ETD

• artificial intelligence
• cybersecurity regulations
• gdpr
• medical device regulation
• neuro-rights
• neurotechnology
• personal data protection

The most recent advances in neurotechnology are starting to blur the boundary between science fiction and reality. From meditation headbands monitoring brain activity to wearable brain-computer interfaces designed to assist drivers, devices once confined to laboratories are now entering the consumer market, promising greater wellbeing and self-optimization, as users are effectively “giving the key” to technologies to interact with their brain.

The growing accessibility of non-invasive consumer neurotechnology raises unprecedented legal challenges: brain-derived data may reveal highly sensitive information, while the integration of AI and connected devices creates novel cybersecurity risks. This dissertation critically assesses whether the current European legal framework can adequately address these challenges, focusing on the Medical Devices Regulation, Cybersecurity regulations, GDPR, and AI Act. It also examines the debate on neurorights, considering whether new fundamental rights are necessary or whether existing protections can address emerging risks.

Chapter I introduces commercial non-invasive neurotechnology, distinguishing it from medical and invasive applications and identifying the legal interests at stake. Chapter II analyses the existing EU framework, including fundamental rights and the applicability and limitations of the MDR, GDPR, and AI Act. Chapter III focuses on cybersecurity, by exploring neurosecurity and assessing whether EU legislation and industry standards provide adequate protection. Finally, Chapter IV will consider some international approaches in this domain and will propose a final position on the governance of consumer neurotechnology in the EU.