Public Resource Dot EU: Compliance Pathways for the EU Standardisation System After the Malamud Judgment

Abstract

The Court of Justice of the European Union’s Grand Chamber judgement in Public.Resource.Org v Commission (“Malamud”) raises fundamental questions about the relationship between EU law and the European standardisation system. By holding that harmonised standards referenced in the Official Journal must be accessible to the public free of charge, the Court reaffirmed the principle that individuals must be able to know the norms governing their legal rights and obligations. While widely welcomed as a victory for transparency and the Rule of Law, the judgement poses significant challenges to the longstanding governance and funding model of European standardisation, which relies heavily on copyright-based revenues generated by European Standardisation Organisations and national bodies. This article examines the practical and institutional consequences of the Malamud ruling and explores viable compliance pathways for the EU standardisation system. After outlining the role of harmonised standards within the New Legislative Framework and their growing importance in regulatory regimes such as the Artificial Intelligence Act, it analyses the judgement’s implications for access to law and the copyright status of standards. The article then evaluates a range of implementation models, including Commission-hosted publication, read-only access portals, licencing buyouts, and expanded use of common specifications. It argues that a Commission-hosted publication model, supported by revised funding arrangements, offers the most coherent pathway to reconcile open access with the continued functioning of the European standardisation infrastructure, and proposes corresponding reforms to Regulation 1025/2012.

1. Introduction

On 5 March 2024, the Court of Justice of the EU (CJEU) delivered its Grand Chamber judgement in Public.Resource.Org v Commission (the “Malamud” case, known for its principal litigant).1 It is a landmark ruling on access to harmonised standards that has sent shockwaves through the European standardisation system. The CJEU held that once a harmonised standard is referenced in the Official Journal (“OJ”) it must be made available to the public free of charge. Invoking foundational Rule of Law principles, the Court recognised an overriding public interest in the disclosure of such standards without charge under Regulation 1049/2001,2 since citizens and businesses must be able to know the norms that affect their legal rights and obligations.3

The judgement was widely lauded by scholars as a victory for transparency and legal certainty (see, e.g., Lundqvist 2024), but it also poses existential questions for the current European standardisation model, a public–private partnership reliant on copyright-based funding. There has yet to be a systematic examination of the implications of this judgement, from a practical point of view: namely, how does the EU standardisation system respond to this seismic change? Such an analysis is timely: the EU Commission has announced that it plans to reform Regulation 1025/2012, and preparatory work is underway. The Commission has recently concluded a public consultation, in which it acknowledges that “harmonised standards are part of EU law, and that the principles of transparency and accessibility apply.” (See European Commission 2025a).

This article examines the implications of the Malamud judgement and explores compliance pathways for the EU standardisation system. It begins by explaining the role of harmonised standards under the New Legislative Framework (“NLF”) as implemented by particular pieces of legislation, notably the Artificial Intelligence Act (“AI Act”). Next, it analyses the legal and constitutional consequences of Malamud, particularly for copyrightability of standards, and the Rule of Law and free access to legal norms. It then assesses the impact on the revenue and copyright model of European Standardisation Organisations (“ESOs”) and National Standardisation Bodies (“NSBs”). Finally, it discusses practical models for compliance—from Commission-hosted publication to read-only portals, national measures, licencing buyouts, and fallback “common specifications”—weighing their merits and shortcomings.

This piece argues that a Commission-hosted solution, paired with funding reforms, is needed to align the system with constitutional requirements, and concludes with recommendations for legislative reform of Regulation 1025/2012 to secure open access to standards while sustaining the standardisation infrastructure.

2. Harmonised Standards Under the NLF

Harmonised European standards are a creature of the EU’s New Legislative Framework (“NLF”), formerly known as the “New Approach.” Since the 1980s, this regulatory technique has outsourced the drafting of detailed technical rules to private bodies, as a means to promote European integration and free movement of goods and services, all while avoiding overly prescriptive legislation, and the associated burden on the EU institutions. Under the NLF, EU legislation lays down essential basic requirements for products or services (for example, safety or performance criteria), and tasks the ESOs (CEN, CENELEC, and ETSI) with developing concrete technical standards that satisfy those requirements. Compliance with a harmonised standard confers a presumption of conformity with the corresponding legal requirements, pursuant to the so-called “harmonisation” directives/regulations. The European Commission, after verifying a standard meets its mandate, publishes the reference to the standard in the L-series of the Official Journal of the EU (“OJ”), the section reserved for binding EU law.4 Notably, only the reference (title and number) is published, not the full text of the standard, which remains available exclusively through the standardisation bodies (usually for a fee). This public–private scheme regards harmonised standards as “voluntary” means of compliance, yet in practice they carry significant legal effect.

The NLF approach proved successful in many sectors (machinery, toys, medical devices, etc.), and its use has expanded over time. The domains of application of the NLF have steadily broadened beyond their original industrial focus. The approach began with classic product safety legislation, exemplified by measures such as the Machinery Directive 2006/42/EC and the Toy Safety Directive 2009/48/EC, which relied on harmonised standards to operationalise essential physical requirements. Its scope was later extended to arguably more complex and sensitive fields: for example, the Medical Devices Regulation (EU) 2017/745, and, broader still, the General Product Safety Regulation (EU) 2023/988. More recently, the European Accessibility Act (Directive (EU) 2019/882) introduced harmonised standards for accessible goods and services, while the Radio Equipment Directive 2014/53/EU incorporated cybersecurity-related essential requirements.

Recently, the EU has extended this model into yet more new domains, including the digital and algorithmic sphere. The EU Cyber Resilience Act5 and, notably, the AI Act heavily rely on harmonised standards to operationalize their requirements. For example, providers of general purpose and high-risk AI systems will be expected to follow standards (developed under EU Commission mandate) to meet the AI Act’s essential requirements, enjoying a conformity presumption if they do so. Given the breadth of the AI Act (addressing not only safety but also fundamental rights, such as non-discrimination and privacy), the delegation of norm-setting to private standardisation bodies has raised concerns about democratic legitimacy (See Leyden 2025; See also Gornet 2024). Indeed, well before Malamud, commentators noted that in areas implicating fundamental rights the current private standardisation system might not meet the heightened legitimacy and transparency requirements of EU law. In the AI context, the stakes are higher than in traditional product regulation, prompting questions about whether privately drafted standards should effectively determine the contours of sensitive legal norms touching on matters such as AI ethics and fundamental rights protections.6

As an addendum, it must be noted that to address potential delays or failures in developing standards, the AI Act includes the option of common specifications (“CS”) as a fallback (like a growing number of other domains of EU legislation).7 Under Article 41 of the Act, if no suitable harmonised standard is available or if serious issues arise, the European Commission may itself adopt technical specifications via implementing acts. These common specifications, once issued, would effectively mirror the role of standards by conferring a legal presumption of conformity. Like harmonised standards, compliance with common specifications is not formally compulsory—manufacturers remain free to prove compliance by other means—but the burden of proof and market realities will likely make them de facto binding in most cases. CS are thus not a panacea: they also suffer from many of the shortcomings of harmonised standards in terms of how they are to be drafted and adopted (Article 41 of the AI Act, for example, merely states that they must be drafted in consultation with an advisory forum without providing further detail). It is unclear how the drafting of common specifications will ensure appropriate representation of industry expertise or other stakeholders, let alone meet demands for public accountability or transparency. These issues are discussed in further detail in Section 6 below (see also Leyden 2025, p. 8).

