Now What

Leaders of any tech company, not just Big Tech, must recognize that the landscape has transformed—and will continue to evolve rapidly. Although traditional approaches like lobbying, voluntary standards, and cooperation with regulators offer some benefits, they fall short.

Companies must build efficient and effective compliance processes, addressing regulation at scale while keeping costs under control and maintaining the ability to innovate at pace:

• Manage regulator relationships. This is as vital as managing relationships with customers. Regulators expect quick, consistent, and accurate responses to their requests.
• Lobby effectively. Strategies include educating regulators, aligning on the interpretation of laws and directives, and setting voluntary commitments.
• Identify and assess relevant regulations. New laws must be systematically analyzed for relevance and impact to adequately prioritize responses. Consistent interpretation across jurisdictions is critical.
• Develop internal standards. Translating regulations into clear, actionable internal standards is vital for product and engineering teams to respond to the requirements efficiently. It is critical to de-duplicate, aggregate, and simplify the requirements.
• Create and update controls. Turning standards into reality requires implementing effective controls across the organization. The best way to do this is by designing new products—and even the firm’s tech architecture—with compliance in mind. Certain controls need uniform standards (such as authentication and data controls). Others are more bespoke and require training for product and engineering teams.
• Monitor and test controls. Regular testing ensures that controls function as intended, using techniques like white-hat testing. Where possible, testing should be automated or replaced by live data feeds from automated controls.
• Be clear about what risk is acceptable. This prevents fresh debates about risk levels from holding up product development.

These strategies ensure that new products are compliant at release and stay compliant over time. Companies that have not invested in a holistic compliance function need to catch up and make sure that they are taking all key laws and regulations into account.

The Idea in Action

Tech firms are learning—as many other regulated companies already have—that they must build multiple compliance teams: a centralized enterprise team to lead the strategy and business-aligned teams to integrate compliance into daily operations. The skills in their current legal teams will not be sufficient.

Tech firms also need to build the appropriate systems. These include tools to track controls, testing, and incidents to ensure that employees can effectively manage compliance risk.

Culture needs to change as well. Compliance capabilities have to be integrated into a tech company’s thinking, which is not easy. Change begins with a proactive approach to risk management and strong leadership support for compliance. Tech firms must prevent bureaucratic compliance processes from stifling innovation.

Compliance works best if the whole company buys into it, understanding that the organization needs a social license to operate. This requires a culture where risk is no longer someone else’s problem; staff should proactively spot and address potential problems.

If You Do Nothing Else

Build a modern compliance program that supports rather than hinders change. This journey often takes two to four years to complete, but companies that successfully navigate it will avoid legal pitfalls and gain a significant competitive advantage. Those that fail to do so risk distraction from regulatory inquiries, forced product changes, lawsuits, and fines. Acting now lets you focus on what all tech firms need—innovation.

The authors thank Bernhard Gehra and Matthew Barton for their invaluable contributions.