Research and Technology Risks: Part IV – A Prototype Regulation

The following prototype regulation shows that it is possible to cover all kinds of research and technology risks in one piece of regulation, making the currently practiced piece-meal approach superfluous. Compared with the practice of developing particular pieces of regulation e.g. for biotechnology, nuclear science, geo-engineering and always running behind the new technologies popping-up, this regulatory approach permits an easy handling and a faster and more complete coverage of research and technology risks.

The following prototype regulation is the final part of a series of four blogposts. It is recommended to read the other three first:

Regulating Research and Technology Risks: Part I – Research Risks;

Regulating Research and Technology Risks: Part II – Technology Risks;

Regulating Research and Technology Risks: Part III – Risk classification.

Text in [square brackets] is deemed to be even more optional than the remainder.

Text in (ordinary brackets) suggests completion in accordance with the needs and conditions in the respective jurisdiction.

PROTOTYPE REGULATION TO COVER RESEARCH AND TECHNOLOGY RISKS

Article 1 – Application and subject matter

(1) This regulation applies to research or technology undertakings [others than those regulated by specific regulation] OR [other than the following: …1].

(2) Subject-wise, this regulation covers the risks caused by these research or technology undertakings. Other regulation dealing with other aspects than these risks remains applicable.

[Further clarification of scope, if needed; see also previous footnote. Be aware of the fact that some specific legislation might cover research and technology undertakings even with regard to risks, but not necessarily for all the risks caused by the undertakings. In this case consider a subsidiary applicability of your new regulation on research and technology risks.]

Article 2 – Definitions

– Research: Investigation of new possibilities in the field of natural science or engineering science;

– Technology: application of possibilities offered by natural science or engineering science2;

– Undertaking: organised activity, regardless of whether limited in time or space;

– Operator: Natural or legal person [initiating,]3 organising or assuming the responsibility to the research or technology undertaking;

– Severity: Seriousness of harm without taking into consideration the duration / lasting;

– Scope: Number of persons affected by harm;

– Likelihood: probability of the harm occurring;

– Lasting of harm: period during which the harm exists [or is psychologically perceived];

– Risk: likelihood of harm >0;

– Death risk: likelihood of death >0;

– Existential risk: likelihood of extinction of mankind >0;

– Indirect risks: risks caused by a chain or several chains of events which are each linked by a causal relationship;

– Causal relationship: relationship between two or more events according to which the second or subsequent events would not have happened at the very moment4 if the first had not happened5;

– Authority: (define or refer to the administration in charge of the application of this Regulation).

Article 3 – Risk assessment, risk management and acceptability of risks

(1) Operators shall assess risks prior to starting their undertaking and repeat their risk assessment periodically, at least once per year, and when there are facts indicating a [potential] need for revision.

(2) When assessing risks, operators shall take account of the severity (seriousness), the scope (the number of affected persons), the likelihood and the lasting of harm. These factors are to be multiplied. The risk assessment shall take into account all conditions influencing these factors, including those which derive from the outside such as the environment at the specific location of the undertaking.

(3) Indirect risks shall be taken into account.

(4) In case of risk of multiple harms for the same victims, such as risk of suffering followed by risk of death, it is appropriate to evaluate both risks and to assess and classify risks separately.

(5) Effects on animals shall [not] be taken into account [with a devaluation factor of 1/2 1/3, …].6

(6) A particularly thorough risk assessment shall be undertaken when research or technologies might lead to the extinction of mankind (“existential risk”)7.

(7) In case of uncertainty, operators shall apply a safety margin proportionate to the uncertainty and at least of [100%] OR [1000%].8

(8) Operators shall reduce risks to the extent that the risk reduction does not disproportionately endanger the utility of the undertaking. To that end, they shall assess how they can improve the conditions influencing the risks, the location of the undertaking being itself one of the conditions. They shall refrain from reducing a certain risk when this risk reduction would disproportionately increase another risk. To reduce risks, operators shall cooperate with the concerned natural or legal persons. Operators shall inform the concerned persons on risks that cannot be further reduced.9

