1.1.1 The Algorithmic Leviathan

In the seventeenth century, Thomas Hobbes famously argued in favour of a strong, undivided and absolute sovereign – poetically captured by a reference to the biblical LeviathanFootnote ² – who would safeguard society against a war of all against all.Footnote ³ Through the establishment of a social contract, citizens would agree to give up certain freedoms in exchange for the peace and security that the powerful sovereign would provide. Following Hobbes’ influential work, the term Leviathan – still conjuring up the image of an all-mighty stateFootnote ⁴ – has been used to refer to authoritarian regimes.Footnote ⁵ However, it is increasingly also applied to liberal democracies of which it is argued that their executive branch of power (and public administration in particular) has become overly powerful.Footnote ⁶ More recently, the term is also deployed in the context of public authorities’ increased reliance on algorithmic systems, which have proven to be a highly potent and effective tool to exercise and amass power – giving rise to the so-called Algorithmic Leviathan.Footnote ⁷ Today, a mounting number of states – regardless of their political form of organisation – are arguably starting to qualify for this appellation.

In essence, algorithmic systems enable the automation of tasks through various techniques, from simple rule-based algorithms to more complex knowledge-driven and data-driven methods, including artificial intelligence (AI).Footnote ⁸ Such systems are increasingly used by public and private actors alike for a range of functions, from the recommendation of books that consumers might like to purchase online or the prediction of crime hotspots, to the approval of a loan. Given the impact they have on their environment and on people subjected to their outputs, algorithmic systems are hence tools through which one can wield powerFootnote ⁹ and through which one can regulate – whereby regulation is understood, broadly, as a means to manage risk or influence behaviour to achieve a pre-specified goal.Footnote ¹⁰

Regulation can, however, also be understood more narrowly: as a means used by a public authority to influence behaviour or to manage risk through law.Footnote ¹¹ Public authoritiesFootnote ¹² of the executive branch of power – tasked with the implementation, application and enforcement of law – increasingly deploy algorithmic systems to regulate in this narrower sense. Across the European Union (EU), Member States have, for instance, started deploying algorithmic systems to assist in decision-making regarding the initiation of tax fraud investigations, the allocation of social welfare benefits, the risk assessment of children’s well-being, the profiling of criminals, and a range of other administrative acts.Footnote ¹³

While reliance on algorithmic systems raises intricate ethical and legal questions in private and public contexts alike, in this book, I will be focusing on this narrower type of regulation, and particularly on how public authorities rely on such systems to inform or take administrative acts. Drawing on a definition from the Council of Europe, administrative acts comprise (1) legal acts, of both individual and general application, (2) physical acts of the administration taken in the exercise of public authority which may affect the rights or interests of natural or legal persons; and (3) situations of refusal to act or an omission to do so in cases where a public authority is under an obligation to act.Footnote ¹⁴ It is through these acts that the executive branch of power regulates individuals, and directly and significantly impacts their lives. As this book will demonstrate, by increasingly outsourcing the adoption of administrative acts to algorithmic systems, the executive can not only act more efficiently but also more powerfully, hence transforming into an Algorithmic Leviathan. Given this specific focus – and being well aware that other scholars have used the term more broadlyFootnote ¹⁵ – in this book I will reserve the term algorithmic regulation to denote public authorities’ use of algorithmic systems to inform or take administrative acts.

The benefits of algorithmic systems are well known. Their use to automate administrative acts can improve productivity, lead to cost savings, and generate efficiency gains, particularly by operating at scale.Footnote ¹⁶ Against the background of an aging civil servants’ population, an increasing workload and widespread budget cuts, it is thus no wonder that public authorities are strongly incentivised to adopt this technology on a large scale, as part of the EU’s digital agendaFootnote ¹⁷ and the broader impetus to digitalise the public sector.Footnote ¹⁸ The European Union’s recovery plan – the “largest stimulus package ever”, aiming to “rebuild a post-COVID-19 Europe”Footnote ¹⁹ – even explicitly includes a pillar on ‘digital transformation’ that Member States need to integrate in their recovery plans to receive a financial contribution.Footnote ²⁰ Reference is thereby made to investments in “government ICT solutions, e-services, applications”, including the “use of advanced technologies (such as high performance computing, cybersecurity or artificial intelligence) for public services and decision making”.Footnote ²¹

While the potential of algorithmic regulation is clear, the technology can also cause significant harm.Footnote ²² This risk is inherent to the use of any technology, yet the features of algorithmic regulation – and the exercise of power that they enable, along with the delegation of human authority and control over impactful decisions – raises particular threats.Footnote ²³ First of all, algorithmic systems are shaped by human programmers, and they can hence reflect the prejudices and biases of these programmers, or of the data selected by these programmers to train them on, which can lead to discriminatory outcomes.Footnote ²⁴ Algorithmic systems also process vast amounts of (personal) data, based on which they can instantly categorise and profile individuals, infer new (sensitive) information about them, and intrude their personal sphere.Footnote ²⁵ Furthermore, algorithmic systems can be used in an opaque manner, which might make it more difficult to identify and address potential unintended errors or prejudices. More importantly, such opacity can also conceal the possible risk that they are deliberately designed in a biased, intrusive or erroneous way.Footnote ²⁶ Due to the scale and speed at which these systems can be used, the consequences when something goes wrong can be enormous.Footnote ²⁷

