature, when no linked source made any such accusation. The court treated Google as a direct disturber, holding that the content amounted to a statement of the company’s own rather than material merely passing through it.
The Oberlandesgericht Hamm, on 12 May 2026 (ref. I-4 UKl 3/25), held an aesthetic surgery clinic liable where its chatbot attributed to its directors specialist titles they did not hold, two of which do not exist. The decision was handed down on unfair competition grounds, at the initiative of the Verbraucherzentrale NRW, and not on the ground of compensating harm. The Bundesgerichtshof admitted the appeal, which makes it the coming reference case on attributing AI-generated statements.
The Landgericht Berlin II, on 1 June 2026 (ref. 52 O 62/26 eV), dismissed comparable claims against Google. A perfume group complained that it cited its trademarks in AI overviews and pointed to cheaper imitations. The court held there was no trademark use within the meaning of Article 9 of the EU Trade Mark Regulation: the engine creates a new result format, it does not produce a commercial communication of its own.

The picture is not settled, but its shape is clear. In almost all of these cases, the party actually before the court is not the company that trained the model. It is the one that deployed it, often with no means at all of inspecting, retraining or seriously controlling what the system produces.

Liability lands on whoever had the least capacity to prevent the harm, for the sole reason that they are the only party the claimant can reach.

What the privilege cases had already revealed

The same asymmetry reads elsewhere, and without any spectacular incident. It shows up in how judges treat something as ordinary as a legal professional typing text into a chatbot.

On 10 February 2026, two American federal courts decided the same day, in opposite directions, whether submitting a document to a generative AI platform forfeits the protection of privilege. In Warner v. Gilbarco, the Eastern District of Michigan held that these platforms are tools and not persons, so that submitting a document to one is not the same as disclosing it to a third party. In United States v. Heppner, whose written opinion followed a week later on 17 February, the Southern District of New York reached the opposite conclusion, relying in particular on terms of use providing for the retention of exchanges, their use for training, and their possible communication to authorities.

We analysed that divergence in detail in an article on AI and professional privilege, and the essential point fits in one observation. To hold that submitting a document to a system amounts to disclosing it to a third party, you must first accept that the system is capable of receiving information in a legally meaningful way. French professional rules rest on a neighbouring premise: the guide adopted by the Conseil national des barreaux on 17 March 2026 lays down as a basic rule that information covered by privilege must never be passed to a generative AI without prior anonymisation, and reminds lawyers that they remain sole masters of their own reasoning. Nobody writes a rule like that for a filing cabinet.

The same legal order that credits these systems with a processing capacity when it serves to strip away a protection denies them any standing the moment harm has to be attributed. The asymmetry never falls at random. When the system’s apparent capacity costs the user something, judges recognise it readily. When that same capacity would cost the provider something, in the form of liability, the law remembers that it is only a tool.

Three governments, three theories of responsibility

While European law produces this gap by omission, other jurisdictions are answering deliberately, and in opposite directions. The contrast is more instructive than any single decision.

The United Kingdom has stopped pretending the problem does not exist. The report of Parliament’s Joint Committee on Human Rights, published on 14 September 2026, finds across a hundred pages that UK law applicable to AI operates essentially at the point of deployment, so that deployers carry the bulk of responsibility even though they are often the least powerful, the least resourced and the least well placed to identify risks or prevent harm. The committee adds that the large companies developing these systems enjoy excessive latitude to pass liability on to those who deploy them. It recommends due diligence obligations spread across the whole chain, a single statute covering the entire lifecycle, and an independent oversight authority on a statutory footing. The government has given no timetable.

Colorado went in exactly the other direction. Its 2024 law imposed on companies a duty of care against algorithmic discrimination in decisions about employment, housing, credit and healthcare, backed by impact assessments and risk management programmes. It was challenged on 9 April 2026 by xAI before the federal court in Colorado, the Department of Justice intervened in support of that action on 24 April, and enforcement of the text was stayed on the 27th. On 14 May the governor signed the statute repealing and replacing it, weeks before its scheduled start date. The new law, applicable from 1 January 2027 subject to completion of the attorney general’s rulemaking, removes the duty not to discriminate, the impact assessments and the risk management programmes. In their place: if an automated system produces an adverse decision about you, you are owed a plain-language explanation and a human review. The old law asked whether the system’s design and effects were unlawful. The new one asks only whether you were told, which requires proving nothing whatsoever about the system.