3. The Malamud Judgement: Rule of Law and Access to Standards

The Malamud case squarely presented the tension between the private copyright model of standardisation and the public law status of harmonised standards. In 2019, the NGOs Public.Resource.Org and Right to Know requested the European Commission to disclose four harmonised standards (for toys, electronics, and protective equipment) under the EU’s access to documents regulation (Regulation 1049/2001). The Commission refused, invoking the exception for protection of “commercial interests”, reasoning that the standards were copyrighted by CEN and that therefore free disclosure would undermine the ESOs’ revenue from selling standards. On this basis, there was therefore no “overriding public interest” in disclosure.8 The applicants challenged this refusal before the General Court, arguing that per the CJEU’s earlier case James Elliott—which held that a harmonised standard “forms part of EU law”—the public must have access to the content of such standards just like any other piece of EU legislation. The General Court, however, sided with the Commission and the standardisation bodies. It drew a formalistic distinction between the OJ reference (which it deemed part of EU law) and the text of the standard (which it treated as a separate, copyright-protected work). The General Court held that protecting the “functioning of the European standardisation system”—specifically its funding through sales—outweighed any public interest in free access. It thus found no “overriding public interest” to justify disclosure, effectively prioritising the ESO business model over open access to what is, in effect, a regulatory document.9

On appeal, AG Medina issued an opinion in 202310 urging the CJEU to reverse the General Court. Emphasising James Elliott and the principle of the Rule of Law, AG Medina argued that harmonised standards, as part of EU law, cannot be treated as ordinary copyrighted works. In her view, either such standards are not protected by copyright at all (being akin to public legal texts), or, at minimum, any copyright must yield to the public’s right to access the law. AG Medina explicitly stated that because harmonised standards are “part of EU law,” (i) they should not be subject to copyright,11 and (ii) even if they were, the need for free access to the law prevails over copyright protection.12 AG Medina also underscored the concrete legal effects of standards: respecting a harmonised standard shifts the burden of proof and operates “as a mandatory rule” for anyone who might seek to contest compliance. Given these effects, she reasoned that accessibility is paramount, and recommended that the Court order the Commission to release the standards to the appellants. Indeed, the Advocate General went so far as to suggest that such standards ought to be published in the Official Journal for enforceability.13

The CJEU’s Grand Chamber judgement, while short and to the point, accepted the essence of the Advocate General’s reasoning on the public interest in access. The Court addressed only the second ground of appeal14—whether an overriding public interest mandated disclosure—and it emphatically concluded that yes, it did. The judgement anchored this conclusion in constitutional principles: Article 15(3) TFEU and Article 42 of the EU Charter guarantee the right of access to documents, and the Rule of Law (Article 2 TEU) requires that individuals can ascertain “unequivocally”15 their rights and obligations. The Court highlighted that the Commission plays a “central role” in the creation of harmonised standards, from initiating their development, to financing, to deciding on their publication in the OJ. Even though drafting is entrusted to private bodies, the normative content is shaped and approved by the Commission to implement EU legislation. Moreover, the Court affirmed that while using a standard is voluntary, the legal effect of the presumption of conformity makes such standards essential instruments for market access. In light of these factors, the Court ruled that free public access is imperative so that any person (for example, a consumer or a competitor) can verify whether products actually comply with the law’s requirements. The existence of a paywall was deemed incompatible with this imperative. Thus, the Court found an “overriding public interest” in disclosure, overturning the General Court’s contrary holding as a matter of law.

Importantly, the Court did not decide whether harmonised standards are “acts of the institutions” for purposes of judicial review. Nor did it decide whether they lose copyright protection once they become part of EU law. By resolving the case solely on the “overriding public interest” exception in the access to documents context, the Court sidestepped those broader issues. As a result, a curious paradox remains: harmonised standards must now be provided to the public upon request (indeed, potentially anyone can demand any OJ-referenced harmonised standard from the Commission, and the Commission is obliged to hand it over), yet the standards presumably continue to be copyrighted works of the ESOs in formal terms, as discussed in greater detail in Section 4 below.

The judgement did not require the Commission to proactively publish all standards in the OJ or elsewhere; it simply mandated disclosure in response to requests, based on the finding of public interest. One must still ask for a document under Regulation 1049/2001 to get it (though practically, the Commission cannot refuse such requests now). The Advocate General’s broader suggestion that standards ought to be published in the OJ for full legal accessibility was not adopted. Thus, European harmonised standards remain in a legal grey zone: they are “part of EU law” and must be accessible, yet they are not fully assimilated to the acquis in how they are promulgated or treated for copyright purposes. The standards now exist in a state of “superposition”: they are both part of EU law and not entirely part of it, simultaneously. This unstable equilibrium sets the stage for further litigation and, as this paper argues, necessitates legislative intervention. The need for such intervention is exacerbated by the use of harmonised standards in fields such as AI, where timely access to the text of standards may be necessary to substantiate matters of law or fact related to fundamental rights.

The Malamud judgement carries significant institutional and constitutional implications. At its core, the ruling vindicates the principle of the Rule of Law in the context of European standardisation. The Rule of Law requires that law be accessible and knowable; no person should be expected to obey a norm that is effectively secret or obtainable only at a cost. By holding that harmonised standards—which can determine regulatory compliance—must be freely available, the CJEU reinforced that public access to law is a non-negotiable element of EU governance. This resonates with longstanding doctrines in national legal orders.16 In this light, the Malamud judgement can be seen as bringing EU practice back in line with fundamental Rule of Law standards: it closes a troubling gap whereby EU consumers were subject to technical norms that, until now, were locked behind paywalls.

Another consequence of Malamud is the spotlight it shines on the delegation of regulatory authority to standardisation bodies. The EU’s reliance on harmonised standards has always raised a question: are these standards, in effect, a form of outsourced legislation?17 The CJEU in James Elliott answered part of that question by declaring the standards to be part of EU law for the limited purpose of preliminary rulings (Article 267 TFEU). However, the full implications of that status—e.g., whether standards can be annulled by the Court or whether their content must adhere to EU fundamental rights—remains uncertain.18 The Malamud case pushes the envelope further: by highlighting the Commission’s controlling role in standardisation and the legal effects of standards, it underscores that these privately drafted norms have a quasi-legislative nature.

This, in turn, raises constitutional accountability issues. If standards are effectively subordinate rules implementing EU law, should there not be clearer mechanisms to challenge them or ensure they respect higher-ranking norms? The Court’s judgement hints at this, noting that treating standards as EU law is what enables individuals to verify and contest compliance.19 Scholars have questioned whether, in domains like AI, which involve “value-laden” choices (See, e.g., Tartaro 2024), the delegation to ESOs might exceed what EU primary law allows. While Malamud did not directly rule on unlawful delegation, it intensifies the conversation about legitimacy and oversight in the EU standardisation system. It suggests that if private standards are to carry legal force, they must be subject to the full array of Rule of Law safeguards—transparency, reviewability, and democratic accountability—lest we create “black holes” of normativity in the EU legal order.20

In sum, the constitutional message of Malamud is twofold: (1) EU law (including its technical norms) must be open and accessible—a victory for the Rule of Law and a rebuke to the idea of “law behind a paywall”—and (2) the EU can no longer hide the policy choices embedded in standards behind the veil of private standard-setting. The ruling implicitly acknowledges that when regulatory outcomes are effectively decided in private forums (ESO technical committees), the EU institutions bear responsibility for those outcomes and must ensure they meet EU constitutional standards (transparency, proportionality, rights-compliance, etc.).21 This shifts the constitutional calculus: European harmonised standards, once seen as purely voluntary guidelines, are now recognised as integral components of EU governance, and thus must align with EU constitutional norms in their creation and availability.22 But the unresolved issues mean that the book is not closed.

