Freedom of Information as a component of sustainable corporate governance: an exploratory study of Austrian state-owned enterprises

State-owned enterprises (SOEs) are hybrid agents (Argento et al., 2019b; Grossi et al., 2015), combining public sector objectives such as social welfare and public service delivery with private sector logics of efficiency and competitiveness. They play a fundamental role in delivering essential public services (Grossi et al., 2015), thereby engaging with a wide variety of stakeholders, including citizens, policymakers, investors, employees, and regulators, and are often seen as role models for responsible business conduct and transparent reporting (Greiling and Bauer, 2023; Garde-Sánchez et al., 2017; Grossi and Thomasson, 2015). In this role they are increasingly under pressure to combine transparency, accountability, and sustainable management (Grossi et al., 2022).

Two central regimes shape this agenda: On the one hand, environmental, social and governance (ESG) reporting, which is regulated by the European Union’s (EU) Corporate Sustainability Reporting Directive (CSRD) (Directive 2022/2464/EU), and the European Sustainability Reporting Standards (ESRS); and on the other hand, Freedom of Information (FOI), which has been increasingly legally anchored by European governments and governments worldwide through the implementation of federal FOI laws (e.g. Dragos et al., 2019; Michener, 2011). Both approaches (the CSRD and FOI) aim at opening up administrative action, making organizational decision-making more comprehensible and strengthening public accountability, yet they are based on different institutional mechanisms. ESG reporting has traditionally relied on proactive disclosure and organizational self-regulation (e.g. Ioannou and Serafeim, 2019; Greiling and Bauer, 2023; KPMG, 2022), whereas FOI legally guarantees access to public information and responsiveness (e.g. Dragos et al., 2019; Foerstel, 1999; Worthy, 2017). It operationalizes transparency not as a voluntary communication tool, but as an institutional obligation and democratic right (e.g. Birkinshaw, 2006; Florini, 2007).

Despite differences in their enforcement and legal character, both disclosure regimes share a common normative foundation: They should provide information for external stakeholders to ensure transparency and accountability. These principles also form the core of both ‘good governance’ and sustainable organizational management (in Rasche et al., 2023). As FOI can be understood as a governance principle that fosters accountability (Piotrowski, 2007), it contributes to creating the conditions for ESG matters and sustainability in SOEs. Thus, FOI moves closer to the idea of sustainability governance, particularly in relation to Sustainable Development Goal (SDG) 16 (“Peace, Justice and Strong Institutions”) (as anticipated by Orme in 2015; United Nations, 2015). Nevertheless, FOI has so far received little scientific attention in ESG and sustainable corporate governance research.

This study thus aims to investigate whether FOI, or rather the anticipation of a future transparency regulation, is reflected in SOEs’ disclosure practices, and if so, how they prepare for and anticipate FOI. Our central research interest lies in linking two previously largely separate discourses, namely the legal-normative discourse on transparency and the strategic-communicative discourse on sustainability. In this sense, for one, we conceptualize FOI as a component of sustainable corporate governance, representing a tool for democratic accountability (Hood and Heald, 2006; O’Donnell, 1998; Piotrowski, 2007) and thereby contributing to organizational sustainability. Second, we empirically examine FOI anticipation by investigating SOEs’ disclosure practices in Austria through addressing the following research questions:

The study employs a concept-building logic backed by an exploratory empirical analysis, specifically through a documentary and keyword frequency analysis (Mayring, 2022). The analysis focuses on the disclosure practices of 101 SOEs in Austria, with particular attention to their financial and non-financial reports (ESG and/or sustainability reports from 2020 to 2024) and their website disclosure practices (from 2026). All accessible reports and website content are analyzed to assess the extent to which FOI and transparency considerations are anticipated and prepared for. The 101 SOEs include SOEs with 100% shareholdings, but also all majority shareholdings, i.e. all affiliated companies in which the federal Austrian government holds more than 50% of the equity capital (Bundesministerium für Finanzen, 2023).

Using Austrian SOEs for this analysis is especially valuable for two major reasons. First, since 2020, when the Green Party became part of the Austrian federal government, efforts to implement a nationwide FOI Act have been resumed and further developed. Since September 2025, Austria has had a comprehensive FOI law in place, obliging covered public sector institutions, including SOEs, to actively and reactively disclose information. The timeframe of our analysis therefore allows us to examine whether and how Austrian SOEs may have prepared for these disclosure requirements and thus have been subject to anticipatory regulatory pressure.

Second, Austrian SOEs operate within a regulatory environment characterized by increasing sustainability disclosure requirements under the EU’s Non-Financial Reporting Directive (NFRD) and, more recently, the CSRD. As entities that are fully or majority-owned by the federal government, they are subject not only to general corporate reporting requirements but also to heightened expectations regarding transparency, accountability, and responsible governance (Garde-Sánchez et al., 2017; Greiling and Grüb, 2014; Greiling and Schaefer, 2020). Sustainability reports have therefore become an important communication instrument through which SOEs disclose information on governance, transparency, compliance, stakeholder engagement, and broader ESG-related activities. The Austrian context thus provides a particularly suitable setting for examining whether FOI is not only anticipated as a transparency obligation but also reflected in SOEs’ ESG-related disclosure practices.

The study’s contribution is three-fold. First, by focusing on FOI as a form of coercive institutional pressure, it contributes to institutional theory (DiMaggio and Powell, 1983), specifically to anticipatory governance (Guston, 2014). The study examines how coercive transparency pressure shapes organizational disclosure practices through anticipatory governance processes. By focusing on the period before and immediately after the introduction of Austria’s FOI law, it explores whether SOEs adapt their disclosure practices in anticipation of emerging transparency requirements (Oliver, 1991). Drawing from this, we provide a framework for the practical FOI institutionalization in SOEs. Thereby, the study also extends beyond the Austrian research context.