Unsurprisingly then, the increased adoption of algorithmic systems is met with increased concern. As a growing body of scholarship has analysed, the use of such systems can adversely impact the rights and interests of individuals subjected to their output, for instance by breaching their right to privacy and their right to non-discrimination.Footnote ²⁸ When considering the context of the public sector in particular, the use of algorithmic systems also gives rise to domain-specific challenges. Public authorities that rely on such systems to inform or take administrative acts might hamper individuals’ social, economic and cultural rights (e.g. by wrongly denying social welfare benefits), their right to asylum (e.g. by wrongly denying an asylum application), their right to liberty and due process (e.g. by wrongly arresting them) and other rights and freedoms that should be protected and respected by the state.

1.1.2 Algorithmic Regulation and the Rule of Law

Reliance on algorithmic regulation can also affect broader societal interests which do not necessarily correspond to, or which go well beyond, individual harm. This can be clarified by distinguishing three types of harm – whereby harm is defined broadly as the thwarting of an interestFootnote ²⁹ – namely individual, collective and societal harm.Footnote ³⁰

Individual harm occurs when one or more interests of an individual are thwarted. When public services, for instance, seek to detect tax fraud and rely on a biased algorithmic system, which disproportionally flags people with a migration background as risky and leads to biased output, this can hamper the interest of the individual who is subjected to the system, and her right not to be unjustly discriminated against.

Collective harm occurs when one or more interests of a collective or group of individuals are thwarted. Just as a collective consists of the sum of individuals, so too might this harm consist of the sum of harms suffered by members of the collective. The use of the biased fraud detection system can, for instance, give rise to collective harm where it thwarts the interest of a collective of people (in this case, those with a migration background who are subjected to the system) not to be unjustly discriminated against.

Societal harm occurs when one or more interests of society are thwarted. It is hence not concerned with the interests of a particular individual or an interest shared by a collective of individuals. Instead, it concerns harm to an interest held by society at large, going over and above the sum or accumulation of individual interests.Footnote ³¹ In the above example, a third type of harm is in fact at play. Whether individuals have a migration background or not, and whether they are subjected to this particular algorithmic system or not, they share an interest to live in a society in which the state treats people equally and exercises its power non-arbitrarily. Otherwise, they would live in fear that the state might treat them unequally next. That interest is different from the interest not to be unjustly discriminated against, and can hence be distinguished from the individual or collective harm done to those directly subjected to the system. Societal harm may well include instances of individual and collective harm, yet it has an impact beyond it and can hence be assessed as a sui generis type of harm.Footnote ³² The distinction between these types of harm matters, since legal mechanisms that are tailored to protect against individual and collective harm may not necessarily be apt to also protect us against forms of societal harm.Footnote ³³

In liberal democracies, the executive branch of power is responsible for implementing and enforcing laws that are, in principle, adopted by the legislative branch through a pluralistic democratic process. Depending on the policy area, public authorities will have a margin of discretion when implementing those laws, and they may have delegated powers to enact laws themselves, yet whenever they exercise public power, they remain bound by the rule of law.Footnote ³⁴ However, as this book will demonstrate, when public authorities implement and enforce the law through algorithmic regulation, this may – inadvertently or deliberately – undermine the rule of law. The rule of law is a core societal interest in constitutional liberal democracies, and any adverse impact thereon can be conceptualised as a societal harm, as it goes beyond the harm to an individual right.

So what is the rule of law? The rule of law implies that government officials and citizens alike are bound by legal rules, and that nobody stands above the law. In the context of the public sector, it requires public authorities to adopt administrative acts based on established rules rather than arbitrary whims.Footnote ³⁵ The rule of law thus tames public power, as it sets the legal boundaries within which public authorities can legitimately exercise their power.Footnote ³⁶ Let me, however, stress that, beyond this general description, there is no universal agreement on what this concept precisely entails.Footnote ³⁷ Drawing on legal sources and scholarship, in this book I will propose a more detailed account of the rule of law in the specific context of liberal democraciesFootnote ³⁸ – given that my analysis is concerned with the EU in particular – and I will emphasise its close alignment with human rights and democracy.

