New Laws and Regulation

Consider regulations such as the GDPR, the EU AI Act, the Digital Services Act, and the Corporate Sustainability Reporting Directive. In recent years, we as researchers have observed that laws and regulations in the digital domain have rapidly moved to the forefront, raising numerous questions and challenges: Where does the data required to comply with these regulations come from? How can data ecosystems be effectively created and managed, and how can the resulting processes be integrated into information systems? How do users respond when faced with seemingly endless cookie settings? When do users feel they are being treated fairly by AI algorithms?

It appears that a new source of research challenges has emerged alongside our typical research processes: legal and regulatory frameworks. Unlike earlier regulations that focused on specific sectors – such as Basel III or BSBC 239 in the financial industry – these new regulations span multiple sectors at once. In this editorial, we aim to explore the most recent regulations relevant to BISE researchers and outline future research directions. Before delving into specific regulations, we want to emphasize that laws and regulations should be recognized as valuable and intriguing sources of research problems for BISE.

To illustrate this, we begin with a broad perspective by examining a typical BISE research process. This process generally starts with (1) identifying a problem, followed by (2) systematically investigating and studying it, and (3) creating new knowledge and understanding, as well as, sometimes, an artifact. For research to be impactful, the outcomes – whether knowledge or artifacts – should ultimately be (4) transferred into practice (see Fig. 1). While the target audience for BISE is typically understood in the sense of “business” (Benbasat and Zmud 1999), the transfer of research results into the social and political spheres has been the subject of increasing interest. (Weinhardt et al. 2024). There is also the viewpoint that relevance needs to be understood as being pluralistic in nature (Lee et al. 2021; Mohajeri and Leidner 2017), particularly with regards to the diverse range of stakeholders addressed. Indeed, there has been an intense discussion in the BISE community how we can focus not only on rigor, but also on relevance (Österle et al. 2011; Straub and Ang 2011; Buhl et al. 2012). Nunamakar et al. (2015) noted that "going the last research mile means using scientific knowledge and methods to address important unsolved classes of problems for real people with real stakes in the outcome" (Nunamaker et al. 2015, p. 15). Van der Aalst et al. go in a similar direction, calling for open science that makes scientific research and related artifacts accessible to everybody (van der Aalst et al. 2016).

Steps 2 and 3 have also been treated extensively in the literature. All social scientists approach their subject via assumptions about the nature of the world and the way in which it can be studied. This involves assumptions about the ontological (e.g., whether the essence of phenomena is external or the product of individual consciousness) and epistemological nature (e.g., the grounds of knowledge, for example, whether it is hard or soft, or whether it can be acquired or must be personally experienced) (Burrell and Morgan 1979). Burrel and Morgan further consider a third set of assumptions about human nature and its relationship to the environment (e.g., responding in a deterministic way or being in control of and creating the environment). Other authors include axiology, which describes the way we as researchers deal with our own values and those of other people involved in our research (Saunders et al. 2016). The set of assumptions we make as researchers directly influences the methods we choose. There are different ways to categorize these methods. One approach is to distinguish between constructivist, nomothetical and idiographic methods. Constructivist methods focus on the conceptual and technical development of artifacts, as seen in design science (Hevner and Chatterjee 2010; Peffers et al. 2007). Nomothetical methods confirm hypotheses and are often used in BISE by applying surveys and conducting experiments in labs, in the field, or in virtual reality environments (Loomis et al. 1999; Meißner et al. 2019). These methods typically follow the hypothetico-deductive approach. Idiographic methods explore and focus on understanding the unique aspects and complexities of individual cases or events with case studies, action research or ethnography (Baskerville 1999; Iivari et al. 1998). While much more could be discussed regarding the creation of knowledge, artifacts, and research methods, further insights can be found in the works of (Saunders et al. 2016) and (Baskerville et al. 2015).

The driving factor behind the topic of this editorial is step 1 in the research process: Where do the problems we conduct research on originate? We find less research on this important first step and identify several typical sources that are often interrelated rather than mutually exclusive (as illustrated in Fig. 2).

First, our research may be inspired by practical problems and phenomena, typically at the organizational or individual level. Examples include studying the factors that affect the successful transfer to cloud services (Benlian et al. 2018) or how governance and strategic alignment influence organizational performance (Wu et al. 2015). At the individual level, further examples include examining the factors that influence users’ trust in e-commerce (Benbasat and Wang 2005) or users’ acceptance of large-language-model-based chat interactions in the service industry (Le et al. 2024).

