Code is Not Law

Code governs the possible; law governs the permissible.¹

When Lawrence Lessig observed that “code is law,” he meant that software constrains what people can do, much as physical architecture does; he did not mean that code generates legally enforceable rights. His insight was descriptive.² Following the rise of blockchain networks, cryptocurrencies, and smart contracts, however, many embraced the far stronger proposition that whatever code makes possible, the law must recognize as binding.³

That proposition is a category error. It has propagated far more widely than its fringe origins would suggest, reaching legislators, regulators, courts, and private parties alike.⁴ The corrective is straightforward, for code acquires legal force only to the extent that positive law confers it.⁵

What Lawrence Lessig Actually Meant

Lessig’s maxim was one strand of a larger argument. On that argument, behavior in cyberspace is constrained by four modalities, namely law, the market, social norms, and architecture. Code is the architecture of digital space.⁶ Code regulates by defining the realm of the possible, not by creating rights, so the maxim advances a claim about regulation rather than about legal validity.

Lessig’s catchy three-word pronouncement should not be read as “code is [positive] law,” but rather as “code is [soft] law.”⁷

Soft law shapes conduct, and it may do so with great force; yet of itself it generates none of the rights and duties that the legal system will recognize and enforce.

How the Insight Was Distorted

Two intellectual currents eroded the distinction between code and law. The cyber-separatists denied that the law of nation states had any purchase online, taking as their manifesto John Perry Barlow’s 1996 Declaration of the Independence of Cyberspace. The cypherpunks went further, treating cryptography and code as the instruments of a self-governing order beyond the reach of positive law.⁸ As these ideologies converged with blockchain technology, scholars began to argue that smart contracts create “de facto property rights” or operate “alegally,” beyond traditional legal frameworks.⁹ Even when carefully hedged, claims of this kind “risk fostering the misguided conviction that what code makes possible, law must accept as enforceable.”¹⁰ The conviction is a proposition about legal validity, and it must be assessed as one.

What Does It Mean to Call Something “Law”?

Asking whether code is law requires first answering what law is. On that central question, “[l]egal philosophy has offered competing accounts of law’s nature, including natural law theory, legal realism, and Dworkinian interpretivism, among others.”¹¹ Each delivers a different test for what makes a rule binding, and therefore a different answer to whether code can ever count as law.

Natural law theory holds that legal validity depends on the conformity of a rule with moral principles, so that a deeply unjust rule forfeits its claim to legal validity on the strongest versions of the theory. Legal realism locates law in the observable behavior of officials, above all judges, treating a rule as law to the extent it predicts how courts will dispose of disputes. Dworkinian interpretivism understands law as the set of principles that best justifies a community’s settled legal practice in its most attractive moral light. By contrast, legal positivism treats law as a system of rules that exists because a society’s recognized institutions accept it as law, irrespective of moral content.

Why the Positivist Lens?

Of these competing accounts, legal positivism supplies the premises best fitted to the “code is law” question. Two propositions sit at its core. The social thesis holds that the existence of law depends on identifiable social facts such as legislative enactment, judicial decision, or customary acceptance, not on moral merit. The separability thesis holds that law and morality are not necessarily connected, so that a rule may be legally valid even when morally unattractive. Together the two theses define what a positivist means when calling something law.

Positivism serves here as a methodological lens, not as the one true theory of law; three converging reasons support it.¹²

First, positivism is the descriptive account of legal authority that lawmakers, regulators, courts, and practitioners employ in daily practice. Its descriptive reach is so wide that even the leading contemporary natural law theorist John Finnis concedes that positivist theories offer a completely adequate account of “what any competent lawyer . . . would say are (or are not) intrasystematically valid laws.”¹³ Whatever its limits as moral theory, positivism describes the legal system in which the “code is law” debate is actually being conducted.

Second, positivism is uniquely suited to the question the debate poses. At its core, the “code is law” thesis is a claim about legal validity, asserting that code alone can generate the kind of rule that courts will recognize and enforce. That is precisely the question positivism is built to address. Natural law theory asks whether a rule is just; legal realism asks what courts will do with it; Dworkinian interpretivism asks how it fits a community’s principled practice. None of these is purpose-built for the question of what counts as a valid source of legal rules; positivism is.