Crucially, by virtue of the legal boundaries it establishes, the rule of law enables the protection of human rights and safeguards human liberty and dignity. Moreover, by enabling legislative and judicial oversight over executive action, the rule of law also counters authoritarian tendencies and ensures that governments respect the democratic process. Accordingly, in constitutional liberal democracies, the law plays a protective role, which public authorities must safeguard when carrying out their tasks.Footnote ³⁹ In the EU legal order, the rule of law consists of a number of principles that public authorities must respect, including the principles of legality and legal certainty, the prohibition of the arbitrary use of executive power, the principle of equality before the law, effective judicial review of executive action, and the separation of powers.Footnote ⁴⁰ As I will argue in this book, the fulfilment of these principles can be undermined when public authorities rely on algorithmic regulation.

Algorithmic regulation requires a translation from legal text-based rules to machine-readable code to enable the automation of the law’s application. This translation process encompasses important normative and political decisions of legal interpretation, rather than mere technical actions. When this process contains errors or mistranslations, encompasses prejudices, occurs arbitrarily, encroaches on people’s rights, or infringes hierarchically higher legal norms, this dilutes the protective function of the law. Given the scale at which algorithmic regulation is deployed, such dilution can be systemic rather than exceptional. That is because the infrastructure put in place for the implementation of algorithmic systems allows for instantaneous mass-decision-making, without the need for human intervention. This also means that, overnight, the parameters of algorithmic systems can be technically adapted by the executive authority that uses them, at the push of a button, thereby immediately affecting all people that are subjected thereto, without the need to inform or to convince (potentially critical) public officials of the changes made. Moreover, the opacity of algorithmic systems can make legislative, judicial and public oversight over how the law is applied through these systems highly difficult.

Over the longer term, this may therefore not only exacerbate the asymmetry of power between the government and its citizens, but also between the executive branch, on the one hand, and the judicial and legislative branch, on the other hand. The latter may no longer be able to ensure that constitutional checks and balances are in place. Both of these asymmetries open the door to the risk that algorithmic regulation incrementally increases executive power, diminishes public accountability, and erodes the rule of law. At worst, algorithmic regulation can in this way become a tool that enables authoritarian and illiberal practices,Footnote ⁴¹ thereby furthering the power of the Algorithmic Leviathan.

At least two scenarios are thinkable. Under a first scenario, a state may resort to the implementation of algorithmic regulation with ill intentions, at scale, to augment its power under the guise of enhancing the efficiency of the public sector, all the while avoiding public scrutiny. It can, for instance, creatively translate law to code and program algorithms in a manner favourable to government supporters, yet unfavourable to dissidents, minority groups or anyone the state considers falling outside the ‘norm’. Under a second scenario, a state may resort to algorithmic regulation with good intentions, yet without proper attention to the risks that can arise therefrom – out of ignorance, negligence, recklessness, or even plain delusion. While the current well-intentioned government may not seek to abuse the vulnerabilities it creates, in the meantime, individuals subjected to the system can nevertheless be harmed, the rule of law’s principles might be undermined, and – albeit inadvertently – an infrastructure is put in place that can easily be abused by a next, less well-intentioned government. Evidently, neither of those two scenarios are desirable, and a third one should be ensured: one in which appropriate safeguards exist to counter this threat.

1.1.3 The EU’s Rule of Law Crisis and the Rule by Law

Such safeguards are not only important for the citizens of individual Member States but for the European Union as a whole. After the disastrous occurrence of World War II – initiated by an authoritarian state – the Union was brought to life as a project of state cooperation with the aim of preventing future wars. Originally, this cooperation was primarily economic in nature, focusing on the establishment of a common market.Footnote ⁴² Yet, over the years, the EU developed into an “autonomous legal order”Footnote ⁴³ with a “complete system of legal remedies and procedures”Footnote ⁴⁴ and cooperation going well beyond economic integration. Underpinning this legal order is the rule of law, enshrined in Article 2 Treaty on European Union (TEU) as a foundational Union value that is common to all Member States. Having been called “one of the most elusive”Footnote ⁴⁵ and even an “essentially contested”Footnote ⁴⁶ concept in legal scholarship, in the EU legal order, the rule of law is a constitutional tenetFootnote ⁴⁷ consisting of various principles which are inherently linked to human rights and democracy, both of which are likewise listed in Article 2 TEU as core EU values.Footnote ⁴⁸

Given the interdependence of EU Member States, the erosion of the rule of law in one Member State is problematic for the Union as a whole. As noted by the European Commission, “if the rule of law is not properly protected in all Member States, the Union’s foundation stone of solidarity, cohesion, and the trust necessary for mutual recognition of national decisions and the functioning of the internal market as a whole, is damaged.”Footnote ⁴⁹ Various direct and indirect legal mechanisms therefore exist not only in national law but also in the EU legal order to help ensure that Member States respect the rule of law.Footnote ⁵⁰ The fact that these protection mechanisms are not an unnecessary luxury is exemplified by the backsliding of the rule of law in several Member States and the growing popularity of authoritarian governance approaches, which is increasingly referred to as a ‘rule of law’ crisis.Footnote ⁵¹