Second, it conceptually links two disclosure regimes, namely FOI and ESG reporting. Through this linkage, the study contributes to a more integrative understanding of institutional transparency and accountability as a sustainability component in SOEs’ corporate governance. FOI, in its function as an accountability tool, is conceptualized as a part of the “G” of ESG, and should therefore be viewed as a foundational mechanism of sustainable governance and responsible business practice for SOEs.

Third, the study provides one of the first empirical assessments of whether and how SOEs anticipate FOI obligations in their reporting and disclosure practices. The findings reveal that, currently, legal transparency requirements and sustainability reporting remain only weakly aligned in practice, indicating that Austrian SOEs predominantly treat FOI as a compliance obligation rather than as a component of sustainable corporate governance.

FOI laws constitute a powerful form of coercive institutional pressure in the sense described by institutional theory (e.g. in Trautendorfer et al., 2024 or Yang et al., 2022). FOI laws establish legally enforceable rules governing access to information held by public sector institutions. In certain cases, they also cover SOEs. These laws oblige covered organizations to disclose documents upon request, justify refusals within narrowly defined exemptions, and comply with procedural requirements such as response deadlines (e.g. Dragos et al., 2019). Oftentimes FOI laws, especially newer, more comprehensive, and more stringent laws, include also provisions on proactive disclosure of documents.

From an institutional perspective, such legal mandates exemplify coercive isomorphism as conceptualized by DiMaggio and Powell (1983): organizations may adapt their structures and practices because they are compelled to conform to formal rules backed by state authority. Coercive isomorphism thus suggests that organizations operating within the same regulatory environment gradually become more similar in their structures and practices as they respond to common legal requirements and external expectations (DiMaggio and Powell, 1983).

In the context of FOI, this implies that SOEs may adopt comparable transparency practices in order to comply with FOI requirements. They may introduce information and document management systems, train staff, and professionalize requesting procedures, thereby reducing barriers to information access and contributing to the de facto operability of the law (more on operability in, e.g. Michener, 2015). Such adaptations can enhance internal clarity, procedural consistency, and risk awareness, and, over time, may become visible not only in internal administrative processes but also in external disclosure practices, including websites and organizational reporting. If SOEs operate with the knowledge that their actions may become publicly visible, this can foster more carefully reasoned and documented governance practices (Fung et al., 2007). FOI laws can therefore be understood as a driver of organizational change that potentially shapes both governance structures and disclosure behavior across SOEs (Oliver, 1991). Indeed, the FOI literature recognizes the impact FOI laws can have on disclosure practices (Mabillard and Keuffer, 2022) and that they also often reshape administrative routines and organizational cultures in public sector organizations (e.g. Hazell et al., 2010; Richter and Wilson, 2013). In this sense, the coercive pressure from FOI acts as both an external regulatory constraint and an internal governance discipline that impacts the inner workings of public sector organizations (Piotrowski, 2007). It can thus also dictate how SOEs are managed and function.

Anticipatory governance refers to the capacity of organizations to integrate foresight and preparation into present decision-making in response to emerging regulatory or societal developments (Guston, 2014). Regulations are often proposed, developed, and finalized over a lengthy rule-making period prior to their adoption, providing organizations with leeway to respond to proposed regulations and prepare their governance systems or alter their business models (e.g. in Hendricks et al., 2023). Accordingly, when organizations expect the introduction or expansion of FOI legislation, they may begin adapting before the law formally takes effect. As mentioned before, they may audit information systems, clarify classifications of sensitive data, train staff, and establish compliance structures in advance to make the law operable and be able to comply with it. Such anticipatory measures can be interpreted as strategic responses to institutional processes (Oliver, 1991), reducing future adjustment costs while signaling responsiveness to evolving societal expectations regarding transparency. If public sector organizations anticipate future FOI requirements, early adaptations in disclosure and governance practices may represent initial manifestations of coercive isomorphic change before formal legal compliance becomes mandatory.

FOI laws do more than impose transparency obligations on public sector organizations. They institutionalize the normative principle of public accountability by providing stakeholders with a “tool” through which organizations can be held accountable (Florini, 2007; Hood and Heald, 2006; Piotrowski, 2007). By implementing and complying with FOI laws, public sector organizations uphold the democratic principle of mutual checks and balances by allowing citizens and other stakeholders to access information about activities carried out on their behalf (Sartori, 1987). FOI therefore equips stakeholders with a “watchdog” function over covered organizations (e.g. Piotrowski, 2007). This role is particularly important in the public sector given that citizens finance government activities through taxation and consequently have a legitimate right to know how, e.g. public resources are used. Even though SOEs are not directly financed by taxes, they are a vital part of the public sector and thus are oftentimes bound by FOI regulations. Therefore, by reducing information asymmetries between SOEs and its various stakeholders, FOI laws not only narrow the information gap between principals and agents but also strengthen democratic accountability (e.g. Hood and Heald, 2006; Mabillard and Zumofen, 2017). Consequently, if SOEs properly prepare for FOI implementation and comply with it, they set the stage for actionable accountability.