Third, and most decisively, the strongest version of the “code is law” thesis fails on its own terms. Its proponents contend that blockchain networks create “nascent legal orders” and ground that contention in social facts such as technical function and community acceptance rather than in moral principles, judicial behavior, or interpretive coherence with existing doctrine; the position is sometimes branded lex cryptographia. Grounding a claim to legal validity in social facts is the positivist move by definition, so the thesis must be tested on the criteria that positivism itself supplies, and if “code cannot qualify as law even under the jurisprudential theory that its own proponents implicitly adopt, then the ‘code is law’ thesis fails definitively.”¹⁴

Hart’s Framework of Primary and Secondary Rules

The decisive modern positivist account is H. L. A. Hart’s, a sophisticated evolution from the earlier conceptualizations of John Austin and Hans Kelsen. Austin had characterized law as orders backed by threats issued by a sovereign whom subjects habitually obeyed; Kelsen had grounded legal validity in a hierarchy of coercive norms deriving from a basic norm, the Grundnorm. Hart analyzed law instead as the union of two kinds of rules.¹⁵

Primary rules impose duties on people, from the prohibition of theft to the duty to pay taxes. A society could exist on primary rules alone, but it would suffer from three structural defects: uncertainty about which rules are in force, inability to make new rules or repeal old ones, and inefficiency in deciding when a rule has been broken.

Secondary rules solve those defects by operating at a higher level, and they are of three kinds. The rule of recognition supplies the master test for what counts as a valid rule of the system, the criterion to which officials and citizens implicitly defer when they identify the law. In the United States, that criterion points roughly to the Constitution, valid statutes, agency regulations within delegated authority, and judicial precedent. Rules of change empower designated actors to introduce, modify, or extinguish primary rules; publicly, they give legislatures the authority to legislate, and privately, they enable individuals to bind themselves through contracts, wills, trusts, and corporate charters. Rules of adjudication empower courts and other designated actors to determine authoritatively whether a primary rule has been broken and what should follow.

Within Hart’s framework, the “code is law” thesis fails at the most basic stage, because the fact that code regulates behavior effectively “does not make it law any more than the fact that gravity pulls objects downward toward the earth makes it a legal prohibition against flying.”¹⁶

There is “an ontological gap that separates architectural constraints from legal rules.”¹⁷ Architecture compels through possibility and impossibility, and code is architecture. Law, by contrast, obligates through normative prescription. In an account drawn from the jurisprudence of Joseph Raz, law “claims authority: it presents itself as creating reasons for action that preempt and exclude contrary considerations.”¹⁸ A complementary distinction drawn from the naturalized jurisprudence of Brian Leiter holds that “while law operates in the space of reasons and justifications, code operates in the causal realm of physical constraints.”¹⁹ A locked door announces no prohibition on entry; it simply prevents it.

On Hart’s account, legal validity “derives from ‘pedigree,’ not performance,”²⁰ meaning a rule counts as law because it can be traced to a recognized source within the legal system, not because it is effective at making people behave.

Is Code Law?

Standing alone, code is not law. It is a uniquely powerful form of soft law that shapes conduct, often with remarkable finality, yet generates no rights and imposes no duties. The regulatory force of code is causal, not normative. Code governs what can happen rather than what ought to happen, and the difference is jurisprudential.

The legal system can nonetheless bridge the gap between architecture and law through the exercise of its own secondary rules, chiefly Hart’s rules of change. The bridging process is best described as investiture. The law selects a verifiable technical fact and clothes it with legal consequences, so that what was previously a mere architectural state becomes a state to which rights and duties attach. Investiture proceeds along two pathways, public empowerment through legislation and private empowerment through the recognized instruments of private ordering.

