A regulatory transformation lever is usually a deadline wearing a different name. The Digital Operational Resilience Act entered into application across the European Union on 17 January 2025, and gave roughly twenty categories of financial institutions a hard deadline for proving their technology could withstand a serious disruption. For a lot of those institutions, it also delivered the only mandate a board would actually approve for rebuilding infrastructure, vendor oversight and incident response capability that had been quietly deteriorating for years. Nobody had signed off the modernisation programme on its own merits. Everybody signed off the compliance programme.
Compliance Deadlines Get Funded. Improvement Plans Do Not
I have sat in enough investment committees to know the pattern. A technology leader asks for budget to modernise a legacy platform, improve vendor governance, or rebuild incident response, and the request competes against revenue-generating initiatives for years without traction. The same leader asks for the same work framed against a binding regulatory deadline, and the funding appears within a quarter. The pattern reflects how organisations actually allocate capital when the downside of inaction becomes legally and publicly measurable rather than merely operationally sensible.
Regulation as the Forcing Function Nobody Admits To
Few executives will say out loud that a regulatory deadline was the real reason a transformation programme finally got resourced, because it sounds like an admission that internal discipline alone was not sufficient. But the pattern holds across sectors. The EU AI Act’s enforcement framework, binding from February 2025, carries penalties of up to thirty-five million euros or seven per cent of global annual revenue for serious violations, and more than sixty-five nations are now developing comparable AI governance frameworks of their own. The European Commission’s AI Office gained its own power to investigate and fine providers of general-purpose AI models on 2 August 2026, a separate enforcement track carrying fines of up to the higher of fifteen million euros or three per cent of a provider’s worldwide annual turnover, a lower ceiling than the figure already cited for serious violations, but a second compliance clock all the same. Every one of those frameworks will force organisations within their reach to build governance capability that a purely voluntary business case would have struggled to justify at the same pace.
The Reframe Boards Are Slowly Making
The organisations getting genuine value out of this dynamic are treating regulation as more than a compliance cost to be minimised. Deloitte’s outlook on the financial services regulatory environment argues that firms combining agile compliance strategies with robust risk frameworks are best placed to treat regulatory shifts as catalysts for innovation rather than obstacles to route around. A DORA programme built purely to satisfy an auditor produces documentation. A DORA programme built to actually reduce operational risk produces documentation as a side effect of infrastructure that is genuinely more resilient, and the second version tends to survive the regulator’s next review far better than the first.
Using the Regulatory Transformation Lever Deliberately
The practical implication for anyone running transformation programmes in a regulated sector is straightforward, if uncomfortable. Stop treating the compliance deadline as separate from the modernisation agenda, and start using it as the forcing function it already functions as, whether anyone admits it or not. The work that regulation makes mandatory is very often the same work that good governance would have justified anyway. The deadline just makes it fundable. The same gap shows up outside financial services and AI: a voluntary handbook in Washington sitting next to a binding law in Singapore shows how little a board actually moves until the requirement stops being optional. Programme leaders who plan for that reality, rather than pretending regulation and transformation are separate workstreams competing for the same budget, get more of the genuinely useful work done, and they get it done before the incident that would otherwise have forced the conversation.
