Sequential compliance decisions of firms on cross-border data flows: An institutionally anchored decision support system
2026-07-12 • Computers and Society
Computers and Society
AI summaryⓘ
The authors study how companies decide whether to send data across borders when rules about data sharing are strict. They created a system that helps companies make these decisions by turning rules into clear steps and using a kind of AI called deep reinforcement learning to find the best choices. Their approach also explains why certain actions are taken, like doing more local data work when sending data is too costly. The system can adjust to different rules and helps businesses understand the hidden costs of compliance even before their behavior changes.
data governancecross-border data transfercompliance costsMarkov decision processdeep reinforcement learningdecision support systemcounterfactual analysispolicy interpretationregulatory compliancetransferability
Authors
Yuepeng Zhou, Dongchi Xing, Li Xiong
Abstract
The economic value of data arises from its flow across organizations and national borders. Yet increasingly stringent data governance regimes are turning cross-border transfer into an institutionally constrained sequential decision, in which firms repeatedly weigh compliance costs against the value of data flows. From the perspective of a data-exporting firm, this paper develops an institutionally anchored decision support system. It converts regulatory rules into a computable minimal compliance mapping and models the firm's weekly decisions as a finite-horizon Markov decision process (MDP), with compliance represented as a hard constraint rather than a penalty term. The resulting problem is solved using masked deep reinforcement learning, while counterfactual path advantages provide interpretable signals to support the firm's cross-border data flow decisions. Experiments show that the policies learned within the system outperform the baselines considered and deliver interpretable, auditable decision support. Local processing concentrates in states where the business value of small lawful transfers does not cover their compliance costs, and the localization boundary shifts systematically as the regime tightens. Credential acquisition is front-loaded within the compliance year, and shallow decision trees reproduce the policy's decisions with high fidelity. Treating the persistent-friction weight as a continuous representation of regulatory strictness further reveals an absorb-then-adjust pattern, in which expected rewards decline before observable behavior changes, implying that assessments based only on behavioral indicators may understate the burden already borne by firms. Moreover, the system is not tied to any specific regulation and can be transferred to other jurisdictions and rule-based compliance problems.