The principles of transparency and accountability are central to sustainable organizational governance because sustainability extends beyond environmental performance to encompass the long-term legitimacy, resilience, and responsible conduct of organizations (Bansal and DesJardine, 2014). Governance systems that promote transparency and accountability can mitigate corruption risks (Cucciniello et al., 2017), improve legitimacy through external scrutiny and the need for careful justifications (De Fine Licht et al., 2014), and strengthen stakeholder trust (e.g. Fung et al., 2007; Wang and Guan, 2023). Especially trust and legitimacy are widely recognized as critical intangible resources that support organizational continuity and long-term survival (Suchman, 1995). However, transparency has drawbacks (Grimmelikhuijsen, 2012). Particularly due to their hybrid nature, strong transparency regulations and information disclosure obligations of SOEs could lead to losses in competitiveness. Moreover, the accountability-potential can also decline, as more transparency does not always mean more understanding. Too much information provision can undermine accountability by stakeholders not being able to filter usable information (Villeneuve et al., 2025), which may have an impact on trust.

Yet, regardless of its potential benefits and drawbacks, transparency is one of the preconditions for functioning accountability. So, while it does not guarantee accountability, it at least makes accountability possible (e.g. Bovens, 2007; Mabillard and Zumofen, 2017). FOI implementation and compliance with it, therefore, can contribute to organizational sustainability objectives by institutionalizing transparency and, consequently, fostering accountability. Fung et al. (2007, p. 109) describe a sustainable transparency system as one that continuously improves the quality and accuracy of disclosed information while increasing its usefulness for stakeholders. Organizations that internalize transparency regulations early are therefore likely to develop stronger disclosure routines, clearer accountability structures, and more robust information-management capabilities. Particularly for SOEs operating in competitive or hybrid environments, proper internal transparency governance may help meeting increasing external societal expectations regarding accountability, openness and responsible governance.

To sum up this brief conceptualization, FOI in its accountability-generating function can be viewed as a catalyst for sustainable governance practices. Through anticipatory preparation and compliance, SOEs may transform transparency from an externally imposed obligation into an embedded organizational value. In doing so, FOI becomes more than a legal requirement: it becomes part of a governance orientation that supports long-term legitimacy, institutional resilience, and organizational sustainability (Bansal and DesJardine, 2014; Fung et al., 2007).

In both legal scholarship and public administration research, a distinction is made between active transparency (proactively publishing information of public relevance) and passive transparency (responding to information requests in compliance with legal FOI obligations). This distinction can be described through a push-pull model of transparency (Scrollini, 2015): While active information provision means that public organizations proactively push information and data out there for the citizens and other stakeholders to use, passive information provision is based on the idea that citizens have to pull information from the organizations.

In recent years, there has been a shift toward more active transparency, so toward the push model, mostly due to the possibilities offered by information and communication technologies (ICTs). Open data platforms have been established and organizations’ webpages are increasingly used for publishing reports and all kinds of information (Janssen et al., 2009). However, proactive transparency, i.e. the push model, has limited power for re-balancing the information asymmetry problem and increasing public accountability (Mabillard and Zumofen, 2017). If the organization itself decides what it wants to disclose (or not disclose), and uses ICTs to improve this active form of transparency, lots of potentially sensitive information can still be withheld. Therefore, a fundamental and comprehensive FOI law equips citizens with the tools to not only access proactively published information but also to effectively pull information from public organizations. To promote this form of passive information provision, most FOI laws allow informal requesting via mail or email. Moreover, some public organizations have implemented digital portals for submitting and processing information requests (Bizzo and Michener, 2017; Michener, 2015).

The accounting literature has extensively explored ESG disclosure practices in the private sector (e.g. Aggarwal and Singh, 2019; Dragomir et al., 2025). In contrast, research that specifically addresses ESG disclosure and sustainability reporting practices in SOEs is still developing (e.g. Greiling and Bauer, 2023; Andrades Peña et al., 2024; Nicolò and Andrades Peña, 2024). As hybrid organizations positioned between public service obligations and commercial objectives, SOEs encounter distinctive accountability demands that make their reporting practices particularly complex (Grossi and Thomasson, 2015). These challenges arise from the need to balance and reconcile multiple, and at times conflicting, institutional logics. Institutional logics refer to the different belief systems, norms, and expectations that guide organizational behavior, such as market-oriented efficiency on the one hand and public sector values such as transparency and accountability on the other (Thornton and Ocasio, 1999).

While financial reporting remains a mandatory and well-established component of corporate disclosure, the present study does not primarily focus on financial statements. Instead, the focus lies on non-financial disclosure practices, as these are more likely to capture governance-related transparency efforts and broader accountability mechanisms beyond purely economic performance (Nicolò et al., 2022).

Early attempts to formalize sustainability reporting in SOEs include initiatives such as the Global Reporting Initiative (GRI) Sector Supplement for Public Agencies and Sweden’s national guidelines for sustainability reporting in SOEs, both of which represent initial efforts to structure disclosure practices in the public sector context (Larrinaga-Gonzélez and Pérez-Chamorro, 2008). However, the 2004 GRI Public Sector Supplement has not been updated since its release. Integrated reporting, while less commonly adopted by SOEs, has been suggested as a potentially more suitable approach because it encourages a holistic view of organizational performance and supports integrated thinking across financial and non-financial domains (e.g. Farneti et al., 2019; Manes-Rossi et al., 2021; Argento et al., 2019a). Nevertheless, both voluntary reporting frameworks were primarily developed with private sector organizations in mind and tend to place limited emphasis on governance-related issues.

