Between Jan. 1, 2026, and Jan. 1, 2027, 47 core ethics and compliance obligations took effect, changed, or landed on the calendar. They came from U.S. federal agencies, seven states, the UK, and the EU. At least eight of them tie a declination, a defense, a penalty discount, or a safe harbor to whether a company’s compliance program can document that it works. Fifteen require evidence for a regulator, a court, or a customs officer, often within a fixed window.

That evidence can’t be assembled after the clock starts. The U.S. Department of Justice (DOJ) rewards a company that can investigate and self-report within 120 days of an internal whistleblower report. U.S. Customs and Border Protection (CBP) gives an importer 30 to 180 days to document the supply chain behind a detained shipment. A program that can’t produce its records on demand gives up the credit regulators now offer for a program that works. AI raises the bar again. When the models inside a tool keep changing, so does the record of how the tool was used, and the people using it need training to keep that use defensible.

Another 36 privacy and data obligations landed in the same window. That work usually belongs to IT or a dedicated privacy function, with E&C as a related party, so the report counts it separately as a sidebar. The count also runs against the enactment headlines. States passed fewer AI laws in the first half of 2026 than a year before. Even so, five of the six AI obligation dates that landed in 2026 came from laws and rules already final in 2025.

At a Glance

Sources: Ethisphere’s 2026 Regulatory Impact Index; Ethisphere planning model (Exhibit 30); 2026 World’s Most Ethical Companies benchmark, 138 Honorees.

Six Findings

What It Means for 2027

1. Fund the five capabilities. Name an owner and a build date for each one, and map every obligation it serves.

2. Plan to the lead time. Jan. 1 work can be staffed in the fall. December 2027 evidence takes most of a year to build, so it belongs in the budget cycle under way now.

3. Rerun scoping before counting on relief. Confirm in writing which delayed or narrowed obligations the company still owes, and release the rest.

4. Assume more is coming and hold a reserve for what isn’t written yet. Size it against what arrived unannounced in 2026, and keep it out of the scheduled work. Set up standing alerts for new rules and guidance (work AI is well suited to), and build a close working relationship with government affairs.

5. Put records management in someone’s remit. Set retention to the longest period any applicable regime requires.

Even mature programs often leave this case out of their board updates. Only 66% of Honorees included the resources needed to achieve program objectives in their board updates over the past year. Chapter 6 turns the findings into a case a Chief Ethics and Compliance Officer (CECO) can adapt.

About the Data

The Regulatory Impact Index is Ethisphere’s count of the obligations a Fortune 1000 ethics and compliance program has to act on. It is current as of Nov. 5, 2026, and every obligation traces to a primary source. It is read against the 2026 World’s Most Ethical Companies® benchmark of 138 Honorees. AI enactment counts come from the NYU Center on Technology Policy. SAI360 platform data (in Chapter 5) comes from 141 customer accounts that receive regulatory change alerts on SAI360’s platform. Cost figures come from an Ethisphere planning model. Each source is labeled wherever it appears, and Appendix A sets out the counting rules.

How Much Landed

Between Jan. 1, 2026, and Jan. 1, 2027, 47 core ethics and compliance obligations took effect, changed, or landed on the calendar. They came from U.S. federal agencies, seven states, the UK, and the EU, and nearly all of them fell within six domains that ethics and compliance programs own or share. Another 36 privacy and data obligations landed in the same window, and the index counts them separately as a sidebar.

The count runs against the enactment headlines. According to the NYU Center on Technology Policy, states passed fewer AI laws in the first half of 2026 than in the first half of 2025. The count was 109 laws in 29 states by July 1, against 121 laws in 39 states a year earlier. The obligations kept arriving anyway. Five of the six AI obligation dates that landed in 2026 came from laws and rules that were already final a year earlier. Among them were Texas’s Responsible AI Governance Act and California’s privacy regulations on automated decision-making.^{1SourceTexas Responsible AI Governance Act (2); California CPPA regulations (42); NYU Center on Technology Policy, Tech Policy Press, July 6, 2026} Fewer new laws did not mean less work coming due.

The count is the smaller part of the story. What changed more is the kind of work these obligations demand. More of them run on fixed clocks. More of them reach past the organization’s own walls, into suppliers, ownership chains, and functions that E&C does not run. And more of them treat the quality of the compliance program as evidence. They reward programs that can prove they work and penalize those that can’t.

That has a direct consequence for 2027 budgets. Holding a program’s resources flat while its obligations grow is a decision to carry more risk, and several of this year’s rules make that risk easier for a regulator to measure.

What the Index Counts

The index doesn’t try to capture every rule. It counts the obligations a Fortune 1000 ethics and compliance program has to act on, sorted into three categories (Exhibit 1). Twenty-two took effect in 2026, whenever enacted. Another 21 were already in force but changed in 2026 in ways a CECO had to act on, and four are scheduled to take effect Jan. 1, 2027.

Exhibit 2 breaks the count down by domain. Among the core domains, AI governance leads with 12 items, followed by anti-bribery, anti-corruption, and enforcement policy (eight) and trade sanctions and export controls (seven). Financial crime, third-party and supply chain risk, and antitrust contributed six each, and conflicts of interest two. The privacy sidebar holds 36 more.

Privacy and data is counted, but separately. It produced the most activity of any domain, yet it sits inside the E&C remit at 66% of Honorees, below the 75% to 100% range for the other core domains.^{2SourceBenchmark Q2.32} The response usually belongs to IT or a dedicated privacy function, with E&C as a related party. E&C teams still need to know what privacy regulators expect, so each chapter notes where the sidebar adds to the load.

Behind the headline count, the full index holds another 51 narrower items: rules for AI developers rather than deployers, sector-specific rules for health care and insurance, and individual sanctions packages. They apply to fewer programs, so they sit outside the headline count.

Who Wrote the Rules

U.S. federal agencies account for 17 of the 47 items, and 12 of those are enforcement policy or guidance. U.S. states account for 14 across seven states, mostly statutes on AI and pricing. The UK contributed 10 and the EU six (Exhibit 3).

California contributed six of the 47, the most of any state. The privacy sidebar tilts much further toward the states: 30 of its 36 items are state laws, and 10 of those are California’s.

Why the Count Understates the Load

A raw count treats a list update and a new corporate criminal offense as equal, and they aren’t. The index shows three different kinds of weight, and each calls for a different response (Exhibit 4).

