P ei e , Jella; Lachenmaie , Jens F.; Hinz, Oli e ; an de Aals , Wil
A icle — Published Ve sion
New Laws and Regula ion
Business & In o ma ion Sys ems Enginee ing
P o ided in Coope a ion wi h:
Sp inge Na u e
Sugges ed Ci a ion: P ei e , Jella; Lachenmaie , Jens F.; Hinz, Oli e ; an de Aals , Wil (2024) : New
Laws and Regula ion, Business & In o ma ion Sys ems Enginee ing, ISSN 1867-0202, Sp inge
Fachmedien Wiesbaden GmbH, Wiesbaden, Vol. 66, Iss. 6, pp. 653-666,
h ps://doi.o g/10.1007/s12599-024-00902-6
This Ve sion is a ailable a :
h ps://hdl.handle.ne /10419/315727
S anda d-Nu zungsbedingungen:
Die Dokumen e au EconS o dü en zu eigenen wissenscha lichen
Zwecken und zum P i a geb auch gespeiche und kopie we den.
Sie dü en die Dokumen e nich ü ö en liche ode komme zielle
Zwecke e iel äl igen, ö en lich auss ellen, ö en lich zugänglich
machen, e eiben ode ande wei ig nu zen.
So e n die Ve asse die Dokumen e un e Open-Con en -Lizenzen
(insbesonde e CC-Lizenzen) zu Ve ügung ges ell haben soll en,
gel en abweichend on diesen Nu zungsbedingungen die in de do
genann en Lizenz gewäh en Nu zungs ech e.
Te ms o use:
Documen s in EconS o may be sa ed and copied o you pe sonal
and schola ly pu poses.
You a e no o copy documen s o public o comme cial pu poses, o
exhibi he documen s publicly, o make hem publicly a ailable on he
in e ne , o o dis ibu e o o he wise use he documen s in public.
I he documen s ha e been made a ailable unde an Open Con en
Licence (especially C ea i e Commons Licences), you may exe cise
u he usage igh s as speci ied in he indica ed licence.
h p://c ea i ecommons.o g/licenses/by/4.0/
EDITORIAL
New Laws and Regula ion
Oppo uni ies o BISE Resea ch
Jella P ei e •Jens F. Lachenmaie •Oli e Hinz •Wil an de Aals
Published online: 17 Oc obe 2024
The Au ho (s) 2024
1 In oduc ion – The Eme gence o a Resea ch Topic
Conside egula ions such as he GDPR, he EU AI Ac , he
Digi al Se ices Ac , and he Co po a e Sus ainabili y
Repo ing Di ec i e. In ecen yea s, we as esea che s
ha e obse ed ha laws and egula ions in he digi al
domain ha e apidly mo ed o he o e on , aising
nume ous ques ions and challenges: Whe e does he da a
equi ed o comply wi h hese egula ions come om? How
can da a ecosys ems be e ec i ely c ea ed and managed,
and how can he esul ing p ocesses be in eg a ed in o
in o ma ion sys ems? How do use s espond when aced
wi h seemingly endless cookie se ings? When do use s
eel hey a e being ea ed ai ly by AI algo i hms?
I appea s ha a new sou ce o esea ch challenges has
eme ged alongside ou ypical esea ch p ocesses: legal
and egula o y amewo ks. Unlike ea lie egula ions ha
ocused on speci ic sec o s – such as Basel III o BSBC 239
in he inancial indus y – hese new egula ions span
mul iple sec o s a once. In his edi o ial, we aim o explo e
he mos ecen egula ions ele an o BISE esea che s
and ou line u u e esea ch di ec ions. Be o e del ing in o
speci ic egula ions, we wan o emphasize ha laws and
egula ions should be ecognized as aluable and in iguing
sou ces o esea ch p oblems o BISE.
To illus a e his, we begin wi h a b oad pe spec i e by
examining a ypical BISE esea ch p ocess. This p ocess
gene ally s a s wi h (1) iden i ying a p oblem, ollowed by
(2) sys ema ically in es iga ing and s udying i , and (3)
c ea ing new knowledge and unde s anding, as well as,
some imes, an a i ac . Fo esea ch o be impac ul, he
ou comes – whe he knowledge o a i ac s – should ul i-
ma ely be (4) ans e ed in o p ac ice (see Fig. 1). While
he a ge audience o BISE is ypically unde s ood in he
sense o ‘‘business’’ (Benbasa and Zmud 1999), he
ans e o esea ch esul s in o he social and poli ical
sphe es has been he subjec o inc easing in e es .
(Weinha d e al. 2024). The e is also he iewpoin ha
ele ance needs o be unde s ood as being plu alis ic in
na u e (Lee e al. 2021; Mohaje i and Leidne 2017), pa -
icula ly wi h ega ds o he di e se ange o s akeholde s
add essed. Indeed, he e has been an in ense discussion in
he BISE communi y how we can ocus no only on igo ,
bu also on ele ance (O
¨s e le e al. 2011; S aub and Ang
2011; Buhl e al. 2012). Nunamaka e al. (2015) no ed ha
‘‘going he las esea ch mile means using scien i ic
knowledge and me hods o add ess impo an unsol ed
classes o p oblems o eal people wi h eal s akes in he
ou come’’ (Nunamake e al. 2015, p. 15). Van de Aals
e al. go in a simila di ec ion, calling o open science ha
makes scien i ic esea ch and ela ed a i ac s accessible o
e e ybody ( an de Aals e al. 2016).
