A large share of the rules governing the global economy is not written by states. Private bodies decide how financial instruments are valued on a balance sheet, which protocols carry data across the internet, and what counts as sustainably harvested timber. These rules come from technical committees convened by the International Organization for Standardization, the International Accounting Standards Board, the Internet Engineering Task Force and a wide range of certification schemes. Formally, they are voluntary. In practice, they often are not.

Public law and market structure keep up the appearance of voluntariness. WTO law treats conformity with international standards as a safe harbour. EU legislation grants a presumption of conformity to products built to harmonised standards. Global retailers make certification a condition of supplier access. Through these channels, a privately drafted text acquires the practical force of regulation. Yet it lacks the procedures that regulation normally requires: legislative deliberation, guaranteed publication, meaningful judicial review and electoral accountability for those who wrote it.

This is the governance gap. Rule-making authority has migrated to private bodies, but accountability has not followed. Private standard-setting should not be dismantled, because it supplies technical expertise, speed and transnational reach that intergovernmental processes rarely match. The real challenge is institutional design: keeping that capacity while restoring the channels through which affected parties can contest the rules that bind them. This requires mapping how private authority expanded, diagnosing where its legitimacy falls short, and specifying how the public-private interface should be structured.

The scale alone is striking. ISO has published more than 25,000 international standards through national member bodies from roughly 170 countries, though the substantive drafting happens in technical committees staffed largely by industry experts. Around it sits a dense ecosystem of sectoral bodies: the IASB for financial reporting, the IETF and W3C for internet architecture, GS1 for supply-chain identification, and sustainability schemes such as the Forest Stewardship Council and the Marine Stewardship Council.

The volume of standards matters less than their integration into public law. The first channel is trade law. Article 2.4 of the WTO Agreement on Technical Barriers to Trade requires members to base technical regulations on relevant international standards where these exist. Under Article 2.5, a regulation that pursues a legitimate objective and follows such standards is rebuttably presumed not to obstruct trade unnecessarily. Private outputs thereby become the benchmark against which the legality of public regulation is measured.

The second channel is delegation and incorporation by reference. Since its New Approach of 1985, the European Union has legislated essential requirements while assigning technical detail to European standardisation organisations, whose harmonised standards confer a presumption of conformity. IFRS standards have been mandatory for EU-listed companies since 2005 and are required across well over a hundred jurisdictions. Domestic regulatory codes elsewhere incorporate thousands of privately authored standards by reference.

The third channel is market enforcement. Sustainability and labour certifications are enforced through procurement contracts rather than through law. For a smallholder exporting fresh produce to European supermarkets, a scheme such as GLOBALG.A.P. functions as a precondition of market access. Formal voluntariness offers little comfort to a producer whose only buyers require the certificate.

From an institutionalist perspective in the Keohane tradition, this architecture is partly a rational response to transaction costs. Private standards solve coordination problems efficiently and spread faster than treaties. What results, however, is not a simple transfer of power from public to private hands. It is a layered, hybrid authority: rules are written privately and enforced publicly or commercially. Neither classical public-law accountability nor ordinary market discipline fully captures this arrangement. That mismatch is the source of the governance gap.

Takeaway

The decisive question is not whether a standard is formally voluntary but which public or market mechanism makes compliance unavoidable. That mechanism is where authority actually resides, and where accountability should attach.

Private standard-setting grounds its legitimacy in expertise and consensus. Consensus, however, is only as representative as the forum in which it is reached. Participation in technical committees is costly, requiring specialised staff, sustained travel, years of engagement and often membership fees. Participation therefore skews heavily toward large firms and national bodies from high-income economies. Consumer, labour and environmental interests remain thinly represented, and many developing-country members observe rather than shape outcomes.

Tim Büthe and Walter Mattli's work on private regulators explains why this asymmetry compounds over time. Actors whose domestic standardisation systems are coherent and well coordinated can project their preferences into international committees early and effectively. Standards consequently tend to encode the technologies and practices that incumbents already use. Switching costs then lock those choices in. Each new entrant must then adapt to an existing standard rather than help shape it.

Transparency is the second deficit. Many standards are copyrighted and sold, so rules with legal effect sit behind paywalls. European courts have begun to confront this tension. In James Elliott Construction (2016), the Court of Justice held that harmonised standards form part of EU law. In Public.Resource.Org (2024), it held that an overriding public interest requires access to such standards. The underlying principle is basic to the rule of law: no one should be bound by norms they cannot read without paying for them.

