Regulation Is Becoming an Engineering Requirement, Not a Paperwork Exercise

For most of my career, compliance arrived as a questionnaire. Somebody from risk sent a spreadsheet, we described our controls in prose, an auditor read the description, and everyone moved on for another year. The gap between what the document said and what the systems actually did was usually small enough to live with and occasionally rather larger, and nothing in the process was designed to find out which.

That model is quietly ending, and I do not think it is ending because auditors got stricter. It is ending because the questions have become ones that only the system can answer. Where does this data physically reside, and can you show it changing. Which model produced this decision, on what inputs, and can you reproduce it. Who has had access to this record in the past year. What is in this piece of software, including the dependencies of your dependencies. You cannot write a convincing paragraph about any of those. Either the evidence is emitted by the running system or you do not have it.

That turns a large amount of what used to be governance work into ordinary engineering work, and it lands on teams who are not staffed or scheduled for it. Retention rules become code with tests. Lineage becomes a thing the pipeline records rather than a diagram somebody maintains. Access review becomes a query rather than an email thread. Software inventory becomes a build artefact. None of this is technically hard. All of it is work that nobody has planned for, and it competes for the same time as the features.

The organisations I have seen handle this well are not the ones with the biggest compliance function. They are the ones who treated evidence generation as a system property from the start, so that producing an audit answer is a report rather than a project. The ones struggling are those still bridging the gap with human effort at the end of each cycle, and that effort scales linearly with every new obligation.

I would not have predicted, fifteen years ago, that regulation would become one of the strongest forces shaping how we build systems. It is worth getting good at now, while it is still a differentiator rather than a scramble.

– Serguey Shinder