Regulatory compliance: definition and how to become compliant

Regulatory compliance means following the laws, regulations and standards that apply to your business, and being able to prove it. Once confined to banking and legal teams, it has become everyone's business with the GDPR, NIS 2, DORA, the AI Act and the Cyber Resilience Act. This article sets out the definitions, a six-step approach to becoming compliant and who does what. For day-to-day management once the project is over, see our article on cybersecurity compliance management.

In an organisation, compliance is the set of means that ensure its activity follows the rules that apply to it. Those rules come from several sources:

• laws and regulations, national and European: this is regulatory compliance in the strict sense;
• professional standards and industry frameworks, imposed by a supervisor or a sector;
• contractual commitments, increasingly security clauses required by customers;
• internal rules: code of conduct, policies, procedures.

French banking regulation offers one of the most precise definitions. The order of 3 November 2014 on internal control in banks and investment firms describes compliance risk as the risk of a judicial, administrative or disciplinary sanction, a significant financial loss or reputational damage arising from failure to follow the rules specific to the business. The definition works in any sector: non-compliance is paid for in fines, lost contracts and lost trust.

There is also an international standard to organise the subject: ISO 37301, published in 2021, sets out the requirements for a compliance management system. It is designed for any organisation, whatever its size, and can be certified. Among other things, it requires you to identify your obligations, assess compliance risks and secure leadership commitment. Compliance is the "C" in GRC (governance, risk and compliance).

Each area has its own texts and supervisor. The most common ones for a company operating in France:

For a long time, IT compliance in France boiled down to the GDPR and, for a few hundred operators, the military programming law. Three shifts have changed the scale of the subject.

Texts piling up

Since 2022, the European Union has adopted NIS 2, DORA, the AI Act and the Cyber Resilience Act, each with its own security requirements, reporting deadlines and penalties. One company may fall under three or four of them. Our article on compliance management reviews them one by one; the one on cybersecurity frameworks presents the standards to build on.

Accountability moving up to the board

Article 20 of NIS 2 requires management bodies to approve cybersecurity measures and oversee their implementation; Article 5 of DORA gives them ultimate responsibility for managing ICT risk. Digital compliance is no longer something you can delegate entirely to IT.

Requirements flowing down the supply chain

A company covered by none of these texts may still have to comply through its contracts. Customers subject to NIS 2 or DORA pass their obligations on to suppliers through questionnaires and clauses (see what NIS 2 and DORA require regarding providers). For many smaller companies, this is how cyber compliance arrives.

A compliance project takes an organisation from a non-compliant state to a compliant, demonstrable one. Whatever the text, it follows the same six steps.

1. List the applicable requirements

Which texts apply, to what scope (entities, sites, activities, products, processing) and by when? Include contractual requirements and your own rules. This work then continues as an organised regulatory watch, otherwise the list will be wrong within six months.

2. Assess the gaps

Compare your practices with each requirement. Interviews, questionnaires, document reviews and technical checks complement each other; a cybersecurity audit can be the starting point. Each requirement gets a status (compliant, partly compliant, non-compliant) and a justification.

3. Prioritise and plan

Not all gaps are equal. Rank them by the risk they create, using your risk analysis, and by regulatory deadlines. The action plan sets a measure, an owner, a deadline and a budget for each gap. Senior management approves it, since it decides on resources.

4. Implement

Measures are organisational (governance, procedures, training, supplier clauses) and technical (access management, logging, backups, encryption). Internal rules are written into policies, such as the information security policy for the cyber side.

5. Document and prove

The GDPR set the principle in 2018: the controller must comply and be able to demonstrate compliance (Article 5(2)). The same logic applies to other texts. Attach dated, current evidence to each requirement: register, minutes, test report, configuration screenshot, training record.

6. Maintain

A compliance project that stops at the final report starts degrading the next day: new texts, new systems, staff turnover, changing suppliers. The project must lead to an ongoing activity of controls and updates, compliance management, which automating some checks turns into continuous compliance.

In most organisations, three functions share the subject under senior management's responsibility. Their missions overlap without merging.

• Paper compliance. Well-written policies that nobody follows. Auditors and regulators ask for proof that a rule works, not just that it exists.
• One text, one project. Handling the GDPR, then NIS 2, then DORA as three separate projects means assessing the same measures three times. A common set of controls, for example built around an ISO 27001 ISMS, works better.
• A vague scope. Without a written scope, the gap assessment has no baseline and the project has no end.
• Forgetting suppliers. Part of your obligations rests on your providers: hosting, managed services, software vendors. Assessing them is part of the work (see third-party risk management).
• Stopping at the report. Without an owner and regular controls after the project, the level reached erodes within months.