Governing at a distance: The EU AI act and GDPR as twin pillars of digital law and corporate governance
The rapid global deployment of artificial intelligence (AI) has created governance challenges relating to accountability, privacy, corporate oversight, and regulatory compliance. While the European Union (EU) Artificial Intelligence Act (AI Act) and the General Data Protection Regulation (GDPR) are often analysed separately, limited scholarship has examined how both frameworks operate together in shaping corporate governance beyond the EU. This article investigates how the AI Act and the GDPR function as complementary regulatory instruments that reconfigure governance structures within firms and influence corporate decision-making globally. The research adopts a doctrinal and comparative legal methodology, informed by regulatory governance theory, combining analysis of EU legislative texts, enforcement practice, academic literature, and governance guidance. Building on work in digital regulation and regulatory capitalism, the study finds that both instruments extend governance-by-design principles into corporate practice by embedding compliance obligations into risk management systems, internal controls, board oversight, and accountability processes (Bradford, 2020; De Gregorio & Dunn, 2022). The article concludes that the AI Act and GDPR operate as twin pillars of digital governance that enable the EU to govern corporate conduct at a distance. The paper contributes to scholarship on AI regulation and corporate governance by offering an original analytical framework relevant to both academics and practitioners.