J. P ei e (&)J. F. Lachenmaie
Chai o In o ma ion Sys ems 1, S u ga Uni e si y, Keple s .
17, 70174 S u ga , Ge many
e-mail: [email p o ec ed]
J. F. Lachenmaie
e-mail: [email p o ec ed]
O. Hinz
Facul y o Economics and Business Adminis a ion, Goe he
Uni e si y F ank u , Theodo -W.-Ado no-Pla z 4,
60323 F ank u am Main, Ge many
e-mail: [email p o ec ed]
W. an de Aals
Chai o he P ocess and Da a Science g oup (Leh s uhl u
¨
In o ma ik 9), RWTH Aachen, Aho ns . 55, 52056 Aachen,
Ge many
e-mail: [email p o ec ed]
123
Bus In Sys Eng 66(6):653–666 (2024)
h ps://doi.o g/10.1007/s12599-024-00902-6
S eps 2 and 3 ha e also been ea ed ex ensi ely in he
li e a u e. All social scien is s app oach hei subjec ia
assump ions abou he na u e o he wo ld and he way in
which i can be s udied. This in ol es assump ions abou
he on ological (e.g., whe he he essence o phenomena is
ex e nal o he p oduc o indi idual consciousness) and
epis emological na u e (e.g., he g ounds o knowledge, o
example, whe he i is ha d o so , o whe he i can be
acqui ed o mus be pe sonally expe ienced) (Bu ell and
Mo gan 1979). Bu el and Mo gan u he conside a hi d
se o assump ions abou human na u e and i s ela ionship
o he en i onmen (e.g., esponding in a de e minis ic way
o being in con ol o and c ea ing he en i onmen ). O he
au ho s include axiology, which desc ibes he way we as
esea che s deal wi h ou own alues and hose o o he
people in ol ed in ou esea ch (Saunde s e al. 2016). The
se o assump ions we make as esea che s di ec ly in lu-
ences he me hods we choose. The e a e di e en ways o
ca ego ize hese me hods. One app oach is o dis inguish
be ween cons uc i is , nomo he ical and idiog aphic
me hods. Cons uc i is me hods ocus on he concep ual
and echnical de elopmen o a i ac s, as seen in design
science (He ne and Cha e jee 2010; Pe e s e al. 2007).
Nomo he ical me hods con i m hypo heses and a e o en
used in BISE by applying su eys and conduc ing expe i-
men s in labs, in he ield, o in i ual eali y en i onmen s
(Loomis e al. 1999; Meißne e al. 2019). These me hods
ypically ollow he hypo he ico-deduc i e app oach.
Idiog aphic me hods explo e and ocus on unde s anding
he unique aspec s and complexi ies o indi idual cases o
e en s wi h case s udies, ac ion esea ch o e hnog aphy
(Baske ille 1999; Ii a i e al. 1998). While much mo e
could be discussed ega ding he c ea ion o knowledge,
a i ac s, and esea ch me hods, u he insigh s can be
ound in he wo ks o (Saunde s e al. 2016) and (Bas-
ke ille e al. 2015).
The d i ing ac o behind he opic o his edi o ial is
s ep 1 in he esea ch p ocess: Whe e do he p oblems we
conduc esea ch on o igina e? We ind less esea ch on
his impo an i s s ep and iden i y se e al ypical sou ces
ha a e o en in e ela ed a he han mu ually exclusi e (as
illus a ed in Fig. 2).
Fi s , ou esea ch may be inspi ed by p ac ical p ob-
lems and phenomena, ypically a he o ganiza ional o
indi idual le el. Examples include s udying he ac o s ha
a ec he success ul ans e o cloud se ices (Benlian
e al. 2018) o how go e nance and s a egic alignmen
in luence o ganiza ional pe o mance (Wu e al. 2015). A
he indi idual le el, u he examples include examining
he ac o s ha in luence use s’ us in e-comme ce
(Benbasa and Wang 2005) o use s’ accep ance o la ge-
language-model-based cha in e ac ions in he se ice
indus y (Le e al. 2024).
