Chasing Innovation: Why Law Keeps Falling Behind Technology

Technology is reckless; inventions are glorified; law is seemingly present, but not really. Our world’s greatest past conceptions were distinct: the printing press in the midst of the 15th century, the electric light, the telephone and the automobile during the late 19th century, the airplane in the early 1900s; for centuries we managed to keep a clear track of how our world was revolutionized and inherently altered by innovation. Law on its part, always had the role of rationalizing notions that could easily get out of hand and hamper social cohesion, by establishing control mechanisms and protocols that safeguard in their entirety our world’s different societal needs and norms.

Considering the introduction of automobiles in the late 1800s, this technological breakthrough revolutionized transportation and commerce, yet it was launched without basic safety measures such as seatbelts. It took decades for lawmakers to address this gap. The change came through the advocacy of an American lawyer and political activist Ralph Nader, whose ground-breaking 1965 book “Unsafe at Any Speed” exposed a new danger, the car accident. His efforts contributed directly to the passage of the National Traffic and Motor Vehicle Safety Act of 1966, which included provisions regarding seatbelts, indicating the necessity for regulation against technological innovation.

Back then, regulators had enough time and space to closely examine new inventions, identify potential threats and dangers for consumers, and create concrete safeguarding frameworks accordingly. Technology and law moved simultaneously and almost in parallel. What is happening now is a totally different story; we are witnessing a real-time race: technology sprints ahead with relentless speed, while law and regulation scramble to keep pace.

This intense velocity of technological breakthroughs is owed to the insulation of the information technology sector; the industry acts as if it does not have to worry about harm or impact. New technologies are served daily on consumers’ plates raw, without proper preparation or interdisciplinary elaboration. Regulators are striving and often failing to adapt to a continuously changing environment that is completely unprecedented; no one knows what is coming next. Yet regulators must be in a position to regulate effectively. For instance, when rules are imposed on domains such as artificial intelligence or cybersecurity without a thorough grasp of their technical foundations, a significant gap emerges: policymakers end up regulating in abstracto, while societies face challenges in concreto.

This regulatory gap and the evident distance with technological innovation are perhaps most evident in the field of data protection. In an environment of continuously evolving technologies and unprecedented technical structures, regulators have increasingly resorted to regulating in principle, in an effort to cover merely the edges of each given subject. The General Data Protection Regulation (GDPR) constitutes a strong example of this strategy: rather than setting detailed technical measures, it introduces intensely vague concepts such as “appropriate technical and organisational measures” (Art. 32 par. 1),  “unambiguous consent” (Art. 4 par.11) , “Fairly” and “Lawfully” (Art. 5 par. 1a), generally considered ambiguous terms without a specific and established threshold of determination.

While this flexibility is intended to ensure technological applicability and long-term relevance throughout the coming years, it has also introduced a degree of legal uncertainty, one that makes frameworks ineffective and easy to bypass. Organisations are left to interpret abstract legal standards in concrete, fast-moving technological environments, often without clear guidance as to what compliance truly requires in practice. But truly, how much is 2016, the year that Europe and the world met GDPR, similar to 2022, the year that OpenAI released ChatGPT which sparked the emergence of an array of AI tools and the exponential acceleration of machine learning? And how can the supposedly GDPR established and safeguarded rights such as erasure be meaningfully exercised when data controllers and data importers are increasingly diffuse, layered, or altogether unidentifiable and when user prompts and outputs might be used to train AI models even after deletion?

History demonstrates that technological progress without legal oversight does not result in neutral innovation, but in asymmetrical risk distribution, where benefits are privatized and harms are socialized. The automobile did not become safer through voluntary industry ethics; it became safer through binding legal intervention. The same logic applies today.

For legal practitioners, regulators, and organisations alike, the challenge is no longer whether regulation is necessary, but how existing legal frameworks should be interpreted and applied so as to bridge regulatory gaps and fulfill their original purpose: serving society in the face of a technological revolution.