Why do companies always hear about new regulations too late?

Companies typically hear about new regulations too late because there is no dedicated, continuous monitoring function in place. Regulatory updates get filtered through legal counsel, industry newsletters, or peer conversations — all of which are reactive by nature. By the time a regulation reaches the desk of someone with decision-making authority, the implementation deadline is often uncomfortably close. This article unpacks why that pattern persists, what it costs, and how organisations can break the cycle. If you want to talk through your own situation first, feel free to get in touch with us, and we will be happy to help.

How do companies typically find out about new regulations?

Most companies discover new regulations through informal, fragmented channels rather than a structured monitoring process. The most common sources are industry associations, legal advisories, news alerts, and conversations with peers or auditors. These channels are passive and inconsistent, meaning the same regulation can reach different organisations weeks or even months apart.

In practice, the journey from regulatory publication to internal awareness usually looks something like this:

A regulation is published in an official journal or government gazette
Legal or compliance specialists pick it up and begin interpreting it
Industry bodies summarise it in a newsletter or webinar
A manager or executive reads a summary and flags it internally
The organisation begins assessing what it means for its operations

Each step in this chain introduces delay. A regulation that was published twelve months ago may only enter an organisation’s awareness six months later, leaving very little runway to act. For frameworks like NIS2, DORA, or the EU AI Act, that kind of delay is not just inconvenient — it is a compliance risk with real legal and financial consequences.

The deeper problem is that this process is not really a process at all. It is a collection of coincidences. Whether a regulation reaches the right person depends on who happens to be subscribed to the right mailing list or who attended the right conference. That is not governance. That is luck.

Why does regulatory awareness consistently arrive too late?

Regulatory awareness arrives too late primarily because most organisations treat compliance as a project rather than a continuous function. When no one owns the ongoing task of monitoring the regulatory landscape, updates fall through the gaps between departments and between annual review cycles.

Several structural factors compound the problem:

Siloed responsibilities: Legal, IT, HR, and operations each track regulations relevant to their domain, but no one holds a cross-domain view. A regulation touching both data privacy and AI governance may be tracked by neither team.
Reactive compliance culture: Many organisations mobilise only when an audit is approaching or an incident has occurred. Between those moments, regulatory monitoring is deprioritised.
Complexity of the regulatory calendar: The EU regulatory pipeline is dense. NIS2, DORA, the EU AI Act, ISO 42001, and updates to GDPR enforcement guidance all move on different timelines. Tracking them manually across multiple jurisdictions is genuinely difficult.
Governance drift: Even organisations that start with good intentions see their compliance posture erode over time as staff change, priorities shift, and documentation goes stale. This drift makes it harder to absorb new requirements when they do arrive.

The result is a recurring pattern: a regulation is announced, the deadline approaches, and the organisation scrambles. The scramble is expensive. And it repeats with the next regulation because the underlying structural gap was never addressed.

What are the real costs of discovering a regulation too late?

The real costs of late regulatory discovery extend well beyond fines and penalties. They include operational disruption, reputational damage, rushed implementation that creates new risks, and the erosion of trust with customers, partners, and investors. The visible cost is the regulatory sanction. The invisible cost is often larger.

Direct financial and legal exposure

Regulators across the EU have become more active in enforcement. Under GDPR, fines can reach four percent of global annual turnover. NIS2 introduces personal liability for senior management. DORA sets strict incident reporting timelines with consequences for failure. Discovering these requirements late means less time to implement controls correctly, which increases the probability of a violation.

Operational and strategic disruption

When compliance becomes urgent, it displaces other work. Teams are pulled from product development, customer projects, or operational improvements to address the compliance gap. Vendors and technology platforms may need to be replaced quickly, without proper due diligence. Contracts may need to be renegotiated under time pressure. These disruptions have a real cost that rarely appears in compliance budgets but shows up in missed targets and strained resources.

There is also a strategic dimension. Organisations that are consistently behind on regulation tend to be excluded from enterprise procurement processes, public sector contracts, and partnerships with larger companies that require their supply chain to meet certain compliance standards. Being late to a regulation is not just a legal problem. It is a commercial one.

Which internal roles are responsible for tracking new regulations?

In most organisations, responsibility for tracking new regulations is unclear, divided, or assumed to belong to someone else. In theory, the Chief Compliance Officer, General Counsel, or Data Protection Officer carries this responsibility. In practice, these roles are often under-resourced, focused on existing obligations, and not structurally connected to all the domains a new regulation might affect.

The challenge is that modern regulations do not respect organisational boundaries. NIS2 touches IT security, vendor management, incident response, and board-level accountability simultaneously. The EU AI Act affects product teams, procurement, HR, and legal. A single role tracking a single domain will consistently miss the cross-functional implications of new requirements.

What effective regulatory tracking actually requires is a governance function that sits across domains rather than within one. That means someone — or a team — with a mandate to monitor the full regulatory landscape, interpret what it means for the specific organisation, and translate that into action across security, privacy, quality, and AI governance. In many mid-market companies and scale-ups, that function simply does not exist as a dedicated capability. It is distributed across roles that each have other primary responsibilities, which means it gets done partially, inconsistently, or not at all.

How can organisations stop missing regulatory changes?

Organisations can stop missing regulatory changes by building continuous governance into their operating model rather than relying on periodic reviews or informal monitoring. This means establishing a permanent function — not a project team — that actively tracks the regulatory environment, assesses impact, and maintains readiness across all relevant domains.