Second, we o en seek o iden i y gaps o inconsis encies
in exis ing heo ies o esea ch me hods. Theo y gaps e-
quen ly se e a sou ce o inspi a ion o ou esea ch, as
heo ies in BISE can a y widely in na u e. They do no
only aim a explaining bu also ocus on analyzing (and
desc ibing), p edic ing, and p o iding guidance on how o
do some hing (design and analysis) (G ego 2006). A
p ominen example is he Uni ied Theo y o Accep ance
and Use o Technology (UTAUT; (Venka esh e al. 2003)),
Fig. 1 Connec ions be ween
esea ch s eps and p oblem
sou ces
123
654 J. P ei e e al.: New Laws and Regula ion, Bus In Sys Eng 66(6):653–666 (2024)
which ex ended and in eg a ed he Technology Accep ance
Model and o he s by adding se e al cons uc s o add ess
heo y gaps. O he examples can be ound in heo y models
conce ning algo i hm a e sion, whe e con ex -dependen
bounda y condi ions help explain why, in ce ain si ua-
ions, algo i hms may be app ecia ed, while ejec ed in
o he s (Cas elo e al. 2019; Heßle e al. 2022). A classic
example o a desc ip i e heo y would be Go y and Sco
Mo on’s amewo k o Managemen In o ma ion Sys ems
(Go y and Mo on 1989). Besides gaps in heo y, he e a e
p oblems a ising om insu icien esea ch me hods o
e hical conce ns (Spieke mann e al. 2022). Fo example,
BISE esea che s ha e in ensi ely discussed and u he
e ined design science as a me hod (Pe e s e al. 2007;
He ne and Cha e jee 2010). Me hodological challenges
in expe imen al esea ch o BISE ha e also been add es-
sed, including op imizing expe imen al designs (P ei e
e al. 2015), and conduc ing Neu oIS expe imen s wi h
mul iple physiological senso s (Ha iha an e al. 2017).
Thi d, echnological ad ancemen s o en c ea e new
oppo uni ies and challenges, p omp ing esea ch ques ions
abou hei implica ions, adop ion, and in eg a ion. Recen
no able examples include ad ances in AI, such as
explainable AI (Baue e al. 2023) and gene a i e AI
(Feue iegel e al. 2024), as well as i ual and augmen ed
eali y (Peuke e al. 2022; P ei e e al. 2020) o block-
chain echnology (Beck e al. 2017). This hi d sou ce o
esea ch p oblems highligh s he o e lap be ween hese
sou ces. Fo example, wi h he a ailabili y o he la es
e sions o gene a i e AI ools, conc e e p oblems o
companies and use s a ise, o example conce ning p i acy
and us . O he echnologies, such as he use o blockchain
echnology o non- ungible okens in he me a e se,
emain mo e specula i e, p omp ing esea ch ques ions
s emming om po en ial o p o o ype implemen a ions.
This ype o esea ch aligns wi h he call by O likowsky
and Iacono o ocus mo e on he IT a i ac and o a emp
‘‘ o unde s and he complex and agmen ed eme gence o
IT a i ac s, [and] how hei compu a ional capabili ies and
cul u al meanings become wo en in dense and agile ways
[…]’’ (O likowski and Iacono 2001, p. 133).
In his a icle, we highligh a ou h p omising sou ce o
ele an esea ch ques ions: con ex ual changes. These
include socio-economic and cul u al shi s, such as glob-
aliza ion, inancial c ises, e ol ing cul u al no ms (e.g.,
pola iza ion, he inc easing impo ance o di e si y), as
well as phenomena such as pandemics, clima e change, and
wa s. A ecen example is esea ch ha eme ged om he
socie al, scien i ic, and educa ional impac s o he Co id-
19 pandemic ( an de Aals e al. 2020). We a e pa icu-
la ly also obse ing he g owing p e alence o a subg oup
o con ex ual changes, which is inc easingly in luencing
ou esea ch: laws and egula ions.
2 Buckle Up, i ’s he Law
2.1 Legal Ac s in he Eu opean Union
As he digi al domain con inues o g ow in alue and sig-
ni icance o bo h businesses and e e yday li e, i has also
a ac ed inc easing public in e es and egula o y a en ion.
In esponse, a ising numbe o legisla i e ac s ha e been
in oduced wo ldwide o add ess digi al aspec s o li e and
business. Some p ominen examples o in e na ional laws
a e he Digi al Pla o m Commission Ac o 2023 in he
Uni ed S a es, new GDPR-like egula ions in indi idual
U.S. s a es, such as he Cali o nia P i acy Righ s Ac and
he U ah Consume P i acy Ac , as well as he Cybe se-
cu i y Law o he People’s Republic o China – o only
name a ew.
In his a icle, we a e looking a legisla ion by he
Eu opean Union (EU) ha a ec s us as he BISE com-
muni y. We ha e chosen he EU because, wi h GDPR and
he EU AI Ac , we ha e wo p ominen examples wi h
which he EU seems o be he pionee wi h impo an
egula ions conce ning digi al business. The EU’s o e a -
ching goal is o es ablish a single, common ma ke o all
i s membe s, encompassing bo h digi al and physical
ma ke s. This goal also applies o in e na ional companies
ha wish o p o ide p oduc s and se ices wi hin he EU.
The legisla i e p ocess in he EU in ol es se e al key
bodies: he Eu opean Pa liamen , he Council o he EU,
and he Eu opean Commission. These ins i u ions wo k
oge he o c ea e new laws, e e ed o as legal ac s. We
will ocus on he binding ypes o legal ac s, which include:
Fig. 2 P oblem sou ces
123
J. P ei e e al.: New Laws and Regula ion, Bus In Sys Eng 66(6):653–666 (2024) 655
•Regula ions, ha a e di ec ly binding o all membe
s a es,
•Di ec i es, which se goals ha mus be achie ed by
na ional law,
•Decisions, which a e o en add essed o a speci ic a ge
g oup o one s a e.