Frequency load is many small changes, such as sanctions lists and packages that turn over again and again.^{3SourceUFLPA Entity List expansion (T2); EU 18th, 19th, 20th, and 21st Russia packages (77, 78, 84, 88); OFAC Iran general licenses suspended (89); OFAC Iran authorizations withdrawn (91); OFAC Cuban Assets Control Regulations amendments (94)} Structural load is a few changes, each requiring a new capability, like the UK offense of failure to prevent fraud or CBP’s forced-labor documentation standards.^{4SourceUK failure to prevent fraud offense (F1); CBP forced labor operational guidance (T1)} Speed load is the deadline that is itself the obligation, like DOJ’s 120-day window or OFSI’s 15- and 30-business-day settlement schemes.^{5SourceDOJ Corporate Whistleblower Awards Pilot Program (A4); OFSI enforcement and monetary penalties guidance (S4)}

Sanctions makes the distinction clear. It produced more new items in 2026 than any core E&C domain, but most of the full index’s 21 sanctions rows are list and package changes. Each one is manageable; the burden is that they never stop.

For a budget conversation, the second and third kinds matter most. Frequency load is largely a tooling problem. Structural and speed load are people problems: they need someone with the right skills, available at the right moment, with the authority to act.

Where the Heaviest Items Land

Four parts of the program absorb most of the structural and speed load.

Speak-Up and Self-Disclosure Now Run on a Clock

The U.S. Department of Justice issued its first department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy on March 10, 2026.^{6SourceDOJ Corporate Enforcement and Voluntary Self-Disclosure Policy (97)} Four related policies sit around it. The Corporate Whistleblower Awards Pilot Program was expanded in May 2025 and revised July 30, 2026. The Antitrust Division’s Whistleblower Rewards Program paid its first $1 million award in January. The National Security Division issued guidance on self-disclosing sanctions and export-control violations. And the Serious Fraud Office (SFO) said it will invite prompt self-reporters to negotiate a deferred prosecution agreement.^{7SourceDOJ Corporate Whistleblower Awards Pilot Program (A4); DOJ Antitrust Division Whistleblower Rewards Program (N2); DOJ National Security Division self-disclosure guidance (S1); UK SFO guidance on self-reporting and DPAs (A5)}

Together they turn speak-up into a race. An employee who reports internally has 120 days to reach DOJ and preserve their place in line for a federal award.^{8SourceDOJ Corporate Whistleblower Awards Pilot Program (A4)} The company, in that same window, has to triage the report, investigate, and decide whether to self-disclose. In April, the UK made sexual harassment a standalone protected whistleblowing disclosure, so the line between an HR complaint and a speak-up report is gone.^{9SourceUK Employment Rights Act 2025, sexual harassment as a protected disclosure (A6)}

The ability to prove when a report arrived now carries legal weight. Among Honorees, 71% track all misconduct reports in a single organization-wide system, while 18% keep separate, non-integrated systems by function.^{10SourceBenchmark Q6.02}

The Third-Party Program Now Carries Trade and Customs Risk

In July, DOJ stood up a Global Trade & Commerce Enforcement Section. With the Department of Homeland Security, it also published a Resource Guide to Trade Fraud Enforcement that tells companies to treat trade compliance as core risk management.^{11SourceDOJ Global Trade & Commerce Enforcement Section and DOJ/DHS Resource Guide to Trade Fraud Enforcement (F2)} The joint Trade Fraud Task Force passed $1 billion in recoveries by July 2026.^{12SourceDOJ-DHS Trade Fraud Task Force (F3)} CBP replaced its 2022 forced-labor guidance with operational expectations for supplier due diligence and tracing documentation, and the Uyghur Forced Labor Prevention Act (UFLPA) Entity List grew by 43 names.^{13SourceCBP forced labor operational guidance (T1); UFLPA Entity List expansion (T2)} The EU’s Forced Labour Regulation guidelines followed in June, ahead of a product ban in December 2027.^{14SourceEU Forced Labour Regulation guidelines (T4)}

Screening rules moved too. The March advisory on sham transactions from the Office of Foreign Assets Control (OFAC) looks past the 50% rule to retained influence, proxies, and control. The BIS affiliates rule extends Entity List license requirements to companies 50% or more owned by listed parties. Its suspension now runs through Jan. 10, 2027, after BIS formally extended it in November.^{15SourceOFAC sham-transaction and evasion advisory (S2); BIS Entity List affiliates rule (96); suspension extended through Jan. 10, 2027 (Baker McKenzie; Reed Smith)}

The result is a third-party program expected to reach origin claims, labor conditions, and control relationships across sub-tier suppliers. Honorees are positioned to own that work: 93% say E&C plays a significant role in end-to-end third-party risk management.^{16SourceBenchmark Q2.06} Their current depth is thinner. Over the past two years, 55% audited fewer than 10% of their third parties, and 51% used qualified auditors for forced-labor facility audits.^{17SourceBenchmark Q8.21, Q8.24}

U.S. Companies Face Wider Corporate Liability in the UK

The UK contributed 10 items to the headline count, more than the EU’s six. For U.S.-based organizations, the UK is the jurisdiction where corporate exposure widened most.

• The failure-to-prevent-fraud offense makes large organizations strictly liable for frauds committed by employees, agents, or subsidiaries to benefit the organization, unless reasonable procedures were in place^{18SourceUK failure to prevent fraud offense (F1)}

• Since June 29, 2026, an organization is liable for any offense committed by a senior manager acting within their authority, not only economic crimes^{19SourceUK Crime and Policing Act 2026, s.250, senior-manager corporate liability (98)}

• Every director and person with significant control of a UK entity must verify their identity by Nov. 18, 2026^{20SourceUK Companies House identity verification (F4)}

• OFSI now scores the adequacy of sanctions controls as a penalty factor and cut the voluntary-disclosure discount from 50% to 30%^{21SourceOFSI enforcement and monetary penalties guidance (S4)}

• The Competition and Markets Authority can fine consumer-law breaches directly, up to 10% of global turnover^{22SourceUK DMCC Act 2024, CMA direct consumer-law enforcement (N3)}

• On Oct. 12, 2026, the UK government opened a consultation on whistleblowing reform, open until Jan. 8, 2027. It covers a proposed Serious Fraud Office scheme to pay economic crime whistleblowers, similar to programs at the U.S. Securities and Exchange Commission (SEC) and DOJ.^{23NoteUK government consultation, Oct. 12, 2026}

Most fraud programs were built to stop fraud against the company. The UK offense targets fraud committed for it, through sales practices, accounting, and marketing claims. That calls for a new risk assessment rather than an update to the old one.