(9) Operators shall refrain from undertakings for which, after risk reduction, the possible benefit, multiplied with the likelihood of the benefit, does not outweigh the various risks. [However, they may launch such a research or technology undertaking if the undertaking might help to remedy an existential risk, unless it also triggers another existential risk with a higher likelihood.]10

(10) Operators shall refrain from undertakings for which the benefit is not to be weighed much higher than the risks when the risks are borne by other natural or legal persons than those who take profit from the undertaking.11

(11) Undertakings bearing an existential risk are only acceptable when they remedy another existential risk with higher likelihood.12

(12) The final decision on whether the undertaking shall be conducted despite the risks shall be taken by the natural persons legally representing the operator. These persons shall decide on the basis of the risk documentation which shall include documentation on risk assessment, risk management and acceptability of risks.

Article 4 – Risk classification

(1) Research or technology undertakings are classified in Risk Classes I to V according to the following method:

(Develop method, e.g. in accordance with one of the risk classification models presented in the previous blogpost. We recommend Model A for jurisdictions which only wish to manage a simple method and Model D for those which prefer a complex, fine-tuned method.)

(2) The risk classification for certain currently known research and technology undertakings is laid down in Annex I to this Regulation.13

(3) The Authority may, [inter alia] to cover new types of research or technology undertakings, modify and complement Annex I by administrative regulation.14 [It shall report to the parliament immediately [before and] after adopting such modification or completion.] [The parliament may revoke or modify the administrative regulation at any moment in accordance with the procedure set-out in … .]15

Article 5 – Procedural obligations of operators by risk class

(1) Class I:

(a) Operators planning a research or technology undertaking falling in Class I shall:

– fulfil the obligations set out in Articles 3 and 10, and

– shall register their undertaking in the public database set-up by the Authority in accordance with Article 14.

(b) Before changing their undertaking in a way that might affect risks and at least every six months, they shall update their database entries.

(2) Class II:

(a) Operators planning a research or technology undertaking falling in Class II shall:

– fulfil the obligations set out in Articles 3 and 10,

– apply a quality management system covering the fulfilment of the obligations contained in these Articles, and

– register their undertaking in the public database set-up by the Authority in accordance with Article 14.

(b) Before changing their undertaking in a way that might affect risks and at least every six months, they shall update their database entries.

(3) Class III:

(a) Operators planning a research or technology undertaking falling in Class III shall:

– fulfil the obligations set out in Articles 3 and 10,

– apply a quality management system covering the fulfilment of the obligations contained in these Articles,

– have their quality management system certified by a conformity assessment body [entrusted by the Authority] [and] [accredited by … ], and

– register their undertaking in the public database set-up by the Authority in accordance with Article 14 .

(b) Before changing their undertaking in a way that might affect risks and at least every six months, they shall update their database entries and inform the conformity assessment body thereof.

(4) Classes IV and V:

(a) Operators planning a research or technology undertaking falling in Classes IV or V shall:

– fulfil the obligations set out in Articles 3 and 10,

– apply a quality management system covering the fulfilment of the obligations contained in these Articles,

– have their quality management system certified by a conformity assessment body [entrusted by the Authority] [and] [accredited by … ],

– register their undertaking in the public database set-up by the Authority in accordance with Article 14, and

– apply for authorisation with the Authority by submitting [the quality management system,] the risk documentation and all available scientific or engineering literature dealing directly or indirectly with risks of similar undertakings, regardless of whether this literature is in their favour or not.

(b) Before changing their undertaking in a way that might affect risks and at least every six months, they shall update their database entries and inform the conformity assessment body and the Authority thereof.

(5) Voluntary choice of a more stringent conformity assessment procedure:

Operators may opt for a more stringent conformity assessment procedure than the one foreseen for the respective risk class.16

(6) Upclassification of ongoing undertakings:

Whenever new facts or a corrected evaluation of previously known facts lead to the conclusion that the undertaking falls in a higher Risk Class than initially assumed, the operator shall immediately initiate the conformity assessment procedure for the higher Risk Class.

Article 6 – Authorisations

(1) The Authority shall provide authorisations where the application is complete and the conditions set-out in Articles 3, 5 and 10 are fulfilled. In case of non-fulfilment of … (list certain of the General Obligations) authorisations may still be provided if the research or technology undertaking might help to remedy an existential risk, unless it triggers another existential risk with higher likelihood.17

(2) Applications are deemed to be authorised if the Authority does not react within three months. [In cases of particular difficulty, the Authority may prolong the deadline for its decision up to a further three months by notifying this prolongation to the applicant.]

