When a competitor gets fined for a violation your organisation might also have, you tell your clients the truth: the risk is real, it is measurable, and now is the right time to find out where you stand. A regulatory fine against a peer is not just bad news for that company. It is public confirmation that the enforcement environment is active, that regulators are looking at your sector, and that the gap between “probably fine” and “formally penalised” can close faster than most organisations expect. The sections below walk through every angle of this conversation, from what the fine actually signals to how continuous governance changes the dynamic entirely. If you want to talk through your specific situation first, feel free to get in touch with us and we will help you from there.
What does a competitor’s fine actually signal about your own risk?
A competitor’s fine signals that your own risk profile deserves immediate scrutiny. Regulators rarely penalise one organisation in isolation. When an enforcement action lands in your sector, it typically reflects a pattern of non-compliance that the supervisory authority has been investigating across multiple players. If the violation relates to a framework you are also subject to, such as NIS2, GDPR, or the EU AI Act, the same gap may exist in your own organisation.
The most important thing to understand is that a fine is a lagging indicator. By the time a penalty is published, the underlying investigation has usually been running for months. The organisation penalised was not caught because it was uniquely careless. It was caught because it was audited, and the audit found what was already there. If your governance processes are structured the same way, the exposure is structural, not incidental.
There is also a secondary signal worth noting. Enforcement actions in the EU regulatory environment tend to cluster. One published fine often prompts supervisory authorities to widen their review to comparable organisations. The fine against your competitor may have just moved your organisation closer to the top of an informal watchlist.
How do clients typically react when they hear about a competitor’s fine?
Clients typically react in one of three ways: concern, denial, or deflection. Understanding which reaction you are dealing with shapes everything about how the conversation should go. Most clients who hear about a competitor’s fine will initially feel a spike of concern, followed quickly by a rationalisation that their situation is different. That rationalisation is usually the most dangerous part of the conversation.
The concern response
Clients in this group want to act but are not sure what action looks like. They ask whether they need to do an audit, whether they should call their legal team, and whether the fine could happen to them. This is the most productive starting point. The concern is genuine, the urgency is already there, and the conversation can move quickly toward a structured review of actual exposure.
The denial and deflection response
Clients in this group minimise the relevance of the fine by pointing to differences in company size, sector segment, or the specific nature of the violation. They may say their legal team reviewed the relevant policies last year, or that they have a certification in place. These responses are not dishonest. They reflect a common misunderstanding of how governance works: that a document, a certificate, or a one-time review provides durable protection. The job here is to gently challenge that assumption without being alarmist.
What should you say to a client when a competitor gets penalised?
When a competitor gets penalised, you should say three things clearly: what the fine was for, why it is relevant to this client specifically, and what a proportionate next step looks like. Avoid vague reassurances and avoid catastrophising. The goal is to move from headline to context to action in a single, grounded conversation.
Start by naming the violation accurately. Clients respond better to specifics than to general warnings. If the fine relates to a failure in data processing records under GDPR, say that. If it relates to inadequate incident response procedures under NIS2, say that. Then ask a direct question: do we know whether our equivalent process meets the same standard that was found lacking?
From there, the conversation should shift to evidence. What does the client actually have in place, and how recently was it tested? Not reviewed. Tested. There is a meaningful difference between having a policy and having a policy that has been exercised under realistic conditions. That distinction is often where the real exposure lies.
Keep the tone steady. The point is not to create anxiety but to create clarity. A well-framed conversation about a competitor’s fine can be one of the most useful governance conversations a client has all year, provided it leads somewhere concrete.
What evidence can you actually show clients to back up your claims?
The evidence you can show clients falls into two categories: external evidence from the regulatory environment and internal evidence from their own governance posture. Both matter, and neither is sufficient on its own. External evidence establishes that the risk is real and sector-relevant. Internal evidence establishes where the client’s specific exposure sits.
On the external side, published enforcement decisions are publicly available through the relevant supervisory authorities. In the EU, GDPR fines are documented by the European Data Protection Board and national data protection authorities. NIS2 enforcement is handled at member state level. These are not speculative risks. They are documented outcomes with named organisations, described violations, and stated penalties. Sharing the actual decision document, or a clear summary of it, anchors the conversation in fact rather than opinion.
On the internal side, the evidence you can show depends on what governance documentation and monitoring the client already has. A gap analysis against the relevant framework, a record of the last time key controls were tested, or a log of open findings from previous audits are all forms of internal evidence. If those records are thin, incomplete, or out of date, that itself is meaningful information. The absence of evidence is evidence of a gap.
What you cannot do is manufacture reassurance. If the client’s governance posture has not been reviewed against the current version of the applicable framework, you cannot credibly claim they are compliant. Saying so anyway is the kind of statement that becomes very uncomfortable when the next enforcement action lands.
When is the right time to turn a competitor’s fine into a governance review?
The right time to turn a competitor’s fine into a governance review is as soon as the fine becomes public and you can confirm it relates to a framework your client is also subject to. Waiting for the client to raise it, or for a scheduled review cycle to come around, means the window of natural urgency has already started to close.
Timing matters for a practical reason. A fine in your sector creates a brief but genuine window in which clients are more open to honest conversations about their own governance posture. That openness is not a weakness to exploit. It is an opportunity to do something genuinely useful: replace vague concern with a structured understanding of actual exposure.