The practical steps to achieve this include:

Assign clear ownership: Designate a role or function with an explicit mandate to monitor regulatory developments across all domains relevant to the organisation, including security, privacy, AI, and quality.
Integrate domains: Break down the silos between legal, IT, and operations so that cross-domain regulations are caught and assessed as a whole, not in fragments.
Align to regulatory cycles: Build governance activities around the actual timelines of certification and compliance frameworks, not just annual internal reviews.
Treat governance as a living system: Documentation, controls, and role accountability should be maintained continuously, not updated in a rush before an audit.
Combine expertise with tooling: Human expertise is needed to interpret regulatory intent and assess organisational impact. Tooling provides the structure and consistency to maintain oversight at scale. Neither alone is sufficient.

For many organisations, building this capability in-house is not realistic. The expertise required spans multiple domains, the regulatory landscape changes constantly, and the investment in dedicated staff is difficult to justify for companies that are not yet at enterprise scale. This is the gap that a continuous governance service is designed to fill — providing the permanent, expert-operated function that keeps organisations ahead of regulatory change rather than scrambling to catch up.

The goal is not to predict every regulatory development. It is to build the structural readiness to absorb new requirements without disruption. That readiness comes from continuous governance: a model where compliance is not a periodic project but an always-active organisational capability. Companies that make that shift stop being surprised by new regulations because they are already positioned to respond. Contact us to find out how we can help your organisation build that capability.

Frequently Asked Questions

How do we know which regulations are actually relevant to our organisation?

Relevance depends on a combination of factors: your industry sector, the jurisdictions you operate in, the nature of the data you process, and the technologies you use. A good starting point is to map your organisation against the key EU regulatory frameworks — GDPR, NIS2, DORA, and the EU AI Act — and identify which thresholds or criteria apply to you. However, relevance is not always obvious from a regulation's title or headline scope, which is why cross-domain interpretation is essential. Many organisations discover they are in scope for a regulation only after a specialist reviews their full operational profile.

What is the difference between a compliance project and a continuous governance function?

A compliance project has a defined start, end, and objective — for example, achieving ISO 27001 certification by a specific date. Once the project closes, active work stops until the next audit cycle or incident prompts a review. A continuous governance function, by contrast, never switches off. It maintains documentation, monitors the regulatory landscape, tracks control effectiveness, and ensures that new requirements are absorbed into the organisation's posture as they emerge. The practical difference is that a project leaves gaps between cycles, while a continuous function eliminates them.

How much lead time do organisations typically need to implement a new regulatory requirement?

Implementation timelines vary significantly depending on the regulation's scope and the organisation's existing maturity. Technical controls, policy updates, and staff training for a framework like NIS2 can realistically take six to twelve months for a mid-market organisation starting from a low baseline. If procurement, vendor contracts, or board-level accountability structures need to change, the timeline can extend further. This is precisely why late discovery is so damaging — by the time many organisations become aware of a regulation, the available runway may already be insufficient for a proper, low-risk implementation.

Can we rely on our legal counsel or external law firm to keep us informed about new regulations?

Legal counsel is a valuable input but is not a substitute for a dedicated regulatory monitoring function. Law firms typically advise on regulations that are already finalised or approaching enforcement, and their guidance is usually framed around legal interpretation rather than operational implementation. They are also unlikely to proactively flag cross-domain implications — for example, how a new AI regulation intersects with your existing data privacy controls or procurement processes. Treating legal counsel as the primary early-warning system creates the same reactive pattern that causes organisations to discover regulations too late.

What should we do first if we suspect we are already behind on a regulation?

Start with a rapid gap assessment against the specific regulation in question — identify what the requirements are, which ones apply to your organisation, and what controls or documentation you currently have in place. From that gap map, you can prioritise actions by risk level: address the highest-exposure gaps first, particularly those tied to incident reporting obligations, management accountability, or technical security controls. Avoid the temptation to address everything simultaneously, as this often leads to shallow, box-ticking compliance. If internal expertise is limited, bringing in external support for the initial assessment can significantly accelerate the process.

How do smaller companies or scale-ups manage regulatory compliance without a large internal team?

Smaller organisations face a genuine resourcing challenge: the regulatory landscape demands multi-domain expertise that is difficult and expensive to hire for in-house. The most practical approach is to combine a lightweight internal owner — someone with a mandate to coordinate compliance activities — with external expertise that provides the depth and continuity the internal team cannot. Fractional or managed governance services are increasingly used by mid-market companies and scale-ups to access the equivalent of a full compliance function without the overhead of building one from scratch. The key is ensuring that the external function is integrated into the organisation's operations, not just consulted on an ad hoc basis.

How do we make the business case internally for investing in proactive regulatory monitoring?

The most effective business case frames proactive monitoring as risk reduction and commercial enablement rather than a cost centre. Quantify the downside: potential fines under GDPR or NIS2, the cost of a scrambled implementation, and the commercial opportunities lost when the organisation cannot meet the compliance requirements of enterprise customers or public sector procurement. Then compare that against the cost of a continuous governance function. In most cases, a single avoided enforcement action or a single enterprise contract won — both of which are realistic outcomes of strong compliance posture — more than justifies the investment. Presenting concrete regulatory deadlines and their associated penalties to senior leadership is often the most direct way to shift the conversation.

Navigation