It is 2034. Two years ago, you had a brain-computer interface fitted, and it has since replaced your phone. You think of a sentence, and it’s delivered as a message: no typing, no talking, no screen. It is faster than anything you have used before and, like most people around you, you have long stopped wondering how it works.
One Friday evening, your boss emails to ask whether you could “just take a quick look” at something over the weekend. For half a second, a sentence forms in your head that you would never say out loud. Then you compose a polite reply: of course, happy to help. You did think it, but did you say it?
Doesn’t matter. Your boss receives both.
On Monday, the questions begin. Did you say the first message, or did you merely think it while your device said it for you? Can it be used in disciplinary proceedings? Is it, in any meaningful sense, yours?
None of this is pure science fiction. In August 2025, a Stanford team published findings showing that “inner speech” produces brain activity that resembles, in a weaker form, the activity produced when we try to speak. In the researchers’ own words, this raises the possibility that inner speech could accidentally leak out, so that a speech implant could end up decoding something the user intended only to think, not to say aloud. As Nita Farahany put it, the boundary between public and private thought may be blurrier than we assume. For lawyers, that blur is arguably even more problematic, because it reaches the heart of one of the oldest distinctions in our legal tradition.
The line the law takes for granted
European human rights law treats what happens inside your head very differently from what you do with it. On one side lies what we call the forum internum, in other words, the inner sphere in which you form, refine, doubt and abandon your thoughts. Under Article 9 of the European Convention on Human Rights and Article 10 of the EU Charter of Fundamental Rights, this inner sphere is protected absolutely: no interference with it can ever be justified, whatever the public interest at stake, so as to shield people from indoctrination, from attempts at “de-programming” and from being forced to disclose what they believe. In simple terms, you can be held to account for what you say or do, but not for what you think. On the other side lies the forum externum, which covers what you manifest to the world. That sphere can be limited, provided the limitation is lawful, necessary and proportionate. This, however, means there is a tipping point: whatever a “thought” may be, there is a point at which it stops being thought and becomes expression, and the law assumes it knows where that point lies.
For most human history, that assumption caused, generally, no problem. The line ran through your mouth, your pen or your keyboard, and a thought stayed in your head until you chose to let it out. That act of choosing was the tipping point on which every legal consequence we attach to speech, from liability and attribution to evidence and contract formation, depended. A brain implant changes things, because it removes the act that used to mark that tipping point. Speaking, writing or typing all require a separate, voluntary movement of the body, and that movement is what turns a thought into expression. A speech implant needs no such movement: it reads the neural activity behind the words directly. And since inner speech and attempted speech produce similar patterns in the brain, differing mostly in strength, the device cannot simply wait for you to “act”. It has to infer, from the signal itself, whether you meant to speak or were only thinking. As such, the decision to release a thought is no longer just something you perform, but an inference a device makes.
However, the moment of release cannot simply disappear, because, without it, either every passing thought would become speech, or no message would ever count as speech. What changes is, therefore, who draws the line between thought and action, and how. It may no longer be the person, through a decision of their own, but someone else.
Who draws the line today
The Stanford researchers saw this problem coming and engineered a two-part response. For implants designed to decode attempted speech, they trained the decoder to recognise inner speech and ignore it. For future implants designed to decode inner speech directly, they built something like a mental password: the system decodes nothing until the user silently “thinks” a rare keyword that unlocks it. In real-time tests, the keyword was correctly detected, or correctly not detected, 98.75% of the time, leading the authors to conclude that “high-fidelity methods exist to prevent unintended decoding of private inner speech”.
As far as engineering goes, this is both impressive and responsible. From a legal perspective, however, it may reveal something problematic, as the boundary between your absolutely protected inner life and your limitable expression may have just become a design parameter, a classifier threshold, a choice of keyword, an accuracy rate. Lower the threshold and more of your mind becomes “speech”, but raise it and the device misses or rejects messages you did mean to send. Somebody has to make that trade-off, and at present the obvious candidate is the manufacturer.
This is, of course, not meant to be a criticism of engineering or technological progress. The point is to ask ourselves whether that is acceptable for a distinction between what we think and what we do that our legal order and society treat as fundamental.
Why EU law does not reach it
One might expect the EU’s extensive digital rulebook to have an answer. It regulates personal data, artificial intelligence and medical devices, so there should be something. On closer inspection, however, there is not much.