Second, we often seek to identify gaps or inconsistencies in existing theories or research methods. Theory gaps frequently serve a source of inspiration for our research, as theories in BISE can vary widely in nature. They do not only aim at explaining but also focus on analyzing (and describing), predicting, and providing guidance on how to do something (design and analysis) (Gregor 2006). A prominent example is the Unified Theory of Acceptance and Use of Technology (UTAUT; (Venkatesh et al. 2003)), which extended and integrated the Technology Acceptance Model and others by adding several constructs to address theory gaps. Other examples can be found in theory models concerning algorithm aversion, where context-dependent boundary conditions help explain why, in certain situations, algorithms may be appreciated, while rejected in others (Castelo et al. 2019; Heßler et al. 2022). A classic example of a descriptive theory would be Gorry and Scott Morton’s framework for Management Information Systems (Gorry and Morton 1989). Besides gaps in theory, there are problems arising from insufficient research methods or ethical concerns (Spiekermann et al. 2022). For example, BISE researchers have intensively discussed and further refined design science as a method (Peffers et al. 2007; Hevner and Chatterjee 2010). Methodological challenges in experimental research for BISE have also been addressed, including optimizing experimental designs (Pfeiffer et al. 2015), and conducting NeuroIS experiments with multiple physiological sensors (Hariharan et al. 2017).

Third, technological advancements often create new opportunities and challenges, prompting research questions about their implications, adoption, and integration. Recent notable examples include advances in AI, such as explainable AI (Bauer et al. 2023) and generative AI (Feuerriegel et al. 2024), as well as virtual and augmented reality (Peukert et al. 2022; Pfeiffer et al. 2020) or blockchain technology (Beck et al. 2017). This third source of research problems highlights the overlap between these sources. For example, with the availability of the latest versions of generative AI tools, concrete problems for companies and users arise, for example concerning privacy and trust. Other technologies, such as the use of blockchain technology for non-fungible tokens in the metaverse, remain more speculative, prompting research questions stemming from potential or prototype implementations. This type of research aligns with the call by Orlikowsky and Iacono to focus more on the IT artifact and to attempt “to understand the complex and fragmented emergence of IT artifacts, [and] how their computational capabilities and cultural meanings become woven in dense and fragile ways […]” (Orlikowski and Iacono 2001, p. 133).

In this article, we highlight a fourth promising source of relevant research questions: contextual changes. These include socio-economic and cultural shifts, such as globalization, financial crises, evolving cultural norms (e.g., polarization, the increasing importance of diversity), as well as phenomena such as pandemics, climate change, and wars. A recent example is research that emerged from the societal, scientific, and educational impacts of the Covid-19 pandemic (van der Aalst et al. 2020). We are particularly also observing the growing prevalence of a subgroup of contextual changes, which is increasingly influencing our research: laws and regulations.

In our view, there are numerous research topics open for further exploration. Therefore, we propose a range of research topics and questions to inspire BISE researchers. Table 2 presents one legal act from each of the groups discussed earlier, along with corresponding research topics. These topics are listed in no particular order, and some are further elaborated below. While the list is not exhaustive, it is intended to serve as a foundation to encourage BISE researchers to pursue these relevant and timely areas of inquiry.

Even though the potential benefits for better analytic results based on a more extensive data basis and the possibility of leveraging third party analytic capabilities and resources are promising – especially to SMEs, currently, many companies are reluctant to share data with others. To address this, a framework should be developed that helps organizations assess the criticality and importance of their data sets in relation to their specific business models. This framework would guide companies in identifying which data can be shared without negatively impacting their operations. Additionally, companies must weigh the potential benefits of data sharing against the associated risks, making decisions about whether to share data with partners or the public. The framework should, therefore, consider criteria that determine the risk of data sharing versus its benefits. One method to differentiate between critical and non-critical data is by separating data from its context, as suggested by Werling et al. (2022). Once the decision to share data has been made, the question arises: how should this data be shared? One current model involves data brokers or data trustees who manage data exchanges. However, the definition, roles, and obligations of data trustees are still under development, and their authority or ability to intervene in case of issues has not yet been finalized. The data trustees can run so-called data spaces that are the infrastructure for data management. Hutterer states that even though the idea of data spaces is very promising, it is impossible to get empirical insights into their mechanisms due to the lack of implemented data spaces (Hutterer 2023).