The mo e ex ensi e laws a e egula ions and di ec i es.
O e he las 20 yea s, he EU has passed 7728 new eg-
ula ions and di ec i es (see Fig. 3). While he pace o
lawmaking may be slowing due o he inc easing com-
plexi y o legisla i e p ocesses, e o s o ‘‘be e egula-
ion’’ (Eu opean Commission 2024b), and ongoing
amendmen s o exis ing laws, his end does no hold ue
o he digi al domain. In 2021, he EU decla ed he onse
o he ‘‘digi al decade’’, se ing he ambi ious goal o c e-
a ing ‘‘a human-cen e ed, sus ainable and mo e p ospe ous
digi al u u e’’ (Eu opean Commission 2024c). This ision
is o be ealized h ough a se ies o egula ions and unding
measu es ha help o con ey skills, empowe he go e n-
men , imp o e in as uc u es and gea up business o he
digi al ans o ma ion (Eu opean Union 2024). This has so
a esul ed in abou 75 new legal ac s since 2021 and leads
o an inc easing sha e o ac s ha add ess he digi al
domain
1
. De ails on he p og ess o he digi al decade can
be ound in he ack eco d published by he EU (Eu opean
Commission 2024a).
BISE, howe e , is no only conce ned wi h legisla ion
aimed a he digi al domain; i also add esses o he
signi ican legal ac s ha ha e been passed in ecen yea s
ha ha e di ec o indi ec ami ica ions on BISE ela ed
opics. Fo example, ac s ha deal wi h he supply chain o
wi h co po a e social esponsibili y may equi e he
de elopmen o co esponding in o ma ion sys ems o
moni o o epo ele an issues. Table 1p o ides a
selec i e o e iew o ac s ha migh be o in e es o
BISE esea che s. We ha e selec ed hem based on hei
connec ion o BISE as well as hei imeliness and ha e
g ouped hem by he opic hey add ess.
To u he examine hese legal ac s om a BISE pe -
spec i e
2
, we clus e ed hem in o ou g oups, while ac s
ha belong in o mo e han one g oups a e possible, (see
also las column o Table 1): (1) da a in e ope abili y,
sha ing, and p o ec ion, (2) speci ic echnologies, (3) dig-
i al ma ke s and se ices, and (4) cybe secu i y.
Ac s on da a in e ope abili y, sha ing, and p o ec ion:
Many legal ac s conce n da a which ocus on one o h ee
a eas: Fi s , ac s ha go e n da a collec ion and da a
sha ing. Da a collec ion and da a sha ing a e essen ial o
achie e anspa ency, o example in supply chains. Da a is
he ounda ion o any ype o epo ing, and as such, mus
be ca e ully managed o comply wi h legal equi emen s
se by laws such as he Co po a e Sus ainabili y Due
Diligence Di ec i e and he Co po a e Sus ainabili y
Repo ing Di ec i e. Second, he e a e ac s speci ically
add essing da a p o ision o au ho i ies, such as Digi al
Iden i y amewo ks o public Open Da a ini ia i es. Thi d:
he e a e ac s ela ed o da a sha ing. These ac s deal wi h
da a sha ing ac oss company bo de s and speci ically
add ess indus ial IoT da a. This is mean o os e new
Fig. 3 Pe cen age o legal ac s
conce ning digi al opics
compa ed o all legal ac s
passed by he EU pe yea
Sou ce: EUR Lex.
1
An ac is conside ed o conce n he digi al domain when i
add esses ei he he heme o ‘‘in o ma ion echnology and da a
p ocessing’’ o one o he subca ego ies o ‘‘in o ma ion’’ (selec ed
subca ego ies a e: in o ma ion sys em, exchange o in o ma ion, da a
sha ing, da a p o ec ion, da a go e nance, open da a, a i icial
in elligence) in he EU Lex da abase.
2
Fo u he de ails on he legal pe spec i e, we ecommend he
wo k o Aueamnuay e al. who assessed he legal quali y and impac
o a ious digi al ac s passed by he EU (Aueamnuay e al. 2024).
