Mira: Once the law is passed, its interpretation and application become the tasks for many different actors, such as public supervisors and private actors. These actors in turn may have different views on how to comply with the law, due to, among other things, different organizational settings, educational or national backgrounds of individual supervisors, to name but a few. The application of the law and the monitoring of compliance (the latter being the first step of enforcement) lead to the processes and decisions, which require explaining how the law is being understood by, for instance, supervisors, and how they will enforce it, or how compliance will be done within an organization. This ‘grey area’ of executive discretion raises a number of pertinent questions. More specifically, the question is who should be in charge to saying how compliance is ought to be done and, for instance, if public supervisors should be operationalizing the law with the help of internal and/or external documents, such as risk-based policies and guidance, for effective and consistent application? How should supervisors and private entities align different laws to address specific concerns, which may fall just in between existing regulatory frameworks? etc. The tension here is about legitimacy and controls of soft law, on the one hand, and attempts to ensure legal certainty and effectiveness, on the other hand. Ultimately, it is about the question of what is fair and what is legally certain? Let an addressee of a law develop compliance on their own, even though this may lead to possible non-compliance (as judged by a public authority), an investigation, or a fine? Or should a public supervisor help complying to ensure that the investigation or the fine is only a matter of the last resort, ie when non-compliance has been persistent? To what extent should EU law-maker regulate enforcement, and to what extent should this be left to the EU shared administration and eventually the courts, the latter option leading to a long waiting period before legal certainty may be established? These have been the questions that I have been investigating in my ongoing research projects, and which I have brought to my classroom during LLM Law & Economics’ course ‘supervision of markets, enforcement and agency design’. I am delighted to share interesting thoughts from three graduates of this master, who have written their theses with me on these pertinent questions. While dealing with different policy areas – from EU Space Law to AI-enabled risks and Anti-Money Laundering, common conclusion seems to be clear: effectiveness of a law can certainly benefit from the clarity of the law, especially on who should organize compliance, alignment with other laws, and with how much discretion. Leaving the task of establishing legal certainty to the courts only may lead to ineffective laws, wrong applications, unnecessary overcompliance, and impede innovativeness.
Alexandra: My thesis was titled ‘Legal Certainty and Enforcement Gaps in EU Space Law: Assessing the EU Space Act’s Approach to Debris Mitigation in Low Earth Orbit’. What sparked my attention was Dr. Scholten’s paradox: we enact EU law to create certainty, yet the way it is enforced frequently returns the very uncertainty it was meant to remove. I wanted to test that paradox in a field where regulatory failure is not a doctrinal inconvenience but a tangible and largely irreversible one. Launch rates have gone from roughly 300 payloads a year in 2018 to around 1,500 today, and debris between 1 and 10 cm can be neither shielded against nor tracked, so the legal burden falls on ex ante design rather than ex post liability.
The problem I tackled was therefore whether the Commission’s June 2025 EU Space Act proposal delivers on its own promise of legal certainty, or whether it reproduces enforcement-driven uncertainty in regional form. I built a single framework from three literature streams that had never been used jointly to assess a specific EU instrument: legal certainty, EU enforcement, and space law, on the premise that certainty and enforcement are two halves of one question: can an operator, and the authority supervising it, know in advance what is required and what follows from non-compliance?
My conclusion is that the Act is a genuine but partial advance. Against the international regime it is strongly favourable: binding debris definitions, direct obligations on private operators, a quantified de-orbit horizon. Against European fragmentation – the problem it was mainly designed to solve – the Act creates more consistency, but stops short of fully resolving the problem.. At least twelve operational standards are deferred to implementing acts carrying no statutory deadline, and a two-track asymmetry leaves the New Space operators generating most of the risk under an open-ended penalty provision. Dr. Scholten’s paradox is narrowed, not closed completely.
Dr Scholten's paradox - we enact EU law to create certainty, yet the way it is enforced frequently returns the very uncertainty it was meant to remove - is narrowed, not closed completely.