The GDPR is the natural starting point, but it doesn’t really tell us when a thought becomes an action. The European Data Protection Supervisor has made clear that neurodata is personal data, even describing the use case at the centre of this piece as active collection, in which data is gathered while users are thinking about something, illustrated by imagined handwriting being decoded and translated into text. The processing is therefore plainly covered, and policymakers are already debating whether neural data should become an express special category under Article 9 GDPR: a European Parliament research study has floated the explicit inclusion of neurodata in Article 9, and others have called for a targeted amendment of Articles 4 and 9. That debate, however, concerns how strongly the data is protected, not what the data becomes. The GDPR asks whether the processing of your neural signals has a legal basis, a defined purpose and adequate safeguards. Those are questions about how the device handles your data, and they can all be answered satisfactorily without ever asking whether a particular thought should have been turned into an output in the first place. Imagine a manufacturer that complies with every one of them: it has your consent, processes your neural data only to transmit your messages, and keeps it secure. Its decoder can still misread a passing thought as an intended message and send it. Nothing in that sequence breaches the GDPR, because the processing did exactly what it was supposed to do. The failure is not in how your data was handled, but in what the device decided your data meant, and that is a question the GDPR simply does not ask.
The AI Act fares little better. It does mention brains, i.e. Recital 29 notes that manipulative techniques could be facilitated, for example, by machine-brain interfaces or virtual reality, and the Commission’s guidelines on prohibited practices refer to emerging machine-brain interfaces and advanced techniques like dream-hacking and brain spyware. Practitioners have also pointed out that neurotechnologies used to detect or infer emotions may fall under the rules on emotion recognition, and commentators increasingly argue that the Act could indirectly regulate neurotechnology as a whole. All of this, however, concerns AI that manipulates you or infers something about you. A decoder that faithfully converts your own leaked inner speech into a message does not necessarily do either. It simply speaks on your behalf.
The Medical Device Regulation can also be a good candidate, since a communication implant for a person with paralysis will very likely qualify as a medical device. Such a device must meet the Regulation’s general safety and performance requirements, i.e. it must achieve the performance intended by its manufacturer, be safe and effective, and incorporate software that ensures repeatability, reliability and performance in line with its intended use. Where its decoding AI forms part of a medical device subject to third-party conformity assessment, that AI also becomes a high-risk system under Article 6(1) of the AI Act. The implant in our opening scenario, however, might not be medical at all. It was meant to simply replace a phone. The MDR does extend to certain non-medical products listed in its Annex XVI, and point 6 of that Annex addresses neurotechnology, but only equipment “intended for brain stimulation” that applies currents or fields “to modify neuronal activity in the brain”. The Commission’s common specifications for those products accordingly focus on stimulation risks, such as side effects and interactions with other implants. A device that merely reads the brain, decodes its activity and sends messages likely stimulates nothing, and does not appear to fall within Annex XVI. The result is, therefore, quite curious. The patient who needs a brain-computer interface in order to communicate gets something that was subject to a conformity assessment, and other requirements, while the healthy consumer who adopts one as a lifestyle upgrade may receive none of these from the MDR. Even where the Regulation does apply, moreover, it asks whether the device is safe and performs as its manufacturer intends. Measuring performance against the manufacturer’s intentions might mean measuring the decoder against the manufacturer’s own definition of what ought to count as output. Leaked inner speech would most likely be treated under its rules on use error and software reliability, that is, as a performance defect rather than as a question about the boundaries of the self.
That leaves the Charter, with Article 10 protecting freedom of thought. The difficulty is that the Charter is addressed to the EU’s institutions and to the Member States when they are implementing Union law. This does not automatically exclude its use against companies, because the Court of Justice has accepted that some Charter provisions can be relied upon directly in disputes between private parties, i.e. in Egenberger and Bauer. In AMS, by contrast, the Court declined to treat workers’ consultation rights under Article 27 in the same way, because that provision must be given more specific expression in EU or national law to be fully effective. Two questions therefore remain open. The first is whether Article 10, applied to neural decoders, resembles Egenberger or AMS, that is, whether it is a self-standing right or one that needs legislative detail before it can operate between private parties. The second is whether a dispute about a consumer implant would fall within a field covered by EU law at all, given that no EU instrument specifically governs how decoders are designed. Neither question has been answered, which makes the Charter, at best, a common-sense but uncertain shield.
Taken together, this is not a story of any single instrument failing. Each does what it was designed to do: the GDPR protects personal data, the AI Act targets AI safety, the MDR checks safety and performance, and the Charter sets out the foundations. The gap lies between them, because every framework assumes that the boundary between thought and action, as we know it, still works.
First fix: make “intentional output” a legal requirement
The most intuitive solution would be to write the Stanford password into law, so that no brain-computer interface may output anything unless its user has deliberately unlocked it. The proposal is attractive for how conceptually simple it is. It is concrete and testable, it builds on a solution that already works in the laboratory, and it keeps control in the hands of the person whose mind is at stake. It even echoes familiar regulatory techniques, such as privacy by default or explicit consent. But it runs into three difficulties.
