Review Reports - Beyond Compliance: AI, GDPR, and ESG as Pillars of Emerging Responsible Corporate Governance in the EU Regulatory Landscape

Round 1

Reviewer 1 Report

Comments and Suggestions for Authors

In this paper, the Author provides an effective and well-structured analysis, offering readers the relevant tools to address the most significant issues. The structure of the paper is clear, the argument is coherent and generally well-supported. However, the convergence between the three frameworks appears to be described rather than fully demonstrated. A more in-depth analysis of the issue addressed in Section 8, from line 411 onwards, would strengthen the originality of the paper. The Author could further explain how the sharing of common regulatory principles may lead to an actual integration of governance processes, by a detailed analysis of the relevant legal provisions. However the overall quality of the paper is very good.

Author Response

We totally agree with your comments. We will take them into consideration and resubmit the so-amended paper. Thank you. In specific, we intend to include in the paper the following (after the first two paragraphs of Section 8)

"The convergence identified in this paper becomes more concrete when the relevant legal provisions are examined as governance mechanisms rather than merely as substantive regulatory requirements. Under Article 9 of the AI Act, providers of high-risk AI systems must establish, implement, document, and maintain a risk-management system operating throughout the lifecycle of the system. Article 10 adds detailed data-governance requirements, while Article 17 requires a documented quality-management system. These provisions do not simply require an organisation to satisfy isolated technical standards; they require the creation of continuous processes for risk identification, documentation, monitoring, review, and corrective action. The AI Act therefore provides an organisational architecture that can interact with pre-existing enterprise risk-management and compliance systems. In particular, Article 9(10) expressly recognises that AI risk-management requirements may be combined with risk-management procedures established under other Union law, providing a direct legal basis for integration rather than requiring entirely separate processes.

The GDPR establishes a comparable governance logic. Article 5(2) places responsibility for, and the ability to demonstrate compliance with, the data-protection principles on the controller. This principle is operationalised through provisions requiring appropriate technical and organisational measures, privacy by design and by default, records of processing, and data protection impact assessments. The significance for convergence is that GDPR compliance already requires organisations to maintain an internal accountability infrastructure capable of identifying risks, documenting decisions, allocating responsibility, and demonstrating compliance. Consequently, where an AI system processes personal data, the organisation does not face two entirely independent governance questions. The AI Act's requirements concerning risk management and data governance must operate alongside the GDPR's accountability requirements. The resulting governance process can therefore involve a common risk assessment, coordinated documentation, and clearly allocated responsibility, while the substantive requirements of each regime remain legally distinct.

The ESG framework provides a third mechanism through which regulatory requirements can become integrated into corporate governance. The sustainability reporting framework requires relevant undertakings to incorporate sustainability information into management reporting and to address both the undertaking's impacts on sustainability matters and the effects of sustainability matters on the undertaking. The reporting architecture therefore links sustainability information to business strategy, risk management, governance, and decision-making rather than treating sustainability as an external communications exercise. The CSDDD reinforces this organisational dimension by requiring companies within its scope to integrate due diligence into relevant policies and risk-management systems under Article 7, identify and assess actual and potential adverse impacts under Article 8, take preventive or corrective measures, engage with stakeholders, establish notification and complaints mechanisms, and monitor effectiveness. These provisions closely resemble the procedural architecture found in digital regulation: identification of risk, documentation, organisational responsibility, implementation of measures, monitoring, and periodic review.

Taken together, these provisions demonstrate a more specific form of convergence than the sharing of abstract principles. The integration occurs because the three regimes require organisations to perform functionally comparable governance activities around different categories of risk. A corporation can therefore construct a common governance cycle in which risks are identified, assessed, documented, allocated to responsible decision-makers, mitigated, monitored, and reported, while the substantive criteria applied at each stage remain framework-specific. For example, an AI system used in supply-chain management may require an AI risk assessment under Article 9 of the AI Act, consideration of personal-data risks under the GDPR, and consideration of human-rights or environmental risks within the company's sustainability due-diligence processes. The governance process can be coordinated even though the legal tests applied to algorithmic, informational, and sustainability risks are different. It is this process-level integration—not the elimination of substantive legal differences—that provides the strongest basis for the paper's convergence thesis.

The legal provisions also indicate that convergence should be understood as conditional rather than absolute. The AI Act applies a risk-based model focused on particular categories of AI systems and risks; the GDPR establishes a general framework for the protection of personal data; and ESG legislation applies according to the scope and thresholds established by the relevant reporting and due-diligence instruments. Consequently, not every company and not every corporate activity will be subject to all three frameworks to the same extent. Nevertheless, for undertakings whose activities fall within overlapping regulatory scopes, the existence of common procedural requirements creates incentives and opportunities for integrated governance. Thus, the sharing of common regulatory principles may lead to an actual integration of governance processes. Convergence therefore occurs through the interaction of applicable obligations, through inter-operation between different sections of companies and through the specific organisational structures used to implement them, rather than through formal legal uniformity."

Reviewer 2 Report

Comments and Suggestions for Authors

The paper is very well written. I would like to point the following basic queries:

The author in introduction has mentioned "The fragmentation problem is particularly acute because each framework has been analysed in isolation by different scholarly communities." I expected more discussion on whether fragmentation and analysis in isolation is leading to a consquence not called for or acceptable?
Is there any substantive reason for calling for convergence? Will convergence achieve better corporate governance? Though the author has written in its findings 'regulatory requirements of each domain interact with and reinforce the others', more discussion on why to converge them would help readers understand author's point of view better.
The author probably can also look at jurisdictions where CSR is mandatory for companies that reach certain thresholds but not for all and ESG reporting is also not mandatory for all companies. It may help in finding some additional points.
The author may like to compare important provisions of all three compliance models separately in a follow on paper.