AI Governance Arrives Through HR Technology

AI governance contributed 12 items, more than any other core domain. The ones most likely to reach a Fortune 1000 program concentrate on employment decisions. Illinois now bars discriminatory use of AI in hiring, promotion, and discharge and requires notice to workers. California’s Civil Rights Council rules treat automated-decision tools that produce adverse impact as discrimination unless they are job-related. The rules also reach the vendors that supply those tools and require four years of records. Connecticut’s Public Act 26-15 protects employees who report catastrophic AI risks and requires disclosure of AI-related layoffs. On Jan. 1, 2027, Colorado’s automated decision-making law and California’s ban on workplace emotion recognition follow.^{24SourceIllinois HB 3773 (1); California Civil Rights Council automated-decision rules (I1); Connecticut Public Act 26-15 (18); Colorado SB 26-189 (20); California AB 1883 (35)}

A second cluster covers disclosure: the EU AI Act’s Article 50 transparency duties, which took effect Aug. 2, 2026, and state rules requiring chatbots to identify themselves.^{25SourceEU AI Act Article 50 (12); California AB 1609 (27); Utah AI Policy Act (I2); New York AI companion safeguards (I3)}

E&C already has a seat at this table. Among Honorees, 80% say E&C plays a significant role with product development on responsible AI use, and 72% a significant role in product and service decisions involving AI.^{26SourceBenchmark Q2.19, Q2.06} The formal remit has not caught up: the benchmark’s list of E&C remit areas does not include AI at all.^{27SourceBenchmark Q2.32}

What It Says About the E&C Role

The Program Itself Has Become Evidence

At least eight of the 47 core E&C items tie an enforcement outcome directly to the quality of the compliance program:

• DOJ’s Corporate Enforcement Policy promises a declination to qualifying self-disclosers and sets a three-tier resolution framework that rewards remediation^{28SourceDOJ Corporate Enforcement and Voluntary Self-Disclosure Policy (97); DOJ Criminal Division white-collar enforcement plan (A3)}

• The National Security Division offers a presumptive declination for timely disclosure, cooperation, and remediation^{29SourceDOJ National Security Division self-disclosure guidance (S1)}

• The EU Anti-Corruption Directive requires member states to treat compliance programs and self-disclosure as mitigating factors^{30SourceEU Anti-Corruption Directive, Directive (EU) 2026/1021 (A2)}

• The UK fraud offense gives a defense to organizations with reasonable prevention procedures^{31SourceUK failure to prevent fraud offense (F1)}

• OFSI scores the adequacy of sanctions controls when setting penalties^{32SourceOFSI enforcement and monetary penalties guidance (S4)}

• Texas offers a safe harbor for AI governance programs built on the NIST framework^{33SourceTexas Responsible AI Governance Act (2)}

• California recognizes anti-bias testing as a defense factor for automated employment decisions^{34SourceCalifornia Civil Rights Council automated-decision rules (I1)}

Regulators are pricing program quality into outcomes. Documentation, testing, and records have moved from back-office hygiene to the organization’s first line of defense. A program that can’t produce them quickly is a more expensive program to have when something goes wrong.

E&C Answers for Controls Owned Elsewhere

A growing share of the index lands on work run by other functions, with E&C expected to make sure it holds up. Exhibit 5 maps the changes to four functions: human resources and talent, trade operations, pricing and revenue management, and the corporate secretary and board.

California’s pricing-algorithm law shows how far the reach goes. It applies to businesses that use a common pricing algorithm, not only to the software vendors that sell one, and it raised corporate criminal fines from $1 million to $6 million.^{35SourceCalifornia Cartwright Act amendments on common pricing algorithms (N1)} Honorees have the working relationships: 91% say E&C plays a significant role coordinating with supply chain management.^{36SourceBenchmark Q2.19} What is new is accountability for controls E&C does not operate.

Washington Changed Enforcement While Statehouses Wrote Statutes

Of the 17 U.S. federal items, 12 are enforcement policies or guidance rather than statutes or rules. The states went the other way: all 14 state items are laws or regulations. At the same time, written requirements receded on both sides of the Atlantic. FinCEN permanently exempted U.S. companies from beneficial ownership reporting, the EU narrowed the Corporate Sustainability Due Diligence Directive (CSDDD) and moved it to 2029, and DOJ and the Federal Trade Commission (FTC) have not replaced the competitor-collaboration guidelines they withdrew.^{37SourceCorporate Transparency Act final rule exempting U.S. companies (F6); EU CSDDD as narrowed by Omnibus I (T3)}

Fewer written safe harbors and more prosecutorial discretion make planning harder. A program has to be defensible against enforcement priorities that can change by memo. Meanwhile, two federal whistleblower reward programs in the index expanded or paid out in the same year.^{38SourceDOJ Corporate Whistleblower Awards Pilot Program (A4); DOJ Antitrust Division Whistleblower Rewards Program (N2)} For E&C teams in an already turbulent year for business, less regulation on paper has not meant less risk.

The Newest Load Sits at the Edges of the Remit

The areas nearly every Honoree assigns to E&C produced the least new regulation. Conflicts of interest (in the remit at 100% of Honorees) and gifts and entertainment (99%) yielded two items between them. Third-party risk (85%), AML (81%), sanctions (80%), and antitrust (75%) yielded 25. AI, which the remit question does not list, yielded 12.^{39SourceBenchmark Q2.32}

Staffing has not kept pace with that shift. A quarter of Honorees report no one in the E&C function with a trade and sanctions background. A third report no one with AML experience, and 36% no one with a responsible AI background.^{40SourceBenchmark Q2.34} These are the domains where the 2026 load concentrated.

A Lens for 2027

The count points to three habits for 2027. Plan for evidence, and assume any control may have to be shown to an outside party within a fixed window. Build once and map many. Exhibit 6 maps five shared controls to the regimes each can serve, and one self-disclosure protocol, for example, can serve DOJ, the National Security Division, the SFO, and OFSI. And plan to the calendar rather than the headlines. Jan. 1, 2027, is mostly a California and AI event, and most 2026 delays moved work into 2027 and 2028 instead of removing it. Chapters 2 and 3 map those dates.

On Jan. 1, 2027, four obligations in the headline count take effect and a fifth reaches a new compliance stage, and four of the five are California’s. The privacy sidebar adds 13 more dates that day. Count every obligation the index tracks and the day carries 28. Add the EU Deforestation Regulation, which applies to large and medium companies on Dec. 30, and the week holds 29 (Exhibits 10 and 11).

The rest of the calendar is less tidy. In 2026, a program in scope for the full headline count absorbed 25 obligation dates spread across 21 separate days (Exhibits 8 and 9). Only four landed on Jan. 1, and four more in the three days from June 29 to July 1 (Exhibit 7). Counting the privacy sidebar, those two windows carried 12 and 11 dates.

Volume is only part of the strain. Obligations that arrive together compete for the same people in the same weeks: the policy owner, HR, product, privacy, and the vendors who build the tools. That is the fragmentation problem in practical terms. Fifty states, the federal government, the UK, and the EU write rules on their own schedules with their own vocabulary. The ethics and compliance team is where those schedules collide.

Two findings make the collision more manageable than it looks. First, the statehouse pile-ups fall on Jan. 1 and July 1, so a program can plan backward from them. Second, laws that land together often ask for the same underlying work under different names. The definitions rarely match, but the evidence a program needs to meet them often does.

