EU Data Governance, AI Ethics, and Responsible Digitalisation in Higher Education: A Compliance–Capability Framework for Universities

Abstract

Higher education institutions function as complex data ecosystems that simultaneously act as data holders, data users, and data intermediaries across teaching, research, and administration. This complexity makes EU data governance and responsible AI directly relevant to universities because compliance increasingly depends on organisational capability linked to fundamental rights protection, cybersecurity resilience, and market integrity. Sector scale amplifies risk because routine administrative errors, biased automated decisions, or weak access control can produce cumulative harm and erode institutional trust. The objective of this abstract is to formulate a compliance–capability framework that aligns EU data governance instruments with AI ethics and responsible digitalisation requirements and translates them into implementable institutional mechanisms. The study applies qualitative policy and legal analysis through doctrinal mapping of the EU regulatory stack relevant to universities, including the GDPR, the Data Governance Act, the Data Act, and the AI Act. It synthesises trustworthy AI ethics frameworks and integrates descriptive indicators on cross-border mobility, digital skills, and cyber risk to support risk-based governance design. Criteria-based institutional design reasoning is used to connect legal duties to governance roles, evidence artefacts, and monitoring indicators across the data and AI lifecycle. Results show that universities face overlapping duties because a single workflow may combine personal data processing, research data sharing, learning analytics, and AI-supported decision support. The GDPR remains foundational, while the Data Governance Act structures trusted reuse, the Data Act addresses fair access, and the AI Act introduces risk-based transparency, oversight, and AI literacy expectations. Further research should test interoperability models for research data sharing and measure how maturity in training and oversight reduces rights violations and incident rates.