More recent regulatory developments, particularly the 2022 CSRD (Directive 2022/2464/EU), have accelerated a shift from traditional triple-bottom-line sustainability reporting toward ESG-based disclosure frameworks in SOEs (Nicolò and Andrades Peña, 2024). Consistent with this, existing studies indicate that ESG implementation in SOEs is often still at an early stage, frequently characterized by a strong emphasis on environmental aspects and an insufficient integration of governance and social dimensions (e.g. Andrades Peña et al., 2024; Nicolò and Andrades Peña, 2024; Argento et al., 2019b).

In contrast to other consolidated democracies (e.g. Ackerman and Sandoval-Ballesteros, 2006; Banisar, 2006; McClean, 2010), in Austria a comprehensive federal FOI regime has only recently been introduced, entering into force in September 2025. Prior to this reform, access to administrative information was partly regulated through constitutional and statutory provisions. Since a constitutional amendment in 1987, Article 20 of the Federal Constitutional Law (Bundes-Verfassungsgesetz, B-VG) ^[1] contained both the principle of official secrecy (Amtsverschwiegenheit) and a limited duty of public authorities to provide information. While public bodies were generally obliged to maintain confidentiality regarding facts obtained in the course of their official duties, citizens could request certain information under federal and provincial “duty to provide information” laws (Auskunftspflichtgesetze). These provisions were widely criticized for prioritizing secrecy over transparency and granting authorities broad discretion to refuse requests.

This changed with the adoption of the Informationsfreiheitsgesetz (IFG), which abolished the constitutional principle of official secrecy and introduced a constitutionally guaranteed right of access to information held by public authorities. The new framework rests on the two pillars typical for FOI: first, a proactive obligation to publish information of general interest-such as studies, reports, statistics, or contracts ^[2]-and second, a general right for individuals to request access to information from public organizations, subject to defined exemptions such as the protection of national security, privacy, or legitimate economic interests.

An important feature of the reform concerns the inclusion of SOEs. The scope of the Austrian FOI law extends beyond traditional public sector organizations to entities organized under private law, particularly companies that are majority-owned by the state or that are subject to oversight by the national Court of Audit (Rechnungshof) or provincial audit offices. These SOEs are therefore generally required to grant access to information they hold upon request and also face proactive publication obligations where information is considered to be of general public interest. At the same time, disclosure may be restricted if publication would reveal trade or business secrets or otherwise harm legitimate commercial interests. These exceptions are necessary to maintain competitive neutrality. However, a legally mandated balancing of interests is required as a countermeasure. This means the SOE bears the burden of proof for demonstrating concrete, serious economic harm, which is directly weighed against the public's interest in information. This should ensure that secrecy becomes an exception requiring justification, rather than an obstacle.

A comparison with selected other European jurisdictions shows that Austria’s approach to including SOEs within the scope of the federal FOI is not universal, but also not unique. To compare FOI regimes, we use the global right-to-information rating, which ranks countries’ FOI laws worldwide according to the strength of their legal frameworks. One of the indicators captures the scope of the law and whether SOEs are covered by FOI. ^[3] For instance, in Sweden, which represents one of the most far-reaching transparency regimes in Europe and the oldest worldwide (with the implementation of the Freedom of the Press Act in 1766) ^[4], a broad range of public organizations is subject to disclosure obligations under the constitutional principle of public access to official documents (in McClean, 2010). However, regarding SOEs, the scope of the law only applies to documents of the corporation, partnership, economic associations and foundations where municipalities or county councils exercise judicial control. ^[5].

Germany adopts a different approach. The federal FOI Act was adopted in 2006 and applies primarily to federal administrative authorities, only exceptionally to private-law entities if they perform public administrative functions. ^[6] Consequently, many German SOEs fall outside the scope of federal FOI legislation unless specific sectoral or Länder (state) provisions apply. While covered entities must respond to requests, the protection of business and trade secrets constitutes a legitimate exemption (Mueller et al., 2019).

Likewise, in France, the right of access to administrative documents extends to public authorities and certain private-law entities entrusted with a public service mission ^[7]. Consequently, similar to Germany, some SOEs are subject to FOI obligations when acting in the exercise of public service functions. Access may nevertheless be refused to protect industrial and commercial secrets, and the regime relies less heavily on public-interest balancing than the Austrian FOI law. Overall, it becomes obvious that some European FOI laws cover SOEs based on the performance of public-service functions, whereas others, such as Austria, cover them more directly through public ownership and control. However, the protection of business and trade secrets is prioritized in most of these provisions to ensure competitiveness.

This study is based on a qualitative longitudinal design using a documentary and keyword frequency analysis to examine the extent to which SOEs in Austria have prepared for the implementation of the FOI law (“Informationsfreiheitsgesetz, IFG”). The analysis focuses on the presence and use of FOI-related terminology in publicly available reporting documents from 2020–2024 and websites in 2026. The sample consists of 101 organizations listed in the Austrian Federal Participation Report 2024 (“Beteiligungsbericht 2024”). According to this report, the Austrian federal government holds direct and majority ownership stakes in these entities. The sample includes companies and public-law institutions, including universities, that are under federal supervision, as well as other legal entities of public law whose legal form is defined by federal legislation. In addition to fully owned entities, the sample also comprises majority-owned affiliated companies in which the federal government holds more than 50% of the equity capital. Social insurance institutions are not included (Bundesministerium für Finanzen, 2023).

First, the official websites of all 101 SOEs were systematically reviewed (similar to Andrades et al., 2019). As historical website versions were not available across all organizations, the website analysis represents a cross-sectional snapshot of disclosure practices at the time of data collection (in 2026), whereas the report analysis covers the period from 2020 to 2024.

