Regulatory Risk

There was a time when a new rule was treated as something you started obeying on the day it took effect. Regulation belonged to legal, and a new requirement meant editing a few documents. The rules that actually bite, though, ask you to change structure rather than paperwork. Which country your data sits in, or whether you store payment details yourself, are not conditions you fix inside a month.

So the same scene kept repeating. A company learns about a rule taking effect in six months two weeks before the deadline, asks for estimates, and finds out that moving servers alone takes three months. At that point only two decisions are available: postpone everything on the roadmap, or keep selling while out of compliance.

Regulatory risk is the name given to that problem so it can be lined up in advance. It doesn't describe a violation you are committing now; it labels the items that could block you later and puts them on the risk list. What the name changed is when the watching starts — from the day an amendment passes to the day it's first discussed.

You catch the signs while a rule is still being debated, identify which part of your product it touches, rank it by likelihood and size, then work backwards from the effective date to fix a start date.

1. Watch at the discussion stage. Getting from a proposed amendment to an effective date usually takes more than a year, and a grace period often follows. That span is what gives you time to prepare — but a company that first hears about it in the news has only half of it left.
2. Write down which part of your product it touches. The point is to translate the text of the rule into your own items. Once one amendment reads as "date of birth among the fields collected at signup," "the overseas region where files are stored," and "three lines of copy on the consent screen," the next judgment becomes possible.
3. Score likelihood and size. Giving each one to five points and multiplying them is common. An item almost certain to pass that forces a structural change scores 4 times 5, or 20; one that is only being discussed and needs a copy change scores 2 times 1, or 2.
4. Work backwards from the effective date to set a start date. Subtract the preparation time from the deadline and you get the month work has to begin. Two quarters of preparation against a July deadline next year means starting this year. Without that arithmetic the item stays on the list forever while never starting in any particular month.
5. Write the trigger as a number or an event. For items that carry a contingency plan — an alternative plan for a specific thing going wrong — record the moment it switches on, such as "the day the amendment clears the floor vote." With no trigger, switching on requires a meeting, and the meeting costs weeks.

The basic home is one row on the risk list. On the table collecting everything that could shake the company, regulatory risk sits beside the other types and gets ordered by score. The table gets reread each quarter, and people are assigned only to items whose score went up. An item at 20 gets an owner and a date; an item at 4 stays where it is and gets reread next quarter, because most of what a score decides is what not to work on yet.

It also shows up when judging whether to enter a new market or industry. In densely regulated areas such as healthcare or finance, this single item can settle whether entry is possible. Once entry is decided, which licenses or filings you need belongs to business regulation, the body of rules and reporting duties you have to satisfy to operate at all.

Product design pulls it forward. Where data lives and which fields you collect are decisions that are hard to reverse after they're built. Running through what Korea's Personal Information Protection Act (PIPA) requires while the design is still open leaves far less to fix when rules later change.

Companies selling to enterprises meet it in contract review. The customer's legal team asks how you satisfy each requirement, and if the answers aren't written down the contract slips by weeks. When a slow response loses a deal and that becomes known, it can spill into reputational risk.

"I'm putting this on the list as a regulatory risk. It takes effect next year, but preparation runs two quarters."

It isn't work for today, yet the start date has to be decided today.

"We're not in violation now. We will be in violation if the amendment passes."

Asking people to separate the current state from the future risk.

"Regulatory risk scores 20, the highest on the table. Let's assign an owner next quarter."

The judgment that this item has moved to the front of the queue.

At a quarterly risk review, Pagedeck added a row for a pending amendment tightening the conditions on moving personal data out of the country. Pagedeck's document files were stored in an overseas cloud region, and if the amendment passed the product would have to offer a domestic storage option.

Grace asked Theo how long that would take and the answer was two quarters. Two quarters back from the expected effective date landed in the fourth quarter of that year, so the item stayed on the list, recorded as fourth-quarter work. The amendment did pass the following year, by which point the work was more than half done.

The most common assumption is that you can respond once the law changes. There's a grace period, so doing it inside that window sounds reasonable. But a grace period and a preparation period are not the same thing. Renegotiating contracts and changing where data is stored take months, and those months have to fit inside the grace period. A company that isn't ready on the effective date can't sell a new contract from that day forward.

Reading it as a description of currently breaking the law is almost as common, because the word risk sounds like an accusation. What the item actually covers is something legal today that could be blocked or become expensive later. Blend the two together and the moment legal reports "no current violations," the row gets deleted from the table — and preparation doesn't start until the deadline is in sight. Keeping two columns on the row, one for what the rule says today and one for what it would say after the change, is enough to stop a clean legal answer from emptying it.