On the other hand, before using external data which we have received in critical applications, both users and developers need to be sure that the external data is accurate, correct, and reliable. This has so far been discussed as an issue of data quality, which is typically addressed within one organization. Most of the time, the organization that produces the data has a good understanding of its data quality – but others will not because they do not know how the data was generated. We therefore propose to look at the data quality problem from another perspective, which is: how can we verify or validate external data to assess its data quality? We need to develop mechanisms and procedures that can help with the task of assessing the quality of data collected by others. Mechanisms to address this could include comparing data with other sources, involving or creating trusted third-parties to assess and certify data quality (Baars et al. 2022; Weber et al. 2023), or detecting outliers by comparing the data to expected or standard operational values.

Another interesting area of research comes from the obligation for certification and compliance with the AI Act. There is a need to develop processes and measurements that help companies to check for compliance need to be developed. This is a core area of expertise for BISE researchers. However, compliance involves not only monitoring and control but also a comprehensive approach to AI strategy and governance. For high-risk AI systems, organizations must implement a quality management system that includes a clear strategy for regulatory compliance. Additionally, the AI Act mandates a risk management system throughout the life cycle of a high-risk AI system, covering mitigation and control measures. BISE researchers that have a tradition in IT management, strategy and governance are well-positioned to explore the specific challenges that the AI act poses to existing theories and frameworks. This includes identifying the roles and responsibilities needed for managing critical AI applications, decision-making processes for AI development, and strategies for keeping AI systems up to date and in compliance. Finally, the EU AI Act is expected to impact the society as a whole and in the long-term. For example, algorithmic discrimination might manifest itself because the same software is used for many different decisions, and it might be self-reinforcing because decisions made by AI algorithms are used for re-training and fine-tuning (Pfeiffer et al. 2023). The AI Act seeks to acknowledge these threats and stresses the fact that AI algorithms must not discriminate, a principle already enshrined in EU law. Thus, BISE researchers are asked to investigate how to mitigate algorithmic discrimination and how to ensure that all users are treated equally.

Research topics arising from the Digital Service Act: The Digital Services Act (DSA) requires platform providers to detect and remove illegal content, such as hate speech and misinformation, offering significant opportunities for researchers to improve methods for identifying problematic content. Sentiment analysis is one of the core technologies addressing this challenge by interpreting subjective information such as sentiments, opinions, and emotions in user-generated content (Ligthart et al. 2021; Nandwani and Verma 2021). Techniques in sentiment analysis range from lexicon-based methods, which use predefined word lists to assess sentiment, to machine learning-based approaches, such as supervised and unsupervised learning, which train models to classify sentiments. Deep learning-based approaches, including CNNs, LSTMs, and transformers, have significantly enhanced sentiment detection by automatically learning intricate patterns from large datasets. Transformers, such as BERT and DistilBERT, are particularly relevant due to their ability to capture long-range dependencies and contextual meanings in text, offering more accurate sentiment analysis, especially in complex cases, but also requiring substantial computational resources (Acheampong et al. 2021). Researchers can continue to refine these models to detect more subtle forms of problematic language, such as sarcasm or implicit hate speech, or explore hybrid approaches that combine the strengths of lexicon-based, machine learning, and deep learning techniques. Additionally, engaging users in content moderation through gamification or nudging mechanisms can encourage participation, enhancing both user engagement and the platform’s ability to manage content effectively.

The Digital Services Act (DSA) also mandates that providers of intermediary services publish detailed reports on their content moderation practices. These reports must include data on the number of content removals and the accuracy rates of their automated content moderation systems. To ensure this information is both accessible and transparent to users, there is a growing need to research effective designs for conveying these metrics. Clear and intuitive designs will help users understand how content is managed on these platforms and promote trust in the system.

Beyond the central platform, a broader ecosystem of partners – including content creators, advertisers, and service providers – often operates within the platform’s structure. The impact of the DSA on this ecosystem has not yet been thoroughly explored, raising important questions about how these partners are affected by the regulation. Researchers can investigate how the new reporting requirements and content moderation processes influence not only the platform but also its connected stakeholders, potentially uncovering challenges or opportunities for adaptation within this ecosystem.