123
656 J. P ei e e al.: New Laws and Regula ion, Bus In Sys Eng 66(6):653–666 (2024)
Table 1 Selec ed digi al ac s by he EU ha ma e in BISE
Yea Legal ac Pu pose [quo es om o icial EU documen s] G oup
G oup 1: da a in e ope abili y, sha ing, and p o ec ion
2018 Gene al da a p o ec ion egula ion (GDPR) P o ec ion o pe sonal da a
F ee mo emen o pe sonal da a wi hin he Union
1
2018 Regula ion on he ee low o non-pe sonal
da a
Remo ing obs acles o he ee mo emen o non-pe sonal da a be ween di e en EU
coun ies and IT sys ems in Eu ope
1
2018 Single digi al ga eway Facili a es online access o in o ma ion, adminis a i e p ocedu es, and assis ance
se ices ha EU ci izens and businesses may need in ano he EU coun y
1
2019 Di ec i e on open da a and he e-use o
public sec o in o ma ion
legal amewo k o he euse o public-sec o in o ma ion such as geog aphical, land
egis y, s a is ical o legal in o ma ion held by public-sec o bodies o public
unde akings, and o publicly unded esea ch da a
1
2022 Da a go e nance ac Inc ease us in da a sha ing
S eng hen mechanisms o inc ease da a a ailabili y
O e come echnical obs acles o he euse o da a
1
2023 Co po a e sus ainabili y due diligence
di ec i e (CSDDD)
Fos e sus ainable and esponsible co po a e beha io in companies’ ope a ions and
ac oss hei global alue chains
1
2023 Co po a e sus ainabili y epo ing di ec i e
(CSRD)
Mode nize and s eng hen he ules conce ning he social and en i onmen al
in o ma ion ha companies ha e o epo
1
2024 Da a ac Making da a (in pa icula indus ial da a) mo e accessible and usable
Encou aging da a-d i en inno a ion
Inc easing da a a ailabili y
1
2024 Eu opean digi al iden i y (eudi) egula ion Enable he c ea ion o a uni e sal, us wo hy, and secu e Eu opean digi al iden i y
walle
1
2024 Eu opean heal h da a space egula ion Empowe indi iduals o ake con ol o hei heal h da a and acili a e he exchange
o da a o he deli e y o heal hca e ac oss he EU
Fos e a genuine single ma ke o elec onic heal h eco d sys ems
P o ide a consis en , us wo hy, and e icien sys em o eusing heal h da a o
esea ch, inno a ion, policy-making, and egula o y ac i i ies
1
2024 In e ope able Eu ope ac Facili a e c oss-bo de da a exchange
Accele a e he digi al ans o ma ion o he public sec o
1
G oup 2: Ac s on speci ic echnologies
2022 Pilo egime o ma ke in as uc u es
based on dis ibu ed ledge echnology
Remo e egula o y ba ie s o he issuing, ading and se lemen o c yp o-asse s ha
a e inancial ins umen s
2, 3
2024 AI ac Add ess isks o heal h, sa e y and undamen al igh s
P o ec democ acy, ule o law and he en i onmen
2
G oup 3: Ac s on he digi al ma ke
2022 Digi al ma ke s ac Make he ma ke s in he digi al sec o ai e and mo e con es able 3
2022 Digi al se ices ac P e en illegal and ha m ul ac i i ies online
P e en he sp ead o disin o ma ion
3
2022 Pilo egime o ma ke in as uc u es
based on dis ibu ed ledge echnology
Remo e egula o y ba ie s o he issuing, ading and se lemen o c yp o-asse s ha
a e inancial ins umen s
2,3
G oup 4: Ac s on cybe secu i y
2016 Ne wo k and in o ma ion sys ems di ec i e
1 (NIS 1)
Imp o ed cybe secu i y capabili ies a he na ional le el
Inc eased EU-le el coope a ion
Risk managemen and inciden epo ing obliga ions o ope a o s o essen ial
se ices and digi al se ice p o ide s
4
2022 Ne wo k and in o ma ion sys ems di ec i e
2 (NIS 2)
Imp o e he esilience and inciden esponse capaci ies o public and p i a e en i ies,
compe en au ho i ies and he EU
4
Upcoming Cybe esilience ac Sa egua d consume s and businesses buying o using p oduc s o so wa e wi h a
digi al componen
4
Upcoming Cybe solida i y ac S eng hen common EU de ec ion, si ua ional awa eness, and esponse capabili ies,
Build an EU-le el cybe secu i y ese e wi h se ices om us ed p i a e p o ide s,
and
Suppo es ing o c i ical en i ies
4
123
J. P ei e e al.: New Laws and Regula ion, Bus In Sys Eng 66(6):653–666 (2024) 657
digi al business models o s eng hen he compe i i eness
o Eu opean companies. Rele an ac s a e he Da a
Go e nance Ac , he Da a Ac , and he Heal h Da a Space
Regula ion. Las ly, his g oup also includes he Gene al
Da a P o ec ion Regula ion (GDPR), which is well-es ab-
lished and ocuses on he p o ec ion o pe sonal da a.
Ac s on speci ic echnologies: The EU ies o egula e
impac ul echnologies, such as blockchain and AI. Wi h
he i s AI egula ion wo ldwide and he pilo ma ke o
blockchain applica ions in he inancial sec o , he EU
conside s i sel o be on he o e on o digi al legisla ion.
The pilo ma ke egula ion o dis ibu ed ledge ech-
nology c ea es empo a y exemp s om exis ing o he legal
equi emen s in he inancial indus y. The pu pose o his
ac is o gi e inancial ins i u ions he possibili y o ad ance
hei business models and au ho i ies o gain p ac ical
insigh s in o he applica ion and con ol o blockchain
echnologies. The AI Ac aims o p o ide a comp ehensi e
legal amewo k o AI de elope s, ou lining he equi e-
men s o AI sys ems used wi hin he Eu opean Union. I
classi ies AI applica ions in o ou isk ca ego ies: unac-
cep able, high, limi ed, and minimal isk. Fo high- isk AI
sys ems, he Ac imposes s ic e obliga ions. These a e
sys ems ha a e used as sa e y componen s in c i ical
in as uc u e, p o ile indi iduals, o de e mine access o
educa ional ins i u ions o o ec ui men o companies.