4. Unresolved Copyright Issues

On one view, the judgement’s pointed silence on the copyright issue is Solomonic: by leaving a major issue unresolved, neither side was entirely satisfied, forcing them to resolve it themselves.23 Do, or, more to the point, should harmonised standards lose their copyright protection once cited in the OJ? The judgement can be read in two divergent ways. On one hand, CEN and CENELEC quickly declared that the ruling “does not call into question” the subsistence of copyright in harmonised standards (See CEN/CENELEC (2024a)). On the other hand, the applicants declared victory (See Morrison Foerster 2024). Some commentators suggest the decision amounts to a de facto waiver of copyright for standards that have become part of EU law. In short, the Court acknowledged the access problem but avoided the copyright one, forcing a future resolution in the marketplace of ideas (See Kanevskaia 2025).

4.1. Is Copyright Relevant if Disclosure Is Forced?

One reading of Malamud is that it is analogous to the rulings of the Court of Justice in Magill24 and IMS Health.25 In those cases, in a competition law context, the Court accepted that exclusive rights in intellectual property (“IP”) (in copyright and databases, respectively) may, in exceptional circumstances, be curtailed where they control access to an indispensable input and refusal to licence them would prevent effective competition. Following the analogy, so too does Malamud recognise that the exclusive rights claimed by ESOs over the text of standards must yield to overriding public interests when those standards function as indispensable legal norms. In both contexts, the underlying IP remains formally intact, but its exploitation is constrained by a compulsory access obligation: in competition law, the duty to licence competitors on fair, reasonable, and non-discriminatory terms; in the standardisation context, the duty of the Commission to disclose standards freely upon request.

The analogy highlights that what is at stake is not necessarily the destruction of IP, but its re-functionalisation in light of overriding legal principles—the maintenance of undistorted competition in the one case, and the Rule of Law in the other. Just as the “essential facilities” doctrine in competition law situates IP within the economic framework of the internal market, the Malamud ruling constitutionalises harmonised standards as legal infrastructure that cannot be enclosed by private rights. But the difference lies in the breadth of disclosure required: in Magill and IMS Health disclosure was required only as regards downstream market operators, and against a fee. The obligation to disclose opened up by Malamud applies to any member of the public, without charge.

Indeed, the Court explicitly held that the overriding public interest in the ability to know legal obligations must prevail over any private copyright claims in harmonised standards. Unlike Magill and IMS Health, therefore, the interference with copyright in Malamud is not exceptional, but is systematic and structural: it applies to every harmonised standard cited in the OJ, unconditionally. One might query whether this in fact hollows out the right entirely. Article 16 of Regulation 1049/2001 states that it is “without prejudice to any existing rules on copyright which may limit a third party’s right to reproduce or exploit released documents.” But it is unclear whether any useful right to exploit remains if anyone is entitled to request a free copy of a standard without needing to cite any justification. In practice, all that would remain for the ESOs and NSBs as copyright holders would arguably be to prevent further exploitation of the copyrighted material by others, or to enforce their “moral” rights, i.e., the right to claim authorship of the work and the right to object to any derogatory action in relation to the work. These rights are not harmonised at EU level.26

4.2. Are Standards Sufficiently “Original” to Merit Protection?

A broader question raised by AG Medina is whether technical standards should benefit from copyright protection in the first place. In EU law, copyright subsists in a document only if it qualifies as a “work”, meaning it embodies sufficient “expression” and is “original” to the author (an “author’s own intellectual creation” standard).27 That said, there is no category-based exclusion for technical documents. Even utilitarian texts can be protected if they meet the criteria. Thus, a harmonised standard could in theory be a protected work if (i) its content is an identifiable expression of the author’s mind (as opposed to mere ideas or data), and (ii) it is original in that the author exercised free and creative choices in its creation. These criteria, distilled from CJEU case law (in judgments relating to other domains, such as Infopaq,28 BSA,29 Football Dataco,30 and Painer31) (See also van Eechoud 2012, para. 60; Margoni 2016), set a relatively high bar: the work must reflect the imprint of personal creative freedom rather than just technical skill or labour. In this context, the key question is whether harmonised standards typically possess the required originality.

This problem as it relates to standards has yet to be definitively adjudicated on by European courts either before or after Malamud. Therefore, the doubt remains. It arises because harmonised standards are collaboratively drafted technical documents, often developed under mandates from the European Commission to satisfy predefined legislative “essential requirements.” The drafting process is constrained by the need to meet specific technical objectives, format requirements, and consensus procedures. As a result, authors of standards may have limited creative freedom in expressing the content. AG Medina took the view that the requisite freedom will likely not be present when drafting a harmonised standard because both the content and layout are largely dictated by legal and technical requirements, leaving little space for the exercise of personal creative choices.32 In copyright terms, many standards may be so constrained by their function that expression merges with the underlying idea or procedure, making any given provision essentially the only (or one of very few) way(s) to convey that requirement. Under the idea-expression dichotomy (and its EU analogues), such strictly functional or dictated language would not, following this logic, be “original” to any author.33 This can be illustrated by reference to, e.g., toy safety standards: the text typically consists of precise technical instructions (surface areas, gram measurements, prescribed testing steps) with little room for variation.

This type of writing arguably reflects technical know-how and compliance with drafting rules, rather than creative expression.34 On the other hand, not all standards are identical in this respect (which would presumably be the case for standards under the EU AI Act regarding fundamental rights protection). Commentators acknowledge that the “actual extent of freedom” available to drafters can vary depending on the technological field and the drafting context (See Mendis and Kanevskaia 2024). For example, drafting a software interoperability standard might allow for more discretionary narrative description (and thus more choice of wording) than drafting a simple materials test protocol. Ultimately, whether a given harmonised standard meets the originality threshold is a fact-specific inquiry. On this reasoning, determining if a technical standard fulfils the originality criterion requires a case-by-case analysis of the drafting process and constraints. Notably, the European Commission presumed that the standards requested by Public.Resource.Org were original works simply because of their length and the number of choices involved in structuring a lengthy document. The General Court accepted this assumption in 2021, but the AG criticised this as being ipse dixit. As AG Medina observed, “vague reliance on the length of a document is not sufficient to prove” the presence of genuine creative choices by the author.35 In short, while many (if not most) harmonised standards likely possess the requisite originality, others at least potentially lack the creativity to qualify for copyright at all, but until a court squarely adjudicates on this, their copyright status remains ambiguous.

It bears emphasis that should the reasoning above be adopted, it would potentially apply to all standards (not just harmonised standards) produced by ESOs, provided they fail to meet the required originality threshold. Thus, it would have implications for the standardisation system beyond mere concerns of access to EU law strictly speaking. As such, the solutions discussed below should be read with caution as applying only to harmonised EU standards strictu sensu and not to standards adopted by ESOs in general.