Second, all available financial and non-financial reports, in particular sustainability reports, covering the period from 2020 to 2024 were analyzed. This timeframe allows for a longitudinal investigation of how Austrian SOEs have gradually addressed transparency, disclosure, and information access in anticipation of the FOI Act. The analysis was limited to the reporting period from 2020 to 2024 because, at the time of data collection, a considerable number of Austrian SOEs had not yet published their 2025 annual and sustainability reports. Restricting the analysis to 2020–2024 therefore ensured a complete and comparable dataset across all organizations.

The non-financial reports are particularly relevant for the purpose of this study: They have become an increasingly important disclosure instrument for Austrian SOEs in the context of EU sustainability reporting requirements and are expected to contain information on governance, transparency, stakeholder engagement, compliance structures, and broader ESG-related activities.

Keyword frequency analysis. A keyword frequency analysis was conducted to identify whether SOEs address issues related to information access, transparency, disclosure obligations, and data governance in the context of the upcoming FOI legislation. The set of keywords was derived deductively from the exact terminology used in the Austrian FOI law (BGBl. I Nr. 5/2024) ^[8] (in German, as the primary language of the analyzed documents, the English translation is in brackets). The following ten FOI-specific keywords were used in the search process “Informationsfreiheitsgesetz (Freedom of Information law),” “Informationsfreiheit (Freedom of Information),” “Informationsanfrage (information request),” “Informationsbegehren (information request),” “Informationsregister (information register),” “Informationsgebühren (fees for access to information),” “Informationszugangsregelung (information access regulation),” “Informationsbehörde (information authority),” “Recht auf Information (right to information),” and “IFG (FOI).” In addition, four more generic transparency terms were included, such as “Transparenzgesetz (transparency law),” “Transparenzregister (transparency register),” “Transparenz (transparency),” and “Transparenzrichtlinie (transparency policy).” To capture discussions on disclosure obligations we include “Informationspflicht (obligation to provide information),” and “Offenlegungspflicht (obligation to disclose),”. For capturing secrecy, the analysis also incorporated the three terms “Geheimhaltung (secrecy),” “Amtsgeheimnis/Amtsverschwiegenheit (secrecy),” and “Bankgeheimnis (secrecy [specifically for banks and credit institutions]).” Furthermore, two keywords related to data protection (“Datenschutz (data protection)”, “Datenschutzbehörde (data protection authority)”) and two keywords related to open data (“Open Data (open data)”, “Offene Daten (open data)”) were considered.

Each SOE’s most recent version of the website (in 2026) and the available reports (from 2020 to 2024) were systematically screened for the occurrence of these keywords. The presence of a keyword was recorded as a binary variable using a structured coding scheme. If at least one keyword was identified in a given document or source, it was coded as “1,” whereas the absence of any keyword was coded as “0.” In addition to the binary coding, the specific keyword(s) identified in each case were reported to allow for more detailed qualitative interpretation of the results.

Documentary analysis. The documentary analysis focused exclusively on two of the FOI-specific keywords: “Informationsfreiheitsgesetz” (Freedom of Information law) and “IFG”. These keywords were selected because they represent the most direct and legally specific references to the law within the FOI-specific keyword category. Broader transparency-related terms were excluded from this stage of the analysis to avoid ambiguous interpretations. Based on the contextual analysis of these FOI-specific keyword occurrences, each of the text passages was coded according to the type of FOI-related communication present in the text. The coding scheme combines deductive and inductive category development. Two categories were derived deductively from the theoretical distinction between active and passive transparency in the FOI literature. These categories capture whether organizations refer to proactive publication obligations (active transparency) or procedures for handling information requests (passive transparency). During the coding process, two additional categories emerged inductively from the empirical material. While analyzing the keyword contexts, we observed that some SOEs merely provided general explanations of the FOI law, whereas others discussed FOI primarily in relation to data protection regulations based on the EU’s General Data Protection Regulation (GDPR). These patterns were therefore added as separate categories.

The coding scheme (Table 1) distinguishes thus four categories: general information about FOI, active transparency, passive transparency, and data protection references. The categorization advances the analysis beyond simple keyword occurrence by capturing how SOEs communicate FOI. It is particularly relevant for assessing the extent to which Austrian SOEs merely acknowledge FOI, actively prepare for active and passive disclosure obligations, or integrate FOI into broader governance and compliance practices.

To enhance the reliability of the coding process, all authors independently conducted the keyword search and coding procedure. The results were then compared and harmonized. Any discrepancies in coding decisions were discussed and resolved jointly to ensure a consistent interpretation of the keyword occurrences across all SOEs and document types. This procedure helped to reduce individual coder bias and increase the robustness and transparency of the analytical process (Guthrie and Abeysekera, 2006).

From the initial theoretical sample of 101 websites (2026), 505 financial and 505 non-financial reports (over the 5-year period from 2020 to 2024) ^[9], respectively, we found keyword occurrences on 97 websites, 108 financial reports, and 66 non-financial reports. Table 2 provides an overview of the frequency distribution of the documents and sources that include at least one keyword from a keyword category across the sample period. So, each document belongs to one SOE, but clearly it can occur several times if keywords from more than one category occurred in the document. It should be noted that the values in 2026 are driven by the one-time website audit conducted in that year, therefore, it should not be interpreted as evidence that no FOI-related website disclosures existed prior to 2026. The concentration of website keywords in 2026 is a methodological effect, representing the current snapshot of the SOEs’ web presence at the time of data collection.

Regarding the reports, interestingly, financial reports show a higher absolute number of keywords than the non-financial reports (sustainability reports). However, this could be an artifact of the larger volume of financial reports available in the sample, as many SOEs still do not publish separate sustainability documents. Yet, this is an important finding in itself.