The third deficit concerns accountability for outcomes. Certification relies on auditors who are usually paid by the firms they inspect, which creates a structural conflict of interest. In 2012, a fire at the Ali Enterprises garment factory in Karachi killed more than 250 workers, only weeks after the facility had received SA8000 social accountability certification. Victims seeking redress from certifiers face a fragmented and often inaccessible landscape of private law liability.

These deficits have distributional consequences. Compliance costs fall disproportionately on producers in lower-income economies, while the benefits accrue mainly to lead firms in the form of risk reduction and brand protection. Standards can therefore operate as de facto market access barriers, excluding smallholders and accelerating supply-chain consolidation. The legitimacy deficit is therefore a mechanism for reallocating rents, not just a procedural shortcoming.

Takeaway

A procedure can be fair to everyone present and still systematically blind to everyone who could not afford a seat. Inclusive consensus requires attention to the cost of entry, not just the rules of debate.

Governments relying on private standards risk two failure modes. The first is abdication: public authorities rubber-stamp privately negotiated outcomes and lend them coercive force without scrutiny. The second is displacement: states rebuild standard-setting capacity in-house, losing technical expertise and fragmenting markets along jurisdictional lines. The design objective lies between these poles. Kenneth Abbott and Duncan Snidal describe it as orchestration, in which public authority enlists, steers and disciplines private intermediaries through mandates, conditions and support.

The first instrument is conditional recognition. Public reliance on a standard should depend on procedural benchmarks rather than on the reputation of the body that produced it. The WTO TBT Committee's 2000 Decision sets out six principles for international standardisation: transparency, openness, impartiality and consensus, effectiveness and relevance, coherence, and the development dimension. The ISEAL Codes of Good Practice perform a similar function for sustainability schemes. Recognition under such benchmarks should be periodically reviewed and revocable, not granted once and assumed thereafter.

The second instrument is retained endorsement and a credible backstop. The EU does not adopt IFRS automatically. Its endorsement mechanism allowed it to carve out contested provisions of IAS 39 in 2004. EU standardisation law similarly permits the Commission to adopt common specifications where harmonised standards are inadequate or delayed. A credible public fallback disciplines private bodies more effectively than continuous intervention, because it changes the bargaining dynamics inside the committee room.

The third instrument is investment in participation and access. Under Regulation 1025/2012, the EU funds organisations representing consumers, environmental interests, workers and small enterprises so that they can participate in standardisation. Similar support for developing-country delegations, together with free access to legally binding standards, addresses the input and transparency deficits directly rather than merely acknowledging them.

The fourth instrument is accountability for verification. Mandatory due diligence regimes, such as France's 2017 duty of vigilance law, decline to treat certification as a safe harbour, keeping responsibility with the lead firm. Supervising accreditation bodies, the entities that certify the certifiers, extends oversight one level up. Coordinating that supervision across regulators reflects Anne-Marie Slaughter's insight: transnational private authority is best matched not by a single global regulator but by networks of national authorities sharing information and aligning their conditions.

Takeaway

Delegation becomes abdication only when the delegating authority surrenders three things: the power to set conditions, the capacity to refuse, and the ability to build a fallback. Retain those three, and private expertise becomes a public asset rather than a public liability.

Private standard-setting has become load-bearing infrastructure for global economic governance, yet its institutional design still reflects its origins in technical coordination among firms. Trade law, legislative delegation and supply-chain contracts have converted voluntary outputs into binding constraints without importing the accountability that binding rules require.

The appropriate response is neither nostalgic re-nationalisation nor passive deference. It is deliberate orchestration. Recognition should be conditioned on procedural quality, endorsement and fallback powers should be retained, participation should be funded for those currently priced out, and binding standards should be freely accessible. Verification should also be supervised, so that a certificate cannot substitute for responsibility.

The broader lesson concerns how global governance is mapped. Authority increasingly resides in hybrid arrangements that formal accounts of the international system overlook. Institutional reform must therefore follow authority wherever it operates, not only where constitutions and treaties locate it. Closing the governance gap begins with recognising that private rule-making is public power in practice.