As the above illustrates, the unresolved copyright status of harmonised standards raises serious legal, practical, and economic implications. Some industry voices paint dire scenarios of underfunded standards development, while others suggest alternative funding mechanisms (including increased public support) could compensate—in other words, it might not be “all about the money.” (See Kanevskaia 2025). At a minimum, in light of these conflicting claims, there is a need for an unbiased economic analysis of whether free public access would truly undermine the ESO model. What is clear is that if copyright-based revenue is curtailed, the EU will need to rethink how standards development is financed and coordinated in the future.

5. Impact on ESOs and NSBs: Copyright and Revenue Model Under Strain

Therefore, the most immediate fallout of Malamud is its disruptive impact on the business model of European standardisation bodies. Two of the three ESOs (CEN, CENELEC),36 together with national standards bodies in each Member State, traditionally finance a significant portion of their activities through the sale of standards publications and related services. This model, decades old, treats standards documents as IP—copyrighted by the ESO and licenced to NSBs for national resale—with significant revenue generated from companies purchasing standards (either in hard copy or digital format). For instance, CEN and many NSBs derive much of their operating income from selling access to standards, including harmonised (“hEN”) standards adopted in Europe.37 The Commission’s own decision rejecting the applicants’ request noted that free, no-cost access to harmonised standards could “significantly reduce” CEN’s revenue and “call into question” the financing model of the system. The General Court likewise acknowledged that “the sale of standards is an essential part of the economic model of all standardization bodies.” On this view, free public access would force these bodies to completely rethink their organisational structure. This frank depiction presupposes the apparent dependence of the standardisation system on copyright monopolies over the texts (though, it must be said, this assertion has yet to be empirically verified).38

Now that the CJEU has effectively mandated free access (at least upon request) to harmonised standards, the ESOs and NSBs face a major revenue challenge. If companies and the public can obtain standards directly from the Commission for free, demand for paid standards is likely to plummet. In anticipation of this, stakeholders have voiced alarm. The German Institute for Standardisation (“DIN”) warned that the judgement could create “legal uncertainty for companies” and jeopardise the private standardisation system as a whole (See DIN 2023). Likewise, industry and governments have argued that undermining the sales revenue would weaken the capacity for standardisation work and thus weaken the EU Commission’s standardisation strategy. Even before the final judgement, some national governments took the side of the ESOs: the former German government, for example, stated that it viewed the existing funding model as crucial, cautioning that completely free access could imperil the system’s sustainability (See Deutscher Bundestag 2025). This stance reveals a fear that if ESOs and NSBs cannot charge for standards, they may lack resources to convene experts and develop new standards, potentially slowing innovation and the EU’s ability to regulate emerging technologies.

As noted, from the copyright perspective, Malamud stops short of expressly invalidating the ESOs’ copyright claims over standards. But it certainly diminishes the practical value of any such right. Formally, the ruling did not declare harmonised standards to be uncopyrightable. Thus, ESOs might still assert copyright if, for instance, a private party reproduces and distributes a standard widely, particularly if accompanied with some questionable trade practice. However, the CJEU’s logic implies that, at least vis-à-vis the Commission and the public interest, those copyrights cannot be used to deny access.

We are left with a situation where harmonised standards exist as copyrighted works that must nonetheless be handed out for free by the Commission on request, a contradiction that likely will not stand in the long term. Indeed, comparing this situation to the United States, one finds that the status of standards in Europe is now more ambiguous than in the U.S., where courts have grappled with similar incorporation-by-reference issues. In the U.S., it is well-established that “the law” cannot be copyrighted (under the government edicts doctrine) (See, e.g., Balganesh 2021), though privately authored standards incorporated by reference occupy a grey area. U.S. courts have increasingly tilted toward access as well. For example, the D.C. Circuit held in 2018 that the non-commercial publication of standards that have been incorporated into law constituted “fair use” under U.S. copyright law (a concept that does not exist under EU copyright law).39

By contrast, Malamud leaves European standards formally under ESO copyright, but with a broad right of public access. The ESOs must now confront the reality that their content is, for all intents and purposes, part of the public legal domain, even if the law has yet to catch up and unequivocally label it as such. A foreseeable reaction by ESOs and NSBs would be to seek alternative revenue streams. If direct sales of standards decline, standardisers might turn to other funding sources: increased membership fees, more services or training offered for a fee, or greater reliance on industry sponsorship of specific standardisation projects.

One option already practiced in some cases is project-based funding (See Monsees 2025), where industry consortia or government grants pay for the development of certain standards (with the standard then made freely available). The Malamud ruling could accelerate a shift toward project funding. Furthermore, it should be noted that a significant portion of the actual costs incurred amount to man-hours dedicated to standardisation tasks by industry (and therefore have already been internalised).40 However, observers caution that heavier reliance on industry financing could exacerbate legitimacy concerns, effectively giving large corporate players even more influence if they are footing the bill. The literature on standardisation governance has long identified imbalances in participation (SMEs and civil society often struggle to participate in technical committees), and deficits in democratic oversight as weaknesses of the system (See, e.g., ANEC/BEUC n.d.). A funding model where industry money further predominates might widen those gaps, unless counterbalanced by public interest funding.

It bears emphasis that balanced funding and participation would ultimately serve the interests of both civil society and business, since enhanced public participation will enhance the perceived legitimacy of the standards, and presumably reduce the risk of subsequent challenges.

For their part, CEN/CENELEC have proposed a “universal fund” to meet various societal objectives, similar to that introduced in the telecom regulatory framework of 2002 (See CEN/CENELEC 2025). In their view, such a fund would reduce the impact of the Malamud case on standardisation bodies, and allow the Commission to comply with the ruling while upholding IP rights. Member states should be the primary source of funding for such a universal fund. Beyond this, however, CEN/CENELEC’s proposal is sparse and detail, and it remains to be seen whether the Commission will be minded to adopt such a mechanism in any forthcoming legislative proposal.

6. The Elephant in the Room: Tensions with International Standardisation System

The international ramifications also deserve mention. Many harmonised EN standards are identical or equivalent to ISO/IEC international standards, developed in parallel through cooperation between CEN/CENELEC and ISO/IEC (or simply transposed directly under the Vienna or Frankfurt Agreements between CEN/CENELEC and those bodies).41 The Malamud judgement’s effect on making such standards freely available in Europe has unnerved international standard bodies. In December 2024, ISO and IEC took the extraordinary step of initiating legal proceedings against the European Commission to “protect international standards from unauthorized disclosure.”42 This is an assertion on their part that the EU Commission cannot simply give away ISO’s copyrighted materials. The WTO Agreement on Technical Barriers to Trade (“TBT”) is also part of the backdrop (See European Commission n.d.-b): it encourages the use of international standards in regulations and values transparency. WTO principles would support broad public availability of mandatory technical regulations, but they also respect IP rights (per the TRIPS Agreement). A conflict could arise if international standard bodies perceive that the EU Commission’s compliance with Malamud effectively forces them into open access, potentially undermining their global revenue (and their ability to function, given that many ISO members rely on sales too). Post-Malamud (and the ISO/IEC action), there has been an apparent deadlock on the publication of references to harmonised standards based on ISO/IEC material in the Official Journal (See IBF Solutions n.d.). The implications of this impasse are obvious for the viability of the EU standardisation system.

In light of all the factors noted above, the EU Commission and the ESOs now face a delicate balancing act: implementing Malamud in a way that satisfies the Rule of Law and access requirements, without collapsing the financial and cooperative framework that has underpinned standards development.

