Most companies that prepare for regulations before they come into force do so because waiting until enforcement begins is already too late. By the time a regulation is active, the organisations that started early have embedded the required controls into their operations, while latecomers scramble to retrofit compliance onto systems and processes that were never designed with it in mind. If you want to understand how this works in practice, or if you are figuring out where to start, feel free to get in touch with us, and we are happy to point you in the right direction.

Why do companies start preparing before a regulation is enforced?

Companies start preparing before a regulation is enforced because the internal changes required to meet regulatory requirements take far longer to implement than most organisations expect. Drafting policies, assigning accountability, updating contracts, training staff, and adjusting technical infrastructure cannot be completed in weeks. Organisations that begin early can absorb that work gradually, without disruption to operations.

There is also a strategic dimension. Regulators in the EU have consistently signalled that they will scrutinise the preparedness of organisations from the moment a regulation enters into force, not just from the moment of a reported incident. An organisation that can demonstrate a structured, documented preparation process is in a fundamentally stronger position than one that assembled a last-minute checklist.

Beyond risk management, early preparation often reveals operational improvements that have nothing to do with compliance. When organisations map their data flows for GDPR readiness, for example, they frequently discover redundant systems, unclear ownership, and inefficiencies that were costing them money long before any regulator asked a question. Regulatory preparation, done well, tends to make organisations more coherent and better governed overall.

How do organisations track regulations that are not yet in force?

Organisations track upcoming regulations by monitoring official EU legislative sources, subscribing to regulatory intelligence services, and maintaining relationships with legal and governance advisors who specialise in their sector. The EU’s official journal, the European Parliament’s legislative observatory, and sector-specific supervisory authorities all publish timelines and implementation guidance well in advance of enforcement dates.

In practice, most mid-market organisations do not have the internal capacity to monitor every regulatory development across all relevant domains simultaneously. This is where governance structures become important. A functioning governance framework assigns responsibility for regulatory horizon scanning to specific roles, ensuring that signals from regulators are captured, assessed for relevance, and translated into internal action plans before deadlines become urgent.

Organisations that rely on periodic external audits or one-off consultancy engagements often miss the window between a regulation being published and it entering into force. That window, which can range from one to three years depending on the regulation, is precisely the period when preparation is most effective and least disruptive. Continuous governance, rather than point-in-time reviews, is what makes systematic regulatory tracking possible.

What steps do companies take to prepare for a new regulation?

Companies preparing for a new regulation typically follow a structured sequence: assess the gap between current practices and what the regulation requires, assign accountability for each requirement to specific roles, implement the necessary controls and documentation, and then test and validate that those controls work as intended. This sequence is repeated and refined as the regulation’s implementation guidance becomes clearer.

Gap assessment and scoping

The first step is understanding which parts of the organisation the regulation affects and what it specifically requires. This means reading the regulation carefully, not just summaries of it, and mapping its requirements against existing policies, technical systems, and organisational structures. Many regulations include sector-specific provisions or thresholds that determine whether and how they apply, so scoping accurately at this stage prevents wasted effort later.

Accountability and implementation

Once the gap is understood, accountability must be assigned clearly. Regulations rarely fail because organisations lacked information. They fail because no specific person or team owns the implementation of specific requirements. Assigning named accountability, setting internal milestones, and building the preparation into regular management reporting transforms regulatory readiness from an abstract project into an operational reality. After accountability is established, the actual work of implementing controls, updating contracts, training staff, and adjusting processes can proceed in a structured, trackable way.

What is the difference between compliance and governance readiness?

Compliance means meeting the documented requirements of a specific regulation at a specific point in time. Governance readiness means having the organisational structures, roles, processes, and culture in place to meet regulatory requirements continuously, adapt to new ones, and respond to incidents without losing control. Compliance is a state; governance readiness is a capability.

The distinction matters because compliance achieved through a one-off project degrades over time. Staff change, systems evolve, business models shift, and the controls that passed an audit in one year may no longer reflect operational reality in the next. Organisations that treat compliance as a destination rather than an ongoing discipline routinely find themselves out of step with requirements they technically met before.

Governance readiness, by contrast, is what prevents this drift. When governance is embedded as a permanent organisational function rather than a periodic exercise, the organisation is continuously aware of its obligations, continuously monitoring its controls, and continuously in a position to demonstrate that awareness to regulators. This is the distinction between organisations that are prepared and organisations that were prepared.

Which upcoming EU regulations should organisations prepare for now?

In 2026, the EU regulations that most mid-market and scale-up organisations should be actively preparing for include NIS2, the EU AI Act, DORA (for financial entities and their critical ICT suppliers), and the ongoing requirements of GDPR and ISO frameworks where certification is relevant. Each of these carries enforcement mechanisms and supervisory expectations that require structural preparation, not just documentation.

NIS2 significantly expands the scope of cybersecurity obligations beyond critical infrastructure to include a wide range of sectors and their supply chains. Organisations that were not previously subject to network and information security requirements may now be in scope and need to build incident response, risk management, and reporting capabilities from the ground up.

The EU AI Act introduces risk-based obligations for organisations that develop, deploy, or use AI systems, with the most stringent requirements applying to high-risk applications. Even organisations that do not build AI systems may be affected as deployers of third-party tools that fall within the Act’s scope.

DORA applies to financial entities and their ICT service providers, requiring structured digital operational resilience frameworks, including testing, incident classification, and third-party risk management. For organisations in or serving the financial sector, preparation should already be underway.

