A. Legal arrangements as instruments of sociotechnical ordering

Maintaining order requires continuous work in which legal arrangements play an important role. The most important question of how to analyse productive connections between legal arrangements and sociotechnical order concerns how to view legal arrangements themselves. I argue that one should avoid overstating the autonomy of legal arrangements while also taking them more seriously than mere neutral ordering tools of specific interests and values.

As for the avoidance of overstating law’s autonomy, one can remember that to be used is to become part of something.Footnote ²⁶ Legal arrangements are used, perhaps most obviously by policymakers, to address perceived problems of sociotechnical ordering. By this view, legal arrangements do not play much of a role in their own right – since they work as mere instruments of order – but instead the interests and values are what matter. Thus, it becomes important to understand the purposes to which legal arrangements are designed and used. This directs the analyst’s attention to the problematisations of sociotechnical order by various actors, that is, how an actor is ‘turning givens into questions’.Footnote ²⁷ The methodological move here is to turn an actor’s problematisations and values from research resources into a topic of inquiry. To study problematisations is to resist the urge to treat the stated harms or injustices of the current order simply as given issues to which one can start formulating legal responses with the legal tools with which one is familiar. The starting point could be certain actors’ problems in a given time and space.Footnote ²⁸ In addition, the stated values and purposes informing problematisations, such as privacy, freedom or autonomy, would not be treated as stable reference points external to governance.Footnote ²⁹ They are immanent to the governance. Thus, one could instead pay attention to how these values and purposes of governance are conceptualised by governing actors – what the values mean to them.

Making problems and values topics of inquiry could be insightful because framing the problems of current order, such as those related to technology and/or corporate practices, in a specific way can maintain other arrangements and practices as givens. Problematisations also influence the legal remedies that are taken up to address those problems.Footnote ³⁰ For example, one can take the debates around the societal harms of artificial intelligence, including the large language models such as those deployed in OpenAI’s ChatGPT. In general, the policy discussions on the harms of artificial intelligence (AI) have supplied two broad understandings of what problems should be addressed and by whom. One understanding of the harm, often advanced by prominent figures in AI development and finance, brings up rather airy and intractable threats of potential human extinctionFootnote ³¹ and ‘loss of control of our civilisation’.Footnote ³² From such warnings of universal catastrophe projected far into the future, no clear vision of legal-political action in the present emerges except maybe one of an extreme (and highly unrealistic) version of the precautionary principle that would aim at ending the AI development entirely. Therefore, such harm formulations end up devolving agency to the AI industry itself and relying on its sense of responsibility when the threat of ‘catastrophe’ eventually seems imminent.

The other strand of understanding AI harm centers the reproduction and reinforcement of pre-existing societal inequalities both globally and regionally. It also brings up AI’s huge environmental strain.Footnote ³³ These formulations of AI harm point to the present social order and its pre-existing pathologies in terms of vast power and wealth imbalances, and the ongoing climate catastrophe and resource overconsumption. These problem formulations also set aside the universalistic understanding of the harm by foregrounding the unequal power dynamics in AI design and the disparate impact of AI systems already in operation. These imbalances are visible on several axes – between the Global North and South; the biggest multinational corporations and other economic actors; and the more well-off citizens and the already marginalized groups. From this, a need for the investigation of pre-existing social order and possible intervention in the present suggest themselves. Another implication is the skepticism towards the potential of self-regulation by the dominant industry actors. Instead, such harm formulations might instead suggest intervention by democratic actors.