The review itself does not need to be extensive to be valuable. A focused gap analysis against the specific framework implicated in the fine, combined with a review of the controls most likely to be scrutinised by a regulator, can be completed in a matter of days. What matters is that it is systematic, documented, and leads to clear findings rather than general reassurance.
If the review reveals gaps, that is useful information. If it confirms that controls are in place and operating effectively, that is also useful information. Either outcome is better than operating on assumptions.
How does continuous governance change this conversation entirely?
Continuous governance changes this conversation because it means you are never starting from zero when a competitor gets fined. Instead of scrambling to assess exposure after the fact, you already have a current, documented picture of where the organisation stands against every relevant framework. The competitor’s fine becomes a prompt to review a specific control area, not an alarm that triggers a broader investigation into whether governance is in place at all.
This is the core difference between governance as a periodic exercise and governance as a permanent organisational capability. When governance is treated as a project, it produces a snapshot. That snapshot reflects the organisation’s posture at the moment of the review, and it begins to drift the moment the review is complete. By the time the next review comes around, the gap between documented posture and actual posture may be significant.
When governance operates continuously, the posture is maintained in real time. Policy changes are tracked. Control effectiveness is monitored. Findings are followed up. The organisation does not need a competitor’s fine to know where it stands, because it already knows. The conversation with the client shifts from “we need to find out if we have a problem” to “here is what our current monitoring shows, and here is what we are doing about it.”
This is the model we have built at Moatt. Our governance services operate on a continuous subscription basis, integrating security, privacy, quality, and AI governance into a single, always-active system. When enforcement news breaks, our clients are not caught wondering. They are already informed. That is what structural governance readiness looks like in practice, and it is the most honest answer you can give a client who asks whether what happened to their competitor could happen to them.
If you want to move from reactive to continuous governance, the best starting point is a direct conversation about where your organisation stands today. Contact us and we will help you build a clear picture of your current posture and what it would take to keep it current going forward.
Frequently Asked Questions
How quickly should we act after a competitor's fine is published?
You should act within days, not weeks. The window of natural urgency that a published fine creates is brief, and the regulatory signal it sends — that supervisory authorities are actively reviewing your sector — does not wait for your next scheduled governance cycle. A focused gap analysis against the implicated framework can typically be scoped and initiated within a week, giving you a documented, defensible picture of your exposure before the news cycle moves on.
What if we already have a compliance certification — does that protect us?
A certification confirms that your controls met a defined standard at the point of assessment, but it does not guarantee ongoing compliance. Regulators assess actual operational posture at the time of an investigation, not historical certification status. If your processes, systems, or organisational structure have changed since the certification was issued — and they almost certainly have — the certification may no longer reflect your real exposure. Treat it as a baseline, not a shield.
Which frameworks should we prioritise reviewing after a competitor's fine?
Start with the framework directly implicated in the fine. If the penalty relates to GDPR data processing obligations, review your records of processing activities, lawful basis documentation, and data subject rights procedures. If it relates to NIS2 incident response requirements, examine your detection, reporting, and recovery controls. Once the primary framework is assessed, it is worth checking for overlap with adjacent frameworks — many organisations subject to NIS2 are also subject to GDPR, and a gap in one area often signals a gap in the other.
What are the most common mistakes organisations make when responding to enforcement news?
The most common mistake is treating the response as a communications exercise rather than a governance exercise — reassuring stakeholders without actually verifying the underlying controls. A close second is delegating the response entirely to legal counsel, who can assess liability but are not always positioned to evaluate operational control effectiveness. The most productive response combines a legal read on exposure with a practical review of whether the controls that failed in the competitor's case are operating effectively in your own organisation.
How do we know if our incident response procedures would actually hold up under regulatory scrutiny?
The clearest test is whether your procedures have been exercised under realistic conditions, not just documented and filed. Regulators increasingly expect organisations to demonstrate that incident response plans have been tested through tabletop exercises or simulated scenarios, that roles and responsibilities are understood by the people who hold them, and that reporting timelines are achievable in practice. If your last test was more than twelve months ago, or if the plan has not been updated to reflect changes in your technical environment, it is worth treating that as an open finding.
Can a small or mid-sized organisation realistically maintain continuous governance without a large internal team?
Yes, and this is precisely where a continuous governance service model is most valuable. Large organisations can absorb the overhead of dedicated compliance functions, but smaller organisations typically cannot — which means governance tends to be handled reactively, in bursts, around audit cycles or enforcement events. A subscription-based governance model, like the one Moatt operates, provides always-active monitoring, policy maintenance, and control oversight without requiring the client to build and sustain that capability internally. The cost of continuous governance is almost always lower than the cost of a single enforcement action.
What should we document now so that we are better positioned if a regulator does come to us?
Prioritise documentation that demonstrates active, ongoing governance rather than a one-time review. This includes a current record of processing activities (for GDPR), documented control testing results with dates and outcomes, a log of identified findings and their remediation status, and evidence that relevant staff have received up-to-date training. Regulators look for signs that compliance is embedded in how the organisation operates day-to-day, not assembled in response to an inquiry. The strongest position is one where the documentation already exists and is current before any investigation begins.