7. Compliance Pathways for Open Access: Models and Options

With the Malamud judgement establishing a clear need for free public access to harmonised standards, the question turns to how to implement this in practice. Multiple pathways have been proposed or can be envisioned to bring the EU standardisation system into compliance with the demands of the Rule of Law, while attempting to preserve the integrity and sustainability of standard-setting activities. Table 1 sets out the key models and options for moving forward.

Table 1. Possible solutions for free access to harmonised standards (Post-Public.Resource.Org).

Approach 1	Advantages	Disadvantages
1. Status Quo Ante—Access on request (Reg. 1049/2001)	‒ Formally complies with Public.Resource.Org (access if requested)—avoids outright secrecy. ‒ Preserves current ESO/NSB funding model. ‒ Minimal disruption to existing system.	‒ Not proactively transparent; public must know what to ask for. ‒ No solution to unresolved copyright question.
2. NSBs mandated to publish free	‒ Free, direct public availability improves transparency. ‒ Leverages NSBs’ existing dissemination role. ‒ Aligns with Rule of Law expectations.	‒ Cuts NSBs’ core revenue; risks undermining standardisation capacity. ‒ Uneven implementation across NSBs may fragment access. ‒ Likely resistance from NSBs/industry.
3. EU Commission publishes all standards	‒ Maximal transparency: all standards available like legislation (e.g., via Official Journal). ‒ Uniform access across EU. ‒ Strongest reinforcement of Rule of Law (no paywalls).	‒ Disrupts ESO/NSB revenue model; requires new funding. ‒ Likely litigation from ESOs/ISO/IEC. ‒ Possibly resource-intensive for Commission. ‒ Politically contentious (appropriation of private work).
4. Current solution: “Read-only” free access (compromise portals)	‒ Immediate transparency gain (no payment to view). ‒ Quick, interim measure. ‒ Balances access with partial copyright protection.	‒ Limits usability (no download/print). ‒ Not true “widest possible access.” ‒ Risks new legal challenges; potentially seen as half-measure.
5. EU/Member State buyout or licencing	‒ Balances public access with compensation to ESOs/NSBs. ‒ Acknowledges both public interest and private rights.	‒ High public cost; ongoing budgetary burden. ‒ Risk of fragmentation
6. Embed full text into legislation	‒ Maximal transparency/legal certainty. ‒ Clearer democratic oversight (Parliament/Council). ‒ Removes dependency on private bodies.	‒ Impractical: significant legislative burden. ‒ Loss of technical expertise/consensus process. ‒ Slows responsiveness to technological change.
7. Commission-issued “Common Specifications” (Binding EU acts setting technical detail when no standard exists, e.g., under AI Act)	‒ Full legal certainty and accessibility: CSs are EU legal acts, automatically published in the OJ. ‒ Stronger democratic legitimacy: subject to comitology 2 and Council/Parliament oversight. ‒ Avoids private copyright issues entirely (EU-authored “law”). ‒ Judicial reviewability under Art. 263 TFEU.	‒ Undermines the co-regulatory model; reduces stakeholder-driven consensus and industry expertise. ‒ Runs contrary to legislative intent behind AI Act (harmonised standards as the preferred means of concretizing “essential requirements”) ‒ Commission may lack technical depth and agility compared to ESOs. ‒ Risks politicisation of technical norms; industry acceptance may fall. ‒ Slower adoption; may stifle innovation if Commission cannot update as quickly as ESOs. ‒ Could weaken international alignment if EU develops unique specifications outside ISO/IEC. ‒ Applies only prospectively (i.e., for new legislation or standards). Writing common specifications to replace existing standards would be unreasonably costly.

¹ Note that not all solutions are mutually exclusive. ² For a summary see Craig (2012).

7.1. Status Quo Ante—Access on Request (Reg. 1049/2001)

Under the status quo ante, the European Commission would continue to provide harmonised standards only upon specific request, in line with the Access to Documents Regulation 1049/2001. This approach minimally satisfies the Rule of Law imperative by avoiding secret law, but it is not proactively transparent: citizens and businesses must know which standard to ask for and navigate an administrative process for each document. Moreover, it leaves unresolved a fundamental tension: the standards remain formally copyrighted by the ESOs/NSBs even as the public now has a right to obtain them, which is at the very least a contradictory situation. Relying on case-by-case requests is also institutionally burdensome (the Commission has apparently faced an unprecedented wave of applications) and therefore would be unsustainable as a long-term solution (See Mendis and Kanevskaia 2024).

7.2. NSBs Mandated to Publish Free

Another option is to legally require European and national standardisation bodies (“NSBs”) to publish the full text of harmonised standards free of charge to the public. This would directly fulfil the transparency and accessibility demands of the CJEU’s ruling by making the law’s technical content openly available at its source. Such a mandate, however, would fundamentally disrupt the current funding model: NSBs and ESOs finance their activities through the sale of standards, and stripping away that revenue without compensation could undermine the standardisation process, both at the EU level, and—since many standards are heavily based on ISO/IEC standards—the international level. Implementing this solution would likely require an amendment to the EU Standardisation Regulation (Regulation 1025/2012) to impose an open access duty and to provide alternative funding for standards development. Due to contingent factors (e.g., limited funding), it cannot be excluded that there may also be uneven uptake and resistance at the national level: some Member States or NSBs might delay or dilute implementation, leading to fragmented access across the EU. Despite these challenges, aligning NSBs’ obligations with Rule of Law principles (as many national legal systems do for incorporated standards) would ensure that no citizen is denied knowledge of binding norms due to a paywall.

7.3. EU Commission Publishes All Standards

This approach would have the European Commission centrally publish all harmonised standards (for example, by printing them in the Official Journal or hosting them on an EU website), treating these standards as akin to EU legislation in terms of accessibility. It would achieve maximum transparency and uniform access, effectively putting standards on the same footing as regulations or directives, freely available to anyone. Advocate General Medina explicitly urged this path, arguing that because harmonised standards form part of EU law, they should be published in the Official Journal for full enforceability and public access. In light of the judgement, a Commission-hosted publication model would be the clearest way to implement the Rule of Law: “if it’s part of EU law, publish it like EU law.”

The legal and institutional implications, however, are significant. Proactive publication by the Commission would likely require new legal measures (again, an update to Regulation 1025/2012 or a dedicated act) to either secure permission from the ESOs or to declare these standards non-copyrightable when referenced by EU law. It would also necessitate a rethinking of the public–private partnership: the current ESO/NSB revenue stream from selling standards would vanish, meaning that the EU (and/or national governments) would need to fund the standardisation system directly. Without such funding reform, this option faces the risk of legal challenges from the standardisation bodies (and possibly ISO/IEC international partners) for undermining their IP. Politically, an EU move to unilaterally publish standards could be seen as appropriating the fruit of private technical work, so any implementation would likely involve negotiations and transitional compensation to the standard bodies. Nonetheless, this solution most robustly fulfils the CJEU’s mandate of openness and has strong normative appeal in reconciling the status of harmonised standards with that of other EU legal acts.