It is possible to approach the Union’s or European civil society actors’ other myriad problematisations of technologies with the same analytical lens. Indeed, the Union’s current attempts to rein in Big Tech or gain digital sovereignty imply that the power or conduct of some corporate actors are indeed seen as problematic. But how specifically are they being problematised? What background ideas and distinctions do such problematisations rely on? How are different values understood? This analysis can also tease out the converse – what is not thought as problematic but left as given? For example, it may be that the problem of unaccountable Big Tech power may take certain enabling legal structures of that power as unproblematic givens.Footnote ³⁴

B. Legal arrangements that run away from their creators

The previous point focused on the problems, interests and values of sociotechnical order and on how our legal arrangements serve as tools to address those problems and promote those interests and values. However, to take legal arrangements more seriously than as mere neutral instruments of values and interests, one needs to account for how legal arrangements have a degree of autonomy from the intentions of policymakers and other norm-formulating actors. As Sara Ahmed has stated, ‘intentions do not exhaust possible uses of a thing’.Footnote ³⁵ Often, policymakers cannot predict how actors will eventually come to rely on legal arrangements.Footnote ³⁶

This means moving away from crude functionalism and emphasising the possibility to leverage our existing legal tools as support for various projects that can diverge from the interests of both policy-makers and sometimes even powerful social actors, such as those of capital, patriarchy or racial supremacy. A corresponding move here relates to our understanding of sociotechnical order itself. More specifically in the context of digital economy, the move is to turn corporate power or another form of order from a cause to an effect.Footnote ³⁷ Social or political power is not a starting point that triggers a (legal) response, but a product of relations that quite likely absorb legal elements.Footnote ³⁸ These complex and heterogeneous contributing legal elements merit further study.Footnote ³⁹ The task is to explore and (re)describe what these relations and legal elements are. One could trace the interaction between pre-existing legal tools and actors other than the original policymakers. This also enables us to chart how legal tools and institutions can enable different concentrations of power. For any private or public actor, relying on law is necessary because our entire sociotechnical order has been thoroughly entangled with legal arrangements for a very long time. Also, when legal arrangements run away from their creators and become support for one actor, this often means restraining another one.Footnote ⁴⁰

The idea of sociotechnical ordering that ubiquitously relies on legal tools that have run away from their creators can also help to make sense of law’s legitimisation of power. Legal arrangements do not only enable practices and actors concretely via the simple force of law.Footnote ⁴¹ They also justify them. Thus, by legitimisation I mean law’s function of redefining ‘power and preconception as legal right’.Footnote ⁴² Nowhere in law is it openly stated that a specific legal tool is meant, for example, to maintain the Big Tech hegemony over the European digital economy. Legal arrangements are instead justified in terms of the shared values and public interests that presumably informed their adoption. Thus, when mobilising different legal arrangements, private and public actors can also tap into the legitimising power of law that helps to make their projects appear natural and just.

In Europe, internal market law as one of the most traditional fields of EU law provides here the first example of the mobilisation of pre-existing legal arrangements. Following the increasing importance of services in digital economy,Footnote ⁴³ the EU’s long-standing legal efforts to free the cross-border flows of services – officially justified in terms of individual freedom to pursue endeavors across EU Member States – have proved important also for the corporate behemoths of digital economy.Footnote ⁴⁴ The free movement of servicesFootnote ⁴⁵ and the freedom of establishmentFootnote ⁴⁶ have enabled corporations to locate themselves in Member State of their choice (usually Ireland, Luxembourg, or Netherlands). The Court of Justice of the European Union (CJEU) has interpreted ‘service’ widely and thus many corporations are able to mobilise the freedom for their business.Footnote ⁴⁷ At the same time, these corporations are able to enjoy the national legal entitlements, such as lax taxation, which have largely not been harmonised. This is the basis for a dynamic where the material benefits of digital business largely accrue to the select host locations whereas the various costs are borne locally. For example, it has been shown that online platform businesses undermine states’ income structure by competing against and bankrupting the local brick-and-mortar businesses that pay taxes to those states.Footnote ⁴⁸

The free movement of services has been elaborated further in the e-Commerce Directive.Footnote ⁴⁹ While a lot of scholarly attention has been devoted to the liability exemption provisions of the Directive,Footnote ⁵⁰ it also contains some other important entitlements. Article 3 of the Directive encapsulates the country-of-origin principle – officially meant to guarantee the uniform enforcement of common rules in the internal market – which directs most of the regulatory authority from the country where business is done to the country of establishment. Article 4, in turn, prohibits even the country of establishment from imposing a prior authorisation as a requirement for the provision of many online services.Footnote ⁵¹ Together, these provisions serve to restrict regulatory powers both in countries of operation and establishment.

