Legislation and Adaptation: How Compliance Experts Are Staying Ahead of Regulatory Change

Name: ISMS.online
Address: Nile House, Nile Street, Brighton, East Sussex, BN1 1HW, GB
Telephone: +441273041140
Price range: ££

By Christie Rae • 3 November 2026 • 7 min read

When GDPR came into effect in 2018, it set a new precedent for data protection. The regulation strengthened individual privacy rights in the EU, requiring organisations to restructure data processing activities, update privacy policies and implement appropriate security measures.

More recently, the EU AI Act became a benchmark for the regulation of AI systems, with a risk-based classification system. To ensure compliance, many in-scope organisations had to adopt new processes, rethink existing processes and review how entire teams carried out their roles.

But regulatory change isn’t all landmark legislation. For many organisations, regulations like the Data Use and Access Act (DUAA), require smaller, strategic changes as opposed to an overhaul of processes and operations.

In a recent roundtable, we spoke to six compliance professionals who shared their expertise on absorbing new regulations and frameworks into their existing compliance programmes.

Getting the Foundations Right

For our experts, the first consideration when adapting to a new regulation is getting the foundations right. This means understanding the regulation’s requirements and how they differ from those of regulations with which they’re already compliant:

What changes under the new regulation?

What does their organisation already do that aligns with the regulation’s requirements?

Which processes need to be amended rather than completely changed?

Which processes need more thorough review?

What will employees need to do?

What will customers require?

Working Collaboratively

Jack Salsbury, Head of IT and Information Security at Autotech Group, shares that taking a collaborative approach across governance, risk and compliance, rather than treating it exclusively as an IT or compliance team issue, is key. “It’s really important to get a foundation of communication and cross-function working in place. If I update a policy or create a control, the governance needs to be there to communicate that across the business effectively.”

“You can put these things forward to shareholders and C-suite, and often it’s very quick for them to say yes, but there are so many elements of the communication piece to ensure that the organisation actually follows the policies, procedures and controls you’ve built,” he adds.

Employee Engagement

Similarly, our experts stress the importance of employee engagement with – and understanding of – a compliance programme. Joanne Ballard, Data Protection and Compliance Officer at Maintel, says that employee engagement can be encouraged in different ways. Businesses should assess what works for employees. For example, consider whether approaches like surveys or in-person conversations are more effective. “It’s being able to vary your approach for your audience and trying to find something that connects with everyone.”

She adds that organisations should consider where they can streamline processes for employees. “For example, we’ve created a single form covering Data Protection Impact Assessments (DPIAs), Fundamental Rights Impact Assessments (FRIAs) and AI Impact Assessments (AIIAs) for staff to complete during the supplier review process, rather than requiring three separate forms.”

Sam Peters, CPO at IO, agrees that minimising the compliance workload for employees is an important factor in fostering a culture of compliance. “We have a project in the IO platform for each department, so the department leads can manage the operating procedures for their team in one place,” he says. “When a new starter joins, we include some of those core processes in the policy pack, so they’re not just seeing the policies for compliance with our management system. They’re seeing their team’s key policies at the same time.”

Addressing Regulatory Change

With the right foundations in place, how do proactive organisations absorb new regulations?

Integrating Compliance Management

Dariusz Cieśla, VP of Product and Strategy at AI Clearing, says that mapping standards and creating one set of policies and procedures, where appropriate, can reduce friction. He uses ISO standards as an example: “If a business has a context of the organisation policy, with internal and external issues, they’d usually have to create that for each ISO standard, even though the documents are virtually the same.

“AI Clearing has created one set of internal and external issues, and if we have more, we add them to the list. Similarly, we can review and update procedures rather than creating entirely new ones. These policies and procedures can evolve as new standards are added to the management system.”

He adds that organisations can use this method to verify whether new policies or procedures are required or whether existing documentation can be amended.

Senior Leadership Support

A governance and compliance professional in the software industry advises compliance officers to focus on leadership engagement and ensuring responsibility for certain operating procedures sits with the relevant departments, rather than just compliance or IT teams.

“For example, if your business is working towards ISO 42001 compliance and looking at Annex 6, you may choose to make it the responsibility of the research and development department to determine what the AI software development lifecycle (SDLC) is, working in collaboration with the compliance team.”

A cybersecurity director at an industrial machinery supplier agrees, pointing out that aligning responsibilities with the correct areas of the business is a challenge many compliance teams face. “When you’re implementing ISO standards, the standard tells you that you must do something, but it doesn’t tell you how,” they explains

“The business seeks those answers, and we could certainly provide them, but then we’re dictating the procedures and we’re dictating the best practices. That’s something that IT operations needs to take ownership of.”

Addressing Challenges

Shadow AI

Our State of Information Security Report findings revealed that more than a third (36%) of organisations have experienced employees using generative AI tools without organisational permission or guidance, often referred to as shadow AI. The experience of our compliance experts reflects that challenge.

They conclude that employee education, such as training that ensures staff understand the risks and consequences of shadow AI use, is one of the most effective ways of preventing it.

Policy Suitability

Autotech Group’s Jack Salsbury says that often, gaps and issues within policies and procedures will be identified through use over time. “As the policies evolve, as they get followed, and as end users start understanding those policies, that’s where some of those gaps can start coming through.”

For businesses, this means undertaking regular reviews of documentation – treating compliance as a continuous cycle, rather than a check box list.

Risk Management

The governance and compliance professional suggests organisations hold regular risk review meetings based on each risk’s review due date and concentrate on the risks they’ve chosen to treat. “Choose a risk score above which your organisation will treat, not tolerate, a risk, and use that as a baseline for risk decision making,” they say.

New Regulatory Requirements

As organisations work to achieve compliance with existing regulations and standards, it can be difficult to keep an eye on what’s on the horizon. Maintel’s Joanne Ballard shares that she stays informed about regulatory developments through external newsletters from legal partners, industry publications, and a legal AI tool called Wordsmith. By using this combination of approaches, the business saves a considerable amount of time.

“It’s reduced what used to be probably a fortnight’s work down to a couple of hours,” she says.

Evolving with Regulatory Change

The regulatory landscape is becoming increasingly complex. Alongside legislative requirements, many organisations now require partners and suppliers to be compliant with frameworks like ISO 27001, ISO 42001, SOC 2, and NIST CSF.

The organisations that flourish in this environment, absorb new regulations swiftly, and build real resilience will be those that innovate and adapt. A joined-up approach to compliance across the core disciplines of information security, data privacy and AI allows businesses to build a foundation of resilience, enabling them to absorb new regulatory requirements with confidence.