(3) For authorisations of undertakings falling in Class IV, the Authority shall consult a panel of national experts (or reference to an existing panel). (Further provisions on the composition, the setting-up and the functioning of the panel, if necessary.)

(4) For authorisations of undertakings falling in Class V, the Authority shall consult a panel of international experts (or reference to an existing panel). (Further provisions on the composition, the setting-up and the functioning of the panel, if necessary.)

(5) Authorisations may be limited in time or be subject to conditions.

(6) The Authority may consult other jurisdictions, whether affected or not, prior or after issuing authorisations. It shall inform other possibly affected jurisdictions on its authorisations.

(7) Authorisations may be prolonged in the same procedure as for initial applications. [However, the Authority may abstain from a new panel consultation if … (no new facts / no new insights to be expected …).]

(8) Authorisations may be revoked with effect from the beginning in the following cases:

– The operator knew from the beginning of facts that would have hindered the authorisation, but did not refer to these facts in his application.

– The operator exerted pressure or used illegal means to obtain the authorisation.

– The operator infringed the penal code in connection with the undertaking and the infringement is directly or indirectly linked to the risk of the undertaking or the authorisation procedure.

(9) Authorisations may be revoked with effect from the date of [the revoking decision] [the revoking decision becoming effective] in the following cases:

– New scientific findings create the need to re-assess the risks linked to the undertakings in question.

– The Authority comes to know facts that would have hindered the Authority to authorise the undertaking if the Authority had known them prior to the authorisation.

Article 7 – Protection of [animals] [and] [of nature] / Respect of other applicable law

(1) In order to protect [animals] [and] [the nature], the Authority may refuse to authorise or ban individual research or technology undertakings by administrative decision. It may for the same reason also generally ban certain types of research or technology undertakings in the procedure set-out in … (procedure for administrative regulation).18

(2) The Authority may also refuse to authorise or ban individual research or technology undertakings when there are reasons to believe that the undertakings infringe other applicable law.19

Article 7 – Temporary ban of undertakings awaiting classification20

Pending the classification of new types of research or technology undertakings, the Authority may temporarily refuse to authorise or ban these undertakings or subject them to conditions or time-limitations.

Article 8 – General empowerments of the Authority

(1) The Authority has the following empowerments:

a) to request information and all types of internal documents, including commercial documents, from operators or natural or legal persons supposed to be operators21;

b) to cooperate with their peers and scientific institutions inside or outside of … (jurisdiction) and to exchange information and documents on the operators and their undertakings if they can formally or informally ensure confidential treatment;

c) to temporarily stop an undertaking or subject it to conditions in view of further investigating the related risks;

d) to definitively or temporarily stop an undertaking or subject it to conditions or time-limitations if any of the generally applicable obligations set-out in this Regulation are not fulfilled;

e) to enforce temporary or definitive stops or other measures mentioned in c) and d) by any measures including the sealing of facilities, confiscation or destruction of data or objects;22

f) [in cases of extremely high risks23,] to supervise electronic and telecommunication of operators;

g) [in cases of extremely high risks or in cases of conscious or of evident non-compliance with obligations set-out in this Regulation or in cases of criminal activities] to confiscate or transfer patent rights linked to the undertaking and to request the registration of these rights in view of subsequently confiscating or transferring them;

h) to take measures similar to those permitted by letters a) to g) above against planned undertakings when there is either complete uncertainty regarding the risks triggered by the research project or if, based on first evidence or findings regarding similar research projects, it is not completely unlikely that the undertaking will trigger [major] risks;

i) to communicate its decisions to peers, to third parties and, if useful / necessary to prevent further risks or damage, to the general public, all in or outside of … (jurisdiction);24

(2) All the empowerments shall be used with full respect of the principle of proportionality.

(3) Decisions shall be reasoned and point-out the legal remedies.