The longitudinal analysis itself shows a gradual increase in use of rather generic terms that focus on data protection and generic transparency, while FOI-specific keywords remain virtually absent. Only 2 SOEs use specific FOI terms in their financial reports from 2024. Notably, FOI-specific keywords do not appear in non-financial reporting at all. However, regarding the website numbers, FOI seems to have become increasingly relevant with a total of 24 SOEs mentioning specific FOI-terms on their websites in 2026. This shows that while data protection and the idea of transparency might have been already at the agenda of SOEs for a longer time, the anticipation of FOI might have only recently started. An overview of the 26 SOEs ^[10] that used FOI-specific terms and their organizational characteristics is provided in  Appendix 1.

Beyond examining the keyword sources, we are interested in the specific context in which FOI is embedded in disclosure practices. We distinguish between four categories, in line with the different types of transparency (see Table 1): For one, SOEs rather generically or superficially describe how they will be affected by FOI and what FOI is (= General information about FOI). Second, in some cases they explicitly list what information they have to proactively publish (=Active transparency). Third, in other cases they even have an own email established or explain what an FOI request should look like and how they can be contacted (=Passive transparency). Last, we found that often SOEs embed FOI-related information in data protection information (=Inclusion in data protection issues). However, it is important to note that these categories are intertwined. In most of the cases we found general information provision followed by, e.g. concrete active information provision or data protection considerations.

General information about FOI. For one, SOEs explain generically what FOI is, and how their institution is affected by FOI. For example, the Austrian National Bank states in its annual report in 2024 (translated from German):

The Austrian labor market service (AMS) provides the following rather superficial information on their website:

However, these statements can also be quite short, such as the one of the Austrian Agency for Health and Food Safety (AGES) writes on their website:

Active transparency. In these statements, SOEs explicitly list what information they will proactively publish and also where this can be found. These almost always go hand in hand with the first cluster, meaning that prior to the explanation, the SOEs state why they are publishing this information. Examples are the Austrian Development Agency stating the following on their website:

Another example for this cluster comes from the Medical University of Vienna, on their website it says:

In other cases, these sections are again very brief, such as the information from the IEF-Service GmbH (Insolvency Compensation Fund Service GmbH) on their website:

Passive transparency. Similar to the prior cluster, there are SOEs that explain how requesting information from them works and sometimes they even provide a dedicated email address for requesting. The University of Applied Arts Vienna, for example, writes the following on their website:

However, interestingly, if SOEs provide concrete information on how to submit FOI requests, they do so often without explaining their legal compliance with FOI. For example, the Bundesrechenzentrum (BRZ) simply states “Freedom of Information Act (FOIA): For inquiries, please use only the provided web form.” In contrast, the Rail Infrastructure Service Company Ltd. (SCHIG GmbH) even implemented their own FOI-dedicated e-mail address:

Inclusion in data protection. A large part of the FOI related content is simultaneously mentioned with or embedded in the explanation of broader data protection obligations. Here, examples come from the (Austrian) Financial Market Authority (FMA):

The Federal Accounting Agency even provides concrete suggestions on how to secure personal data protection:

We started this article by framing the introduction of Austria’s FOI law as an important form of coercive institutional pressure for SOEs (DiMaggio and Powell, 1983). The law establishes legally binding transparency obligations that require all covered organizations, including SOEs, to adapt their disclosure practices. However, our findings demonstrate that coercive pressure does not automatically produce homogeneous organizational responses.

Although Austrian SOEs all operate under the same regulatory FOI framework, individual organizational preparedness varies, with only a minority explicitly referring to the law and implementing FOI measures. However, this minority of SOEs appears to be relatively well prepared: In many cases, they do not merely refer to the law in abstract terms, but provide concrete information on how they intend to deal with FOI obligations. In some cases, they specify which documents or categories of information will be proactively published and where these can be accessed. In others, they offer practical guidance for submitting information requests, for example by providing dedicated contact points or email addresses. This finding extends the discussion on coercive isomorphism. Rather than immediately leading to organizational convergence, coercive pressure appears to trigger heterogeneous responses, ranging from non-recognition to full operational implementation and compliance. Such variation is consistent with institutional theory, which recognizes that organizations respond differently to external pressures depending on their capabilities, strategic choices, and organizational context (Oliver, 1991; Deephouse et al., 2017).

Moreover, the observed operational measures correspond well with previous FOI research showing that transparency legislation often leads organizations to formalize administrative routines, document management systems, and disclosure procedures (e.g. in Bizzo and Michener, 2017; Michener, 2015; Richter and Wilson, 2013). Consequently, FOI appears to function not only as an external legal obligation but also as an organizational governance mechanism that gradually reshapes internal routines and management practices (Piotrowski, 2007).

Although FOI represents institutional pressure that could have encouraged organizations to prepare well before legal implementation, our findings provide only limited support for a strong anticipatory governance interpretation. FOI-specific keywords do not gradually increase in financial or non-financial reports over time, nor do they indicate widespread early organizational adaptation. Even though rather generic transparency terms increased in all forms of reporting, most explicit FOI references appear only on corporate websites after the law entered into force.

This finding contrasts with anticipatory governance literature (Guston, 2014; Hendricks et al., 2023), which suggests that organizations frequently prepare governance structures during lengthy regulatory processes. Since the Austrian FOI reform was politically debated over several years, one could have expected stronger evidence of preparatory disclosure activities. Instead, Austrian SOEs appear to respond primarily once implementation became imminent or legally effective.