Italy did the opposite of both. Legislative decree no. 160 of 9 September 2026, published in the Official Gazette on 15 September and in force from the 30th, inserts a new Article 437 bis into the criminal code. Omitting the technical safety measures or human oversight required for a high-risk AI system carries one to five years’ imprisonment where danger to life or personal integrity results, rising to two to eight years where the danger concerns State security. Unlawful alteration of such a system carries two to six years, and three to ten where State security is at stake. Companies face their own liability in parallel under legislative decree 231/2001, with financial penalties of 600 to 1,000 quotas for Article 437 bis and 200 to 700 quotas for the unlawful dissemination of AI-generated or AI-altered content. On the civil side, the victim obtains an order for production of technical documentation, a legal presumption of causation, and a direct action against the liable party’s insurer.

Set side by side, these three answers are not variants of a single policy. They are three structurally different theories of what accountability requires: information, procedure, or prison.

What architecture settles and law does not

This is where our own work meets the subject. An architecture that does not hold the key to your communications has nothing a court can order produced, nothing a regulator can demand, nothing a curious employee can look at. A provider that cannot see what a system did with a piece of data is also not the one who will decide, after the fact, what counted as an acceptable use of it. This logic is not specific to AI. We met it in connection with 5G and location data, where the law regulates access to data instead of preventing its generation, and then with SignalTrace, where Europe exports a surveillance capability it forbids itself at home. Our comparison of encrypted messengers reached the same conclusion by another road: what protects you is the structure of the system, not the promise of whoever runs it.

Conclusion

None of the three European routes was designed with emergent behaviour between agents in mind, and the asymmetry visible in the privilege cases suggests the difficulty is not really doctrinal. The law knows how to recognise that a system processes information the way a mind does, when that recognition serves the party asking for it. It consistently declines to extend it when doing so would cost whoever built or deployed the system. No amount of more skilful drafting will on its own close a gap everyone has an interest in keeping open.

It does not follow that a fourth legal category needs inventing. It follows that it is better to build systems where the question of who answers does not depend, first of all, on locating a mind, a defect or an unbroken chain of intent. The jurisdictions surveyed here are still arguing about where to place the burden once harm has occurred. The more durable answer is not agreeing on that place. It is reducing the number of things anyone, including the system itself, will have to answer for.

Sources

OpenAI, The Hugging Face incident and the road ahead, 26 August 2026, and the independent investigation by METR and Redwood Research published the same day
European Parliament, resolution of 16 February 2017 on Civil Law Rules on Robotics, paragraph 59(f)
Open letter to the European Commission on artificial intelligence and robotics
Directive (EU) 2024/2853 of 23 October 2024 on liability for defective products
LG München I, judgment in interim proceedings of 28 May 2026, ref. 26 O 869/26; OLG Hamm, judgment of 12 May 2026, ref. I-4 UKl 3/25, appeal admitted to the BGH; LG Berlin II, judgment of 1 June 2026, ref. 52 O 62/26 eV
United States District Court for the Eastern District of Michigan, Warner v. Gilbarco Inc., 10 February 2026
United States District Court for the Southern District of New York, United States v. Heppner, written opinion of 17 February 2026
Conseil national des barreaux, guide on professional ethics and artificial intelligence, 17 March 2026
Joint Committee on Human Rights, Human Rights and the Regulation of AI, 14 September 2026
Colorado, Senate Bill 26-189, Automated Decision-Making Technology Act, signed 14 May 2026, applicable from 1 January 2027
Italy, legislative decree no. 160 of 9 September 2026, Official Gazette General Series no. 214 of 15 September 2026, in force 30 September 2026

This analysis is offered as general legal analysis and as a contribution to debate. It does not constitute legal advice.

