Regulations Don’t Govern - People Do: Organizational Agency in Digital Governance

Abstract

In an era defined by rapid digital transformation and proliferating regulatory mandates - from the EU’s General Data Protection Regulation (GDPR) to evolving AI ethics frameworks - a dominant assumption persists: that governance is a passive, compliance-driven response to external rules. This seminar challenges that deterministic view, arguing instead that digital governance is an active, socially constructed process where organizational agency plays a crucial role in defining digital responsibility and compliance. By shifting the lens from “rules as governors” to “people as governors”, the seminar reconsiders who actually governs digital technologies - and with what consequences.

Andrea Fried will discuss studies from her ongoing research, tracing the discursive construction of digital compliance across three related domains. Across these domains, a common thread emerges: compliance is not a fixed state but an ongoing accomplishment - one that can be defined, performed, or undone.

Domain 1: ‘Defining compliance’ - Exploring regulatory conversations involving numerous stakeholders in the formation of the EU’s Digital Operational Resilience Act (DORA)

Domain 2: ‘Selling compliance’ - Analyzing the credibility of corporate communication on compliance with the information security standard ISO/IEC 27001

Domain 3: ‘Challenging compliance’ - Studying digital compliance in crisis: accountability and controllability in a university cybersecurity incident response

Dr. Andrea Fried is Senior Associate Professor at the Department of Management and Engineering, Linköping University, Sweden and Guest Researcher at RSM until October 2026 funded by a sabbatical grant from Linköping University’s Rector’s office. This seminar invites participants to explore the dynamics of digital governance, and Andrea looks forward to discussing where shared research interests might lie.