DIGITAL TWINS

Digital Twins: Technology, Regulation and Emerging Case Law

Digital twins are virtual representations of physical objects, systems or environments that are continuously updated through data. Unlike traditional digital models, they can integrate real-time information, sensors, artificial intelligence and simulation tools in order to reproduce existing conditions and, increasingly, to predict possible future scenarios.

Originally developed for industrial applications, digital twins are now becoming important instruments of public governance. Cities and public authorities use them to simulate traffic flows, energy consumption, air pollution, climate risks or urban development projects before taking decisions in the physical world.

At European level, this evolution is particularly visible in Destination Earth (DestinE), the European Commission’s initiative for developing digital models of the Earth to support climate adaptation and the management of extreme events. Another major development is the Local Digital Twins towards the CitiVERSE European Digital Infrastructure Consortium (EDIC), which connects local digital twins and promotes their use for urban planning and citizen participation. The European Commission describes local digital twins as virtual representations of a city’s physical assets, processes and systems, using data, analytics and AI to create real-time simulations.

A fragmented but increasingly relevant legal framework

There is currently no single EU regulation specifically governing digital twins. Their legal framework instead results from the combined application of several areas of EU law.

The General Data Protection Regulation (GDPR) applies whenever a digital twin processes personal data. This may be particularly relevant for urban digital twins using mobility, location or behavioural data. Article 22 GDPR also establishes safeguards concerning decisions based solely on automated processing when they produce legal or similarly significant effects.

The Data Act (Regulation (EU) 2023/2854) is particularly relevant to industrial and IoT-based digital twins because it regulates access to and use of data generated by connected products and related services. Together with the Data Governance Act, it contributes to the emerging European framework for data sharing and reuse.

The AI Act (Regulation (EU) 2024/1689) becomes relevant when artificial intelligence is integrated into a digital twin. Not every digital twin is an AI system, but twins incorporating machine-learning or AI-based predictive components may fall within its scope. Particular attention is required where public authorities use AI systems falling within the high-risk categories established by the Regulation.

Cybersecurity is another essential dimension. Depending on their architecture and function, digital-twin infrastructures may interact with the NIS2 Directive and with the Cyber Resilience Act, particularly where connected software or hardware components qualify as “products with digital elements”. The latter establishes cybersecurity requirements concerning the design, development and vulnerability management of such products.

For environmental and territorial digital twins, the legal framework must also be read together with EU environmental law and the Aarhus Convention. Directive 2003/4/EC guarantees public access to environmental information held by or for public authorities. This raises an increasingly important question: when simulations, models and predictions produced by a public digital twin concern air quality, climate risks or environmental impacts, to what extent should they themselves be considered accessible environmental information?

From Destination Earth to the digital city

The European Union provides some of the most advanced examples of public-sector digital twins.

Destination Earth (DestinE) is developing digital twins of the Earth for climate adaptation and weather-induced extremes. Its data governance is itself legally interesting: the EU is the owner of DestinE Digital Twin Outputs, while outputs derived from data made available under free and open policies are generally made available under an open data policy, subject to limitations concerning underlying licences, security and system integrity.

At the urban level, CitiVERSE seeks to connect local digital twins across Europe. These models can simulate, for example, how changes in traffic affect air quality, congestion or decarbonisation. The initiative also explores immersive technologies allowing citizens to visualise proposed urban transformations and participate in decision-making.

This evolution illustrates an important transformation: the digital twin is no longer merely a technical representation of reality. It can become an interface between data, prediction and public decision-making.

What about case law?

There is not yet an established body of European or international case law dealing specifically with territorial or environmental digital twins. Nevertheless, existing judgments concerning automated decision-making, data protection, surveillance, transparency and environmental information provide principles that are likely to shape their future regulation.

A particularly important example is the judgment of the Court of Justice of the European Union in SCHUFA (C-634/21, 7 December 2023). The Court held that the automated production of a probability value can itself constitute automated individual decision-making under Article 22 GDPR where a third party relies strongly on that value when making a decision affecting an individual.

Although SCHUFA does not concern digital twins, its reasoning may become relevant when predictive outputs generated by a digital twin substantially determine administrative or other decisions. The distinction between a system that merely supports a human decision and one whose prediction effectively determines that decision may therefore become legally decisive.

At the international human-rights level, the case law of the European Court of Human Rights concerning data-intensive surveillance is also relevant. In Big Brother Watch and Others v. the United Kingdom (Grand Chamber, 2021), the Court emphasised the need for safeguards throughout the different stages of large-scale data processing and found violations of Article 8 ECHR in aspects of the United Kingdom’s bulk interception regime. While the technological context is very different, the judgment illustrates the broader principle that increasingly powerful data infrastructures must be accompanied by adequate safeguards, oversight and proportionality.

Environmental case law may become equally important. Digital twins can produce simulations concerning pollution, climate change, biodiversity, floods or urban development. The principles derived from the Aarhus Convention and EU rules on access to environmental information therefore raise new questions concerning access not only to raw environmental data, but also to models, simulations and predictive outputs used by public authorities.