7.4. “Read-Only” Free Access (Compromise Portals)

In the wake of the judgement, the Commission and CEN-CENELEC have adopted a compromise: providing read-only online access to certain harmonised standards via national “digital reading rooms” or portals.43 Under this model, any member of the public can view the text of a harmonised standard on-screen at no cost, but cannot download, print, or reuse it without purchasing it from the NSB. The arrangement immediately improves transparency by removing the paywall for those who simply need to consult a standard’s content, and it reflects a negotiated balance to respect the ESOs’ copyright (since the standards remain on a locked viewer controlled by the NSBs). However, this solution’s legal adequacy remains debatable, and this adequacy will need to be clarified (potentially through further litigation). It also bears note that, under this system, CEN/CENELEC harmonised standards are made accessible on national read-only platforms, while harmonised standards based on ISO/IEC international standards are “currently available solely via individual requests for access to documents” (solution 1).44 This is not merely a transparency UX choice;45 it is a legally salient indication that the Commission is continuing to treat the ISO/IEC subset as higher-risk pending judicial clarification.46

Relatedly, the Commission’s “European standards” hub page now explicitly notes “Access to documents” as a sub-feature of the harmonised standards ecosystem, alongside the notification system and standardisation requests. This suggests that this form of access is not an ad hoc workaround but (at least for now) is being normalised as a standard component of the EU standardisation infrastructure (See European Commission n.d.-a). But one might question its adequacy: The CJEU stressed that citizens must be able to “unequivocally ascertain” their rights and obligations under the law, and a read-only portal—especially one that initially only includes the specific standards litigated in the case—may not fully satisfy that principle if access is constrained or incomplete. From an institutional perspective, the read-only portals are a stop-gap measure: they deliver some compliance with the judgement without awaiting legislative change, but they do not resolve the underlying issue of general access to all harmonised standards. The limitation on use (no copies or local storage) means the public still lacks the “widest possible access” to these documents, contrary to the spirit of openness in Regulation 1049/2001. Indeed, it is easy to characterise this as a half-measure: while better than outright secrecy, it could invite further challenge (for example, whether denying the ability to print a law-related text is consistent with the right to information). Unless expanded and made more user-friendly, the read-only approach is likely a temporary bridge rather than a permanent solution.

7.5. EU/Member State Buyout or Licencing

A fifth option would be for public authorities to pay for the rights to make standards available: essentially “buying out” the copyright or obtaining a broad licence from the ESOs and NSBs to allow free public access. In practical terms, this could mean the EU (or individual Member State governments) allocates funds to compensate the standardisation bodies for the loss of sales revenue, in exchange for which the standards would be openly published for all users. The legal appeal of this model is that it marries the public interest in open access with respect for private IP rights: rather than unilaterally abolishing or overriding copyrights, the rights are honoured but under terms paid for by the public purse. Commentators have suggested that such a paid licencing scheme might be an efficient and fair way to “cut the Gordian knot,” ensuring standardisers remain financially whole while the public enjoys free access to the law.

For example, Mendis and Kanevskaia argue that if completely free access would undermine the ESO business model, a shift to FRAND-type licencing or other compensation could be a possible solution to balance interests.47 It is unclear, however, how FRAND-type licencing is transposable from the patent context to a copyright regime, which is based on the sale of documents rather than the implementation of patented technologies. Nor would it overcome the access issue, since FRAND licencing still presupposes access for end users against a fee. Furthermore, the financing issues would remain, since even FRAND-type licencing would presumably undermine the ESO and NSB licencing model and require some form of public subvention to compensate for this.

It appears that no matter what solution is adopted, there will be a shift of the cost burden to taxpayers or the EU budget. The scope of harmonised standards is vast (covering thousands of documents across many sectors),48 so a full buyout could impose a high ongoing budgetary commitment (though as noted, this has yet to be quantified). If done piecemeal by individual Member States, it might also result in unequal access or double-paying: some countries might pay for certain standards while others do not, fragmenting the single market’s legal transparency. To work effectively, a buyout/licencing solution would likely need to be coordinated at the EU level, possibly through a dedicated fund under an amended Regulation 1025/2012 or the Single Market Programme. Instituting such a scheme raises institutional questions: how to assess fair compensation, how to ensure ESOs continue to have incentives to produce high-quality standards, and how to prevent overreliance on public funding. This could be done in a variety of ways: structured as lump-sum payments, periodic royalties indexed to the number of harmonised standards cited in the Official Journal, or revenue-floor guarantees calibrated against historic sales figures. Despite these complexities, this model presents a workable compromise path: it upholds the CJEU’s openness mandate and could be more politically palatable to standardisers since it recognises the value of their work in monetary terms.

7.6. Embed Full Text into Legislation

A more radical solution would be to dispense with incorporation by reference entirely and instead incorporate the full text of each harmonised standard directly into EU legislation (for instance, as annexes to regulations or directives). Under this approach, when EU law uses a technical standard to flesh out regulatory requirements, the standard’s content would be enacted as law and published in the OJ, just like any other annex or technical schedule. The legal effect of this would be absolute transparency: the public availability of the standard would be guaranteed as a matter of legislative publication, and there would be no question of a separate copyright restricting access. This approach aligns with AG Medina’s view that norms which are “part of EU law” should be treated as official legal texts, not as ordinary copyrighted material, in line with constitutional principles in all Member States that insist that all binding rules be published or accessible to the public.49 By embedding standards in legislation, democratic oversight is enhanced: the European Parliament and Council would have scrutiny over the precise content of the technical rules, potentially improving accountability and fundamental rights compliance.

However, the institutional and practical implications are largely negative. This would arguably amount to the worst-case scenario: the New Approach and the NLF were created precisely to avoid the need for legislators to negotiate and codify highly technical specifications; reversing this would vastly increase the legislative workload and slow down the adoption of standards. EU lawmakers might find themselves voting on minutiae of engineering or chemistry, which is both impractical and beyond their expertise. Furthermore, the agility of the standards process—which currently allows experts to update technical norms relatively quickly—would be lost; every change would require a formal legislative amendment, a cumbersome process ill-suited to fast-moving technological fields. This solution could also discourage innovation: if the legislative route cannot keep up with technological change, industry may be left with outdated legal standards. In short, while embedding the full text of standards into legislation would perfectly satisfy the court’s transparency concerns, it would undermine the flexibility and public–private collaboration that are hallmarks of the EU standardisation system. As a result, it is viewed as a theoretical solution of last resort rather than a desirable reform. Even AG Medina, while insisting on accessibility, stopped short of suggesting that every standard must be legislated in full; her emphasis was on either excluding standards from copyright or publishing them in the OJ, not on ending the delegation to private bodies altogether.

7.7. Commission-Issued “Common Specifications”

Finally, as alluded to above, the EU could increase its reliance on common specifications—technical rules issued by the Commission itself—as an alternative to harmonised standards. Topically, the Artificial Intelligence Act also invokes this approach: under Article 41 of the AI Act, if the ESOs fail to develop a needed standard or if urgent requirements arise, the Commission may adopt common specifications via an implementing act, which then confer the same presumption of conformity as a harmonised standard. Expanding this concept, the EU could choose to bypass private standards in certain domains and instead promulgate the technical requirements directly. The legal implications are that these common specifications, being EU legal acts, would automatically be published in the OJ and freely accessible, thus meeting the CJEU’s requirements of transparency by design. They would also carry clearer legal authority (and reviewability under Article 263 TFEU) since they are formally enacted by a public authority, potentially reducing the “grey zone” status of private standards in EU law. This could be particularly attractive in areas where fundamental rights or safety are at stake, ensuring that democratically accountable institutions control the substantive norms.