This pattern may also reflect Austria’s comparatively recent FOI regime. In countries with longer-established FOI legislation, such as Sweden, the United Kingdom, or Spain, transparency obligations have had considerably more time to become embedded within organizational routines, digital transparency infrastructures, and disclosure practices (Andrades et al., 2019; Hazell et al., 2010; Worthy, 2021). The Austrian case therefore appears to capture an early stage of institutionalization rather than a mature transparency regime.

Nevertheless, this interpretation should be treated cautiously. Because the website analysis represents a cross-sectional snapshot from 2026, earlier website adaptations cannot be reconstructed. Some organizations may therefore have initiated internal preparations without documenting them in publicly available reports or maintaining earlier website versions. This limitation also reflects a broader challenge in transparency research, where observable disclosure practices do not necessarily capture internal organizational change.

Our study set out to explore whether FOI can be observed as a component of sustainable corporate governance. We examined how Austrian SOEs reflected and anticipated FOI obligations in their non-financial reporting and ESG disclosure practices. Our findings show that explicit references to FOI remain rare and are absent from non-financial reporting, and also not mentioned in the context of ESG matters. If FOI were already understood as part of sustainable corporate governance, one would expect at least some discussion of information access, transparency rights, or organizational preparedness within sustainability reports, ESG sections, or governance chapters. Instead, FOI-related communication is almost exclusively located on corporate websites.

This is theoretically relevant because the study conceptualized FOI as part of sustainable corporate governance, particularly within the governance (“G”) dimension of ESG. The findings show that this link, while being plausible at the conceptual level, so far has only weakly materialized at the organizational level. Austrian SOEs do not, at least not yet, seem to frame FOI as an ESG-related indicator or as a visible component of sustainability governance. Instead, FOI remains largely separate from the logic of sustainability reporting. This supports the view that legally mandated transparency and voluntary or semi-regulated ESG disclosure still follow different institutional logics by the time this study has been conducted. It therefore supports the notion that ESG reporting in SOEs is still often underdeveloped with regard to governance-related dimensions (e.g. Andrades Peña et al., 2024; Nicolò and Andrades Peña, 2024; Argento et al., 2019b).

Despite not being integrated in explicit sustainability reporting, FOI has the potential to reduce information asymmetries and foster accountability. The mere communication of FOI on corporate websites can contribute to stakeholders’ ability to identify and understand SOEs’ transparency efforts, and thus contributes to sustainable corporate governance. Yet, only some Austrian SOEs acknowledge FOI as a legally binding transparency mechanism (at least on corporate websites), and only a small minority even implements digital infrastructure for improved compliance. Therefore, while FOI can be seen as an accountability-promoting governance tool that reduces information asymmetries (Mabillard and Zumofen, 2017) and contributes to corporate sustainability, its current implementation in Austrian SOEs remains fragmented and is therefore only partially able to realize this objective.

Another key finding is the strong connection between FOI and data protection. In many Austrian SOEs, FOI-related information is embedded within data protection statements or explicitly linked to GDPR-related requirements. This suggests that SOEs currently approach FOI primarily through an already existing legal compliance framework rather than as part of a broader governance or sustainability logic. This interpretation is reinforced by the widespread presence of data protection disclosures. Nearly all SOEs in the sample provide such information on their websites, reflecting the high degree of institutionalization of data protection as a legal obligation. By comparison, FOI appears to be at a much earlier stage of organizational embedding. Austrian SOEs may prioritize well-established regulatory domains and integrate new requirements into existing compliance structures, rather than developing entirely new governance frameworks (DiMaggio and Powell, 1983). From an institutional perspective, this pattern is not surprising. Organizations tend to respond more quickly and visibly to clearly defined and enforceable legal pressures. Data protection has had more time to become routinized, whereas FOI is still new in the Austrian context. As a result, FOI is currently treated as an additional compliance requirement that must be integrated into existing structures, particularly where tensions between transparency and confidentiality arise.

Overall, our findings reveal an important disconnect between the study’s conceptual argument and current organizational practice. While we argue that FOI should be understood as a governance mechanism that contributes to the “G” dimension of ESG by institutionalizing transparency and accountability, Austrian SOEs currently do not appear to perceive or communicate FOI in this way. Instead, FOI is predominantly treated as a reactive legal compliance requirement that is addressed in response to coercive institutional pressure following the introduction of the Austrian FOI Act. The almost complete absence of FOI from sustainability and ESG reporting, however, should not be interpreted as evidence against its conceptual relevance for sustainable corporate governance. Rather, it demonstrates that the institutionalization of FOI as a component of sustainability governance has not yet taken place in organizational practice. In this sense, one of the central implications of this study is not that FOI is unrelated to sustainable corporate governance, but that Austrian SOEs currently do not yet recognize or communicate it as part of their sustainability efforts.

The study has implications for the literature in three important ways. First, it contributes to institutional theory by demonstrating that coercive transparency regulation does not necessarily produce immediate organizational convergence. Instead, Austrian SOEs display heterogeneous responses to the same legal pressure, suggesting that coercive isomorphism unfolds gradually rather than instantaneously.

Second, the findings refine anticipatory governance theory. While anticipatory governance assumes that organizations prepare for emerging regulation before implementation (Guston, 2014), the Austrian case demonstrates that such preparation cannot be taken for granted. Instead, organizational adaptation may occur only shortly before—or even after—legal implementation.