Article 9 – General obligations of the Authority

The Authority shall:

– investigate potentially risky undertakings;25

– make available at least … full-time equivalences for the investigation and authorisation of undertakings;26

– ensure by internal procedures that all staff is independent, has no conflict of interest with the undertakings for which s/he is in charge;

– refuse all financial or other support from operators in charge of undertakings falling under this Regulation or legal entities which are mother, daughter or sister entities of operators;

– refuse instructions from others than the ministry for …;

– launch information campaigns to inform operators and potential future operators on the obligations set-out in this Regulation.

Article 10 – Obligations of operators towards staff, contractors and their staff27

(1) Operators shall inform all their staff working on the undertaking on the obligations incumbent on the operators, on sanctions applicable to the operators and their staff and on the provisions on whistle-blowing protection set-out in this Regulation. [They shall prove the fulfilment of these obligations by sending to the Authority the signed declarations of the staff according to which they have been informed about all this.]

(2) Operators shall train their staff on all the legal obligations set-out in this Regulation.

(3) If the operators refer to contractors, the same obligations shall apply with regard to contractors and the staff of contractors.

Article 11 – Administrative sanctions against operators

The Authority may impose on operators administrative sanctions of up to three times their annual budget in case of non-fulfilment of obligations set-out in these Regulations.

Article 12 – Penal sanctions against persons working for the operators

Persons steering or co-steering undertakings covered by this Regulation, regardless of whether they are employees or contractors or staff of contractors, are subject to a penal sanction of up to … years of imprisonment or a fine of up to triple their annual net salary in cases of wilful non-fulfilment of obligations incumbent on the operators. They are subject to a penal sanction of up to … years imprisonment or a fine of up to one annual net salary in cases of negligence with regard to the obligations incumbent on the operators.

Article 13 – Liability and insurance of operators

(1) [Regardless of whether they neglected their duty of care,] Operators of research and technology undertakings are liable towards those natural or legal persons who were affected by a harm [most] probably caused by the undertaking. Causality is also proven in cases where the harm is caused by a chain of events which are each linked by a causal relationship.

(2) [Where the damaged person has proven the harm and provided first evidence for the causality between the undertaking and the harm, e.g. by reference to generally recognised causal chains, causality shall be assumed unless the operator proves that there is no causality given.]

(3) [Research and] Technology undertakings that might cause harm to more than [1.000 / 1.000.000] persons or harm(s) worth more than 1.000.000 [$, €, ¥, … or] the annual budget of their operators shall be covered by liability insurance of an insurer with place of business in one of the following jurisdictions: …

Article 14 – Registry

(1) The Authority shall establish a registry for research and technology undertakings covered by this regulation. The registry shall at least cover the following parameters:

a) Legal identity of the operators;

b) Identity of the legal representatives of the operators;

c) Identity of the persons in charge of the undertaking;

d) Contact means for the above;

e) Start and end of the undertaking;

f) Subject of the undertaking in key words;

g) Short description of the undertaking;

h) List of major risks identified;

i) Date of submission to registry;

j) Date and administrative code of authorisation, if any;

[k) Risk assessment;

l) Full technical documentation.]

(2) [The parameters a) and e) to j) shall be publicly accessible and researchable.]28

Article 15 – Central alert portal

The Authority shall create a central alert portal which permits to upload information on possibly problematic undertakings anonymously. It shall also provide a hot-line via which any person may inform the Authority orally.

Article 16 – Whistle-blower protection

(1) Employees or other persons working for operators, contractors of operators and staff working for contractors of operators are exempted of their confidentiality obligations under labour or contractual law and any other legal provisions or contracts obliging them to keep information of the undertaking or its operator confidential provided that they act in good faith when disclosing information on possible infringement of legal obligations set-out in this regulation.

(2) Statement of whistle-blowers shall be recorded in presence of … (e.g. a judge) and can be used in all state procedures, including criminal and civil law procedures.

(3) The Authority may compensate whistle-blowers for damage, advice them, and organise the change of identity with the help of the authorities … (in charge of identity documentation).

Article 17 – Confidentiality

The Authority shall keep all information confidential, unless the sharing of information is explicitly foreseen in this or other regulation. The Authority [keeps] OR [may keep] information obtained from a whistle-blower confidential even where there is an obligation to share this information set-up by other regulation. The Authority [may not] OR [may] share information obtained from whistle-blowers with other jurisdictions unless the whistle-blower agrees thereto.