The institutional trade-offs, however, are significant. Overreliance on Commission-issued specifications would undermine the longstanding co-regulatory model: it cuts out the traditional role of ESOs and industry stakeholders in developing consensus-based standards. The standardisation bodies bring extensive technical expertise and a bottom-up approach, which might be lost if the Commission (even with expert committees) takes on the task of writing detailed technical rules. Indeed, the inclusion of the CS mechanism in the AI Act was intended as a fallback—the default route remains to use harmonised standards, reflecting a legislative judgement that private standard-setting is preferable unless it fails in a particular instance. Moreover, the Commission may lack the resources and agility to keep technical specifications as up-to-date and internationally harmonised as ESOs can. Furthermore, there is a risk that EU-specific common specifications could diverge from global standards (ISO/IEC), potentially isolating the EU market or creating dual compliance burdens for industry.

Politically, too, if every technical detail becomes a Commission rule, it could provoke concerns of over-centralisation or politicisation of what were once industry-driven norms. In summary, while common specifications ensure full legal openness and could be used to guarantee free availability of essential standards (thus addressing the immediate copyright issue), they are best seen as a complement or safety net. The Malamud judgement’s pressure for accessibility might indeed prompt greater use of common specifications where appropriate (especially under the AI Act’s regime), but a wholesale shift to this approach would mark a profound change in the European standardisation paradigm and could sacrifice some of the efficiency and expertise that the current system provides.50 Perhaps for these reasons, the Commission remains reticent towards the use of common specifications, at least in certain areas: notably, it has signalled that it is not intending to rely on common specifications for AI at the time of writing (See Bertuzzi 2025).

7.8. Analysis of Options

Each of these models is not mutually exclusive; a blended approach might emerge. For example, the Commission might provide a central portal (Commission-hosted) but with some read-only features to prevent abuse during a transition; simultaneously, the EU might allocate funds to ESOs to offset losses (partial buyout); Member States might agree to share costs or provide national access points in the meantime. Indeed, what is clear is that Malamud forces a renegotiation of the implicit contract between regulators and standardisers. The old bargain—“we, the ESOs, develop the standards and sell them; you, the EU, reference them in law to give them effect”—is no longer tenable without modification. The new bargain likely requires the EU to take on a greater share of responsibility, both in disseminating standards and in financing the system.

Among the possibilities, a Commission-hosted free access solution (option 3) stands out as the most direct way to fulfil the CJEU’s judgement and uphold the Rule of Law. It places the European Commission, which already coordinates and supervises harmonised standards development, in charge of ensuring that those standards are available just like any EU legislation. This approach has strong normative appeal: it treats harmonised standards openly as extensions of EU law, reinforcing their legitimacy and visibility. It would also simplify matters for users: a one-stop EU website where all “EN” standards referenced in the OJ could be obtained would dramatically improve transparency and reduce the compliance burden for companies (especially SMEs or startups that found purchasing numerous standards prohibitively expensive). From a Rule of Law perspective, it is the cleanest solution, essentially implementing what AG Medina and many commentators view as the logical consequence of James Elliott and Malamud: “if it’s part of EU law, publish it like EU law.” This fundamental concern is not addressed by the Commission’s current limited access model (option 4).

That said, a Commission-hosted model must fairly address the copyright and funding concerns of the ESO system. The ESOs and NSBs are justifiably concerned that moving to free publication without a new funding mechanism would “pull the rug out” from under them. Thus, it seems that any such solution should be accompanied by reforms to Regulation 1025/2012 and related instruments to reshape the financing of standardisation. Some balancing considerations include:

• Maintaining Quality and Independence: The standardisation bodies would argue that their quasi-independent, expert-driven process has produced high-quality standards efficiently, and that independence is partly maintained by not being entirely government-funded. If the EU begins funding a larger share, care should be taken to preserve the technical expertise and openness of the process (indeed, possibly increasing openness by enabling more stakeholders to participate if cost barriers are reduced). The goal should be to avoid a scenario where lack of funds forces ESOs to cut back activities or where EU funding leads to politicisation of purely technical work. A multi-channel funding approach might be healthiest: EU funds, continued industry contributions (e.g., membership fees), and maybe new revenue streams like paid value-added services.
• Compensation for Losses: An assessment of the financial impact on ESOs/NSBs should be conducted: how much revenue stands to be lost per year from making harmonised standards free? This could be tens of millions of euros EU-wide. The EU budget (perhaps through the Single Market Programme or a dedicated fund) could compensate for a significant portion of this. For instance, if an NSB currently earns a certain amount from selling EN standards, the legislation could provide an equivalent grant conditional on that NSB making those standards freely accessible on its website or redirecting users to the EU portal. A transparent formula could be established, perhaps diminishing over time if the system becomes more efficient or finds other revenues. This could entail a shift to a model such as that used by ETSI (based on membership fees), but this would disrupt the existing structures (via the Vienna and Frankfurt agreements) that exist between CEN/CENELEC and ISO/IEC. As such, any potential solution for compensating CEN/CENELEC for potential losses under a reimagined system would need to be carefully calibrated. This is further exacerbated by the fact that once EU standards become generally available, they will not only be of use for entities in the EU (be they market actors, regulators, or consumers). They could potentially become the groundwork for regulations and compliance efforts worldwide, and arguably amount to a form of subsidy for international businesses and regulators. This is another consideration that will inevitably be raised by EU stakeholders and will need to be taken account in the design of any recalibrated system. On the other hand, this could be a desired effect from a policy perspective (arguably enhancing the so-called “Brussels effect” of the AI Act, which in some quarters would be welcome, but seen as lacking so far.)51
• Copyright and Licencing: Legally, it would be prudent for the EU to clarify the copyright status of harmonised standards. One approach is an amendment to Regulation 1025/2012 stating that when a standard is cited in the OJ, the ESO (and its members) must licence the EU a right to make it available for free. In exchange, the ESO retains copyright for other uses and might get royalties or fees via the compensation scheme. Alternatively, the law could declare that such standards are not subject to exclusive copyright to the extent necessary for public access, essentially codifying a limitation or exception under copyright law for standards-as-law. This would guard against any future legal challenge by an ESO or ISO trying to stop the Commission from publishing content (which Malamud already largely precludes, but a belt-and-suspenders approach in legislation could help). Careful drafting is needed to respect international IP treaties (TRIPS does allow exceptions for public information, as noted above). The key is to avoid chilling the collaborative relationship with global standards bodies while asserting the primacy of access to law.
• Timeline and Transition: Implementing a Commission-hosted database with potentially thousands of standards is not trivial. The Commission will have to work with ESOs to obtain the files, possibly translate some if needed (though usually standards are only in EN/FR/DE or the like at European level). A phased rollout could be considered: for example, start with all newly referenced standards from 2024 onward, then gradually add older ones. During a transition, read-only portals and info points can bridge gaps. It will be important to communicate clearly to industry that the official free source is coming (to avoid confusion or reliance on unofficial copies).52

In weighing these concerns, it is essential to remember the bigger picture: European standardisation serves European public policy and the single market. Its legitimacy and effectiveness hinge on broad acceptance and use of standards. If standards are seen as paywalled “private” documents, that undercuts their legitimacy in the eyes of the public and even courts. By contrast, a system where standards are openly accessible can strengthen the role of standards: they can be more readily referenced in national regulations, taught in universities, and used by innovators. The free availability of standards could spur uptake, possibly leading to indirect economic benefits (more innovation, fewer compliance errors) that outweigh the lost direct revenue. In any event, the adjustment is inevitable. Even the most ardent defenders of the status quo acknowledge that Malamud is a binding judgement that must be respected. As Kanevskaia notes, while many practical questions of financing loom, “the bigger questions of legal certainty and the Rule of Law should not be overlooked.” (See Kanevskaia 2025). In other words, compliance is not just about money: it is about aligning the standardisation system with fundamental legal values. That alignment will ultimately be to the system’s benefit, conferring stronger democratic legitimacy and stability.