P o ide s o such sys ems mus implemen isk manage-
men and quali y managemen sys ems, ensu e ho ough
documen a ion, and main ain human o e sigh in decision-
making p ocesses o ensu e ha humans-in- he-loop e ain
he inal au ho i y in key decisions.
Ac s on he digi al ma ke : Wi h he inc easing ma ke
sha e o global hype scaling pla o ms and he g owing
signi icance o social media, he EU has in oduced ules
speci ically a ge ing hese p o ide s o ensu e he sa e,
secu e, and e icien use o hei digi al se ices. A he
same ime, hese egula ions aim o educe he in luence o
pla o ms as ga ekeepe s. Since pla o ms ha e he abili y
o s ee use s owa ds ce ain websi es o wi hhold o he s,
he Digi al Ma ke s Ac (DMA) ensu es equal igh s o all
ma ke pa icipan s, p ohibi ing pla o ms om p io i izing
hei own p oduc s and se ices. These laws a e pa icu-
la ly ocused on p o ec ing use s’ igh s by egula ing
pla o m p o ide s and shielding use s om illegal o
misleading con en . The Digi al Se ices Ac (DSA), o
ins ance, a ge s he la ges pla o ms, speci ically hose
wi h a leas 45 million use s in Eu ope. Non-compliance
wi h hese ac s can esul in signi ican penal ies, wi h
companies acing subs an ial ines o ailing o adhe e o
he egula ions.
Ac s on cybe secu i y: Cybe secu i y has become a
majo ocus in Eu opean legisla ion, wi h nume ous ac s
passed since 2018 and mo e expec ed in he nea u u e.
The o ganiza ion ‘‘In e ace’’ has iden i ied 154 legal ac s
ela ed o cybe secu i y (Rupp 2024). As digi al se ices
a e now he ounda ion o mode n socie y and e e yday
li e, he EU is making e o s o ensu e ha c i ical
in as uc u e, in pa icula , is well-p o ec ed agains cybe
h ea s. These egula ions co e a wide ange o a eas, om
ensu ing a mo e secu e global In e ne and es ablishing
ules o secu e digi al p oduc s, o o ming join de ense
cen e s ha in eg a e cybe de ense capabili ies. The leg-
isla ion also includes indus y-speci ic egula ions a ge ing
sec o s such as ene gy, inance, anspo a ion, and educa-
ion. A key p inciple in hese egula ions is he isk-based
app oach, which equi es o ganiza ions o iden i y po en ial
isks and implemen measu es o mi iga e hem (Lemni ze
2022). Addi ionally, companies a e obliga ed o epo
cybe -a acks, and hey can be audi ed o hei p e en i e
measu es. In he wo s -case scena io, ailu e o pass an
audi could esul in a company’s ope a ions being hal ed,
and co po a e leade s may be held pe sonally liable o
hei o ganiza ion’s cybe secu i y pos u e.
2.2 Exis ing Resea ch on Laws and Regula ions
So, how exac ly ha e esea che s in he BISE communi y
add essed hese new laws and egula ions in he pas ? We
ha e iden i ied se e al con ibu ions ha all in o h ee key
a eas:
a) In es iga ing speci ic egula ions, pa icula ly o
hei impac on he BISE domain
b) Designing new solu ions o handle challenges a ising
om legisla ion
c) Discussing he con ibu ion o BISE o legisla ion in
gene al.
Resea ch ocusing on legal ac s (A): In ecen yea s,
esea ch has also examined he impac o speci ic egula-
ions on esea ch: Vainionpa
¨a
¨e al. (2023) conduc ed a
deep di e in o he AI Ac . A e p esen ing and discussing
po en ial challenges, hey p oposed a esea ch agenda o
u he esea ch based on he AI Ac . They analyzed he
scope o he AI Ac , as well as i s app oach, wo ding,
cohe ence wi h o he laws, and en o cemen . F om his
analysis, hey iden i ied h ee key a eas o u u e esea ch:
he daily handling o he egula ion wi hin o ganiza ions,
he law i sel , and i s long- e m e ec s.
Simila ly, P ei e e al. (2023) explo ed algo i hmic
ai ness as a c i ical aspec o he EU AI Ac . Thei dis-
cussion in he BISE communi y co e ed opics such as he
de ini ion o ai ness, he mi iga ion o bias and disc imi-
na ion in AI sys ems, and he long- e m impac s o AI wi h
espec o i s us wo hiness. Empi ical s udies such as he
one by Baue e al. (2024) in es iga ed how machine
lea ning impac s human disc imina ion and how hese
123
658 J. P ei e e al.: New Laws and Regula ion, Bus In Sys Eng 66(6):653–666 (2024)
indings ela e o he AI Ac . Thei pape s also analyzed he
e ec s o explainable AI, which is explici ly demanded by
he AI Ac , on he men al p ocesses o decision make s and
highligh some po en ial, unwan ed downs eam conse-
quences o hese egula ions (Baue e al. 2023).