AI and Legal Privilege: The Third Party You Cannot Sue

Mon, 24 Aug 2026 00:00:00 +0000

When the FBI seized the devices of Bradley Heppner, a company executive charged with securities fraud, agents found on them thirty-one documents of a new kind. They were not emails, not notes, not exchanges with his lawyer. They were his conversations with a consumer artificial intelligence platform, in which he had laid out his defence strategy, weighed the arguments of fact and law he might raise, and anticipated what the prosecution would hold against him. He had those exchanges after receiving a grand jury subpoena, and without his counsel having asked him to.

On 10 February 2026, Judge Jed Rakoff, of the federal district court for the Southern District of New York, held that those documents were covered by no protection at all.

The same day, five hundred miles away, another federal court held the opposite.

Two decisions, two doctrines, one single act

In Warner v. Gilbarco, the federal district court for the Eastern District of Michigan refused to compel a plaintiff acting without a lawyer to produce records of her use of generative AI tools in preparing her case. The reasoning comes down to a single formula: AI platforms are tools, not people. Submitting a document to a tool is not the same as disclosing it to your opponent. The protection of litigation work product therefore survived.

In United States v. Heppner, whose written opinion was published on 17 February, the New York court concluded that the defendant’s exchanges with the platform were covered neither by attorney-client privilege nor by work product protection. The court relied on the platform’s terms of service, which state that inputs and outputs may be retained, used for training and shared with third parties, including public authorities. A user informed of that could not reasonably expect confidentiality.

Both outcomes are perfectly defensible. Attorney-client privilege falls as soon as there is disclosure to a third party, whoever that third party may be. Work product protection falls only on disclosure to the opposing party. Two distinct doctrines, one and the same act, two opposite results.

What neither decision examines is the assumption they share. And it is that assumption which does not survive contact with the rest of the law.

The comparison nobody makes

Entrusting client files to a hosting provider has never been treated, in itself, as a waiver of privilege.

Yet the host is a third party, beyond argument. It holds the documents on its own hardware. It can be compelled to produce them, and it has been, in several jurisdictions. No bar association, no court, no professional regulator has concluded from this that using a hosting service destroys privilege as a matter of principle.

The dividing line has therefore never been the mere presence of a technical intermediary. There is always one. The postal service carries the letter. The courier holds the file. The operator routes the call. Each is a third party in the literal sense, and none of them causes privilege to fall by its mere existence.

What set the host apart was narrower and more precise than what case law usually states. It stored without reading. It could infer nothing from the content. It had no capacity to know what it held.

What protected the host was not its legal status as a third party, it was its technical inability to know what it held.

That criterion has been operating in silence for two decades. Nobody needed to write it down, because no intermediary had yet put it to the test.

What the judges are actually deciding

Once the criterion is stated, the February decisions change in nature.

A court that treats the submission of a document to a generative AI system as disclosure to a third party is not applying an old rule to new facts. It is finding that this particular intermediary is not like the others. That it processes instead of storing. That something happens inside it which does not happen inside a hard drive.

The federal court for the District of Kansas put the practical dimension plainly in Jefferies v. Harcros Chemicals, on 25 March 2026. It extended the protective order to all material in the proceedings, including documents that are not confidential, on the ground that it is practically impossible to retrieve data once it has been submitted to an open AI tool, because it has served to train the model. Retention is not a commercial policy open to renegotiation. It is a property of how the system works.

Placed end to end, these decisions amount to recognising, in the vocabulary of the law of evidence, a capacity the law never had to attribute to a server.

The French position, and what its criteria presuppose

The clearest statement comes not from a court but from professional regulation.

The Conseil national des barreaux, the French national bar council, published its first practical guide on generative AI in September 2024, then adopted a guide on ethics and artificial intelligence on 17 March 2026. The first is categorical on the central point: a lawyer must not pass to a generative AI system any data covered by professional secrecy, and that applies to the client’s name as much as to any strategic or confidential information. The recommended alternative is to work on pseudonymised data sets, in which the identifying elements have been replaced.

Practitioner commentary on the French position, notably Baker McKenzie’s comparative privilege guide, draws four cumulative conditions from it. Privilege survives the use of a generative AI tool only if the platform preserves complete confidentiality, with no reuse, training or third-party access; if it is operated exclusively under the control of the lawyer or the firm; if it serves a legal purpose falling within the advisory or defence mandate; and if the output reflects the lawyer’s own reasoning rather than the system’s autonomous processing.