While the Digital Services Act entrusted the enforcement of its new obligations against the largest online services primarily within the Commission,Footnote ⁵² it did not touch the underlying internal market principles of the Directive.Footnote ⁵³ Pursuant to a case by Google, Meta and TikTok, CJEU has recently affirmed the country-of-origin principle and thus restricted the scope of derogations that is available for Member States from the internal market entitlements.Footnote ⁵⁴ This increased the pressure on any national content governance legislation attempting to offer protection against online harms nationally.

Moving from internal market law to contract law, scholarship is directing more and more attention to the ‘the empire of forms’ that undergirds the intricate business relationships of digital economy.Footnote ⁵⁵ Generally, transnational contract law has come far from the auspices and intentions of nation states even though one or several national, regional, and/or international laws do govern online contracting.Footnote ⁵⁶ In global digital business, different kinds of contracts are ubiquitously relied on both at the production and consumption sides. On the production side, contracts facilitate bigger and smaller firms’ activities from data licensing for developmentFootnote ⁵⁷ to enrolling labor often in the form of ‘independent contractors’Footnote ⁵⁸ to securing hardware supply sometimes far into the future.Footnote ⁵⁹ As Klaas Eller has argued, these transnational contracts serve more the purpose of coordinating and safeguarding elaborate value chains than sanctioning in case of breach.Footnote ⁶⁰ On the consumption side, adhesive contracts in the form of ‘click-wrap’ is a standard practice.Footnote ⁶¹ Consumers now routinely take up different digital services or servitised products by clicking to agree to elaborate terms of service that, among other effects, facilitate data flows from the use of service to the provider.

While the EU has recognised the importance of contract law for digital economy for long, its most far-reaching legislative projects such as the Common European Sales Law have so far failed.Footnote ⁶² However, the Union has been more interventionist within certain specific fields of contracts.Footnote ⁶³ Arguably, the most notable field here is consumer law. One facilitative legal construct in this regard may be found in the legal image of the consumer itself. Even though EU law has featured various consumer–citizens with varying capabilities in different times,Footnote ⁶⁴ generally the starting point in consumer law has been the protection of the consumer as the weaker contracting party. Yet Marija Bartl has shown how around the turn of the 2000s the EU consumer law’s understanding of consumer shifted towards a more self-reliant, ‘confident’ consumer.Footnote ⁶⁵ This image matched rather well with the CJEU’s traditional construction of ‘reasonably well-informed and reasonably observant and circumspect’ consumer.Footnote ⁶⁶ The consumer policy trend continued in the early 2010s when the Union adopted the Consumer Rights Directive and introduced its 2012 Consumer Agenda.Footnote ⁶⁷ The focus on confident and rational consumer effectively meant emphasis on procedural rights and information entitlements over more stringent restrictions,Footnote ⁶⁸ leading to what Hans Micklitz called ‘the expulsion of protection from consumer law’.Footnote ⁶⁹

Even though scholars have already pointed out the shortcomings the information obligations in online contracting,Footnote ⁷⁰ this image of confident and rational consumer continues to undergird the boilerplate contracts online and even implicating some aspects of the traditional formalist theory of contract as ‘a will-based interpersonal agreement between parties presumed as equals’.Footnote ⁷¹ Mobilising the confident consumer construct, corporations have adopted the paradoxical image of what Jake Goldenfein and Lee McGuigan call ‘managed sovereign’ – a consumer who is treated rational and self-standing for legal purposes when signing up to a service agreement, but then viewed as an endlessly pliable object of nudging and other influencing once the person is enrolled on the online service.Footnote ⁷² In practice, consumers have no choice but to accept the boilerplate and few spend their time reading or trying to understand the terms and conditions they agree to.