Rega ding he Digi al Ma ke s Ac , Weigl e al. (2023)
examined i s implica ions o p i acy, while Shekha e al.
(2022) ocused on i s economic e ec s. Weigl e al. (2023)
showed ha he goal o da a sha ing – which is necessa y o
allow mo e playe s o compe e in he digi al ealm – may
be in con lic wi h he GDPR and, hus, de eloped a ec-
ommended p ocedu e based on he ype o anonymiza ion
ha is possible in a gi en si ua ion. Shekha e al. (2022)
ound ha he manda ed compa ibili y be ween pla o ms
will lead o educed pla o m p o i s bu o an inc ease in
o al wel a e, including de elope s and consume s.
Addi ionally, some esea che s, such as Heimbu g e al.
(2023) ha e in es iga ed he law-making p ocess i sel . By
ga he ing and analyzing public commen s made du ing he
d a ing o egula ions, hey de e mined impac s on issues
such as powe dis ibu ion and alue c ea ion, which in u n
a e o be conside ed in pla o m-based ecosys ems.
Resea ch add essing challenges a ising om legisla ion
(B): Design-o ien ed esea ch has al eady begun add essing
he equi emen s s emming om new laws and egula ions.
One example ha is b oadly discussed in he li e a u e is
he p oposal o blockchain da a s o age o supply chains,
wi h he goal o c ea ing a sophis ica ed le el o docu-
men a ion, which can be us ed by all pa ies, including
audi o s (Kuma e al. 2020; Chandan e al. 2019).
Blockchain can also be used o documen g eenhouse gas
emissions (Da wish e al. 2023). O he ci cula economy
da a can be s o ed in a digi al win as sugges ed by Mon-
ei o and Ba a a (2024).
The e is exis ing esea ch abou he design o GDPR-
complian in o ma ion sys ems (Guggenmos e al. 2020)as
well as cybe secu i y-complian sys ems – in his example
in he heal hca e domain (Plachkino a and Faddoul 2022).
Addi ionally, in o ma ion sys ems a e being explo ed as
ools o educing Scope 3 g eenhouse gas emissions wi hin
o ganiza ions, hough se e al challenges emain (Caude ay
e al. 2024).
Fu he , esea che s ha e looked in o he s a egic in e-
g a ion o he Co po a e Sus ainabili y Repo ing Di ec i e
(CSRD) in o co po a e managemen sys ems. Fo ins ance,
decision suppo sys ems ha e been highligh ed as c ucial
o achie ing sus ainabili y goals (Fa kas and Ma olay
2024). The s udy by (K asiko and Legne 2023) ou lines
how companies a e de eloping specialized da a p ocu e-
men p ac ices o ensu e eliable sus ainabili y epo ing.
A icles ocusing on he in luence o BISE on legisla ion
(C): As desc ibed in he in oduc ion, he ans e o
esea ch ou comes o he socie y is an essen ial pa o he
esea ch p ocess. This makes i c ucial o engage wi h
policymake s and poli ical ac o s, in o ming hem o ele-
an esea ch indings ha could in luence hei decision-
making.
The discussion on how o es ablish a con inuous
exchange be ween he BISE communi y and he poli ical
domain has been ongoing o qui e some ime. Fo exam-
ple, as ea ly as 1997, an ICIS panel discussed he in e -
sec ions be ween poli ics and in o ma ion echnology
(Romm e al. 1997). La e , Beck called on esea che s o
become mo e in ol ed in poli ics and o de elop a poli ical
agenda (Beck 2002). This con e sa ion con inued wi h
panel discussions in 2012 and 2019, whe e in e na ional
BISE esea che s sha ed a gumen s, opinions, and ecom-
menda ions (Loebbecke e al. 2012; Fedo owicz e al.
2019). Mo e ecen ly, Weinha d e al. (2024) published an
edi o ial p oposing a esea ch agenda on digi al democ acy,
highligh ing IT egula ion as a key a ea o ocus. Thei
a icle emphasizes he need o enhance public unde -
s anding o echnological and digi al inno a ions. The
au ho s a gue ha i is he du y o in o ma ion sys ems
esea che s o p o ide he public wi h he necessa y ools,
guidance, and educa ion. We suppo his call o ac ion,
s essing he impo ance o well-in o med lawmaking o
minimize unin ended consequences and maximize he
bene i s o digi al ad ancemen s.
3 Resea ch Topics ha A ise om Regula ion
In ou iew, he e a e nume ous esea ch opics open o
u he explo a ion. The e o e, we p opose a ange o
esea ch opics and ques ions o inspi e BISE esea che s.
Table 2p esen s one legal ac om each o he g oups
discussed ea lie , along wi h co esponding esea ch opics.
These opics a e lis ed in no pa icula o de , and some a e
u he elabo a ed below. While he lis is no exhaus i e, i
is in ended o se e as a ounda ion o encou age BISE
esea che s o pu sue hese ele an and imely a eas o
inqui y.