Indeed, in a number of Member States, the rise of populist parties has led to government actions aimed at increasing the executive’s power and deliberately eroding the rule of law, for instance by violating the principle of equality and non-discrimination, undermining judicial independence, and obstructing the separation of powers.Footnote ⁵² Crucially, some Member States have deliberately introduced legislation to advance authoritarian and illiberal ends, using the guise of the law’s legitimacy precisely to undermine the rule of law.Footnote ⁵³ Such perversion of the rule of law – which dismantles its essential role to protect human rights and democracy – has been referred to as rule by law. Under the rule by law, the law is merely a formal tool that legitimises executive action, regardless of whether it adversely impacts people’s rights or obstructs public accountability. The law is hence reduced to playing a purely instrumental role rather than a protective one, and can even be used to foster illiberal and authoritarian practices.

This phenomenon is not limited to the European Union. Elsewhere in the world too, liberal democracies are increasingly under threat, with illiberal and authoritarian tendencies on the rise.Footnote ⁵⁴ Rather than through coups d’état or sweeping regime changes, these developments are taking place in an incremental way. Huq and Ginsburg have denoted this phenomenon as ‘constitutional retrogression’, which they define as “a process of incremental (but ultimately still substantial) decay in the three basic predicates of democracy – competitive elections, liberal rights to speech and association, and the rule of law”.Footnote ⁵⁵ They juxtapose this against ‘authoritarian reversion’, which concerns the “wholesale, rapid collapse into authoritarianism”Footnote ⁵⁶ and which – contrary to constitutional retrogression – does not have the advantage of operating under the guise of legality. Indeed, the threat of constitutional retrogression stems precisely from the veneer of the legality through which governments can advance illiberal and authoritarian practices. Crucially, however, the rule by law can also be the result of negligent government action, whereby the adverse effects that certain laws can have on human rights and democracy are carelessly overlooked and left unaddressed. Evidently, such negligence can also be exploited by actors with illiberal or authoritarian intentions.

As a response to these developments, over the past decade, the European Union has strengthened its ‘rule of law toolbox’ by introducing several soft law mechanismsFootnote ⁵⁷ aimed at monitoring the status of the rule of law in EU Member States,Footnote ⁵⁸ as well as introducing new legislation. This includes the Conditionality Regulation adopted in 2020,Footnote ⁵⁹ which enables the suspension of payments to Member States in which rule of law breaches seriously risk affecting the management of EU funds. The European Commission also launched several infringement procedures based on Article 258 TFEU against Member States’ actions that undermined principles of the rule of law and misused the power of law to advance authoritarian and illiberal practices.Footnote ⁶⁰ In addition, the European Parliament adopted several resolutions concerning the ‘rule of law’ situations in two Member States, and asked the Council to determine that a clear risk of a serious breach of EU values was present. In this manner, it hoped to trigger the mechanism of Article 7 TEU, which can lead to the suspension of a Member State’s voting rights when it undermines one of the values listed in Article 2 TEU.Footnote ⁶¹

Yet, despite their necessity, the effectiveness of the EU’s rule of law protection mechanisms – especially in countering the risks raised by algorithmic regulation – can be questioned. Soft-law instruments lack teeth; the procedures foreseen in the Conditionality Regulation – much like infringement procedures – are lengthy, only provide solace ex post, and require a clear link to EU law which – in an area concerning Member States’ public authorities – is not always straightforward; and the Article 7 TEU mechanism that can suspend Member States’ voting rights is in a deadlock as it requires unanimity. The hope therefore rests primarily with (new) secondary legislation to mitigate potential concerns, especially if the aim is doing so ex ante. Thus far, no such legislation exists to specifically mitigate risks emanating from the use of algorithmic regulation by public authorities, though a number of rules already apply to the (automated) processing of personal data, most notably the General Data Protection Regulation (GDPR).Footnote ⁶² While offering some protection, the European Commission acknowledged that the GDPR – along with other existing rules at the EU level – currently does not provide sufficient protection against the adverse effects arising from the use of algorithmic regulation.Footnote ⁶³ And while the ongoing rule of law crisis demonstrates that states do not need algorithmic regulation to erode the rule of law, the use of such systems can nevertheless exacerbate existing concerns and raise new ones, particularly over the longer term and systemically so.