The first is that intention is not observable. The unlock keyword is itself a decoded neural event. In other words, the device does not perceive your intention, but a pattern of neural activity that it classifies as the password. A legal requirement of intentional output would therefore not solve the problem of detecting intent so much as push it back one step. Did you mean to think of the password, or did the phrase simply cross your mind while you were reading an article about brain implants?
The second difficulty is that such a rule would freeze today’s engineering into law. A keyword unlock suits current research devices, but it may not suit the interfaces of 2034, which may rely on continuous context, gaze, posture, emotional state or signals we cannot yet use. A rule mandating one particular mechanism risks being obsolete before it takes effect. A technology-neutral formulation, such as a requirement that outputs reflect the user’s intention, would avoid the freezing problem, but only by falling straight back into the first one, since it would be problematic to verify intent and compliance with the rule.
The third difficulty is that the rule does not answer the hard question. Even a well-designed unlock requirement will let some unintended outputs through at 98.75% accuracy, roughly one in eighty decisions in the reported tests went the wrong way. Accuracy will improve, but it may never be perfect. Even if a mandatory unlock reduces how often a thought escapes, it still says nothing about what an escaped thought legally is.
Second fix: treat unintended outputs as thought, not speech
A second solution would state that if an output left your head without your intention, the law would treat it as such and extend to it the absolute protection of the forum internum. You could not be held liable for it, it could not be used in evidence against you, and it could neither form a contract nor ground a claim in defamation. It keeps the protection of thought absolute, it places the risk of technical failure on the technology rather than the person, and it honours the intuition that no one should be punished for something they never chose to say. Here too, however, three problems emerge.
The first is that third parties cannot see the difference. Your boss received two messages that look exactly alike, and if one counts as speech while the other counts as protected thought, every message from a brain-computer interface user becomes legally uncertain. Legal certainty, on which contracts, evidence and liability all depend, would hinge on a classification the recipient of the output could not directly verify, and the cost of the technology’s failures would simply shift from the user to everyone who communicates with them. It also ignores reality. Your boss did receive that “thought”: it was read, it was understood, and it may already have changed how your boss sees you. The law can decide not to attach consequences to it, but it cannot make it unsent. Calling it a thought does not put it back inside your head. The forum internum is protected because what happens there stays there, and an output that has already reached another person has, as a matter of fact, left that sphere. A rule that pretends otherwise would protect a fiction rather than a mind, and it would leave the real harm, a message that was seen and cannot be unseen, entirely untouched.
The second problem is that the rule invites strategic use, and its enforcement would undermine its own purpose. “My implant said it, not me” would become a universal defence. Who, then, would decide whether a given output was unintended? Realistically, maybe only the manufacturer could, by analysing the system’s logs, the signal patterns, the decoder’s confidence scores, and so on. This leads to a paradox, where the protection of the forum internum would ultimately be enforced by searching for it.
The third problem is that the rule erodes the very absoluteness on which it relies. The forum internum is absolute precisely because its boundary is categorical, with thought on one side and manifestation on the other. This second fix would make that boundary depend on a probabilistic classifier and its confidence intervals. Protection that turns on contested technical evidence is no longer absolute in any meaningful sense.
What we should be discussing, and who should decide
Both fixes end up falling into the same trap: they look for a technical or legal patch for something that is, first and foremost, a conceptual problem. The first tries to engineer the line away by demanding better gates, while the second relabels whatever crosses it by mistake back into the protected zone. But the question remains: when a machine sits between your mind and the world, where should the law say our thinking ends?
This is not something that can be answered in a blogpost. What we can say is that the question is about to start being answered, potentially in the wrong place. Each manufacturer will answer it in its own way, in technical documentation, according to criteria driven by product performance and commercial competition. Even where regulation applies, it checks only that the manufacturer’s chosen line is implemented reliably, not that it is the right line. In other words, a commercial decision is settling a question of fundamental rights.
Who, then, should decide? The question of where an absolute right ends carries constitutional weight, and it belongs with those who bear democratic and judicial responsibility for protecting fundamental rights. That means the EU legislature, which will sooner or later have to decide whether non-medical neural interfaces require a framework of their own, and ultimately the courts, which will have to say what the Charter, the Convention and national constitutional law mean once a thought no longer needs a mouth to leave the body. Engineers and standard-setters will remain indispensable, since a rule that cannot be implemented is worthless. But the criteria for where thought ends and action begins should, first and foremost, be justified in the language of fundamental rights.
Neural interfaces that replace phones are not here yet. Inner speech, however, can already be decoded in principle, and the researchers themselves are working towards next-generation implants that decode it directly. We may have a decade. That is not long for a legal system to rethink one of its oldest distinctions, but it is long enough to begin the conversation, and beginning it now is far better than discovering, one leaked thought at a time, that the market has already decided for us.