2026: Two Clocks Running at Once

The 2026 calendar ran on two clocks. The statehouse clock is predictable. AI governance obligations in the headline count produced six dates in 2026, and four of them fell on Jan. 1 or July 1. The privacy sidebar runs on the same clock, with 14 of its 24 dates on those two days. The enforcement clock keeps no schedule. Core E&C obligations outside AI (anti-bribery and enforcement policy, financial crime, sanctions, third-party and supply chain risk, and antitrust) produced 19 dates in 2026, and only one of them fell on Jan. 1 or July 1. The other 18 arrived when an agency, a ministry, or a parliament decided to act.

That split matters for staffing. A program that plans to the statehouse clock gets a long runway and two crunch dates a year. A program that also answers to the enforcement clock needs standing capacity to read, assess, and respond to changes it can’t see coming. Chapter 1 called the first structural load and the second speed load. 2026 delivered plenty of both.

What the 2026 Calendar Taught

2027: The Pile-Ups You Can See Coming

The 2027 calendar looks thin after January for a simple reason: most 2027 legislative sessions haven’t happened yet. If 2026 is a guide, the July 1 and Jan. 1, 2028, dates will fill as statehouses adjourn.

Do the Definitions Match?

Rarely, though the work underneath them often does. Across the four clusters that converge on Jan. 1, 2027, the reusable piece is usually the evidence: an inventory, a notice, a protocol, an assessment. The piece that has to be redone law by law is scoping, which means deciding whether a tool, a data flow, or a user falls inside each definition. Two of the four, privacy and children’s online safety, sit in the privacy sidebar; they’re here because E&C often has to coordinate with the privacy function on them. Exhibit 13 summarizes the four clusters, and Exhibits 14 through 17 set the definitions side by side.

AI in Decisions About People: Different Tests, Shared Work

California, Colorado, Connecticut, Illinois, Texas, and the EU all regulate AI used to make decisions about people, and no two draw the line in the same place (Exhibit 14). California’s privacy regulator covers only technology that replaces or substantially replaces a human decision-maker. Connecticut covers tools that are a “substantial factor” that “meaningfully alters the outcome” of an employment decision. Colorado covers any tool that “materially influences” a consequential decision. California’s civil rights rules reach any system that “facilitates” an employment decision. Illinois looks at discriminatory effect, and Texas looks only at intent.

The decision domains differ too. California’s “significant decision” leaves out insurance. Colorado’s “consequential decision” includes insurance and government services. Illinois, Connecticut, and California’s civil rights rules cover employment only.

The duties line up far better than the definitions. Every one of these regimes asks for notice to the person affected. Human review appears in California, Colorado, and the EU. Record retention runs four years under California’s civil rights rules and three under Colorado’s. Impact or risk assessments survive only in California and the EU. A program that keeps one AI inventory tagged by decision type, human involvement, and jurisdiction can answer the scoping question for every law from a single source. One notice template built with the full set of required fields covers most of the disclosure duties. One bias-testing file supports a defense in California, a risk assessment for the California privacy regulator, the EU’s fundamental rights assessment, and the Texas safe harbor tied to the NIST AI Risk Management Framework.

Chatbots: The Closest Thing to a Single Build

Ten chatbot laws in the index define their subject in at least six ways. They range from New York’s three-part test for an “AI companion” to Maine’s definition of a chatbot as any program that “simulates human conversation and interaction” (Exhibit 15). Even so, one design meets most of them: a disclosure at the start of each session, a reminder at least every three hours, and a crisis protocol built to the strictest version (evidence-based detection, a 988 referral with a link, coverage of eating disorders and harm to others, and no referral to police).

Three details break the single build. Customer-service bots are exempt in New York, Rhode Island, Oregon, and under California’s companion law. They are covered by California’s new customer-service law, Utah, Maine, the EU, and Colorado. Washington requires hourly reminders for minors. And the age rules diverge: California acts on what an operator knows, Oregon on what it has “reason to believe,” and Colorado requires operators to estimate the age of every user.

Privacy and Data Brokers (Privacy Sidebar): One Near-Copy, One Fresh Start

Oklahoma’s new law is close to a copy of the Indiana and Kentucky laws that took effect in 2026. It has the same thresholds, the same list of sensitive data, a sale defined as an exchange for money, no duty to honor browser opt-out signals, and a 30-day cure period with no end date. A program built for Indiana and Kentucky needs a notice update. Louisiana needs fresh scoping. It applies to any company with more than $25 million in annual revenue that does business in the state. It counts households and devices as well as consumers, treats a sale as any exchange for “monetary or other valuable consideration,” and closes its cure window on July 31, 2027.

Data brokers face three different scope tests (Exhibit 16). California and Vermont exempt businesses with a direct relationship to the consumer, but only for data collected in that relationship. Connecticut uses an exemption for contractual, investor, and donor relationships instead. New Jersey extends registration to first-party “data collectors” that sell to brokers and bans the sale of sensitive data outright. A single “are we a broker?” analysis won’t hold across all four. The registration filings themselves are converging on California’s disclosure list, so the paperwork travels better than the scoping.

Children’s Online Safety (Privacy Sidebar): The Least Reusable Cluster

Children’s privacy and safety laws are where a single build fails most often (Exhibit 17). The laws in the index draw age lines at 13 (New Hampshire and the Children’s Online Privacy Protection Act, or COPPA), 16 (California’s addictive-features law), 17 (Arkansas’s teen band), and 18 (California’s design code and age-assurance law, Vermont, and Nebraska). They use incompatible tests for whether a service is in scope: “directed to children,” a “significant number” of children, or an audience that is at least 2% minors. And they use different knowledge standards. California’s age-assurance law treats a received age signal as actual knowledge, which can trigger COPPA and Arkansas duties that depend on actual knowledge. The age signal has to reach every regime’s controls, not only California’s.

What to Do Before the Next Pile-Up

1. Plan to the cluster dates, not the law dates. Work backward from Jan. 1, July 1, and December 2027, and put the resource request into the budget cycle that comes before each date. Work due Jan. 1 has to be funded months earlier, not discovered in December.

2. Build the evidence once and map it many times. One AI inventory, one notice template, one crisis protocol, one age-signal routing plan, and one assessment file cover most of the January 2027 cluster. Spend the scarce hours on scoping, where the laws differ.

3. Staff the enforcement clock separately. The statehouse dates can be managed as projects. DOJ, OFSI, OFAC, BIS, and CBP changes arrive without notice and need standing monitoring and a fast path to the people who own disclosure, screening, and customs decisions.

4. Put grace-period expirations on the calendar as deadlines. Maryland (April 1, 2027), Louisiana (July 31, 2027), and Connecticut (Dec. 31, 2027) each convert a cushion into an enforcement date.

5. Name owners outside E&C before the date arrives. HR owns the hiring tools, product owns the chatbot, and privacy owns the age signal. E&C answers for all of them, so the owner and the evidence should be named before the obligation takes effect, not after.