In 2021, the European Commission proposed a new regulation laying down harmonised rules on AI (the “AI Act”) to bridge certain gaps in existing legislation and better protect individuals’ “safety, health and fundamental rights”, particularly when “high-risk” AI systems are used.Footnote ⁶⁴ The AI Act, which was adopted in spring 2024, also covers a number of algorithmic applications used in the public sector. In theory, the AI Act has been established to introduce new protection mechanisms that mitigate the adverse effects of algorithmic regulation on the rule of law. However, I will argue that, in practice, it falls short in providing effective protection.Footnote ⁶⁵ The requirements it imposes are woefully deficient and rely to a large extent on a weak self-certification mechanism by AI providers.Footnote ⁶⁶ Moreover, the AI Act focuses primarily on individual harms as opposed to societal harms and ignores the broader rule of law risks arising from algorithmic regulation.Footnote ⁶⁷

1.1.4 Bridging Two Agendas and Countering Algorithmic Rule by Law

Considering the above, the European Union appears to adopt a somewhat schizophrenic approach. On the one hand, through its rule of law agenda, it seeks to prevent and mitigate the erosion of the rule of law by national authorities. On the other hand, through its digital agenda, it supports and even requires those same authorities to adopt algorithmic regulation at scale, despite the fact that this can – deliberately or inadvertently – undermine the rule of law. The following question thus arises: can these two agendas be aligned? Put differently, does the EU have sufficient safeguards in place to avoid that algorithmic regulation – amidst a rule of law crisis – leads to a dilution of the law’s protective function in liberal democracy?

This question has thus far largely been ignored in scholarship. Following the same schizophrenic line, ample legal research has analysed the erosion of the rule of law in liberal democracies,Footnote ⁶⁸ including in EU member statesFootnote ⁶⁹ – yet this strand of research did not assess how this problem can be exacerbated by algorithmic regulation. Likewise, abundant legal research has mapped the risks raised by algorithmic systems, particularly focusing on how their use can affect individual (human) rights and interests, such as the right to non-discrimination or the right to privacy. While scholarship has mainly focused on harm to human rights,Footnote ⁷⁰ increasingly, attention is also given to harm to democracy, typically focusing on algorithms in the context of elections and social media,Footnote ⁷¹ or on the way in which they are used in regimes that are already authoritarian.Footnote ⁷² Moreover, the impact of algorithmic systems on the rule of law is likewise progressively examined,Footnote ⁷³ yet mostly in the context of due process and ‘administrative justice’Footnote ⁷⁴ for individuals. Hitherto, a comprehensive and systematic assessment of the impact of algorithmic regulation on the rule of law as a core value underpinning liberal democracy is still missing. Accordingly, the relationship between both challenges – and more particularly the risk that algorithmic regulation can erode the rule of law and exacerbate authoritarian and illiberal tendencies – remains underexamined.Footnote ⁷⁵

This is problematic for several reasons. First, by considering these challenges as separate issues, the full impact of the adoption of algorithmic regulation in the current political climate – in which liberal democracy and the rule of law are under threat not only outside but also within the EU – remains underexplored. Second, without a mapping of this impact, potential legal solutions to ensure that algorithmic regulation is aligned with the rule of law rather than undermining it, remain underexamined. Third, as demonstrated by the lack of attention to the rule of law in the AI Act, this risk does not sufficiently appear on the radar of the EU legislator who now established a new legal framework for algorithmic systems which will set the tone for how such systems are used in the years and decades to come. Fourth, in the meantime, the adoption of algorithmic regulation by public authorities is becoming ever more widespread, leading to the implementation of a digital infrastructure with potentially irreversible effects for EU citizens and the EU legal order.

The picture that emerges when considering both lines of scholarship simultaneously, is a combination of two problems that might reinforce each other: one, the fact that the rule of law is increasingly being turned into a rule by law in liberal democracies, and two, the fact that algorithmic regulation can weaken public accountability and undermine the law’s protective function. The introduction of algorithmic regulation under the guise or the misguided belief of ‘efficiency’ might hence reinforce a rule by law and open the door to the exacerbation of illiberal and authoritarian tendencies – which I will conceptualise as the threat of algorithmic rule by law. Algorithmic rule by law raises issues beyond those captured by the concepts of technological managementFootnote ⁷⁶ or the rule of algorithm.Footnote ⁷⁷ Regulation is implemented and enforced through algorithmic systems, yet the fact that the veneer of legality is preserved while the law’s protective functions are being hollowed out, incrementally and opaquely, is what makes the situation even more problematic. Like the clueless frog in a pot of water that is slowly brought to boil, this veneer of legality might blind us to the fact that the values we hold dear are nevertheless undermined – carelessly or wilfully.

Accordingly, in this book, I seek to connect these two lines of scholarship and to bridge the gap they leave open. To do so, I will first conceptualise the rule of law in the EU legal order and distil from it the concrete requirements that public authorities must meet when exercising public power. I will draw on these requirements to develop a normative analytical framework that allows me to conduct a comprehensive analysis of how algorithmic regulation can adversely affect public authorities’ adherence to the rule of law. To carry out this analysis, I will examine concrete illustrations of how algorithmic regulation is already used by public authorities in liberal democracies today. Based on my observations, I will conceptualise the threat of algorithmic rule by law, and set out the key features that render it a danger for the rule of law – and for the normative infrastructure of liberal democracy more generally. Finally, I will assess the safeguards provided by EU law against this threat, in light of the broader rule of law crisis. My purpose is hence to highlight potential legal gaps in protection that the EU legislator must address to ensure that algorithmic regulation is aligned with the rule of law and does not exacerbate authoritarian and illiberal practices. Moreover, since the adoption of algorithmic regulation and the erosion of the rule of law are global phenomena, the analysis that I carry out in this book – while EU-focused – could also be of relevance beyond the European Union.