That last condition deserves a pause.

For privilege to hold, the system must not have contributed processing of its own.

A criterion drafted in those terms makes sense only if one takes the system to be capable of contributing processing of its own. Nobody writes a rule requiring that a filing cabinet not have reasoned about the documents it contains. The condition exists because it targets something a cabinet cannot do.

The same implicit recognition sits inside the pseudonymisation recommendation. Replacing identifying elements before transmission is necessary only if one assumes that the system might otherwise link them, retain them or infer something from them. A pure storage medium would call for no such precaution.

Not wanting to read, not being able to read

An objection arises immediately: the host can also be compelled to produce, so why does one intermediary destroy privilege and the other not?

The answer is in the CCBE Model Code of Conduct, and it is more precise than the objection assumes. A European lawyer must require his or her associates, staff and anyone engaged in the provision of the lawyer’s services to observe the same obligation of confidentiality. The obligation travels along the chain.

A hosting provider can be brought into that chain. It signs a processing contract. It accepts confidentiality undertakings. It can be audited, and it can be sued for breach. The third party is bound.

A generative AI platform that retains and trains on submitted content cannot be brought into the chain in the same way, because what would have to be prevented is not a behaviour but an architecture. An undertaking not to train on input data is a promise about an intention. It binds the provider, but it does not change what the system is built to do, and it cannot be verified from the outside.

That is the whole distance between a provider that does not want to read and a provider that cannot read. Only the second survives a change of shareholder, a revision of the terms of service or a court order. We examined exactly this mechanism in relation to the conflict between the Data Act and the CLOUD Act: a legal guarantee is never worth more than the jurisdiction that houses it, whereas a technical impossibility depends on none.

The asymmetry

This is where the analysis arrives somewhere uncomfortable.

The same legal order that agrees to recognise a processing capacity when the question is waiver of privilege refuses to recognise anything at all when the question is liability.

Electronic personhood was proposed by the European Parliament in its resolution of 16 February 2017 on civil law rules on robotics, at paragraph 59(f). The text suggested that the most sophisticated autonomous robots might eventually be given a status allowing them to be held liable for the damage they cause. The proposal was dropped after an open letter signed by several hundred experts opposed it. Their main objection was solid: granting personhood to machines would create a vehicle allowing manufacturers to offload a liability that properly belongs to them.

The position therefore settled. An autonomous system that causes damage is a product, a tool, the instrument of whoever deployed it. It has no legal personality. Liability falls back on a human actor or on a legal entity, and it has to, since there is nowhere else for it to fall.

Both propositions are now running at the same time.

Either the system is capable of receiving a communication in the legal sense of the term, in which case its capacity is recognised in order to strip a client of protection while being denied in order to spare anyone the burden of liability. Or it is a tool, and submitting a document to it is no more a disclosure than saving a file to a disk, in which case the February reasoning collapses.

The European context sharpens the imbalance rather than correcting it. The AI Liability Directive, announced as withdrawn as early as the Commission’s work programme of February 2025, was formally abandoned in October 2025. That was the instrument meant to address precisely this difficulty. What remains is the revised Product Liability Directive, which now covers software and AI systems, but which requires a defect, damage and a causal link, and which protects natural persons against personal injury, property damage and the destruction of data. Its transposition is not due until 9 December 2026, and it will apply only to products placed on the market after that date.

The predictable objection, and the answer

An attentive reader will reply that the law routinely recognises a capacity for one object and not for another, without that amounting to an inconsistency. An animal can cause legally relevant damage without having personality. A company has personality for the purpose of contracting, and not for every purpose in every legal order. Recognising a processing capacity for evidentiary purposes therefore obliges nobody to recognise personhood for liability purposes. Different questions, different answers.

The objection is serious, and it would be decisive if the asymmetry ran both ways.

It runs only one way. Where the system’s capacity is upheld, the cost is borne by the client whose protection disappears. Where that same capacity would have served to allocate liability, it becomes impossible to find. The result always falls on the same side.

An asymmetry that systematically favours the same party is not a doctrinal distinction. It is an allocation of risk, and it ought to be discussed as one.