6. Date-stamp the moving items. The BIS Entity List affiliates rule (suspended through Jan. 10, 2027) and the Companies House deadline for existing directors (Nov. 18, 2026) change status in the weeks after this report publishes.

For most programs, the delays moved the work. Nine obligations tracked in the index have been pushed back since early 2025, by lawmakers and regulators in Brussels, Washington, and Denver. Seven of them were due by the end of 2026. Eight now fall in the 20 months between Dec. 2, 2026, and Aug. 2, 2028, the same stretch of calendar that already holds the biggest pile-ups Chapter 2 found. Only one, the EU’s CSDDD, moved past 2028, and the member-state laws that carry it are due in July 2028.

There is no single cliff in that window. The delayed dates rarely share a day, and most sit months apart. What the delays built is a steeper climb with three hard stretches: the six weeks around Jan. 1, 2027; December 2027; and a long run of EU and U.S. federal dates through 2028. The first of those begins within a month of this report’s publication.

Some delays did remove work; several came with real cuts in scope, and companies that now fall outside those rules have capacity back. For companies still in scope, the delays changed the order of the work and left less room to do it. A deadline that moves 16 months doesn’t give a program 16 spare months when the evidence behind it takes a year to build.

What Moved

The nine delayed obligations cluster in the domains Chapter 1 found carrying the heaviest structural load: AI governance, third-party and supply chain risk, sanctions and export controls, and financial crime (Exhibit 18).

Four of the nine have moved more than once: the Deforestation Regulation, Colorado’s law, the BIS rule, and CSDDD. A date that has moved twice is a poor planning assumption in either direction. The European Commission has said there will be no third extension of the Deforestation Regulation.

Outside the index’s scope, the EU moved Corporate Sustainability Reporting Directive (CSRD) reporting for its second wave of companies from financial year 2025 to financial year 2027, with reports due in 2028. It also raised the threshold to more than 1,000 employees and €450 million in turnover.

Where the Delays Landed

Put the nine delays on the Chapter 2 calendar and three stretches stand out (Exhibits 19 and 20).

Dec. 2, 2026, to Jan. 10, 2027: The Delays Meet the January Pile-Up

Three delayed obligations land within 11 days of each other: the Deforestation Regulation on Dec. 30, Colorado’s SB 26-189 on Jan. 1, and the BIS affiliates rule, whose suspension now runs through Jan. 10. A fourth, narrower item, the EU marking duty for generative AI already on the market, arrives Dec. 2. All of them sit on top of the five headline obligation dates already scheduled for Jan. 1, 2027, and the 13 privacy sidebar dates that land the same day. Each of the three pulls on a different team: commodity sourcing and trade for deforestation, HR technology for Colorado, and export screening for BIS.

December 2027: Three Evidence Deadlines in One Month

The EU AI Act’s high-risk obligations apply Dec. 2. The EU Forced Labour Regulation’s product ban follows Dec. 14. California’s deadline for risk assessments on processing already under way falls Dec. 31, the same day Connecticut’s cure period for its AI employment rules ends. Only the EU AI Act date was moved, and the move is what put it in December. Each of the three asks a program to produce documented evidence: an inventory and assessment of high-risk AI, supply chain tracing down to the product, and written risk assessments. Falling short carries real business risk, including costly delays at the border for products that don’t comply.

2028: A Long Run Instead of a Spike

FinCEN’s adviser rule applies Jan. 1, 2028. California’s first risk-assessment attestations are due April 1. EU member states must transpose the Anti-Corruption Directive by June 1 and CSDDD by July 26. The EU AI Act’s rules for AI in regulated products follow Aug. 2, and Connecticut’s data broker deletion duties begin Oct. 1. For companies with EU exposure, 2028 is the year national law catches up with directives adopted between 2024 and 2026.

AI in Decisions About People: Five Dates in 12 Months

One thread runs through all three stretches. AI used to make decisions about people now has five compliance dates in 12 months: Colorado’s law and California’s automated decision-making rules on Jan. 1, 2027; Connecticut’s employment duties for tools deployed from Oct. 1, 2027; the EU’s high-risk rules on Dec. 2, 2027; and California’s risk assessments on Dec. 31, 2027 (Exhibit 24). Before the delay, the EU would have gone first and set the template. Now it goes fourth, after three U.S. regimes that each define the covered technology differently (Exhibit 14). A program that builds one AI inventory and one assessment file in 2027 can meet all five dates. A program that runs them as five projects will build the same evidence five times.

Not Every Delay Moved the Work

Some of the changes since early 2025 took work away, and a CECO should claim that capacity rather than leave it on the table (Exhibit 21).

• CSDDD now reaches EU companies with more than 5,000 employees and €1.5 billion in turnover, and non-EU companies with €1.5 billion in EU turnover. The EU-wide civil liability regime and the duty to adopt a climate transition plan are gone.

• U.S. companies no longer report beneficial ownership under the Corporate Transparency Act; only foreign reporting companies still file

• A federal court vacated FinCEN’s residential real estate reporting rule in March 2026, 18 days after it took effect

• Colorado’s replacement law dropped the impact assessments and risk management program the original act required

• The FTC withdrew its noncompete rule in September 2025 and moved to case-by-case enforcement

• The European Commission estimates its 2026 simplification package cuts the Deforestation Regulation’s annual compliance costs by about 75%, though the date held

For a company that fell out of scope, those changes freed real capacity. That makes scoping the first move. A program that hasn’t rerun its applicability analysis against the new thresholds may be carrying work it no longer owes, or counting on relief it didn’t get.

What Isn’t Written Yet

The delayed obligations are only the part of the 2027 and 2028 load a program can see today.

A year ago, the 2026 calendar looked lighter than it turned out to be. Of the 25 headline obligation dates that landed in 2026, 15 came from laws, rules, and policies that were not yet final in late October 2025 (Exhibit 22). The two clocks Chapter 2 described behaved differently. The statehouse clock was mostly visible a year ahead: five of the six AI dates came from laws and rules already on the books, and so did 20 of the privacy sidebar’s 24. The enforcement clock wasn’t. Fourteen of the 19 core E&C dates came from instruments that didn’t exist in final form a year earlier. They include DOJ’s Corporate Enforcement Policy, OFSI’s new penalty framework, the UK’s senior-manager liability rule, CBP’s forced labor guidance, and most of the year’s sanctions changes.

The 2027 calendar holds 13 headline obligation dates today. If 2027 follows 2026’s pattern, a program should expect about 20 more headline dates that haven’t been written yet. If new rules and enforcement policy arrive at half that pace, it is still about 10. That gives a planning range of 10 to 20 additional obligation dates in 2027, most of them on the enforcement clock and without a fixed date to plan around (Exhibit 23). This is a planning scenario built on one year of data, not a forecast. 2026 included a department-wide rewrite of DOJ enforcement policy, which may make it a heavy year to model from. The lower end of the range allows for that.

Three conditions make that scenario heavier than the count suggests.