Data protection law also supplies examples of how legal arrangements run away from their creators and may thus facilitate unforeseen projects. Viviane Reding, an ex-Commissioner and one of the chief architects behind the GDPR has stated that ‘the goal of European privacy rules was to go after Big Tech – not the local butcher or football club’ and lamented the national regulators’ enforcement focus on ‘the nitty gritty’ despite these intentions.Footnote ⁷³ However, the GDPR is a broad horizontal piece of legislation – arguably a ‘law of everything’Footnote ⁷⁴ – that seeks to uphold a wide range of principles, freedoms, and rights across myriad of social contexts. This can also make it vulnerable to mobilisation for many projects unforeseen by its architects.

For example, to give data subjects control over their data, the GDPR grants a host of data subject rights to data access and erasure,Footnote ⁷⁵ and the right to restrict or object to data processing.Footnote ⁷⁶ Yet economic actors may have incentives to minimise data access by data subjects to their databases, and thus also the effective exercise of these data subject rights.Footnote ⁷⁷ For this, the requirement of ‘data protection by design’ in Article 25 of the GDPR has offered a suitable legal support. In industry practice, data protection by design requirements have been translated into different techniques of privacy-enhancing technologies (PETs) that seek to prevent unauthorised disclosure. However, as scholars have shown, PETs can still leave considerable risk of re-identification particularly if an actor has complementary data on the data subjects.Footnote ⁷⁸ At the same time, PETs as data protection by design sometimes do de-identify data to the extent that corporations can claim they are unable to provide data subjects their access rights including the right to erasure because they cannot identify them from their data.Footnote ⁷⁹ Sometimes this might have normatively defensible reasons.Footnote ⁸⁰ Yet when mobilised this way, data protection by design can also lend credence to the corporate goal of frustrating the rights granted in the GDPR itself.

The struggles over access to online platform data for research purposes is another example. The architects of the GDPR likely did not foresee nor intend privacy to be mobilised as a shield for Big Tech business operations against academic and civil society scrutiny. Nevertheless, this is exactly what Big Tech has sought to do.Footnote ⁸¹ For example, Meta started restricting access to its application programming interfaces after the Cambridge Analytica scandal revealed widespread harvesting of social media data for political projects.Footnote ⁸² In restricting this access, Meta has sought to harness privacy as a shield against scholarly scrutiny that relies on ‘scraping’ platform data by similar methods to the ones Cambridge Analytica used.Footnote ⁸³

Finally, privacy and data protection law have come to frustrate general corporate accountability in the disclosure of beneficial ownership of corporations and other legal entities. The EU’s new amendments to its Anti-Money Laundering Directive sought to facilitate some corporate accountability also beyond the financing of terrorism and other crime. Amendments provided that some beneficial ownership information would be accessible to the general public to allow ‘greater scrutiny of information by civil society, including by the press or civil society organisations’.Footnote ⁸⁴ However, pursuant to beneficial owners’ legal action against Luxemburg law establishing a Register of Beneficial Ownership, the CJEU later invalidated such disclosure obligation based on its disproportionate interference with the beneficial owners’ fundamental rights to privacy and personal data as guaranteed in Articles 7 and 8 of the Charter.Footnote ⁸⁵ To be sure, compelling reasons may sometimes be found against public information access. Yet wielding data protection against such general disclosure mandates can also uphold corporate secrecy and power in the face of accountability demands.

Indeed, fundamental rights law provides the fourth field of examples of how pre-existing legal arrangements can be mobilised for unforeseen projects. As Rachel Griffin has shown, fundamental rights tend to incorporate a liberal-individualistic framing of human well-being.Footnote ⁸⁶ This can make them amenable to mobilisation for corporate interests.Footnote ⁸⁷ One can begin with freedom of expression and privacy as the most obvious rights in the digital context.Footnote ⁸⁸ Rikke Frank Jorgensen has conducted research on how Big Tech corporations understand the meanings of these two fundamental rights. She has highlighted how people inside the industry see the companies’ operations as being aligned with these rights rather than opposed to them. Yet those people simultaneously understand the rights in highly specific ways that conform to their business practices.Footnote ⁸⁹ Freedom of expression, for example, is what their business is ‘all about’, while human rights threats are associated with government intervention.Footnote ⁹⁰ The aim is to align specific interests and general values,Footnote ⁹¹ which makes it possible to harness those values and principles to enable specific projects. Similarly, Ari Ezra Waldman has argued that our current privacy practices that revolve around individual control and managerial compliance conceptualise what ‘privacy’ and ‘privacy law’ now dominantly mean.Footnote ⁹²