Outside these two pathways, code remains soft law, however effective, a constraint on conduct rather than a source of rights and duties. “[C]ode's road to legal status is narrow and precisely delimited”; neither its effectiveness nor the convictions of its users can supply what is missing, for “it is only an act of positive law that can give code legal force.”²¹ The governing proposition is that “code is not law, unless and until law makes it so.”²²

Code Mistaken for a Source of Rights and Duties

The category error that code can itself generate rights and duties has migrated from theory to practice. Three recurring patterns illustrate what is at stake when participants, drafters, and even lawmakers treat technical capability as legal authority. The first is the assumption that ownership of a non-fungible token (NFT) carries property rights in what it represents; the second, that a smart contract is itself an enforceable contract; the third, that the architectural arrangement of a decentralized autonomous organization (DAO) supplies the legal shield of a limited liability entity. The NFT market illustrates the first pattern.

The first pattern is written into the licenses themselves. The Bored Ape Yacht Club license states that “[o]wnership of the NFT is mediated entirely by the Smart Contract and the Ethereum Network.”²³ The license misstates the law, for ownership “is a legal concept determined by applicable property law. It is not ‘mediated,’ or otherwise structurally modified by blockchain technology, smart contracts or any technological system.”²⁴ If the owner of an NFT dies, title passes to the heirs under the law of succession, whatever the ledger records. The 2022 theft of actor Seth Green’s Bored Ape sharpened the stakes. When the token left his control, the smart contract alone could answer neither who owned the underlying art, nor whether the associated license traveled, nor whether a good faith purchaser could take clean title.²⁵ These are property questions with determinate legal answers, because digital-asset transactions ultimately “rest on an unresolved premise: that digital assets can be owned and are governed by established property rules.”²⁶ Nor can private drafting fill the void, for the principle of numerus clausus confines the forms of property to those the law recognizes, so that “[a] person claiming that an NFT represents ownership of a painting has no more legal authority to do so than someone asserting that possession of a particular pebble confers title to the Brooklyn Bridge.”²⁷ Under the 2022 amendments to the Uniform Commercial Code (UCC), the token itself may qualify as a controllable electronic record if it satisfies the statutory requirements for control. Article 12 provides, however, that rights in property merely evidenced by such a record are governed by law other than Article 12, so transferring the token does not by itself transfer the copyright or other rights in the artwork.²⁸

The second pattern has reached the statute books, where some legislatures declare that a smart contract “shall be considered a commercial contract” or that smart contracts “govern” the rights and duties of an organization’s members.²⁹ An enforceable agreement is a creature of contract law; a smart contract is “a computer program deployed on a blockchain that executes predetermined operations upon receiving specified data inputs,” and the two must be kept apart, for “[t]he former is a creature of law; the latter is an artifact of code.”³⁰ A smart contract may be the vehicle through which parties form or perform an agreement, but it does not become one by executing, for “[s]mart contracts are only legal contracts when the law recognizes them as having legal effect; otherwise they are simply code used to automate technical acts to be conducted on computer systems.”³¹ The same confusion surfaced in Van Loon v. Department of the Treasury, a challenge to the decision of the Office of Foreign Assets Control to place the Tornado Cash crypto mixer on the Specially Designated Nationals sanctions list. The U.S. District Court for the Western District of Texas held that the immutable smart contracts comprising the mixer were sanctionable “property” on the theory that smart contracts are “a code-enabled species of unilateral contracts,” moving from a technically accurate description of smart contracts to treating them as legally enforceable contracts; the Court of Appeals for the Fifth Circuit reversed.³²

The third pattern appears among founders of venture DAOs, who frequently assume that technical control over digital assets supplies the asset-shielding function of a limited liability entity; the case law holds otherwise. In Samuels v. Lido DAO, an investor who had bought and lost money on LDO governance tokens sued the Lido DAO and four of its institutional backers, namely Paradigm Operations, Andreessen Horowitz, Dragonfly Digital Management, and Robot Ventures, alleging that LDO tokens were unregistered securities and that each backer was jointly and severally liable as a general partner in the DAO. The court denied the motion to dismiss, holding that operating an Ethereum staking service that retained a share of validator revenue was sufficient to plead a general partnership. Houghton v. Leshner applied the same partnership theory to the Compound DAO. In Sarcuni v. bZx DAO, nineteen plaintiffs sued the bZx DAO on a negligence theory after a developer was deceived by a phishing email on his personal computer and the resulting security breach allowed attackers to drain roughly $55 million from bZx protocol users. In each case, federal courts allowed claims to proceed on the theory that DAO participants had formed general partnerships by default and stood exposed to joint and several liability, sophisticated institutional investors included.³³ “[L]imited liability . . . is a normative creation available only through the legal system's secondary rules of change, when parties comply with applicable entity formation statutes.”³⁴ The lesson recurs across a crypto economy where “code is supposed to be king” until “faced with financial ruin, even the most ardent crypto enthusiasts discover that traditional legal systems offer a vital safety net.”³⁵