The uncertainty cuts both ways. Some of today’s dates will move again or fall away. Colorado’s original law drew a federal court challenge that DOJ joined, and the same parties are expected to challenge its replacement. FinCEN is reviewing its adviser rule, and the BIS suspension depends on trade talks. None of that shrinks the preparation. It raises the cost of guessing wrong, and a program that waits for certainty on each item will start late on all of them. A useful first step is finding out who in the organization already tracks these items.

Budget for the Calendar You Can’t See

A budget built only on the visible calendar is short by design. In 2026, more than half of the headline obligation dates came from instruments that weren’t final a year earlier. The practical response is a standing reserve: capacity held back for unscheduled work, sized against the program’s own record of what arrived unannounced, and kept out of the scheduled deadlines. Finance teams apply the same logic to contingency. It gives the board a number to approve in advance instead of a gap to explain after the fact.

Three Kinds of Delay

Every delay in the index falls into one of three buckets, and each calls for a different response (Exhibit 25).

For the EU’s high-risk rules, working backward means an inventory of AI used in hiring, credit, and insurance decisions, classification against Annex III, deployer logs and worker notices, and fundamental rights assessments for credit and insurance uses, all in place before Dec. 2, 2027. For most programs, that work starts in the first half of 2027, which puts its funding in the budget cycle under way now.

What to Do Before the Next Date Moves

1. Rerun scoping against the new thresholds. CSDDD, CSRD, and Colorado all changed who is covered. Confirm in writing which obligations the company still owes, and release the rest.

2. Plan to the lead time, not the deadline. Evidence for December 2027 takes most of a year to build. Start in the first half of 2027.

3. Treat Dec. 2, 2026, to Jan. 10, 2027, as one window. The Deforestation Regulation, Colorado, and BIS land within 11 days of each other, on top of the scheduled Jan. 1 dates.

4. Build the AI program once for five dates. One inventory, one notice template, and one assessment file can serve Colorado, California, Connecticut, and the EU.

5. Hold a reserve for what isn’t written yet. Size it against what arrived unannounced in 2026, and keep it out of the scheduled work.

6. Date-stamp the movers. The BIS affiliates rule (suspended through Jan. 10, 2027), FinCEN’s adviser rule, and Colorado’s litigation can all change after this report publishes.

Most of the obligations in the index are cheap to meet. A minority are expensive, and that minority sets the budget.

Of the 47 obligations in the headline count, 17 ask for about a week of work: read the rule, update a policy or a notice, brief the people it affects, and adjust a screening list. Another 15 add a standing process, such as a filing, a registration, or an annual statement that someone now owns. The remaining 15 ask for proof. They reward or penalize a company based on records, testing, and documented controls it can put in front of a regulator, a court, or a customs officer, often within a fixed window.

The U.S. Department of Justice’s Corporate Enforcement Policy rewards a company that can investigate and self-report within 120 days of an internal whistleblower report. Colorado’s automated decision-making law, which applies Jan. 1, 2027, gives a deployer 30 days to explain an adverse decision and requires three years of records. U.S. Customs and Border Protection gives an importer 30 to 180 days to document the supply chain behind a detained shipment. None of that evidence can be assembled after the clock starts; it has to exist already.

Those 15 obligations are where the cost sits, and they are fewer than they look. They draw on five underlying capabilities. A program that builds each capability once can meet every obligation that depends on it, and a program that builds them obligation by obligation pays several times over.

To size the load, we built a planning model and pegged it to how 2026 World’s Most Ethical Companies Honorees staff their programs. Take a U.S.-headquartered multinational with UK and EU operations, imported goods, AI in its hiring process, and consumer data in several states. Forty-two of the 47 obligations apply to it. Absorbing them takes about 3.5 full-time equivalents (FTEs) of new work in the first year for a program built to the Honoree baseline, and about 5.3 for a program without that foundation. After the build, keeping current costs about two FTEs every year (Exhibits 30 and 31).

At the median Honoree team size of 21 to 50 FTEs, that is roughly 10% of the team’s hours in year one and 6% every year after. About 22% of Honorees run teams of 10 or fewer. A team of eight needs about 43% of its hours in year one to absorb the same obligations, and close to 90% if the team has four people.

For a U.S. multinational in scope for most of the index, keeping up with the obligations that took effect in 2026 costs about two full-time people every year. That cost comes from where the company operates and what it does. A smaller E&C team doesn’t get a smaller bill. The UK government’s own estimate points the same way.^{41SourceUK Home Office impact assessment HO 0479, Oct. 3, 2024 (Exhibit 29)} Its setup cost for the new fraud offense is only about a fifth higher for organizations with more than 500 employees than for those with 250 to 500.

Three Tiers of Cost

Each obligation in the headline count sits in one of three tiers, based on the most demanding thing it asks a program to do (Exhibits 26 and 27, with row-level detail in Exhibit 34). The tiers line up with the three kinds of weight Chapter 1 described.

Where the Thesis Holds, and Where It Needs Adjusting

Notice costs a week, and evidence can cost a function. The index supports both halves of that statement. It also adds three adjustments a CECO should carry into the budget conversation.

The Five Capabilities Behind the Evidence

Each capability below serves several obligations. The benchmark shows where Honorees already have a head start and where the gaps are (Exhibit 28).

1The Speak-Up-to-Disclosure Clock

Five obligations put a clock on the self-disclosure decision: DOJ’s Corporate Enforcement Policy and its whistleblower awards program, with a 120-day window; the National Security Division’s guidance for sanctions and export-control violations; the Serious Fraud Office’s guidance on self-reporting; and OFSI’s penalty framework, with 15- and 30-business-day settlement schemes and a factor for the adequacy of sanctions controls. The capability is intake that timestamps every report, triage that reaches the right decision-maker, and an investigation that can support a disclosure decision inside the window.

Honorees are closest to ready here. Among them, 71% track all misconduct reports in a single organization-wide system, 93% use dedicated internal investigators from the E&C function, and 89% evaluated their investigation process in the past year. The gap is at the edges: 18% keep separate, non-integrated systems by function, which makes it hard to prove when a report first arrived. Only 29% run root cause analysis on every investigation, so the rest may struggle to show what they learned from the issues raised.

2The AI Decisions-About-People File

Four obligations ask for evidence about AI used to make decisions about people: Colorado’s automated decision-making law, California’s privacy regulations on automated decision-making and risk assessments, California’s Civil Rights Council rules (four years of records, with bias testing as a defense), and Colorado’s governance rule for insurers. Eight lighter AI obligations depend on the same inventory. The capability is one inventory of AI tools tagged by decision type and jurisdiction, a notice template, a bias-testing file, and record retention set to the longest period any regime requires.

This is where Honorees are thinnest. Among them, 87% trained E&C staff on AI in the past two years. But only 56% address AI in their Code of Conduct, 51% include AI in third-party due diligence, and 24% address it in their Third-Party Code. Of the Honorees that ran standalone E&C audits, 42% covered responsible AI use, about a third of all Honorees. And 36% report no one in the E&C function with a responsible AI background.