Article 18 – Cooperation with other jurisdictions

Authority may conclude cooperation agreements with other jurisdictions on information exchange, mutual advice, and cooperation on enforcement. It may use its general empowerments provided in Article 8 to enforce administrative measures of the other jurisdiction [provided that reciprocity is ensured at least on the basis of an administrative arrangement].29

Article 19 – Financial incentives and involvement in funding procedures

(1) The Authority may subsidise within the limits of its budget:

– The development of best-practice guidance for research and technology undertakings;

– Voluntary compliance programs referring to the legal obligations or the best-practice guidance established by organisations which are representative of the research or technology sector in question.

– Voluntary mutual control by analysis of research and technology projects by an expert panel set-up by a roof organisation.

(2) Within this range, Authority shall give priority to …

(3) The Authority is to be invited to participate all research and technology funding procedures. It may veto the attribution of funds in case of non-compliance with this Regulation [or best-practice guides established by recognised research or technology organisations].30

Article 20 – Support by research institutions and advisory board

(1) All state-funded universities or other research or technology institutes shall make their expertise available to the Authority. They shall accept invitations of the Authority to send a competent delegate to meetings or teleconference of the scientific advisory board.

(2) The Authority may invite representatives of foreign institutes and universities and representatives of international organisations to become temporary observers or permanent members of the advisory board.

Members and observers shall, two weeks before any meeting or teleconference, declare in writing whether they have a potential conflict of interests. The Authority shall decide on the temporary or permanent exclusion of the member or observer with full discretionary power.

(3) The names and the roles of the members and observers of the advisory board [and their declarations of interests] shall [not] be public.

Article 21 – Research and technology risks observatory

(1) Together with … (research institutions of that jurisdiction), Authority shall build a research and technology risks observatory31. Authority shall organise and finance the work of the observatory. It may invite international bodies or research institutions of other jurisdictions to contribute to the work of the observatory and to participate to its meetings.32

(2) The rules on conflicts of interests and publicity set-out in the previous Article apply.

(ANNEX classifying certain undertakings as Class I, II, III, IV or V, concreting the application of the classification rules; see the last table of the last blogpost and delete the columns for the classification models not needed. Or use just the left column of the table and attribute the Risk Classes according to your findings.)

(ANNEXES with research and technology specific requirements if deemed necessary; these can possibly integrate requirements of existing regulation so that the existing regulation can be repealed.)

1List the specific legislation available in your jurisdiction which has the same purpose (risk control). Before doing so, check whether really all the aspects covered by this prototype regulation are covered by the specific regulation in question. If not, consider one of the following three options: (a) repeal of the other regulation or (b) parallel applicability or (c) complementary applicability of one of the two.

2The reference to „science“ ensures that day-to-day activities following extremely simple engineering rules are excluded from the scope.

3To include „initiating“ ensures to cover cases where a powerful legal body has the undertaking organised and executed by others without assuming responsibility. In particular if the undertaking is risky, big companies and research institutions might artificially create formally independent structures which organise and execute the undertaking so that the big companies or research institutions cannot be hold liable or otherwise responsible.

4The reference to the moment is crucial because otherwise no death risks would be covered as everybody dies sooner or later. The reference solves also the issue of alternative causality: a risk still needs to be taken into account even when there is an alternative causal chain leading later to the same result.

5Application of the old latin „condition sine qua non“ formula and similar concepts in Asian philosophy.

6If you wish to take account of effects on animals, consider applying a devaluation factor to avoid political resistance of those who deem animals not being equivalent to men.

7It would be more straightforward to say „… have an existential risk“ because the term „existential risk“ has already been defined. However, it is more user-friendly to make the reader again familiar with the rather uncommon meaning of „existential risk“. Hence both solutions should be deemed defensible.

8In some jurisdictions, the safety factor is mandatory due to the application of the so-called „precautionary principle“.

9To inform the concerned persons permits them to decide whether they wish to stay in the risky perimeter.