Admittedly, the rule of law relies on much more than a protective legal system and necessitates an enabling societal culture in which it can flourish.Footnote ⁷⁸ Indeed, “a widely shared cultural belief that the law should rule is the essential element of the rule of law – and that is the hardest to achieve”.Footnote ⁷⁹ While I hence do not claim that bridging the gaps in the EU legal framework will be sufficient to protect the rule of law against the adverse effects of algorithmic regulation, I will nonetheless argue that it is a necessary condition to achieve this.

1.2.1 Objectives, Questions and Hypotheses

As introduced above, in this book, I seek to connect two developments that are currently taking place in the European Union. The first concerns the increased use of algorithmic regulation by public authorities. The second concerns the erosion of the rule of law and the rise of authoritarian and illiberal tendencies in liberal democracies, including in EU Member States. It is not my purpose to claim that these developments are causally linked. Rather, I seek to analyse and demonstrate how the former might reinforce the latter, and to assess whether the European Union’s legal framework is armed against this threat. The objective of this book is therefore to examine how the use of algorithmic regulation by public authorities can adversely impact adherence to the rule of law, and to investigate what role EU law can play to counter this risk. Its corresponding research question is formulated as follows: What safeguards does the EU have in place to avoid that reliance on algorithmic regulation by public authorities – amidst a rule of law crisis – undermines the rule of law and results in algorithmic rule by law?

To answer this research question, I will formulate an answer to four sub-questions, each corresponding to a more specific objective, which will be dealt with in a dedicated chapter of this book:

1. (a) What is algorithmic regulation, and how is it deployed by public authorities?

   To answer this question, I will examine the technical and societal aspects relating to algorithmic regulation and assess the various ways in which public authorities rely thereon in the functioning of their tasks, in particular to inform or take administrative acts (Chapter 2).

2. (b) How can the rule of law be conceptualised in the EU legal order, and which requirements does it impose on public authorities that are part of the executive branch of power?

   To answer this question, I will look at legal theory and legal sources of EU law to conceptualise the rule of law in the context of the executive branch of power, and distil the requirements it imposes on public authorities. On that basis, I can subsequently develop a normative analytical framework to evaluate the alignment of public action with the rule of law’s requirements (Chapter 3).

3. (c) How is the rule of law impacted by public authorities’ reliance on algorithmic regulation and how can this impact, and the harm corresponding thereto, be conceptualised?

   To answer this question, I will conduct a systematic impact analysis of algorithmic regulation on the rule of law’s requirements, based on the normative framework developed under the second question. Drawing on that analysis, I will then be able to formulate a theory of harm that captures the way in which algorithmic regulation can transform the rule of law into a rule by law instead, leading to the threat that I will conceptualise as ‘algorithmic rule by law’ (Chapter 4).

4. (d) What safeguards does the EU legal framework provide against such harm, and to which extent can these safeguards counter the threat of algorithmic rule by law?

   To answer this question, I will critically assess the legal protection mechanisms that existing and upcoming EU legislation provides against the conceptualised harm, and examine whether and how these mechanisms potentially fall short of their protective purpose (Chapter 5).

These questions are underpinned by four hypotheses, which I will be examining more closely throughout this book:

1. (a) Algorithmic regulation is increasingly used by public authorities across the EU, yet besides generating opportunities, it also poses risks, not only to individual but also to societal interests.

2. (b) The rule of law plays an essential role in liberal democracies, as it enables the protection of human rights and the democratic process. When the rule of law is undermined, this also opens the door to illiberal and authoritarian practices.

3. (c) Given the specific features of algorithmic systems, public authorities’ reliance on algorithmic regulation can undermine the rule of law and foster a rule by law approach instead, which can also affect respect for human rights and democratic accountability.

4. (d) The EU legal framework – including the new AI Act – currently provides insufficient legal protection against the risks posed by public authorities’ reliance on algorithmic regulation.

1.2.2 Methodology

While this book focuses on the extent to which legal mechanisms in the EU legal order can protect the rule of law against the risks posed by algorithmic regulation, it also deals with matters that fall outside the legal domain. In addition to legal scholarship, I will therefore be drawing on other disciplines too, including philosophy of law, ethics, public administration and critical data studies. After this introductory chapter, my inquiry proceeds as follows:

In Chapter 2, I offer a primarily descriptive account of algorithmic regulation, the technology that stands central in this book. I start by examining its building blocks – namely, algorithmic systems – and discuss their technical and societal aspects alike. Subsequently, I describe how public authorities are organised – and more particularly, how administrative acts are adopted within bureaucratic administrations – to further an understanding of the role that algorithmic regulation can play within their organisation. In this chapter, I primarily draw on insights from computer science, critical data studies and public administration.