3Supply Chain Tracing

Three obligations ask an importer to prove where its goods came from. CBP’s forced labor guidance gives 30 to 180 days to respond to a detention. The EU Deforestation Regulation requires due diligence statements with geolocation from Dec. 30, 2026. And the EU Forced Labour Regulation’s product ban applies Dec. 14, 2027, with no safe harbor. Five more obligations, from the UFLPA Entity List to DOJ’s trade-fraud enforcement, raise the stakes on the same evidence.

Over the past two years, 55% of Honorees audited fewer than 10% of their third parties. Just over half (51%) use qualified auditors for forced-labor facility audits, and 45% consider the traceability of materials in their social compliance risk assessment. A quarter report no one in the E&C function with a trade and sanctions background.

4Ownership and Control Screening

The BIS affiliates rule extends Entity List license requirements to companies 50% or more owned by listed parties, and OFAC’s sham-transaction advisory looks past the 50% line to retained influence, proxies, and control. Together they turn a screening check into an ownership-tracing capability that has to run on every counterparty and stay current.

Honorees start with the data: 99% collect ownership and beneficial ownership information in third-party due diligence, 98% screen against sanctions and embargo lists, and 67% reassess third-party risk rankings on an ongoing basis. The new work is aggregating ownership across a chain and keeping it current long after onboarding.

5UK Corporate-Liability Prevention Procedures

The UK failure to prevent fraud offense gives large organizations one defense: reasonable prevention procedures they can document. Senior-manager liability and the Competition and Markets Authority’s direct consumer-law fines raise the stakes on the same risk assessment. The Home Office estimates that the largest organizations need 46 hours to absorb the guidance and 128 hours for the fraud risk assessment, run by a core team of five. After that, it puts the cost at about £3,100 a year for refresh, communications, and training. Among Honorees, 74% have someone in the E&C function with a fraud examiner background.

Privacy Sidebar: The Incident Clock

Three obligations in the privacy sidebar set hard incident clocks: California’s 30-day breach notice, the TAKE IT DOWN Act’s 48-hour takedown for platforms hosting user content, and the SEC’s Regulation S-P amendments for financial firms. Regulation S-P requires customer notice within 30 days and service-provider notice to the firm within 72 hours. They stay out of the headline cost figures because the response usually belongs to IT or a dedicated privacy function. Where privacy sits in the E&C remit, as it does at 66% of Honorees, the incident clock becomes a sixth capability.

The Thread Through All Five: Records

Every evidence obligation is a records obligation. California’s civil rights rules require four years of automated-decision records, and Colorado requires three. The EU AI Act will require deployers of high-risk systems to keep logs for at least six months from Dec. 2, 2027. Records management sits in the E&C remit at 50% of Honorees, the lowest of any area the benchmark asks about. Where records management sits outside E&C, the program depends on another function to produce the evidence that decides its outcome.

What Official Cost Estimates Leave Out

When governments price these rules, they price the paperwork, and several say so. The FTC counted 70 hours for an operator to rewrite its COPPA notices and excluded the written security program because it “does not constitute a collection of information.” The SEC counted 73 hours to write incident-response policies and noted that larger firms already run such programs, so their cost is “reviewing, and possibly updating.” The Home Office counted the time five company secretaries need to read the senior-manager liability measure, about £23 per organization, and said any new controls are costs firms “may incur if they choose.” Exhibit 29 collects 17 of these estimates; Exhibit 29A lists 17 more where the government put the company’s cost at zero or declined to estimate it.

Three governments priced something closer to the work itself, and their figures bracket the planning model. The European Commission puts a deployer’s human oversight of one high-risk AI system at €5,000 to €8,000 a year, “around 0.1 FTE.” Its CSDDD assessment puts full supply chain due diligence for a company over €5 billion in turnover at €480,000 to €643,000 a year, several FTE, before the 2026 omnibus cut it by about 80%. The FTC puts the new Hart-Scott-Rodino (HSR) form at 68 hours per filing, 121 with overlaps, and says 40% of that time is the company’s own staff. The Home Office assessment still carries the size finding: setup for organizations over 500 employees is about a fifth higher than for 250 to 500. Both figures cover reading and a first risk assessment. The cost of a capability is largely fixed, and it doesn’t scale down with the team that has to build it.

Pegging the Cost to Honoree Staffing

Honorees are well staffed by the field’s standards. About six in 10 have more than 20 FTEs in the E&C function, and 40% have more than 50. The median Honoree sits in the 21-to-50 band, and the median budget falls between $5 million and $10 million. At the other end, 22% run the function with 10 or fewer FTEs.

Exhibit 31 applies the planning model across those bands. For the illustrative multinational, year one at the Honoree baseline takes about 10% of a 35-person team’s hours, 23% of a 15-person team’s, and 43% of an eight-person team’s. Below the baseline, the same obligations take 15%, 35%, and 66%. The ongoing cost of about two FTEs is 6% of a 35-person team and 25% of an eight-person team.

A reader can extrapolate from there in three steps. First, sort the obligations that apply to the program by tier, using the row-level classification in Exhibit 34. Second, check which of the five capabilities the program has at the Honoree level, using the benchmark figures in Exhibit 28 as the test. Third, for each capability the program lacks, use the below-baseline build cost in Exhibit 30. Divide the total by the team’s FTEs. The result is the share of next year’s hours the 2026 obligations will claim, before the program does anything it did last year.

Four limits apply. The model counts work that the E&C function leads or answers for, not the engineering, HR, or trade operations time behind it. It leaves out the privacy sidebar; for a program that carries privacy, the sidebar adds about one FTE in year one and half an FTE every year after for the same profile. It leaves out the 51 narrower obligations in the full index, most of them frequency load. And it leaves out the 10 to 20 additional obligation dates Chapter 3 expects in 2027 that haven’t been written yet. Each makes the real number larger.

The Cost Stacks Up

The two people a year cover only the obligations that took effect in 2026 and on Jan. 1, 2027. That cost doesn’t roll off when the year ends. Records still have to be kept, testing rerun, and the disclosure clock staffed. Next year’s obligations arrive on top of it.

How much each new year adds depends on whether its obligations fit capabilities the program already has (Exhibit 32). A year like 2026 whose obligations all fit the five capabilities adds about half a person of permanent work, the ongoing cost of the standing processes alone. A year that demands capabilities the program doesn’t have adds closer to the full two. If 2027 and 2028 each look like 2026, the ongoing cost of keeping up reaches about three to six people a year. At the median Honoree team size, that is 9% to 17% of the team’s hours. A program that holds its headcount flat through 2028 covers that work by doing less of something else.