10This derogation is justified in view of the high moral value of remedying an existential risk (defined as existential risk for mankind). This high value is to be explained by the extremely high number of humans expected to live for the next thousands or millions of years. The extinction of mankind would stop the potential not only of billions, but trillions or even quadrillions of humans who could live over the next millions of years. For further reflection on this aspect, we recommend the writings of the existential risk pioneer Nick Bostrom and in particular his article Existential Risk Prevention as Global Priority.

11Risks almost always affect (also) other people than those who profit from an undertaking. Hence it would go too far to oblige to refrain from an undertaking whenever risks are borne by others than those who profit from the undertaking. The expression „much higher“ is evidently very vague. However, experience shows that legislators are often opposing precise quantification. If your legislator is different, it is worth trying a quantified criterion (50%, 100% …).

12Because of the high number of human beings and the definitive character of extinction of mankind, an existential risk, as small as it might be, can only be justified when the undertaking leads with a certain likelihood to the remedying of another existential risk for mankind with higher likelihood, if at all.

13In principle, the legislator could just lay-down a method and leave the rest to the administration. But the legislator would then lose control. The regulator could also try to classify the risks altogether without leaving any role to the administration, but would as a consequence need to adapt its classification very frequently himself. We recommended here a mixture of the two approaches. The legislator should determine the method but also apply the method to provide concrete instruction. To apply the method on some already known research and technology undertakings has a positivie secondary effect: the users of the method (the administration or the regulator at a future point in time) would see from the examples how the legislator has thought that his method needs to be applied.

14Most jurisdictions the author knows have at least two level of regulation: one decided upon by the parliament (here also called „legislator“) and one decided upon by the government or another administration. The latter is referred to as „administrative regulation“.

15These two sentences would ensure a better control by the legislator.

16To opt for a more stringent conformity assessment procedure makes sense for operators who cannot exclude that their undertaking falls now or later in another Risk Class than assumed. It might also make sense for those operators who wish to be particularly prudent or who aim for a lower liability insurance prime.

17E.g. it might be inappropriate to require a quality management system and its certification when there is an urgent existential risk. To apply a quality management system requires at least some weeks or months of investment. To obtain certification thereof takes several months.

18The wording of this article distinguishes between individual and general decisions. In jurisdictions where such a distinction is not necessary, the simpler wording of paragraph might be used.

19This is the interface permitting to assess the compliance with other applicable law, such as law on research on embryos, animal testing etc. The interface permits to reach a higher degree of compliance with other applicable law and thereby increases the overall consistency of state action.

20In jurisdictions where a distinction is made between the individual and the general decisions of an administrations, the wording of the previous article might be more appropriate.

21This formulation gives some leaway to the Authority in cases where the real operator, initiating the undertaking, hides behind another operator and tries to conceal his responsibility.

22In jurisdictions which require extremely precise and delimited empowerments, regulators might appreciate studying as reference or inspiration the Singapore Air Navigation (Amendment) Act 2014 which contains comprehensive empowerment in its Section 4.

23 Principle of proportionality, applied at constitutional level in quite some jurisdictions.

24This is necessary because nothing is gained if risky research is just relocated to another jurisdiction, possibly next door just behind the border. Publication of measures to peers might also stop a competition spiral downwards in terms of control intensity.

25Such a legal obligation might help the authority to defend its interests when it comes to the annual budgeting exercise. In many jurisdictions, mandatory tasks can be easier defended against budget cuts.

26A precise indication of minimum staffing for the actual tasks avoids a disproportionate administrative overhead and may protect the financial interests of the Authority.

27If need there is, this Article could be complemented by further obligations of operators and labelled „General obligations of operators“.

28Transparency creates an additional level of control by the general public.

29As operators sometimes act in various jurisdictions, it is important to obtain possibilities to enforce on the territory of other jurisdictions. These other jurisdictions will hardly be ready to cooperate if they do not obtain reciprocity. Hence it is useful to have, in one‘s own jurisdiction, the possibility to assist authorities of other jurisdictions.

30For research, public funds are the most important financial source. Hence it should be possible for authorities to establish a link between the fulfilment of legal obligations and the public funding. A similar mechanism could be created to favour the application of best-practice codes.

31Could also be labelled „network“.

32Ideally, such an observatory would be working for several jurisdictions.

Leave a Reply