8. Conclusions: Reform of the Standardisation Regulation

As noted, the EU Commission has announced that it plans to reform Regulation 1025/2012, and preparatory work is underway. The Commission completed a public consultation in December 2025, in which it acknowledged that “harmonised standards are part of EU law, and that the principles of transparency and accessibility apply.”53 Interestingly, the Commission’s individual questions on this topic use circumspect language (“[t]he legally relevant content of standards should be published and freely accessible by default.”). It is unclear whether the Commission is considering introducing a new distinction between the “legally relevant” and other portions of standards through this use of language. Notably, CEN/CENELEC also “[g]enerally speaking … agree to grant access free of charge to the elements of harmonised standards which provide presumption of conformity” (but not other, unspecified, elements) (See CEN/CENELEC 2025, p. 6). From the face of the Malamud judgement, it seems doubtful that compliance would require only disclosure of the “legally relevant” portions of harmonised standards—the judgement required disclosure of the referenced standards in their entirety, i.e., the entire text is legally relevant, since the entire legal standard forms “part of EU law.”54 At the time of writing, the Commission’s Work Programme for 2026 foresees the adoption of a legislative proposal in the third quarter of the year (See European Commission 2026a).

In any event, this move by the Commission confirms that the Malamud judgement marks a constitutional turning point for the EU standardisation system. It has confirmed that when private standards are given legal effect by EU legislation, they can no longer be treated as proprietary secrets or club goods: they become, in essence, part of the acquis communautaire to which all must have free access. To implement this principle and ensure the long-term viability of European standardisation, a series of legislative and structural reforms should be undertaken. Most centrally, Regulation (EU) No 1025/2012 (the Standardisation Regulation) should be amended to embed the lessons of Malamud and adapt the system’s governance accordingly:

• Guarantee of Open Access: The revised Regulation 1025/2012 should explicitly require that all harmonised standards cited in the OJ be made freely available to the public in a timely manner. This could be formulated as an obligation on the European Commission to publish the standards (perhaps via an online portal linked to the OJ). It would eliminate any ambiguity by writing the Malamud access rule into EU legislation. The amended Regulation could further state that providing such access is considered part of the standardisation process and is without prejudice to the voluntary nature of standards (clarifying that “voluntary” refers to use, not access).
• Funding Mechanism: The Regulation should establish a clear mechanism for EU financial support to the ESOs/NSBs in compensation for open access. For example, a new article could set out that the Commission may conclude partnership agreements with the ESOs to fund the development of harmonised standards, including a contribution specifically for making them publicly available. The legislation might authorise an annual appropriation or a multi-year programme under the EU budget for standardisation. It could also encourage Member States to support their NSBs during the transition. In essence, the Regulation would shift the paradigm: from pay-per-document to public funding for public good. This could be justified by emphasising that easy access to standards is crucial for SMEs, innovation, and enforcement of EU law, warranting public investment. Alternatively, a “universal fund” as mooted by CEN/CENELEC could be put in place (See CEN/CENELEC 2025).
• Copyright and Legal Status: To resolve the lingering copyright paradox, the reform could declare that harmonised standards, once cited by the Commission in the OJ, are not protected by copyright insofar as necessary to allow their free reproduction and use for compliance, implementation, or scholarly purposes. This would align EU law with the notion that such standards are part of “EU law” and cannot be exclusively owned. Alternatively, the Regulation could require ESOs to licence the content under an open licence (or dedicate it to the public domain) upon citation. The choice of approach may depend on ensuring consistency with international IP law, but there is room under TRIPS for exceptions for public information.55 In any case, clarifying the legal status will help avoid future disputes. It would also support possible judicial review of standards: if they are treated more squarely as EU acts (or at least as Commission-approved annexes). One could imagine procedures for reviewing their legality (perhaps via a specialised mechanism or by strengthening the ex ante review by the Commission’s HAS consultants to include fundamental rights compliance).
• Stakeholder and Governance Reforms: While prompted by the access issue, reforming 1025/2012 is also an opportunity to address the broader legitimacy concerns. The Regulation could bolster requirements for transparency in the standard drafting process (e.g., publish drafts for comment more widely), ensure balanced representation (formalising roles for consumer and SME groups with voting rights or veto in certain cases), and enhance Commission oversight where standards implicate sensitive areas (like AI or health). The Malamud saga revealed a tension between private standard-setting and public accountability; legislative tweaks could recalibrate that balance. For instance, one might consider a right of scrutiny for the European Parliament or Council for certain important standards before they are cited, or a faster objection procedure if a standard is found to conflict with EU law principles.
• Encouraging International Harmonisation with Openness: The Regulation’s reform should also speak to the international aspect. It can reaffirm commitment to using international standards where possible (as currently) but also assert that when international standards are used in EU legislation, the EU will seek arrangements to make them available. This might push ISO/IEC to adopt more open access policies for standards that become law, or to negotiate terms with the EU. The EU could lead by example, perhaps prompting a global dialogue on access to standards-as-law. The Regulation might mandate the Commission to pursue Memoranda of Understanding with international bodies on access.

In conclusion, the journey started by James Elliott and now propelled by Malamud is heading toward greater “juridification” of harmonised standards, integrating them firmly into the legal order, as has happened in other domains.56 As scholars of juridification have noted in the broader context, where a legal system regulates or imposes norms on a subsystem of law, the result may be judicial measures in reaction to the “law’s indeterminacy and/or lack of transparency.” (Blichner and Molander 2008, p. 45). This appears to be the endgame of the Malamud saga. This need not destroy the private-led standardisation system; rather, it challenges that system to evolve into a more open, transparently funded, and accountable form. The recommendations above aim to ensure that the EU standardisation system remains fit for purpose in the post-Malamud era, upholding the Rule of Law while still harnessing industry expertise and innovation. As noted, European harmonised standards have been in a quantum superposition of sorts, both law and not-law. It is time for the “wave-function” to collapse into a coherent reality: these standards are an integral part of the law, and the EU institutions and legislation must treat them as such. The European Commission’s prompt efforts to implement the judgement are encouraging, but only structural reform will provide the legal certainty and stability needed.

Regardless of whatever solution is adopted, there will inevitably need to be an empirical accounting of the extent to which ESOs, NSBs, and international bodies such as ISO/IEC in fact financially depend on copyright-based access to standards for their activities under the current model. This may be a subject for further research. Ultimately, embracing open access to standards is not only a compliance necessity, it is an opportunity to strengthen the European model, making standards work for all stakeholders in an inclusive and constitutionally sound manner. The legislature should seize this moment to update Regulation 1025/2012, cementing a new equilibrium where accessibility, legitimacy, and technical excellence (or at least sufficiency) in standardisation go hand in hand for the benefit of the single market itself, economic operators, and its citizens.