The transformative potential of digitalisation is already evident in many areas of our modern societies: the steady spread and increasingly intensive use of chatbots alone give a glimpse of the growing relevance of digital technologies in everyday life. The phenomenon of digitalisation is not only of relatively recent origin, but is also itself undergoing a constant process of change. These changes affect not only our communication and consumption patterns, but also other areas such as our legal systems.
Digitalisation creates new realities, not only for individuals but also for businesses and many other areas of society. Alongside the creative and progressive impetus provided by digital technologies, there is a simultaneous need for normative, political and, not least, legal frameworks and safeguards to counteract negative effects and risks. However, these consequences do not constitute a uniform category; rather, they range from data theft and the distribution of counterfeit goods to anonymous insults and threats, as well as forms of addictive behaviour and depression, right through to scenarios involving the end of democracy[1] .
Professor Karsten Löw, who has held the Chair of ‘Commercial Law, in particular the Law of Digitalisation, as well as Commercial and Company Law’ at Schmalkalden University of Applied Sciences since last year, specialises in law in the digital sphere, with a particular focus on artificial intelligence. Returning to the chatbots mentioned at the outset, one question that arises in this context, for example, is who is liable for damages caused by misinformation from such an application: the user, the provider, the developers, those supplying the training data, etc.? This is an open question that is as contentious as it is complex.
The digitalisation of society
Any engagement with the manifold processes of digital transformation faces the not inconsiderable challenge of constant change, which inevitably undermines our grasp of the subject. The latest news regarding Anthropic alone – ranging from the ‘Myth’ model and the risk of automated discovery of security vulnerabilities, through to the restrictions imposed by the US administration and their subsequent lifting – gives an impression of just how fast-paced this field is.
An unusual warning from that very company remains highly relevant: there is a risk that artificial intelligence could take on a life of its own if research into it continues to advance so vigorously and without regulation. This warning culminated in a plea to pause development and draw up a global code of conduct, which would also give societies the opportunity to become accustomed to the new technologies and develop a critical approach to them . Whilst there is certainly a risk that this is merely a marketing campaign, it is clear that the necessary condition – that at least all major AI tech companies must cooperate – is virtually impossible to fulfil. The same applies to the latest reports of undesirable incidents involving the AI systems of two companies: the potential for artificial intelligence to take on a life of its own represents a potential threat in our digital age, to which answers still need to be found across many fields and at many levels.
The law in the digital sphere
Rapid technological progress is therefore always accompanied by risks: as the case involving Collien Fernandez made clear, the speed of technological development has presented legal systems with problems. Leaving the specific case aside, gaps in the application of the law became apparent here, as did the sometimes difficult task of regulating the digital space through the law and linking it back to analogue reality. The fundamental question that arises in this context goes beyond the legal punishment of offences in cyberspace and points to the need for a principled framework governing the digital realm, which implies not only political and legal but also normative dimensions. The very lack of physicality inherent in the digital realm demands a realignment of the law with regard to these areas of application – such as contract law and property law, amongst others – which must be interpreted anew or adapted to the digital space. Karsten Löw’s field of research therefore presents its own challenges, which stem from the singularity, topicality and transformability of its subject matter, and which are further intensified by the interrelationships with other areas of law in which digitalisation is gaining influence.
The relationship between the law and the digital sphere, which is the focus of this discipline, is complex, fragmented and still all too vague. On the one hand, there is the law with its nuanced, codified body of legislation. Through laws, regulations and other rules, the law creates a reliable, transparent and enforceable framework that helps to organise human coexistence in various areas. On the other hand, there is the digital world, which at times seems to be subject to genuinely different imperatives. Even today, the internet has lost little of the anarchic nature that characterised it in the early 1990s and 2000s. The sheer abundance of offerings and possibilities is counterbalanced by a vast sphere of illegality and semi-legality reminiscent of a sort of ‘Wild West’. The rapid pace of change and the innovative nature of the digital realm do not exactly make it easy for the legal system to provide suitable and applicable regulations. Adding to the complexity is the fact that the internet is, by its very nature, a global network that tends to transcend the boundaries of national legislation. Regulations are therefore not obsolete, but they must take these conditions into account.
Data in civil law
A major area of law alongside criminal law is private law, also known as civil law, which, put simply, governs the legal relationships between natural persons and legal entities – that is, companies – and encompasses areas of law such as inheritance law, commercial law, family law, employment law and property law. Needless to say, digitalisation is also creating new regulatory needs in this area. One open question is what the status of data is under civil law and how its legal regulation will take shape.
Although data does not have a specific place within civil law, it is the subject of civil law issues, and its significance is set to increase in the course of the digital transformation. Unlike other goods, data is non-rivalrous; that is to say, it can be used by several people without any problems. Data can be copied, distributed and made available, which distinguishes it from most other goods. At the same time, data has no fixed location: whilst it may exist as encoded information on data storage media, the two do not coincide and can be separated (i.e. the data can be copied, etc.). Ultimately, there is currently no right of ownership over data.
However, data can certainly be regulated as the subject matter of contracts; for example, training data acquired via cloud services. Even without the physical nature of data or its storage media, provisions governing the sale of goods apply here. The issue of liability for defective apps and the terminability of user contracts are also regulated here. One issue in this context – which has now been clarified – is whether the law on breach of contract applies when payment is made in the form of personal data. The Data Act introduces a novel provision, allowing users of products such as cars to use the driving behaviour data collected by the vehicle themselves, to share it with third parties (such as garages) and to be required to consent to its use.