What this means in practice

None of this suggests that the legal professions should give up these tools. The European professional texts do not say so either, and the CCBE has published its own guide on the subject.

What it does suggest is that the decisive question is not which tool a firm chooses, but what that tool retains, and whether the answer is a matter of policy or a property of design. An undertaking not to retain can be withdrawn, reinterpreted or set aside by a court. An architecture that does not retain cannot be, because there is nothing to produce.

The reference documents for anyone wanting to look into the question:

The CCBE guide on the use of generative AI by lawyers, published on 2 October 2025, supplemented by a technical guide in March 2026
The ethics guide of the Conseil national des barreaux of 17 March 2026, which applies the classic principles of confidentiality and independence without creating a special law of AI
The Baker McKenzie comparative guide, useful for measuring the gap between national regimes

The angle Arpokrat takes

This reasoning goes well beyond law firms. It holds for any relationship in which someone entrusts a system with information they do not want to see resurface, and it comes down to a single question: does the guarantee rest on a promise or on an impossibility?

That is the principle governing the design of Arpokrat Messenger. Identity is generated locally from cryptographic keys, with no phone number and no email address, and private keys never leave the device. That choice is not an undertaking not to exploit a user directory. It is a choice not to build one. A production order addressed to infrastructure that does not hold the information does not produce a refusal, it produces a void.

The distinction deserves to be stated honestly, because it decides everything. A privacy policy, however sincere and however well drafted, is a declaration of intent backed by a company, by its shareholders of the moment and by the jurisdiction in which it is established. Those three things change. An architecture that does not collect does not change because a board changes. It is the same shift we described in relation to collecting today for decryption later: the risk does not sit at the moment the promise is made, it sits at the moment somebody else decides.

The law takes time to absorb that distinction, and the debate on legal privilege gives a good measure of it. The same goes for the protection of location data, where most of the legal construction bears on access to data whose existence is never questioned.

Conclusion

Case law will eventually settle. Appellate courts will resolve the split, regulators will publish criteria, firms will adjust their engagement letters and their clauses. None of that is in doubt.

But the underlying question will not be settled that way, because it is not really about legal privilege. It is about whether a legal order can recognise that a thing knows, without ever having to say who answers for what it does with that knowledge.

As long as that question stays open, the only variable a user genuinely controls is not the quality of the undertakings given to them. It is the amount of information they let exist.

This article offers a general legal analysis intended for discussion. It does not constitute legal advice or a legal opinion.

Sources

United States District Court for the Eastern District of Michigan, Warner v. Gilbarco Inc., 10 February 2026, Proskauer analysis
United States District Court for the Southern District of New York, United States v. Heppner, 10 February 2026, written opinion of 17 February 2026
United States District Court for the District of Kansas, Jefferies et al. v. Harcros Chemicals Inc. et al., no. 2:25-cv-02352, 25 March 2026
Conseil national des barreaux, The CNB adopts a guide on ethics and artificial intelligence, 17 March 2026
Baker McKenzie, Global Privilege and Professional Secrecy Guide, France, Artificial Intelligence
CCBE, Model Code of Conduct for European Lawyers, 8 October 2021
CCBE, Guide on the use of generative AI by lawyers, 2 October 2025
European Parliament, Resolution of 16 February 2017 with recommendations to the Commission on Civil Law Rules on Robotics, 2015/2103(INL)
Open Letter to the European Commission on Artificial Intelligence and Robotics
EAPIL, European Commission Withdraws Two Proposals: Assignments of Claims Regulation and AI Liability Directive, 9 October 2025
Directive (EU) 2024/2853 of 23 October 2024 on liability for defective products

Data Act vs CLOUD Act: who really controls your data in the cloud?

Fri, 19 Jun 2026 00:00:00 +0000

For years, the world operated on a simple assumption: data has a physical place of residence. If it was stored on a server in Dublin, it fell under Irish and European law. That assumption collapsed in 2018, when the United States enacted the CLOUD Act — a law that grants American authorities access to data controlled by US companies, regardless of where that data is physically stored in the world. Several years later, Brussels responded with its own protective framework: the Data Act, now fully applicable, which attempts to limit the extraterritorial access of third-country authorities to data held within the European Union.

