A predictable pattern repeats across emerging regulatory areas — AI governance, cross-border data transfer, critical infrastructure resilience: a framework is proposed, debated and revised for years before it is finalised, and organizations wait for the final text before building the internal capability to comply with it. By the time the regulation lands, the compliance timeline is short and the underlying capability — an inventory, an accountable owner, a decision process — does not yet exist.Why Waiting for the Final Text Is the Expensive OptionRegulatory drafts rarely change the underlying governance capability a final rule will require — an inventory of what is in scope, a named accountable function, a decision-making process for the judgment calls the rule will demand. Those foundations are almost always safe to build against the direction of travel long before the text is final, and building them early is a fraction of the cost of assembling them under a compliance deadline that has already started counting down.What to Build Ahead of the Final TextAn inventory of what would be in scope under any plausible version of the rule: the systems, data flows or activities most drafts of a given framework converge on, even before the final definitions are settled.An accountable owner named now, not once the deadline is public: a capability with nobody responsible for it does not appear the week a regulation passes — it appears months later, after the deadline has already started slipping.A decision log for the judgment calls being made under uncertainty: documenting today's reasonable interpretation is what lets an organization show good-faith preparation if the final rule differs from what was assumed.A watch process on the drafting itself: regulatory direction is usually visible well before it is final, to anyone who is actually tracking the process rather than waiting for the announcement.“A regulation's final text changes the deadline. It rarely changes the underlying capability an organization needed to build anyway — which is why waiting for it is a timing decision, not a readiness one.”Treating the Horizon as Part of the ProgrammeThis is not a call to comply with a rule before it exists — nobody can, and guessing wrong on specifics wastes effort. It is a call to build the governance foundations a mature programme needs regardless of exactly how the final text reads, so that when the deadline does arrive, the work remaining is finishing a capability rather than starting one from zero.Share this articleX (Twitter)LinkedInFacebookCopy Link
Quantum ThreatsSep 10, 2026Quantum Computing and Cryptographic Risk: Preparing for Y2QY2Q — the point at which a capable quantum computer breaks today's public-key cryptography — isn't a single future date. Data being encrypted today can already be harvested and held for decryption later.
Digital TrustJun 18, 2026Trust Is Becoming a Measurable Claim, Not a Marketing Line"We take security seriously" used to be an acceptable answer to a customer's due-diligence question. Buyers are increasingly asking for evidence instead.
Deep Tech ShiftsJul 30, 2026Confidential Computing and the Limits of Encrypting Data in UseConfidential computing closes a real gap — data exposed in memory while it's being processed. It is not a substitute for the governance a workload still needs around it.