In the EU, businesses also benefit from a general fundamental right of their own. The right to conduct a business as enshrined in Article 16 of the Charter, has slowly but surely become a powerful and consistently mobilised entitlement in the Union primary law. As Hilary Hogan has shown, in the CJEU jurisprudence the right to conduct a business has evolved into a general right to corporate autonomy that protects whatever potentially profitable activities one sees fit to undertake.Footnote ⁹³ While the right can surely be limited like most other fundamental rights, the CJEU has been willing to accept that a wide range of regulatory activities are to be viewed as infringements of the right, which must be then justified as appropriate, necessary and proportional among other requirements.Footnote ⁹⁴

In the digital context, the CJEU has for example argued that ‘[t]he freedom to conduct a business includes, inter alia, the right for any business to be able to freely use, within the limits of its liability for its own acts, the economic, technical and financial resources available to it’.Footnote ⁹⁵ Regarding online content governance, the CJEU has also reasoned that a filtering injunction requiring an internet service provider to ‘install a complicated, costly, permanent computer system at its own expense’ would amount to a ‘a serious infringement’ of the right to conduct a business.Footnote ⁹⁶ While these judgements have certainly not prevented the EU from enacting new online content regulation, they have contributed to the strengthening of the link between fundamental rights and corporate autonomy, which enables businesses to operate fairly independently without too much public constraints. For example, in the fundamental rights impact assessment of the DSA the Commission ensured that ‘[n]one of the measures in either one of the [regulatory] options should jeopardise the protection of trade secrets or proprietary products of online platforms’.Footnote ⁹⁷ Similarly, Meta has argued before the German Competition Authority that ‘limiting data processing is always unreasonable because it interferes with Facebook’s product design’.Footnote ⁹⁸

Even though all the examples of legal arrangements mobilisation in this section involve powerful corporate interests, even actors with ample resources do not always succeed in connecting with legal arrangements in a durable way. The connections that different actors have managed to forge between their interests and pre-existing legal arrangements can be fragile.Footnote ⁹⁹ The idea that legal arrangements can run away from their creators and be co-opted by various societal actors also accounts for the fact that authoritative legal interpreters sometimes cut the connections that these actors have forged with legal arrangements, for example by reference to a tool’s iteratively construed original purpose.Footnote ¹⁰⁰

One can find an example of this severing of productive connections in data protection law. The GDPR not only constrains data processing and ‘protects’ personal data but also enables various data processing operations if, among other requirements, the processing has a proper legal basis.Footnote ¹⁰¹ Meta has long insisted that ‘there is no hierarchy between legal bases [in the GDPR], and none should be considered more valid than any other’.Footnote ¹⁰² Thus, it has refrained from asking consent for processing for advertising business, relying instead on the so-called contractual necessity legal basis.Footnote ¹⁰³ Yet this connection with the GDPR was effectively severed by the European Data Protection Board’s (EDPB) recent decision against such reliance.Footnote ¹⁰⁴ Afterwards, Meta shifted to legitimate interest legal basis instead.Footnote ¹⁰⁵ This reliance might have also been cut by the CJEU in a judgment on Meta’s data processing for advertising in June 2023, suggesting that Meta needs recourse to consent after all.Footnote ¹⁰⁶ This led the company to introduce an advert-free, subscription-based version of Facebook and Instagram in Europe, which serves as an alternative if a user does not consent to data processing for advertising purposes.Footnote ¹⁰⁷ Yet this strategy was once again rejected by the EDPB, which issued an opinion arguing against such binary options as a basis for valid consent.Footnote ¹⁰⁸ In the latest episode of the saga, the Commission opened its own separate investigation of Meta’s data processing under the Digital Markets Act.Footnote ¹⁰⁹