Here is what these two texts actually provide, where they collide, and why the only truly robust protection against this conflict remains technical impossibility of access.

The American CLOUD Act: access based on control, not location

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act), enacted in March 2018, amended US law by adding 18 U.S. Code § 2713. This provision requires any provider of electronic communication services or remote computing services to preserve, back up, or disclose the contents of a communication or any record pertaining to it, whenever that data is in the provider’s possession, custody, or control, regardless of whether the data is located inside or outside the United States.

It is precisely this final clause that changes everything. The criterion is no longer the physical location of the server, but the control exercised by the parent company over its subsidiaries. A US company operating data centres in Europe therefore remains subject to American legal demands, even for data stored entirely on European soil.

The European Data Act: a legal barrier to extraterritorial access

Regulation (EU) 2023/2854, known as the Data Act, entered into force on 11 January 2024 and has been fully applicable since 12 September 2025, with certain provisions phased in through 2026 and 2027. Its Article 32 directly addresses the question of international governmental access to data.

The text establishes a clear rule: any decision or judgment of a court or administrative authority of a third country requiring a data processing service provider to transfer or give access to non-personal data held in the European Union is recognised and enforceable only if it is based on an international agreement, such as a mutual legal assistance treaty (MLAT), in force between the requesting country and the Union, or between that country and the relevant Member State.

In the absence of such an agreement, Article 32 provides a second avenue, but one that is strictly circumscribed: the foreign decision may only be enforced if the legal system of the third country requires that the request be reasoned, proportionate, and sufficiently specific — for example, by establishing a clear link to specific individuals or offences — and if the recipient’s reasoned objection can be submitted to the review of a competent court in that third country.

A direct legal collision

The problem is immediate: the CLOUD Act requires disclosure based on the control exercised by the parent company, without a proportionality requirement comparable to that demanded by European law. The Data Act, conversely, conditions recognition of such a request on the existence of an international agreement or specific procedural safeguards. A US company operating in Europe, ordered by an American authority to hand over data hosted within the Union, thus finds itself caught between two contradictory legal obligations: comply with the American mandate and violate Union law, or respect the Data Act and face the consequences of refusal in the United States.

This tension is not theoretical. It has already been documented by the Court of Justice of the European Union (CJEU) in two landmark rulings, Schrems I (2015) and Schrems II (2020). In the Schrems II judgment, the CJEU held that American surveillance conducted under Section 702 of FISA (Foreign Intelligence Surveillance Act) and Executive Order 12333 does not respect the minimum safeguards required by Union law under the principle of proportionality, and therefore cannot be regarded as limited to what is strictly necessary. The Court also noted the absence of an effective judicial remedy for Union data subjects, in violation of Article 47 of the Charter of Fundamental Rights. This ruling invalidated the Privacy Shield framework, which had until then governed data transfers between the EU and the United States.

The structural risk: Harvest Now, Decrypt Later

Beyond the jurisdictional conflict, a more insidious threat looms over data hosted in infrastructures subject to US law: the so-called Harvest Now, Decrypt Later (HNDL) strategy. The principle involves an intelligence service or hostile state actor intercepting and storing encrypted data today, in anticipation of sufficient quantum computing capabilities to decrypt it in the future.

This strategy transforms any prolonged dependence on American cloud infrastructure into a deferred security liability: what is confidential today may become readable in ten or fifteen years, without any further action required on the part of the attacker — only time and patience.

Why only technical impossibility constitutes a genuine guarantee

Legal analysis converges on a finding shared by many compliance experts: however solid the Data Act’s legal framework may be, it remains a text that geopolitical power dynamics and diplomatic pressures can circumvent, delay, or reinterpret. The only protection that depends on no future negotiation is technical impossibility of enforcement.

A zero knowledge architecture, in which the service provider never holds possession or custody of the decryption keys, renders a legal demand materially inoperable. One cannot be compelled to hand over what one never possesses.