In Chapter 3, I set out the normative analytical framework of this book by conceptualising the rule of law in the EU legal order and concretising it into requirements that public authorities must meet when adopting administrative acts – including when they rely on algorithmic regulation to do so. To develop this normative framework, I draw on legal theory as well as legal sources, including primary and secondary EU law, case law from the Court of Justice of the European Union (CJEU) and from the European Court of Human Rights (ECtHR), EU soft law and sources from the Council of Europe that contribute to the EU understanding of the rule of law. The rule of law requirements that I distil from these sources will serve as the normative guide of this book.

In Chapter 4, drawing on the analytical framework developed in Chapter 3, I evaluate the impact of algorithmic regulation on the rule of law by systematically analysing how each of its requirements can be adversely affected. To concretise this analysis, I draw not only on theoretical scholarship but also on concrete illustrationsFootnote ⁸⁰ of algorithmic systems that are already used by public authorities today, or that have been used in the past, and examine how these illustrations interact with the identified rule of law requirements. Since this book aims at identifying possible adverse effects of algorithmic systems, I specifically focus on examples that engendered such effects, and purposely limit my investigation to the technology’s use in liberal democracies, to demonstrate that these effects are not limited to authoritarian regimes. Moreover, rather than conducting an in-depth case study of one or two examples, I offer a broader overview of various cases in which algorithmic regulation is used across different public sector domains, with the aim of drawing more general conclusions. Based on my observations, I subsequently conceptualise a corresponding theory of harm, which I denote as algorithmic rule by law. Importantly, the examples of how algorithmic regulation has been used in the past do not allow me to conclude that reliance thereon by public authorities necessarily has an adverse impact on the rule of law. However, they do enable me to argue that algorithmic regulation can have an adverse impact, and that such impact must be dealt with if the aim is to protect the rule of law and safeguard the protective role it plays in liberal democracies.

In Chapter 5, I evaluate the safeguards provided by the existing EU legal framework, by looking at EU regulation aimed at protecting the rule of law, and EU regulation aimed at protecting individuals against the risks raised by reliance on automated data analysis and decision-making. Guided by the analysis carried out in Chapter 4, I critically assess the extent to which such regulation provides adequate protection against the identified harm, so as to ensure that the normative requirements identified in Chapter 3 are preserved.

Finally, in Chapter 6, I summarise my research results, identify avenues for further research, and draw concluding remarks.

1.2.3 Scope of This Book

This book will focus on public authorities’ use of algorithmic systems to inform and adopt administrative acts, and examine how such use can affect the rule of law as conceptualised in the EU legal order. While the subject of this book is vast, I necessarily had to limit its scope in several ways.

First, although ‘public authorities’ are at times understood broadly as encompassing all state-related institutions, I will only focus on the use of algorithmic systems by the executive branch of power. This scope limitation by no means implies that the use of algorithmic regulation by entities belonging to the legislative or the judicial branch of power does not pose rule of law-related risks – quite the contrary. Yet, within the public sector, algorithmic systems are currently primarily used by the executive branch of power. Moreover, their impact on individual and societal interests – including the rule of law – is especially notable in the context of administrative acts, which hence motivated my focus.

Second, and related thereto, when conceptualising the rule of law and analysing how algorithmic regulation might affect this value, I will only examine the requirements it imposes on public authorities that are part of the executive branch of power. The rule of law is, however, more broadly applicable, and it also entails obligations for the legislative and judicial branch of power, and for natural and legal persons. While those obligations can also be impacted by reliance on algorithmic regulation, this falls outside the scope of this book.

Third, this book will only deal with algorithmic systems that operate based on techniques that are currently available or of which it is relatively certain that they will become available in the next years. I shall hence not be focusing on more futuristic or sci-fi scenarios of algorithmic regulation of which, based on the current state of the art, it is uncertain or unlikely that they will materialise. In fact, this book aims to demonstrate that concrete threats to the rule of law already emanate from the use of algorithmic systems that exist today. Furthermore, many illustrations of algorithmic regulation which I draw on in this book concern the automation of tasks based on methods that already exist since decades, without necessarily drawing on more recent approaches such as machine learning or generative AI systems. As my analysis will reveal, even basic algorithmic systems – which, in view of their relative simplicity, would not necessarily fall under the AI umbrellaFootnote ⁸¹ – can pose a threat to the rule of law when deployed irresponsibly by public authorities.Footnote ⁸²

Fourth, it is acknowledged that algorithmic regulation can generate not only societal harm but also societal benefits. Moreover, I do not exclude that algorithmic regulation can be used in a manner that not merely respects but even promotes the rule of law.Footnote ⁸³ However, I will not be examining such uses of algorithmic regulation in this book. Instead, this book primarily examines the harm raised by such technology and will not extensively analyse its benefits, except more sporadically to explain the rationale behind its uptake by public authorities. Furthermore, no cost–benefit analysis of algorithmic regulation will be made, given that such a utilitarian approach – which hinges on the quantifiability of costs and benefits – is difficult to reconcile with the nature of the impact that will be assessed. This book therefore focuses on a qualitative analysis of the impact of algorithmic regulation on the rule of law rather than a quantitative one.