How can smaller organisations build regulatory readiness without a large compliance team?

Smaller organisations can build regulatory readiness by focusing on role-based accountability rather than headcount, using structured frameworks that integrate multiple regulatory requirements into a single operational system, and accessing expert support through subscription-based governance services rather than building all expertise in-house. The goal is not to replicate a large compliance department but to make governance a permanent, manageable part of how the organisation operates.

The most common mistake smaller organisations make is treating each regulation as a separate project requiring separate resources. In practice, the requirements of NIS2, GDPR, ISO 27001, and the EU AI Act overlap significantly in areas like risk management, incident response, data handling, and supplier oversight. An organisation that builds a unified governance system addressing these shared foundations satisfies multiple regulatory requirements simultaneously, rather than duplicating effort across separate workstreams.

This is precisely the model we have built at Moatt. Our governance services combine certified human expertise with structured tooling, integrating security, privacy, quality, and AI governance into one continuous system. For scale-ups and mid-market organisations that cannot justify a full internal compliance function, this hybrid approach provides the ongoing regulatory readiness that periodic consultancy cannot deliver and standalone software tools were never designed to provide.

Regulatory readiness is not a size-dependent capability. It is a structural one. Organisations of any size can achieve it when governance is treated as a permanent function rather than an occasional project. If you are ready to take that step, contact us, and we will help you build a governance foundation that keeps pace with the regulatory landscape, not just the one that exists today.

Frequently Asked Questions

How do we know which EU regulations actually apply to our organisation?

Start by identifying your sector, the nature of your products or services, your company size, and whether you handle personal data, AI systems, or provide ICT services to regulated industries. Most EU regulations define their scope explicitly, including thresholds based on headcount, revenue, or sector classification, so a careful reading of the regulation itself (not just summaries) is essential. If your supply chain includes large enterprises or public sector clients, you may also be in scope indirectly, as many regulations extend obligations upstream to suppliers and service providers.

What is the realistic minimum timeline to prepare for a major EU regulation like NIS2 or the EU AI Act?

For most mid-market organisations starting from a low governance baseline, a realistic preparation timeline is 9 to 18 months for a regulation like NIS2 or the EU AI Act. This accounts for the time needed to complete a gap assessment, assign accountability, implement technical and organisational controls, train staff, and validate that everything works as intended. Organisations that already have mature governance frameworks in place, such as ISO 27001 certification or strong GDPR compliance, can often compress this timeline significantly because the foundational structures are already in place.

What happens if we miss the enforcement deadline — is it better to have partial compliance than none at all?

Yes, demonstrating structured, documented progress toward compliance is meaningfully better than having no preparation at all. Regulators across the EU have consistently shown that they take intent, effort, and evidence of a genuine compliance programme into account when determining enforcement responses. An organisation that can show a gap assessment, an accountability structure, and an implementation roadmap — even if not fully complete — is in a far stronger position than one that cannot demonstrate any preparation. That said, partial compliance should never be treated as a comfortable endpoint; it is a milestone in an ongoing process, not a substitute for full readiness.

How do we avoid compliance drift after we have achieved initial regulatory readiness?

Compliance drift is prevented by treating regulatory readiness as an ongoing operational function rather than a completed project. Practically, this means assigning permanent ownership of compliance monitoring to specific roles, scheduling regular internal reviews of controls and documentation, and building regulatory horizon scanning into your governance calendar. Every time staff change, systems are updated, or business processes evolve, a lightweight review should confirm that existing controls still reflect operational reality. Organisations that embed these habits into their regular management cadence rarely experience the kind of drift that catches others off guard during audits or incidents.

Can a single governance framework genuinely cover multiple regulations, or does each one require its own separate workstream?

A unified governance framework can genuinely satisfy the core requirements of multiple regulations simultaneously, because the foundational elements — risk management, incident response, data handling, access controls, supplier oversight, and documentation — are shared across NIS2, GDPR, ISO 27001, DORA, and the EU AI Act. The regulation-specific requirements, such as particular reporting timelines or risk classification criteria, are then layered on top of that shared foundation rather than built from scratch. This integrated approach is significantly more efficient than running parallel workstreams and produces a more coherent governance system overall.

What are the most common mistakes organisations make when preparing for a new regulation?

The most common mistakes are: starting too late and underestimating the implementation timeline, relying on documentation alone without embedding controls into actual operations, assigning compliance responsibility to a single overloaded individual without broader organisational accountability, and treating the regulation as a one-time project rather than an ongoing discipline. A particularly costly mistake is scoping too narrowly — assuming a regulation does not apply because of a surface-level reading, only to discover mid-preparation that supply chain relationships, data processing activities, or service categories bring the organisation firmly within scope.

How should we prioritise if we are behind on multiple regulations at the same time?

Prioritise based on two factors: enforcement proximity and organisational exposure. Regulations that are already in force or entering enforcement imminently take precedence, and within those, focus first on requirements where non-compliance carries the greatest legal, financial, or reputational risk for your specific organisation. From there, identify the overlapping foundations — risk management, incident response, supplier controls — that satisfy requirements across multiple frameworks simultaneously, and build those first. This approach delivers the broadest compliance coverage in the shortest time, rather than achieving full compliance with one regulation while remaining entirely unprepared for others.

Related Articles

Share

  • October 6, 2026