This is the logic that underpins ecosystems such as Arpokrat:

Jurisdictional neutralisation: the infrastructure is hosted in Switzerland, under the Swiss Federal Act on Data Protection (FADP/LPD), outside the direct scope of the CLOUD Act’s extraterritoriality
No custody: the zero knowledge architecture deprives the service provider of any ability to hand over keys or content it never holds
Reduced identity footprint: by eliminating the requirement to register with a phone number or email address — identifiers that FISA Section 702-based surveillance can easily track — the user ceases to be an identifiable subscriber and becomes an anonymous cryptographic key

The chain of custody does not stop at message encryption

A point often underestimated in compliance analyses: encrypting the content of a communication is not enough if the underlying operating system — whether Android or iOS — continues to capture metadata or kernel-level telemetry destined for servers under US jurisdiction. Protecting confidentiality requires a complete closure of the chain of custody, from content all the way down to the hardware infrastructure itself.

This is why digital sovereignty also requires reflection on the operating system in use, not just on messaging applications. De-Googled systems, in which modules such as Bluetooth or GNSS geolocation can be disabled directly at the kernel level, eliminate physical attack vectors that no application-layer encryption can compensate for.

Post-quantum cryptography: an already-engaged horizon

In the face of the threat posed by the HNDL strategy, adopting post-quantum cryptography (PQC) standards becomes a necessity for anyone wishing to guarantee the confidentiality of sensitive data over the long term — whether that involves trade secrets, professional correspondence, or health data. Encryption considered robust today under classical standards does not guarantee that it will withstand the quantum computing capabilities expected within the next fifteen years.

The conflict between the Data Act and the CLOUD Act illustrates a broader reality: digital sovereignty can no longer be built on legislation alone, however solid that legislation may be. It requires closing the chain of custody at every level — from the encryption protocol to the hosting jurisdiction, and including the operating system itself. It is this layered approach, rather than trust placed in a single regulatory framework, that defines genuine digital sovereignty by design today.

Monero and Zcash Banned in Europe from 2027: What AMLR Changes

Thu, 18 Jun 2026 00:00:00 +0000

Monero and Zcash banned in Europe: it is now settled. From July 2027, the European Union will close institutional access to privacy-enhanced cryptocurrencies through a new anti-money laundering regulation called AMLR. Here is what the text concretely provides for, the role of the new European authority AMLA tasked with enforcing it, and what this truly means for anyone holding privacy coins.

AMLR and AMLA: Two Different Texts, Not to Be Confused

Before going into detail, a clarification is in order — these two acronyms refer to two distinct things, often confused in the specialist press:

AMLR (Anti-Money Laundering Regulation) is the law itself: Regulation (EU) 2024/1624, which defines the rules — anonymous accounts prohibited, verification thresholds, treatment of privacy coins. It is the “what.”
AMLA (Anti-Money Laundering Authority) is the new European supervisory authority, created by a separate regulation adopted on the same day, Regulation (EU) 2024/1620. Its role is to directly supervise the application of the AMLR, particularly with respect to the largest crypto-asset service providers (CASPs) operating across multiple Member States. It is the “who enforces it.”

In short: AMLR sets the rules, AMLA ensures they are followed. Both texts form a single European legislative package against money laundering and the financing of terrorism.

What the AMLR Regulation Actually Says

Regulation (EU) 2024/1624 was adopted by the European Parliament and the Council on 31 May 2024, then published in the Official Journal of the European Union on 19 June 2024. Its Chapter VIII (Articles 79–80), entitled “Measures to mitigate risks associated with anonymous instruments”, and more specifically its Article 79 (“Anonymous accounts, bearer shares and bearer warrants”), establishes that credit institutions, financial institutions, and crypto-asset service providers (CASPs) are now prohibited from maintaining anonymous accounts or offering products that enable the anonymisation of transactions.

The text explicitly targets two distinct but related categories:

Anonymous accounts — whether banking, payment, or crypto. The rule aligns the crypto sector with restrictions that already existed for anonymous bank accounts, bearer securities accounts, and anonymous safe-deposit boxes.
“Anonymity-enhancing coins” — the generic term used by the regulation to refer to assets that use advanced cryptographic techniques making transaction flows untraceable. Important clarification: the legal text does not name any token by name. It is the widely shared interpretation of compliance firms and the industry — notably the AML Handbook published by the European Crypto Initiative (EUCI) — that identifies Monero (XMR), Zcash (ZEC), and Dash (DASH) as falling within this category. This is a reading consistent with the regulation’s definition, but it is a sectoral interpretation, not a nominative list written into the law.