These examples illustrate the role that data already plays in civil law. It is foreseeable that this legal position will need to be further clarified as a result of the increasing relevance of data. At the political level, there is a clear recognition and willingness to restructure this area through a ‘Data Code’. This would be a first step towards effectively addressing the fragmentation of the legal treatment of data across different regulatory contexts. However, as another area demonstrates, the coherence of political guidelines is a crucial aspect.[2]
Well-intentioned and well-executed…
The basic idea seems as clear as it is worthy of support: software and applications based on artificial intelligence models, which adhere to the principles of open source – namely transparency, free access and open-source code – are to be supported by legal provisions. In concrete terms, this preferential treatment refers to sector-specific exemptions, meaning that this software is excluded from the scope of laws and regulations.[3] In short, they are therefore subject to less stringent requirements than their commercial competitors, which is intended to promote these offerings and their innovative potential. The problem, however, according to Karsten Löw, is that the framework legislation is based on an inadequate understanding of open source, meaning that the measures are ineffective and the political impetus is undermined.
Firstly, with regard to openness, three AI models can be distinguished: on the one hand, there are closed variants that do not publish any code, weights or data. On the other hand, there are fully open and reproducible models which, in addition to the weights and training data, sometimes also make the training process public (Open Weights). The third variant lies somewhere in between: these are models that make at least part of their content— ly the trained model parameters—publicly accessible. The actual training code and the data processing parameters, however, remain closed. Consequently, only the second variant achieves the transparency necessary for reproducibility.[4]
According to Karsten Löw, a fundamental problem is that open source is closely associated with a lack of monetisation. It is therefore not a question of availability and transparency, but of maintaining a distance from commercial exploitation. On the one hand, the problem here is that these non-commercial variants fall outside the regulatory framework per se, as they are linked to an economic activity or consideration. On the other hand, this approach fails to recognise the economic logic of modern platform strategies: whilst large providers do allow the non-commercial distribution of certain offerings, these form part of a comprehensive ecosystem designed to attract users. Start-ups, on the other hand – which are the actual focus of the funding – cannot afford to forego monetisation. Even if they otherwise meet all the criteria of open source – such as transparency, free accessibility and reproducibility – this is not sufficient.
In his conclusion, Karsten Löw argues in favour of abandoning the one-sided requirement of non-monetisation as a condition for legal preferential treatment, and instead focusing on the actual accessibility, verifiability and developability of AI models, regardless of the possible existence of business models. This would be the way to fulfil the purpose of the exceptions, which aim to promote open-source software and can thus also contribute to European digital sovereignty
The relationship between progress and control
To shed a final light on another area, we shall now turn to two aspects of governance – that is, the political steering and control of AI systems that are sometimes highly risky. This refers to AI models which, if misused, pose an enormous potential threat. On the one hand, there are high-tech companies that evade supervision and control; on the other, a supervisory body that suffers from institutional shortcomings. Taken together, these findings paint a picture of failings in AI governance that could have serious consequences in the medium and long term.
We had already mentioned Anthropic’s Mythos model, but not the fact that the company has only made the technology available to selected government bodies and organisations. The reasoning behind this echoes a statement by the former Federal Minister of the Interior, Thomas de Maizière, which has since become something of a proverb, to the effect that parts of the response could cause unease amongst the public: The programme poses a significant security risk, as it is capable of automatically identifying security vulnerabilities. The potential threat to critical infrastructure is evident and is becoming even more severe as a result of increasing digitalisation. From a governance perspective, the problem arises that this technology is in the hands of a single company, which decides how it is distributed.
At European level, this attempt to evade control is being addressed inadequately, which Löw describes as structural blindness that is, moreover, self-imposed. In short, the scope of the EU’s AI Regulation (AI Act) extends only to those AI systems that have been placed on the market within the European Single Market. The example of ‘Mythos’ illustrates that, on the one hand, an AI system has significant implications for EU Member States, yet on the other hand, the regulation does not apply because the technology was simply never placed on the European market. The need to define binding rules at international level and to establish mechanisms for ensuring compliance therefore appears both rational and urgently necessary.
However, it is not only the regulatory framework at European level that has been found to have shortcomings; the supervisory authorities in the Federal Republic of Germany are also facing criticism. Under the AI Act, Member States were obliged to establish supervisory structures for AI technologies. In the Federal Republic of Germany, the Federal Network Agency is tasked with implementing the Market Surveillance and Innovation Promotion Act. Part of this involves establishing an independent AI market surveillance chamber, whose remit covers particularly sensitive areas such as law enforcement, border management and the judiciary. As demonstrated by the Palantir software’s deployment in Hesse and Bavaria, which has already begun, the establishment of such independent supervisory bodies is urgently needed. However, the independence of this chamber is open to question, as it is, organisationally and institutionally, part of the Federal Network Agency. These shortcomings are all the more serious given that, in cases of doubt, they affect areas sensitive in terms of fundamental rights.
To conclude this brief insight into Karsten Löw’s field of research, it can be said that whilst this highly dynamic field presents a number of challenges, this work is also of the utmost social relevance. The potential of digitalisation is just as great as the risks posed by its misuse.
[1] https://www.deutschlandfunk.de/trailer-tech-bro-topia-102.html
[2] For interested readers, further information is available here: Karsten Löw, ‘Data in Civil Law’, Juristische Arbeitsblätter (JA) 2026, 177 ff.
[3] Needless to say, these exceptions do not apply to software in sensitive areas, regardless of any open-source affiliation it may have.
[4] It is worth noting in this context that, whilst open models lag behind closed models in terms of technological development, the gap is surprisingly small according to a comparison by Chatbot Arena.