Feyza: My thesis, titled ‘Deepfake-Enabled Impersonation and Remote KYC: An Assessment of the EU Regulatory Framework’, evaluates how well the European Union’s regulatory ecosystem manages the risks of AI-enabled impersonation fraud in remote financial onboarding processes (e-KYC). The core problem is that advanced deepfake technologies, such as synthetic identities and injection attacks, can now easily bypass traditional biometric verification and liveness detection systems. This transforms them into organized financial cybercrime tools that directly threaten market integrity.
The EU has built a broad regulatory framework, but it is unclear if these general rules provide the specific operational safeguards needed to stop real-time AI deception in finance. To answer this, the thesis directly evaluates the eIDAS 2.0, AMLR, AI Act, GDPR, and DORA regulations. As no single legal source defines an adequate defense against deepfake fraud, I derived the evaluation criteria from FATF and EBA supervisory guidance and built an original scoring matrix around three main benchmarks (including three sub criteria for each): future-proofness, control adequacy, and risk sensitivity.
The main finding reveals that the EU regulatory framework is only partially capable of addressing these deepfake-enabled impersonation risks. Although the ecosystem successfully establishes a strong foundation for digital identity governance by ensuring high compliance in technology neutrality and identity assurance levels, it suffers from a fragmented distribution of regulatory responsibilities. Crucially, the AI Act exempts commercial biometric verification systems from mandatory high-risk obligations. This leaves significant structural vulnerabilities in continuous monitoring, dynamic risk assessment, and rapid ad-hoc reviews. Ultimately, the thesis concludes that to resolve these weaknesses, the EU must maintain technology neutrality while adopting a more outcomes-based regulatory approach that enforces clear, minimum operational safeguards against AI-enabled financial fraud.
The EU must maintain technology neutrality while adopting a more outcomes-based regulatory approach that enforces clear, minimum operational safeguards against AI-enabled financial fraud.
Marius: My master’s thesis examines the newly established Anti-Money Laundering Agency (AMLA), tasked with supervising major financial institutions regarding anti-money laundering. At the heart of the research is Art. 5(6) of Regulation (EU) 2024/1620 (AMLA-R), which empowers AMLA to apply both Union law and national rules transposing EU directives. This takes place in the field of ‘mixed administrative procedures’, which are characterized by complex, multi-staged decision-making processes. My central objective was to evaluate whether Art. 5(6) AMLA-R aligns with the principle of legal certainty.
To achieve this, I needed to define the principle of legal certainty. While it is often discussed redundantly, its core remains elusive. Thus, I approached the principle from a philosophical point of view that resulted in the fundamental understanding closely connected to legal justice. Based on that, I divided the principle of legal certainty into three components. By applying these components, multiple questions arose. The thesis defines what ‘national law transposing directives’ are and which national rules fall under that term. Additionally, I assessed the ability of courts to review preliminary decisions based on national law. Based on Fininvest SpA and Others the relevant literature (e.g. Brito Bastos, 2020) a “reviewability gap” for courts in mixed administrative procedures became apparent. Because of that and the uncertainty regarding the definition of “national law transposing directives”, my conclusion is that Art. 5(6) AMLA-R is not sufficiently certain and needs further clarification.
I suggest that clarification has to be done via soft law by the supervisor AMLA, rather than resolving ambiguities through court proceedings. If the supervisor communicates with those being supervised and seeks sincere cooperation, far better results can be achieved, which benefits both sides. In the end, the centralization of supervision at AMLA has many advantages. Nevertheless, it should be emphasized that rules need to be sufficiently certain so that the individuals and the law enforcers will not be overlooked in the practical implementation of the law.
Rules need to be sufficiently certain so that the individuals and the law enforcers will not be overlooked in the practical implementation of the law.
This blog post has been written by the graduates of the 2026 LLM Law & Economics master programme at Utrecht University and their thesis supervisor and this master programme’s director Miroslava Scholten. This blog post supports the idea of ‘Do not waste good students’ research!’ motto and the ‘Student’s Research for Society’ project.