As another example from data protection, civil society actors can mobilise the data rights in the GDPR for the purposes of independent research and industry scrutiny even if this is not stated as an explicit goal of the regulation.Footnote ¹¹⁰ They have also successfully wielded various fundamental rights against powerful corporate and state actors.Footnote ¹¹¹ In the internal market context, despite the Union’s meagre competences in taxation law, the Commission has sought to address Member States’ tax benefits to their hosted digital behemoths as unlawful state aid (albeit with mixed results).Footnote ¹¹²

However, the extent to which legal arrangements appear flexible and thus harnessable is relational to the actor that seeks to harness them. This means that the well-connected and amply resourced, for example powerful multinational corporations and hegemonic states, may often be better positioned to mobilise legal tools to support their projects than the disadvantaged. They have more capabilities. Thus, legal arrangements might appear more flexible to them than to others.Footnote ¹¹³ For example, they can pursue their projects in different legal fora at the same time, such as before regulators, legislatures and courts. They can mobilise more legal services, and endure losses in individual campaigns while having still the resources to advance long-term projects.Footnote ¹¹⁴ They may also have connections and resources to mobilise lobbying services, think tanks, public relations services, media and even academic research to gain support and spread their conceptualisations of important values and legal-political issues.Footnote ¹¹⁵ No authoritative decision-maker can be totally uninformed by these various efforts for societal influence even though actors in public positions generally understand themselves to be working in the general interest.

C. Legal arrangements as constitutive of other forms of governance

The third point of focus concerns how legal tools become embedded into, and thus constitute, markets, technologies and other forms of order that are traditionally understood to be non-legal. The focus is on drawing the connections between traditionally legal and other forms of order. Here, legal arrangements are understood to be productive in a deeper sense than mere supportive instruments for various actors, whether intended or not by their original designers. They are understood to partly create various entities, including actors with interests and other forms of social order such as markets, technologies and societal governance. While this is not to deny that law also responds to market developments, new technologies and other forms of order, the orientation does entail a focus on how legal arrangements form and undergird these other governance systems.

In particular, legal arrangements can be baked into technology, and thus become constitutive of it.Footnote ¹¹⁶ Law and technology scholars are acutely aware that computer code can produce regulatory effects in its own right with very real consequences.Footnote ¹¹⁷ However, there is an increased need to analyse how specific productive interactions between legal and other governance arrangements play out. One could study, for example, how in online environments, many GDPR requirements, especially on valid data subject consent,Footnote ¹¹⁸ have been translated into the technological mechanism of consent management user interfaces or ‘cookie banners’.Footnote ¹¹⁹ The cookie banner is a choice management solution for websites offered by specialised consent management providers. It produces a layered window or banner when a website is loaded, enabling the website user to receive information on data processing and consent to it.Footnote ¹²⁰ Usually, consent can be managed by clicking different choice ‘sliders’ on a pop-up window before proceeding to the website. Existing analysis has tended to revolve around the features of cookie banners that appear as possibly non-compliant with the GDPR requirements for valid consent.Footnote ¹²¹ These analyses involve a shift to legal-normative evaluation, the possible legal implications being that the GDPR is not enforced properly.

However, this assumes a certain irrelevance of the GDPR to consent management. Instead of focusing on irrelevance, one can appreciate how the GDPR has constituted an entire market that offers ‘consent-as-a-service’. Furthermore, delivering data protection and ‘being in compliance with the GDPR’ in the online environment now often involves inserting a properly designed consent management solution into one’s website. Thus consent management services constitute a significant part of online data protection. Finally, data protection law and the designs of consent management platforms have been slowly transformed in tandem through the decisions of the CJEU, EDPB and changing corporate practices. The aim of exploring these connections between consent management and the GDPR is not to draw attention to how consent management solutions and their providers are not complying with the GDPR obligations and how they could comply better. Instead, it is to induce reflection on the practices, markets and actors enabled and produced by the GDPR, and whether this is what we would like online data protection, and to some extent online privacy, to be.