Towards a law of digital twins?

Digital twins sit at the intersection of several regulatory fields: data protection, artificial intelligence, cybersecurity, environmental law, public law and democratic participation.

The central legal challenge may therefore not be the digital twin as a technology, but its progressive integration into decision-making. A digital model that merely visualises a city raises relatively limited legal questions. A continuously updated model that predicts environmental risks, compares policy alternatives and influences administrative decisions raises much deeper issues of transparency, accountability, explainability and democratic legitimacy.

As digital twins evolve from descriptive representations towards predictive governance tools, the key question will increasingly be: who controls the model, the data and the assumptions on which the simulation is based — and who is legally responsible when the virtual prediction shapes a decision in the real world?

 

EU legislation relevant to digital twins

1. GDPR — Regulation (EU) 2016/679: applies where twins use personal data, biometric/health/location data, workers’ data, or city/citizen data.
2. Data Act — Regulation (EU) 2023/2854: key for access to and use of data from connected products/IoT, often the data layer of digital twins.
3. Data Governance Act — Regulation (EU) 2022/868: relevant for trusted data sharing, data intermediaries, altruism, and public-sector data reuse.
4. AI Act — Regulation (EU) 2024/1689: applies where a digital twin includes AI for prediction, optimisation, risk scoring, safety, health, employment, infrastructure, or public services.
5. Cyber Resilience Act — Regulation (EU) 2024/2847: relevant for digital twins connected to products with digital elements, IoT, sensors, software and industrial systems.
6. NIS2 Directive — Directive (EU) 2022/2555: relevant where digital twins support essential or important entities, including energy, transport, health, water, digital infrastructure and public administration.
7. Ecodesign for Sustainable Products Regulation — Regulation (EU) 2024/1781: relevant through Digital Product Passports, which can function as product-level data infrastructures close to product digital twins.
8. Machinery Regulation — Regulation (EU) 2023/1230: relevant for industrial digital twins used in machinery safety, monitoring, simulation or predictive maintenance.
9. Medical Devices Regulation — Regulation (EU) 2017/745 and IVDR — Regulation (EU) 2017/746: relevant for medical/clinical digital twins and software as medical device.
10. Interoperable Europe Act — Regulation (EU) 2024/903: relevant for public-sector digital twins, especially cities and cross-border public services.
11. INSPIRE Directive — Directive 2007/2/EC: relevant for geospatial/environmental twins and public spatial data infrastructures.
12. European Health Data Space Regulation: relevant for health digital twins, secondary use of health data and health-data governance.

EU policy, practice and agency documents

1. Destination Earth / DestinE: EU flagship initiative to build a highly accurate digital twin of the Earth for modelling, simulation and prediction of natural phenomena and human activity.
2. ECMWF Destination Earth Digital Twins: first priority twins concern weather-induced extremes and climate-change adaptation.
3. ESA / EUMETSAT / ECMWF implementation of DestinE: EU agencies and entrusted entities operate core parts of the digital Earth ecosystem.
4. EU Local Digital Twins Toolbox: Commission initiative for interoperable, open, standards-based local/city digital twins.
5. European Digital Twin Ocean: EU Mission Ocean initiative using real-time and historical data to simulate ocean scenarios.
6. JRC “Destination Earth: Survey on Digital Twins technologies”: maps digital twin technologies and identifies challenges such as standards, data/model sharing and interoperability.
7. JRC “MyDigitalTwin” report: explores personal digital twins, privacy, ethics and public-sector use.
8. EASA research projects: AVATAR and OBSERVATOR use digital twins for aviation safety, monitoring and predictive maintenance.
9. ENISA foresight/threat-landscape work: relevant for cybersecurity risks of digital twins, especially IoT, infrastructure and cyber-physical systems.

International organisations and standards

1. ISO 23247 series: digital twin framework for manufacturing; core reference for industrial twins.
2. ISO/IEC 30173:2023: international terminology and concepts for digital twins.
3. ISO/IEC TR 30172: digital twin use cases.
4. IEC White Paper “Virtualizing power systems” 2024: digital twins for energy and power systems.
5. IEC 61850 and IEC 61970 CIM standards: relevant for energy/grid digital twins and smart-grid interoperability.
6. ITU-T Y.4600: requirements and capabilities for smart-city digital twin systems.
7. ITU-T recommendation on digital twin federation in smart cities: addresses federation of multiple city/domain twins.
8. ITU digital twin resources / smart cities work: policy and technical materials on digital twins for sustainable urban planning.
9. IEEE 3144-2025: digital twin maturity model and assessment methodology for industry.
10. IEEE P3501: recommended practice for Digital Twins of the Earth.
11. OECD urban digital twin workstream: 2026 workstream mapping urban digital twin initiatives and developing policy guidance.
12. OECD immersive technologies report: includes national strategies and investment measures involving digital twins.
13. World Economic Forum, “Digital Twin Cities: Key Insights and Recommendations”: governance/practice guidance for city digital twins.
14. UNDP digital twins for sustainable urban development: practice example for municipal data gaps and urban planning.