Fifth, while I will be focusing on the potential adverse effects of algorithmic regulation, I will not be making a detailed comparison between the risks of algorithmic decision-making and the risks of human decision-making. Yet my choice for a focus on the former does not imply a denial or disregard of the latter. Human beings can also make mistakes, be biased, act non-transparently, and inadvertently or deliberately undermine liberal democratic values. Some people therefore argue that, since both methods of decision-making imply risks, one must draw a comparison and make a trade-off, often followed by the contention that ‘at least algorithmic systems can be de-biased’ or ‘be fixed’ or ‘rendered transparent’. In this book, I touch upon these contentions only sporadically, not only because thorough comparisons fall outside its scope, but also because I believe it makes no sense to juxtapose human and algorithmic decision-making. As I will demonstrate in this book, algorithmic decision-making is human decision-making, since algorithmic systems – along with their outcomes – are entirely shaped by the people that develop and use them. I therefore consider algorithmic decision-making to be an extension of human decision-making – embedding all its benefits and flaws – yet at a much faster speed and on a much wider scale, which means it can exacerbate these flaws and render them systemic.

Sixth, it should be noted that the Council of Europe, too, has adopted a binding legal instrument to regulate the impact of algorithmic system on human rights, democracy and the rule of law.Footnote ⁸⁴ Though the contours of this convention are still new at the time of writing this book,Footnote ⁸⁵ its scope largely overlaps with the AI Act, albeit at a much more general level. Since the Council of Europe’s convention also aims to address issues pertaining to the rule of law, its content is likewise of relevance for the concerns discussed in this book. I will, however, not be examining this instrument, as my analysis is confined to the EU legal order. While the acquis of the Council of Europe plays an important role in the EU’s conceptualisation of the rule of law – and will hence be discussed in Chapter 3 – its regulatory initiatives on AI fall outside the scope of this work.

Seventh, as briefly introduced above, algorithmic regulation can affect a myriad of interests, of which the rule of law and its requirements are but one example. An alternative research project could have focused on the impact of algorithmic regulation on human rights, and on how EU human rights law deals therewith. While such an examination falls outside the scope of this book, I will on several occasions highlight the relationship between the rule of law and human rights, which – within the normative infrastructure of liberal democracies – are inherently entwined.

Finally, the risks raised by public authorities’ reliance on algorithmic regulation can also be tackled through (existing or new) legislation at Member State level, for instance through administrative law provisions or more tailored legislation. This book will, however, consider legal gaps at the EU level only. One can question the choice for a focus on EU law regarding matters that appear to be primarily a Member State affair. Yet, as I explained above, Member States’ adherence to the rule of law matters for the Union at large, as it is essential for the success of the European integration project, the enforcement of EU law, and the establishment of mutual trust amongst Member States. Moreover, while some Member States might have national rules in place that provide some protection against the adverse impact of algorithmic regulation,Footnote ⁸⁶ others do not, or only inadequately so, whereas EU citizens should be protected in all EU Member States. For these reasons – and given also the looming EU harmonisation of national rules on algorithmic systems – my focus will be the EU legal framework. This means that I will not be evaluating (the legal safeguards afforded by) national administrative law and national variations of the principles of good administration, despite the fact that they can help counter the developments that this book will problematise.

1.2.4 Relevance

The relevance of this book is threefold. First, it aims to formulate a systematic conceptualisation of the adverse effects of algorithmic regulation, moving beyond a discussion of mere harm to individual interests – which are most prevalent in the current scholarship – towards a theory of harm that encompasses the erosion of the rule of law. Millions of euros are currently being invested into the uptake of algorithmic regulation by public authorities all over Europe, including through funding coming from the EU recovery plan. Given public authorities’ role in steering and governing society, it is essential to ensure that the implementation of this technology – with wide-ranging impact on individuals, collectives and society – occurs in a manner that respects the core values of the EU rather than undermining them.

Second, this book aims to bridge scholarship on the risks of algorithmic regulation with scholarship on the rule of law crisis in the EU – and on the broader rise of authoritarian and illiberal tendencies in constitutional liberal democracies. By mapping how the former can exacerbate the latter – and seeking to align the EU’s digital agenda with the EU’s rule of law agenda – this book makes a novel contribution to legal scholarship and seeks to stimulate further research in this area.

Third, this book aims to critically assess the current and proposed EU legal framework that applies to the use of algorithmic regulation by public authorities. It thereby seeks to contribute to EU policymaking in the field, by providing insights to the EU legislator and other relevant actors regarding legal gaps that must be addressed.