Neurodata and European Law: On the Structural Incapacity of the Current Regulatory Framework to Protect the Cognitive Sphere

Abstract

This paper argues that the current European regulatory framework (GDPR, AI Act, and Medical Devices Regulation) is structurally inadequate to address the challenges posed by commercial neurotechnologies. The focus is specifically on inferential neurodata processed in non-therapeutic consumer contexts. This ineffectiveness is not merely an interpretive gap, but a systemic failure rooted in the absence of a unified conception of the cognitive sphere as an autonomous legally protected interest. The analysis demonstrates how the uncoordinated overlap of these regulations creates a severe protection vacuum regarding algorithmic neural inferences. Finally, the paper identifies the minimum conditions for an adequate European framework.