Resea ch opics a ising om he Da a Ac : Da a sha ing
will soon become manda o y o speci ic indus ies and
da a sou ces o maximize he alue o da a and educe
edundan da a collec ion. Bu in o de o achie e hose
bene i s o da a sha ing, we need o o e come di e en
hu dles on he way.
E en hough he po en ial bene i s o be e analy ic
esul s based on a mo e ex ensi e da a basis and he pos-
sibili y o le e aging hi d pa y analy ic capabili ies and
esou ces a e p omising – especially o SMEs, cu en ly,
many companies a e eluc an o sha e da a wi h o he s. To
add ess his, a amewo k should be de eloped ha helps
o ganiza ions assess he c i icali y and impo ance o hei
123
J. P ei e e al.: New Laws and Regula ion, Bus In Sys Eng 66(6):653–666 (2024) 659
Table 2 Resea ch opics based on legal ac s
G oup: selec ed legal ac Resea ch opics
Da a in e ope abili y, sha ing, and
p o ec ion: da a ac
Which amewo k could guide companies ega ding he c i icali y and alue o da a?
How can da a us ees acili a e da a sha ing be ween o ganiza ions?
How can we design, implemen and p omo e da a spaces and da a ecosys ems ha os e in e -o ganiza ional
da a sha ing?
Which da a is uly necessa y o achie e desi ed ou comes?
How can we e i y o alida e he quali y and us wo hiness o ex e nal da a ha has been sha ed by hi d
pa ies?
Wha p e en s companies om implemen ing p i acy-by-design pa adigms?
How can e ec i e and e icien p ocesses be designed o handle use p i acy eques s?
How can we e ec i ely sepa a e sha ed da a om sensi i e da a (e. g. due con aining o pe sonal da a o
business sec e s)?
How can we manage new ou sou cing and cloud models, such as Compu e-as-a-Se ice, ha le e age
o sho e de elopmen o a e in ended o educe he amoun o in ol ed pe sonal da a?
Technologies: AI ac How o assess whe he an applica ion alls unde he AI de ini ion o he EU AI Ac ?
Which amewo k can we es ablish o help ca ego ize AI applica ions in o app op ia e isk classes?
How can he sandbox concep o he EU AI Ac be implemen ed in a way ha encou ages SMEs o in es in
AI de elopmen ?
Wha speci ic challenges does he AI Ac pose o exis ing AI go e nance and s a egy amewo ks and how
can we econcile hose amewo ks wi h he AI ac ?
How should an e ec i e ma ke o hi d-pa y ce i ica ion o AI sys ems be designed?
Which measu emen s and p ocesses a e necessa y o ce i y compliance wi h he EU AI Ac ?
Wha a e use pe cep ions o ai ness, and how can we mi iga e disc imina ion in AI sys ems?
Digi al ma ke and se ices: digi al se ice
ac
How can we e icien ly de ec and lag inco ec in o ma ion, ha e speech and o he illegal con en ?
How can we iden i y and mi iga e ha m ul ne wo k e ec s and powe dynamics? How can we gene a e,
go e n, and os e bene icial ones?
How can we design e ec i e s uc u es o he handling o such con en ?
How can we le e age gami ica ion o s imula e use pa icipa ion?
Wha is he impac o emo ing undesi ed con en on di e en use g oups and hei in e ne usage pa e ns?
How is he Digi al Se ices Ac a ec ing he ecosys em su ounding pla o m p o ide s?
Cybe secu i y: ne wo k and in o ma ion
sys ems di ec i e 2
Which a e he c i ical ac o s ha de e mine an o ganiza ions’ le el o secu i y?
How can we design in o ma ion sys ems ha ollow he pa adigms o secu i y by design o ze o us ?
Wha a e possible amewo ks o isk managemen and isk assessmen ?
Which p ocesses and s uc u es enable o ganiza ions o handle cybe -a acks e icien ly and e ec i ely?
How can we le e age he po en ial o new echnologies while add essing cybe secu i y challenges?
How can we sys ema ically lea n om inciden s, sha e expe iences ac oss o ganiza ions and p e en u u e
occu ences?
How can he coo dina ion o go e nmen agencies be imp o ed om an e-go e nmen pe spec i e?
Resea ch opics ha conce n all he g oups
a once
Wha a e he bene i s, asks, and equi ed skills and ools o he new ole o a Chie Regula ion O ice ?
How can we u n he adhe ence o egula ions in o a compe i i e ad an age?
Wha mechanisms can be es ablished o acili a e ongoing communica ion be ween lawmake s and he BISE
communi y o keep hem in o med abou c i ical opics?
How can we handle di e en legal equi emen s in di e en coun ies in in o ma ion sys ems?
How can au oma ed ools o documen a ion pu poses be designed?
How o p edic and weigh in ended e sus unin ended consequences ha a ise om new laws?
How can we inco po a e laws and egula ions in he BISE communi y and in o eaching?
Why and how do local implemen a ions o di ec i es di e ac oss EU membe s a es?
Why a e legisla o s c ea ing speci ic egula ions, and do hese achie e he desi ed ou comes?
How a e he egula ions impac ing s a -ups?
123
660 J. P ei e e al.: New Laws and Regula ion, Bus In Sys Eng 66(6):653–666 (2024)