Regarding other forms of order, one can also trace how legal governance interacts with more informal governance arrangements, often referred to as ‘soft law’, ‘self-regulation’, or ‘co-regulation’. Law and technology scholars are now acutely aware that various forms of ‘private ordering’ are highly consequential. However, it is common to contrast the private, unaccountable governance of corporations with traditional ‘hard law’ regulatory schemes. The latter are generally thought to be relatively absent in the European digital economy before the recent flurry of regulation by the EU. More generally, it has been debated in EU legal studies since 2000 at least whether the Union has moved from ‘integration through law’ to ‘integration through governance’.Footnote ¹²²

Here, the methodological move is to sideline general debates and refrain from strict distinctions between hard and soft law and the related question of legal validity.Footnote ¹²³ Nor is it sufficient to label the interactions between law and informal governance as a mixed regime of co-regulation.Footnote ¹²⁴ Rather, one would trace the specific interactions that are formed between legal arrangements and more informal forms of governance, appreciating how hard law can become ‘governmentalised’ and governance ‘legalised’.Footnote ¹²⁵ This also entails resisting the urge to see such amalgams simply as a lack of ‘proper’ lawfulness or to lament them as dilutions of rule of law, but also refraining from normatively embracing such amalgams. Better to illuminate how the meanings of both EU law and governance are slowly transforming through new specific hybridizations, while empowering new actors in different ways. Again, this could engender reflection on how legal tools can enable various other forms of governing actors and governance processes, while the very meaning of law also changes in the process.

For example, scholars have already chronicled how, before the new EU digital regulations, online platform content moderation by these ‘new governors’Footnote ¹²⁶ were undergirded by quite traditional legal entitlements, such as the provisional immunity against liability enshrined in the e-Commerce Directive.Footnote ¹²⁷ Thus, both traditional legal mechanisms and various soft law arrangements enabled new governors of online content to emerge in the first place. Correspondingly, the DSA could be said to have ushered in a new age of hard law, codifying and also transforming many platform governance practices. Yet various more informal and privatised governance arrangements of ‘regulatory managerialism’ will continue to play an important role within the European regulatory picture.Footnote ¹²⁸ In the DSA regulatory complex, these include out-of-court dispute resolution, codes of conduct such as the governance scheme woven around the Code of Practice on Disinformation,Footnote ¹²⁹ and monitoring by trusted flaggers, private auditors, national authorities and vetted researchers. The Commission itself is set to orchestrate all these actors and unfolding monitoring processes.Footnote ¹³⁰

Here, one can study how the DSA and other new digital regulations can produce, for example, new markets for regulatory technology or auditing governance as a form of private ordering.Footnote ¹³¹ Focusing on the external auditing of online systems, the DSA mandates that the largest online platforms and search engines have their systems periodically audited by independent auditors.Footnote ¹³² While the DSA is rather circumspect on who exactly might become such independent auditors,Footnote ¹³³ the Commission’s delegated regulation on external audits lays out the independence requirements so that they open the door for ‘the Big 4’ multinational audit firms (Deloitte, PwC, KMPG, and Ernst & Young).Footnote ¹³⁴ As Julia Black has shown in the context of financial services, such consultancy firms with homogenous organisational cultures are highly consequential for the formation of standardisised ‘best practices’ of governance that ultimately determine what precisely is being scrutinised and how.Footnote ¹³⁵ In the words of the Commission, the audit reports ‘shall offer a comparative basis for public scrutiny’ of the largest online service providers.Footnote ¹³⁶ Scholarship has also pointed to the shortcomings of audit governance, including questionable independence and lack of public accountability.Footnote ¹³⁷ One can study how the DSA and other digital regulations extend private audit governance into new domains, producing new kinds of private ordering.