Author Response

The paper is very well written. I would like to point the following basic queries:

(1) The author in introduction has mentioned "The fragmentation problem is particularly acute because each framework has been analysed in isolation by different scholarly communities." I expected more discussion on whether fragmentation and analysis in isolation is leading to a consquence not called for or acceptable?

(2) Is there any substantive reason for calling for convergence? Will convergence achieve better corporate governance? Though the author has written in its findings 'regulatory requirements of each domain interact with and reinforce the others', more discussion on why to converge them would help readers understand author's point of view better.

(3) The author probably can also look at jurisdictions where CSR is mandatory for companies that reach certain thresholds but not for all and ESG reporting is also not mandatory for all companies. It may help in finding some additional points.

(4) The author may like to compare important provisions of all three compliance models separately in a follow on paper.

We agree with all comments. The idea of a follow on paper with a detailed comparison of important provisions of all three compliance models is excellent. (comment 4).

For comments 1 and 2 we will include in the revised paper in the introduction the following.

"This fragmentation is not merely an analytical or academic problem; it may also generate practical consequences for corporate governance. When AI governance, data protection, and sustainability obligations are treated as entirely separate compliance domains, organisations may develop parallel risk assessments, reporting structures, documentation practices, and lines of managerial responsibility. Such separation can produce duplication, inconsistent risk assessments, and gaps at the points where regulatory responsibilities overlap. For example, an AI system used to generate or verify sustainability information may simultaneously raise questions of algorithmic risk, personal-data processing, data quality, transparency, and sustainability disclosure. Treating these questions through separate compliance channels may obscure their interdependence and make it more difficult for boards and senior management to identify cumulative risks. The problem is therefore not that specialisation within each regulatory field is undesirable, but that excessive institutional separation may prevent organisations from recognising situations in which compliance with one framework materially affects compliance with another.

The argument for convergence advanced in this paper should therefore not be understood as a claim that the three legal regimes should be merged into a single regulatory instrument or that their substantive differences should disappear. Rather, convergence is understood as an organisational and governance response to regulatory interdependence. Where the same corporate activity simultaneously engages AI, data protection, and sustainability requirements, coordination may allow the organisation to identify risks earlier, allocate responsibility more clearly, reduce unnecessary duplication, and produce more coherent evidence of compliance. The value of convergence consequently lies in the capacity to connect existing obligations while preserving the distinct objectives and legal standards of each framework. In this sense, convergence may improve the coherence of corporate governance not because the three frameworks impose identical requirements, but because their interaction requires companies to manage technological, informational, and societal risks within a common decision-making structure."

Thus, the governance rationale for convergence is primarily one of coordination and risk visibility. An integrated approach can enable boards and senior management to see relationships between risks that might otherwise remain within specialised compliance functions. It can also reduce unnecessary duplication where different regimes require comparable activities such as risk assessment, documentation, monitoring, assurance, and reporting. At the same time, integration may strengthen accountability because responsibility for cross-cutting risks can be assigned within a common governance structure rather than divided between independent compliance silos. This does not mean that convergence will automatically produce better corporate governance in every organisation. Its potential contribution is more limited and specific: it can provide a governance structure through which interconnected regulatory risks are identified and managed coherently, while preserving the distinct legal purposes of AI regulation, data protection, and sustainability regulation.

For comment 3 in section 6 the following will be added.

"A comparative perspective illustrates that the movement from voluntary corporate responsibility toward mandatory obligations does not necessarily require universal application of the same requirements to all companies. India provides a useful example of threshold-based regulation. Section 135 of the Companies Act 2013 applies mandatory CSR requirements to companies meeting specified financial thresholds mandatorily contributing 2% of their average net profits to CSR activities. The framework therefore links mandatory CSR governance to the scale and economic capacity of the undertaking rather than applying an identical obligation to every company. In this context, it is argued that mandatory CSR functions as a mandatory advertisement (Kang, 2025).

India's sustainability-reporting framework similarly illustrates differentiated regulatory coverage. This differentiated approach is relevant to the convergence argument because it demonstrates that corporate responsibility can develop through graduated obligations rather than through a single universal regulatory model. A comparable logic can also be observed in European sustainability regulation, where the scope of mandatory sustainability reporting is determined by the applicable legal thresholds and categories of undertaking. The comparative evidence therefore suggests that convergence should not be equated with uniformity: different companies may be subject to different combinations or intensities of obligations, while the governance processes used to identify, document, monitor, and report relevant risks may nevertheless become increasingly integrated.

Kang, Sang Yop. 2025. "Mandatory Corporate Social Responsibility. A Multidimensional Analysis." ECGI. https://www.ecgi.global/publications/blog/mandatory-corporate-social-responsibility-a-multidimensional-analysis

Comment 4. A paragraph will be added in the paper, in section 9, findings, last paragraph.

"A further avenue for research would be a provision-by-provision comparative analysis of the three compliance models. The present paper focuses primarily on the points of interaction among AI governance, GDPR accountability, and ESG regulation and therefore does not attempt to provide an exhaustive comparison of every substantive obligation. Future research could examine the principal provisions of each framework systematically across common dimensions, including scope, risk assessment, documentation, governance responsibility, transparency, monitoring, assurance, stakeholder participation, enforcement, and remedies. Such a comparison would allow the similarities and differences identified at a conceptual level in this paper to be tested more precisely at the level of individual legal provisions and could further clarify the circumstances in which regulatory convergence produces genuine integration of corporate governance processes."

Round 2

Reviewer 1 Report

Comments and Suggestions for Authors

I would like to thank the Authors for addressing my suggestion. I think that it is now clearer that the three regulatory frameworks require organisations to perform functionally comparable governance processes and activities, which may lead to an integration of governance processes when their respective scopes of application overlap.