Third, the study contributes to sustainable corporate governance research by conceptually positioning FOI as a governance mechanism within ESG. From this perspective, FOI contributes to the governance dimension (“G”) of ESG by institutionalizing transparency as a core element of sustainable corporate governance through its accountability-generating function. Accordingly, the study interprets transparency not merely as a formal legal pressure, but as an important component for organizational development and management practices. At the same time, the empirical findings reveal that this conceptual understanding has not yet become common organizational practice. Rather than strategically integrating FOI into sustainability governance, Austrian SOEs currently approach FOI primarily as a reactive legal compliance obligation.

Building on our empirical findings and institutional theory, we propose the FOI Institutionalization Framework (Figure 1) as both a conceptual model and a practical maturity framework for SOEs.

The framework distinguishes four stages of organizational preparedness, ranging from non-recognition, legal awareness, and operationalization to strategic integration within sustainable corporate governance. It therefore provides managers, policymakers, and oversight institutions with a practical tool for assessing where organizations currently stand and which organizational capabilities still need to be developed. Our findings suggest that most Austrian SOEs currently remain between the stages of non-recognition and legal awareness, whereas only a smaller number have reached the operationalization stage through dedicated publication obligations, request procedures, or transparency webpages. None of the analyzed SOEs demonstrates full strategic integration of FOI into ESG reporting or sustainability governance.

For policymakers, this implies that legal obligations alone may not be sufficient to foster comprehensive organizational transparency. Benchmarking initiatives, transparency rankings, or guidance documents could strengthen implementation by creating additional reputational incentives, thereby complementing coercive with mimetic pressures (DiMaggio and Powell, 1983).

For the management of SOEs, the framework should draw attention to the relevance of anticipatory governance. This concept enables public sector organizations and SOEs to transition from reactive crisis management to proactive, strategic foresight. Rather traditional, reactive decision-making models may no longer be able to keep pace with the institutional changes and transformations organizations have to face. Anticipatory approaches allow organizations to gradually adapt their organizational practices and management rather than being overwhelmed by sudden legislative compliance demands. In 2026, this proactive approach is exceptionally crucial for SOEs navigating FOI compliance in Austria. Given that the law is still in its infancy, it remains under continuous evaluation and refinement. This context is supposed to create a steep learning curve for both policymakers and the SOEs’ management. Because the legal parameters will likely adapt over time, Austrian SOEs, as well as those in other established FOI jurisdictions, must continuously monitor prospective regulatory changes. Institutionalizing transparency, as outlined in our FOI Institutionalization Framework, could serve as a tool for managing these changes and adapting to future FOI requirements.

Finally, the website-centered nature of FOI communication demonstrates the growing importance of digital transparency infrastructures (e.g. Janssen et al., 2009; Bizzo and Michener, 2017). At the same time, the absence of dedicated transparency portals contrasts with experiences from countries such as Spain (Andrades et al., 2019), suggesting that Austrian SOEs still rely on comparatively decentralized disclosure approaches. Strengthening digital transparency infrastructures could therefore facilitate both proactive and reactive disclosure while supporting the broader institutionalization of FOI within sustainable corporate governance. Beyond the Austrian context, these findings may also be relevant for countries with more mature FOI regimes, such as the Scandinavian countries. While FOI has long been institutionalized in, e.g. Sweden, the Austrian case illustrates the organizational challenges associated with introducing new transparency obligations and embedding them into governance structures. Thus, legal requirements alone do not automatically lead to strategic organizational integration. Instead, transparency must gradually become embedded in organizational routines, reporting practices, and governance systems. Thus, even mature FOI regimes may benefit from continuously aligning legal transparency obligations with broader sustainability and ESG governance rather than treating them solely as compliance requirements.

This study faces a few limitations. First, the analysis relies on publicly available documents and information from websites, and thus draws on a single method and data source. As a result, methodological triangulation is not achieved, which could limit the robustness and depth of the findings. Future research could address this limitation by incorporating additional data sources, such as qualitative interviews, to gain deeper insights into how SOEs interpret and implement the FOI Act in practice.

Second, the report analysis is limited to the period from 2020 to 2024. At the time of data collection, many Austrian SOEs had not yet published their 2025 annual and sustainability reports. Consequently, the study does not capture the first reporting cycle following the introduction of the Austrian FOI Act. Future research should therefore revisit this topic once a complete set of post-implementation reports becomes available to examine whether FOI becomes more explicitly integrated into sustainability reporting and broader governance disclosures.

Third, the study captures only the externally communicated aspects of transparency practices. The analysis is based on a systematic but surface-level examination of publicly accessible information and does not allow for conclusions about internal organizational processes, decision-making routines, or the actual handling of FOI requests in practice. Consequently, the findings should be interpreted as reflecting disclosure practices rather than fully capturing how SOEs operationalize transparency and FOI in their day-to-day activities. Especially because full FOI compliance cannot yet be evaluated in the Austrian context due to the novelty of the law.

Fourth, the empirical analysis focuses on a sample of 101 Austrian SOEs. While this sample comprehensively covers enterprises in Austria that are wholly or majority-owned by the federal government, the results are clearly context-specific and may not be generalizable to other countries with different regulatory environments. Even though we briefly introduced and explained other European regulations such as Sweden, Germany and France, future research could expand upon this study by examining larger and more diverse samples of SOEs through cross-country comparisons.

Finally, future research could distinguish more clearly between different types of SOEs and sectoral contexts. SOEs operate in a wide range of sectors, such as infrastructure, finance, health care, and education, which can influence both their exposure to transparency requirements and their approaches to disclosure. A more detailed analysis could examine whether sector-specific characteristics influence the extent to which FOI is expected, implemented, and integrated into governance practices.