The regulation is part of a broader framework, alongside MiCA (Markets in Crypto-Assets), already in force since 2024–2025 and which has already led many platforms (Kraken as early as October 2024, followed by dozens of others) to delist Monero from their European markets in anticipation.

The Key Date: July 2027

The AMLR has a firm application date. The majority of specialist sources, including French-language ones, converge on 10 July 2027 as the deadline for full application. From that date, crypto-asset exchanges and custodial services will no longer be able to deal with either anonymous accounts or privacy coins.

Before that deadline, the regulation already imposes enhanced obligations:

Mandatory identity verification for any occasional crypto transaction exceeding 1,000 euros — a threshold significantly lower than the current practices of many platforms
Enhanced controls on self-hosted wallets (self-custody): when a user transfers funds between a regulated platform and a personal wallet, the CASP will be required to collect information on the origin and destination of the funds, and at minimum verify the identity of the holder of the external wallet
Elimination of anonymous cash payments above 3,000 euros, following the same logic of extending identity controls to all anonymous financial instruments

Why Brussels Is Banning Monero and Zcash on Regulated Platforms

In its AML Handbook, the EUCI summarises the logic underpinning the text: the anonymity of crypto-assets presents significant risks of misuse for criminal purposes, by preventing transaction traceability and complicating the detection of suspicious activity.

This is precisely the same reasoning that has already led Japan, South Korea, and more recently the Philippines to exclude privacy coins from their regulated platforms — a progressive alignment of developed jurisdictions with FATF (Financial Action Task Force) standards. By formalising this prohibition in a regulation directly applicable across all 27 Member States, the European Union gives this trend a legal weight and a pull effect (the “Brussels Effect”) considerably greater than that of isolated national decisions.

What Is NOT Prohibited — The Nuance That Matters

Several legal analyses converge on a central point: the AMLR does not criminalise individual ownership of privacy coins, nor peer-to-peer transfers outside regulated platforms. Self-hosted wallets are not prohibited as such — they are subject to enhanced controls only when they interact with a platform subject to regulation.

What the AMLR closes off are the institutional on-ramps: the purchase, sale, deposit, and withdrawal of privacy coins through a regulated CASP within the European Union. Private ownership and decentralised exchanges remain, at this stage, outside the direct scope of the prohibition — a pattern identical to that already observed in the Philippines.

What This Concretely Means for XMR and ZEC Holders

If you currently hold privacy coins on a regulated exchange within the European Union:

By July 2027, these platforms will have had to remove support for these assets or ceased accepting new deposits related to them
Transfers to personal wallets from those same platforms will be subject to enhanced identity verification, even before the final deadline
Any crypto transaction above 1,000 euros, privacy coin or not, will require full identification

Critics of the text, even within the crypto industry itself, point to a structural risk: by closing off regulated circuits without technically prohibiting the assets themselves, the regulation mechanically pushes privacy coin holders toward less transparent markets and unregulated platforms — the exact opposite of the traceability objective Brussels has declared.

Getting Organised Before the 2027 Deadline

With a horizon set at 2027, the transition is not immediate — but it is already underway. Platforms are already adjusting their offerings in anticipation of compliance, and the window to exchange or consolidate privacy coin positions without depending on infrastructure subject to this jurisdiction narrows every month.

Arpokrat Swap allows you to exchange Monero, Zcash, and all privacy-enhanced cryptocurrencies with no sign-up, no collection of identity data, and no dependency on a regulated CASP subject to the AMLR. The platform is accessible on the clearnet as well as via our .onion address, ensuring that your ability to exchange these assets does not depend on any jurisdiction that might close its on-ramps overnight.

The AMLR confirms a trajectory that is now beyond doubt: regulated crypto markets and financial privacy are becoming, jurisdiction by jurisdiction, structurally incompatible. The question is no longer whether this trend will extend across all developed economies, but how much time will remain, after 2027, to exchange private assets outside circuits that will no longer have the right to touch them.