Treat this as a planning scenario. Some obligations will narrow or fall away, as Chapter 3 found for CSDDD, the Corporate Transparency Act, and Colorado’s impact assessments. And 2026 may prove a heavy year to model from, since it included a department-wide rewrite of DOJ enforcement policy. Chapter 3 also found that most 2027 legislative sessions haven’t met yet, and that 10 to 20 more headline obligation dates are likely in 2027 alone. The size of the increase is uncertain, but the direction is clear. The cost of keeping up rises every year regulators keep writing. The company didn’t choose that cost, but it can plan for it.

January Is a Process Crunch, December an Evidence Crunch

The 2027 calendar splits by tier (Exhibit 33). Of the five headline obligation dates on Jan. 1, 2027, two are evidence-tier: Colorado’s automated decision-making law and California’s automated decision-making compliance date. Both draw on the same AI file. Two are standing processes (California’s customer-service chatbot law and its state copy of premerger filings), and one, the workplace emotion-recognition ban, is a week of work. The privacy sidebar adds 13 dates that day, nine of them standing processes. January is mostly process work a team can schedule around.

December 2027 is the opposite. The EU AI Act’s high-risk obligations apply Dec. 2, the EU Forced Labour Regulation’s product ban follows Dec. 14, and California’s risk assessments for processing already under way are due Dec. 31. All three are evidence-tier, and each needs most of a year to build. January can be staffed in the fall. December has to be funded in the 2027 budget cycle under way now.

What to Do Before Jan. 1

1. Sort before you size. Put every obligation that applies to the program into one of the three tiers before building the 2027 budget. The count tells the board the load grew; the tiers tell it where the money goes.

2. Build the inventories first. Start with AI used in decisions about people and pricing tools that use competitor or consumer data (plus, for programs that carry privacy, sales of location data). The cheapest obligations in the index depend on them.

3. Fund five capabilities instead of 15 separate obligations. Name an owner and a build date for each capability, and map every obligation it serves.

4. Put records management in someone’s remit. Evidence obligations are retention obligations. Set retention to the longest period any applicable regime requires.

5. Hand the standing process to tooling and owners. Registrations, filings, and rights requests belong in systems with clear owners, which frees E&C time for evidence work.

6. Price the gap against the benchmark. For each capability below the Honoree level, add the below-baseline build cost, and show the board the difference.

SAI360’s platform data shows what regulatory change looks like as it reaches a program. Across the 135 customer accounts that received content, the median account got about 3,900 alerts from Jan. 1 to Sept. 30, 2026, roughly 100 a week. One account in 10 received more than 7,700, and three received more than 10,000 (Exhibit 35). Over the whole year, the index counts 47 core obligations.

The two numbers measure different things, and the space between them is triage. Every alert has to be read and routed to an owner before anyone knows whether it matters. Whereas Ethisphere’s Regulatory Impact Index counts the 47 regulatory obligations that a compliance program has to act on, SAI360’s platform shows the stream it has to read to find those 47. Most of that stream will never make an index. (Case in point: 72% of the 6,000 regulatory changes behind those alerts are sector-specific health care and banking rules, which fall outside the Regulatory Impact Index’s topical domains.) But every one of those items must still be opened, assessed, and routed, which adds to the organization’s overall triage load.

Within the seven domains the index tracks, the stream and the count rank differently. Financial crime drew the most changes on the platform (573) and AI governance the most obligations in the index (12), while conflicts of interest drew 189 changes and two obligations. Sorting a stream that size is the frequency load Chapter 1 described, and tooling helps most there. The 15 evidence obligations in Chapter 4 are structural and speed load, and they need people. The number that would size the capacity gap is how much of the stream programs take through a formal workflow, and with how many people. The field still lacks it.

Readers come to this report with two questions. Is my sense that the load is getting heavier accurate? And how do I help my C-suite and my board see that the program needs to hold its resources, if not grow them? The first answer is yes. These six arguments address the second.

Many programs never make this case. Only 66% of Honorees included the resources needed to achieve program objectives in their board updates over the past year, which leaves a third that didn’t.^{42SourceBenchmark Q2.16} Honorees are among the most mature programs in the field, and 22% of them run E&C with 10 or fewer full-time employees.^{43SourceBenchmark Q2.33}

A Closing Perspective from SAI360

What 2027 Asks of a Compliance Program

Damola OgundipeSVP and Managing Director, AI and Regulatory Horizon Scanning Products, SAI360

This was a year when the headlines said regulation was slowing down and compliance teams felt the opposite. Both were right. Fewer laws passed, and more of them took effect.

I run a business unit that reads regulatory change for a living, so I’ll start with what we see. The volume reaching a program hasn’t gone down. The median account on our platform got about 100 alerts a week through the first nine months of 2026, most of them from agencies and sector rules that never make the news. Reading that stream and finding the items that matter is weekly work, and it almost never shows up in a budget.

Here’s what I think 2027 will look like:

Plan to the effective date, not the announcement. A signed law doesn’t create any work until its obligations take effect, and this report shows how much of 2026’s load came from laws and rules that were finalized a year or more earlier. A lot of the 2027 calendar is already set. Jan. 1 has a cluster of state AI and privacy dates. December has the EU AI Act’s high-risk rules and the Forced Labour Regulation’s product ban. None of that should surprise anyone who is planning from the effective dates.

Use a delay to build. Nine obligations have moved since early 2025, and most of them landed in 2027 and 2028, which were already busy. The groundwork takes the same effort no matter when the deadline is. You still need an inventory of where AI is used, a map of your data, due diligence records on suppliers, and documentation that a control actually ran. Teams that kept going on that work will be in decent shape. Teams that stopped will be squeezing a year of preparation into a quarter.

Sort the work by what it costs. Some obligations are a policy update and an email. Some add a standing process. Some ask the company to prove something to a regulator on the regulator’s timeline. Most programs count all three kinds the same way when they plan, which is how a team ends up looking right-sized on paper and stretched in practice.

Count the triage. Somebody on the team reads every change that comes in and decides whether it applies. That takes time whether the answer is yes or no, and the answer is usually no. AI helps here (like what we’ve built at SAI360). It can summarize a change and tell you which part of the business it touches. But a person still makes the call, and the hours that person spends are a cost most boards have never seen. Effective tools can help collect this type of triage data.

Bring numbers to the board. How many changes came in. How many applied. How many people worked on them, and what kind of work it was. With those numbers the conversation is about workload instead of headcount. A board that sees the same team as last year assumes the job is the same size. In most programs it isn’t, and 2027 won’t make it smaller.

Exhibits are grouped by the chapter that cites them and numbered in reading order. Every exhibit number in the main report opens its entry here without leaving the chapter.

Return to Chapter 1: Count Obligations, Not Headlines

Return to Chapter 2: Fragmentation Is a Calendar Problem

Return to Chapter 3: The In-Force Cliff

Return to Chapter 4: Classify by Cost to Comply

Return to Chapter 5: The Capacity Gap