Code Invested with Legal Authority by Positive Law

Where the secondary rules of a legal system do invest code with authority, the result is not “code is law” but its opposite, since authority “flows from the law to the code, never the reverse.”³⁶ The law identifies a discrete technical fact and attaches legal consequences to it, while reserving validity, change, and adjudication to itself. Both the public and the private pathway of investiture are visible in current practice.

Public empowerment occurs when a legislature or other recognized public authority identifies a verifiable technical fact and attaches legal consequences to it, so that “the law deliberately envelops a technical system, imbuing the states or outcomes that code produces with juridical effect.”³⁷ The clearest example of legislative investiture is Article 12 of the UCC, adopted in the 2022 Amendments. Article 12 does not declare that code is law; it “carefully defines which technological facts will be granted legal significance and precisely what their juridical status will be.”³⁸ The verifiable technical fact selected is control over a controllable electronic record; to that fact the statute attaches three specific legal consequences. First, a take-free rule provides that a purchaser who obtains control for value, in good faith, and without notice of competing claims acquires its rights free of those claims; the rule “cloaks [controllable electronic records] in the mantle of negotiability” and is “a deliberate act of legal investiture,”³⁹ the archetypal exercise of public empowerment. Second, a choice-of-law waterfall resolves the jurisdictional question for distributed-ledger transactions. Third, the new categories of controllable accounts and controllable payment intangibles allow a payment right to be evidenced by a controllable electronic record, so that the right travels with the token to whoever has control of the record; if structured as a controllable account, the redemption right of a stablecoin would be the paradigmatic example, though the GENIUS Act leaves that construction unresolved.⁴⁰ Those payment-rights categories are the doctrinal foundation for tokenizing financial claims; the early promise that “blockchain operates as a law unto itself” collapsed once insolvent crypto platforms reached bankruptcy court, and genuine tokenization instead depends on the statutory framework Article 12 supplies.⁴¹ The law remains the source of the rule; the code supplies only the triggering fact. The doctrinal mechanics of Article 12 are the subject of UCC Article 12 and Controllable Electronic Records.

Private empowerment operates through the same logic. Parties may incorporate code into contracts, trusts, wills, and corporate charters, instruments the law already recognizes as creating binding commitments, and in every such arrangement “legal force derives from the parties’ valid exercise of their delegated authority, not from the particular technical mechanisms they employ, regardless of their sophistication or effectiveness as architectural constraints.”⁴² A smart contract operating within a properly formed contractual relationship is legally binding because contract law makes it so; a venture organized as a limited liability entity under state law obtains its asset-shielding function from the entity statute, not from the smart contract that records its governance. In each case the role of the code is confined to executing what the law has already empowered the parties to do.

Could Code Ever Become an Autonomous Source of Law?

Beyond legislation and private ordering lies a third and more theoretical pathway, recognition of code as an autonomous source of law through Hart’s rule of recognition. A rule of recognition identifies sources that produce interpretable, prescriptive norms, whereas code records factual states and executes deterministically. Code can express that if a condition occurs an operation will run, but not that if a condition occurs a person ought to act. Recognizing code as a freestanding source of law is therefore “more of a theoretical possibility than a present reality.”⁴³ No present legal system has taken that step.

The stakes are not confined to blockchain. The framework extends to every wave of new technology, “from large language models to autonomous robots.”⁴⁴ “Each generation of technological innovation tempts lawmakers, courts, and market participants to mistake architectural power for normative authority”; the enduring response is that “code governs the possible; only law determines the permissible.”⁴⁵ What changes with each new technology is the technical fact that positive law selects for investiture, not the source of the legal consequences that attach to it.