Another example of the production of private ordering is technical standardisation. Technical standardisation governance, as undergirded by quite traditional EU law,Footnote ¹³⁸ has played a vital role in the creation of the internal market for decades.Footnote ¹³⁹ Three private standardisation bodies – the European Committee for Standardisation (CEN), the European Committee for Electrotechnical Standardisation (CENELEC), and the European Telecommunications Standards Institute (ETSI) – have been tasked by the European Commission to draft European harmonised technical standards for the EU. Technical standards provide crucial mediation when legal rights and obligations are baked into technologies. More recently, we have witnessed legal struggles before the CJEU on whether the European harmonised technical standards are themselves ‘law’ (they are),Footnote ¹⁴⁰ and what obligations pertaining to their free public availability might follow from this designation.Footnote ¹⁴¹ These are important transformations to note as the legalisation of private governance.Footnote ¹⁴² Yet the transformation of legal requirements into technical standardisation governance also involves other stakes.

The Union’s new Artificial Intelligence Act foresees technical standardisation as the way to concretise the fundamental rights and other legal obligations for ‘high-risk AI systems’ and translate them into technological form.Footnote ¹⁴³ In scholarship this regulatory approach has been received with skepticism.Footnote ¹⁴⁴ By enabling CEN and CENELEC to draft harmonised standards, the AI Act also empowers their complex multistakeholderist governance structures.Footnote ¹⁴⁵ Therefore, EU legal arrangements upholding standardisation governance may also indirectly enable powerful corporations ‘holding stakes’ in technical standardisation. Societal stakeholders – most notably Environmental Coalition on Standards (ECOS), European Trade Union Confederation (ETUC), and Association for the Co-ordination of Consumer Representation in Standardisation AISBL (ANEC) – face resource and expertise constraints, and in some cases their participation is standardisation processes is limited.Footnote ¹⁴⁶ All this can amount to a form of governance that Julie Cohen calls ‘extreme multistakeholderism’ – governance that disproportionally rewards the well-connected and amply-resourced industry stakeholders.Footnote ¹⁴⁷

The Commission’s recent struggles to reform the European standardisation governance system itself are illustrative here. In 2022, the Commission unveiled a new standardisation strategy and a proposal to amend the regulation governing the creation of harmonised standards within the European standardisation organisations.Footnote ¹⁴⁸ This was done to account for, most notably, the fact that ‘today’s decision-making processes within the European standardisation organisations […] allow an uneven voting power to certain corporate interests: some multinationals have acquired more votes than the bodies that represent the entire stakeholder community’.Footnote ¹⁴⁹ In particular, ETSI’s governance structure enables industry membership and the influence of financial contributions into decision-making.Footnote ¹⁵⁰ ETSI’s deep-pocketed corporate members include, among others, Google Ireland, Meta Ireland, Amazon Web Services and several companies of the Huawei group.Footnote ¹⁵¹ In the end, the Commission decided to leave ETSI out from its AI standardisation request even though the organisation has been very active in the field.Footnote ¹⁵² The newly amended regulation on standardisation organisations and harmonised standards now provides that certain important decisions on European standards must be ‘taken exclusively by representatives of the national standardisation bodies within the competent decision-making body of that organisation’.Footnote ¹⁵³

After a harmonised technical standard has been drafted, the Commission is meant to determine whether it fulfils the requirements set out in the standardisation request, and ultimately AI Act. In practice, and coming back to the topics of audit governance and regulatory managerialism, the assessment is carried out by independent experts called Harmonised Standard Consultants (HAS Consultants).Footnote ¹⁵⁴ The Commission has outsourced the selection and management of these special consultants to a HAS Contractor, which for many years has been no other than the audit company Ernst & Young.Footnote ¹⁵⁵ In sum, the elaborate translation of legal mandates into technical standards offers one field where myriad productive connections between law and other forms of governance can be traced. In technical standardisation, legal mandates are governmentalised and private governance legalised.