Proof on a Deadline
Regulators now price your program’s quality into the outcome. The proof has to exist before the clock starts.
In 2026, 47 obligations landed on ethics and compliance programs. Eight tie a declination, a defense, or a penalty discount to whether your program can prove it works. Fifteen demand that proof on a deadline. The Index gives you every one, what it will cost, and the board case to fund it in 2027.
Get the report
Count obligations, not headlines
The Headlines Counted Laws. Compliance Teams Counted Obligations.
While U.S. states passed fewer AI laws in the first half of 2026 than 2025, compliance programs still absorbed 47 new or changed regulatory obligations, spread across 21 days. And 18 of 19 enforcement-clock dates have no fixed schedule to them. More than half came from rules and policies that were not final a year earlier.
What the Index found
Three findings to take into the 2027 budget conversation.
The Program Is Now the Evidence
Regulators are pricing program quality into outcomes. DOJ promises a declination to qualifying self-disclosers and gives a company 120 days to investigate and come forward. The UK’s failure to prevent fraud offense gives large organizations one defense: procedures they can document. OFSI scores the adequacy of sanctions controls when it sets a penalty. None of that evidence can be assembled after the clock starts.
Heavier Than the Headlines, and It Keeps No Calendar
The statehouse clock is predictable: Jan. 1 and July 1. The enforcement clock is not. Of the 19 dates from core obligations outside AI, 18 fell on some other day, including three rewrites of self-disclosure terms in seven weeks by OFSI, DOJ, and DOJ’s National Security Division. Nine obligations were delayed since early 2025, and eight now land between Dec. 2, 2026, and Aug. 2, 2028, on top of work already scheduled. Delay bought sequence, not slack.
The Cost Follows the Footprint, Not the Team
Of the 47, 15 demand evidence, and they set the budget. Keeping up costs a U.S. multinational about two full-time people a year, and a smaller team doesn’t get a smaller bill. The cost follows where the company operates and what it does. Governments price the paperwork and say so; the planning model prices the program.
What you get
Every obligation, sourced, dated, and sized for your 2027 budget.
All 47 obligations, each traced to its primary source, placed on the calendar, and sorted by what it takes to meet. Start with a 15-minute version built for the budget conversation, then go as deep as you need: six chapters, 35 exhibits, and two appendices, about 90 minutes in full. Each finding links to the exhibit that proves it.
- Six findings, each with the exhibit behind it
- What the findings mean for 2027, and five actions to take now
- Your 2027 budget case, with the talk track for the board
- Appendix A, the methodology, and Appendix B, every source
Everything you need to see 2027 coming, staff for it, and fund it.
- Executive SummaryThe count, the calendar, and the cost in one view
- Six FindingsWhat changed, each backed by the exhibit that proves it
- What It Means for 2027Five actions to take now
- The Board CaseThe budget ask and the talk track to defend it
- Go DeeperWhere to go next for the detail behind each finding
- The full reportAll 47 obligations, 35 exhibits, the methodology, and every source
Frequently asked questions
Ethisphere’s count of the ethics and compliance obligations a Fortune 1000 program had to act on between Jan. 1, 2026, and Jan. 1, 2027. Each obligation is traced to a primary source, sorted by what it asks of the program (a week of work, a standing process, or a new function), and read against how the 2026 World’s Most Ethical Companies Honorees staff their programs. It is produced in partnership with SAI360.
The Index counts obligations in force, not laws signed. Of the 47 core obligations, 22 took effect in 2026, 21 changed in ways a CECO had to act on, and four take effect Jan. 1, 2027. U.S. federal agencies wrote 17 of the 47, and 12 of those are enforcement policy or guidance rather than statutes or rules. Another 36 privacy and data obligations are counted separately as a sidebar, because privacy sits in the ethics and compliance remit at 66% of Honorees against 75% to 100% for the other domains.
From Ethisphere’s planning model, anchored to 17 published government cost estimates (U.S. paperwork burden hours, UK impact assessments, EU staff working documents, and California’s STD 399). For an illustrative U.S.-headquartered multinational, the model puts the load at about 3.5 full-time employees’ worth of new work in year one and about two every year after. The report treats the government estimates as floors: they price the paperwork, not the program. The FTC, the SEC, and the UK Home Office each said as much in their own estimates.
Ethisphere owns the data, the counting rules, and the analysis. The staffing comparison comes from 138 Honoree programs in the 2026 World’s Most Ethical Companies benchmark. SAI360 is Ethisphere’s partner on the report and contributed platform data, which the report labels as SAI360 platform data wherever it appears: a typical program on the platform received about 100 regulatory alerts a week in 2026, against the 47 obligations the Index counts for the year. The space between is triage.
Fill in a short form and you get the report page: the 15-minute version first (Executive Summary, Six Findings, What It Means for 2027, The Board Case, and Go Deeper), then the full report below it, with all 35 exhibits, the methodology, and every source. Read it online as soon as you submit the form.
December 2027
December 2027 holds three evidence deadlines. The funding decision is now.
Each one takes most of a year to build. Get the count, the calendar, the cost tiers, and a board case you can adapt for the budget cycle under way now.
The 2026 Regulatory Impact Index is produced in partnership with SAI360.