The same holds true for auditors who have the task of assessing the level of security in a given company. The process of auditing is cumbersome and is handled different by each individual auditor. Based on personal experience and expertise, an auditor can make exceptions to defined security requirements. Streamlined auditing processes will become increasingly important as the number of companies requiring audits grows due to the expanded definition of critical infrastructure. When a cyberattack occurs, organizations must quickly mobilize their cyber defense capabilities. This requires well-defined roles, systems, and processes to manage threats efficiently. Developing a robust incident reporting mechanism is key to a successful defense. BISE researchers can contribute by leveraging their experience from enterprise architecture management, offering guidance on how to come up with new capabilities, and providing the enterprise architecture information necessary to assess the impact of an attack. For smaller organizations, outsourcing certain cyber defense functions to specialized partners may also be a viable option, highlighting the importance of effective partner management in this context. The relationship between AI and cyber security is twofold and there have been publications about both directions – AI can be a new threat, for example when it is asked to program a new encryption virus, and AI can be used to protect against cyber threats, for example when AI is used to detect unusual network traffic (Becklines 2024; Shanbhag et al. 2024; Sinha and Muktevi 2024). As a result, companies have to be on the lookout for new challenges to their cyber security as well as their technical defenses continuously, and could be supported by automated mechanisms that inform them about current developments. One research topic could be to identify relevant information demand to keep informed about ongoing developments and suitable sources to cover the demand. Dashboards could be designed based on this information to display threat levels can help security experts manage risks more effectively. Another related research topic might be how to provide the most effective security training to employees, as the continuous education of employees will be increasingly important in safeguarding organizations.

Research topics arising from the complete set of new regulations: Analyzing the law-making process is crucial for improving the efficiency of future legislation, enabling timelier implementation of necessary changes. Here, we could apply process mining to determine bottlenecks or unstructured parts in the processes. One example of such a project that provides access into the engine room of German legislation is Open Discourse (Richter et al. 2020), which is providing the data foundation for analytics regarding the progress of law-making and regarding the political debate. Besides Open Discourse, which relies on protocols from debates, it would also be possible to collect statements from different interest groups and see how the draft of a law is changing over time to reflect demands by specific groups. An example is the transparently documented progress of the German NIS 2 implementation as published by the state (Bundesministerium des Inneren und für Heimat 2024). Such a document analysis involving multiple European member states could also help to answer the question of why and how the implementations of directives are different from each other in each member state.

In addition, the general use of tools, especially generative AI-based tools, which could either help identifying problematic or contracting regulations during the process or legislation, or help documenting how the legal requirements are addressed by the individual company, should be leveraged. Top-down, generative AI can be used to write a template for a company’s cyber security policy but must then be fitted to the individual company and needs to be binding for all parts of the company. Bottom-up, we can use tools to document the IT landscape and the business architecture or tools for penetration testing to identify vulnerable parts of the infrastructure.

The increasing number of regulations has to be handled on the company level. This is especially important when operating in an international context, which requires adherence to even more laws than the ones discussed so far. Furthermore, with the growing severity of penalties for non-compliance, the financial and operational impact on organizations can be significant. Some companies have already started to implement Chief Regulation Officers that monitor laws and regulations and try to intervene when new laws emerge. As with other CxOs, their roles, responsibilities, and impact should be evaluated. Other forms of institutionalization include competence centers within companies or specialized consulting services that could be offered by industry associations.

In any case, we need to educate more people on these topics due to their relevance and impact on multiple job profiles, such as security consultants and data scientists. The law-making process and opportunities to influence these processes should be incorporated into the study programs of BISE students. Conversely, we should also aim to educate law students on BISE-related topics. To achieve the best outcomes, collaboration with legal specialists is essential. Additionally, we should strengthen the connections between BISE researchers and legislators to contribute our insights on these critical topics that have extensive consequences.

These consequences are sometimes unintended as we have seen with the browser cookies based on GDPR (Johnson et al. 2023). To avoid such issues in the future, BISE researchers are asked to develop methods to predict these unintended consequences. This could be achieved – at least in some cases – by involving experts from the BISE community in the legislative process. Also, to further reduce unintended consequences and to ensure compliance of digital products and services with current laws, third parties that inspect and certify products could be involved.

Finally, we could investigate how companies subject to new laws are performing in comparison to companies operating outside of the EU. Can they leverage the potential benefits of regulations, or are these regulations hampering innovation? This may become apparent when we consider start-ups and their chances of success, which are influenced by the balance between innovation potential and regulatory barriers, such as the administrative overhead they must address. The same is true at the societal level – how are political debates progressing in regions that embrace measures against misinformation compared to those that do not, and how is technology usage and acceptance impacted by the regulations?

These new regulations provide diverse and exciting opportunities for BISE research. We are eager to see developments in the coming years and recommend initiating the respective research projects now to assess the impact of these regulations before they come into full effect. Based on these insights, we can in turn become even more valuable partners to legislators and policymakers in broadening the impact of BISE research and developing effective regulations that strengthen our businesses, and improve the cohesion of our society.