What Regulators Really Want: Building Capability In Europe’s New Regulatory Era

The organisations that thrive in the AI era will not be those that automate the fastest, but those that govern the best.

For years, organisations viewed compliance as a support function, a necessary safeguard operating alongside the business. Regulations were monitored, audits conducted, policies updated and advisors consulted when questions arose.

That world no longer exists.

Today, organisations face a convergence of artificial intelligence, cyber threats, operational risk and an unprecedented wave of European regulation. The AI Act, DORA, NIS2 and emerging data governance frameworks are reshaping expectations across every sector.

Yet many organisations misunderstand what is actually changing. The real transformation is not that Europe is regulating more technology. The real transformation is that Europe is regulating an organisation’s ability to govern technology.

This distinction fundamentally changes what clients must prioritise and how advisors can create value. Many organisations still ask the wrong question: Are we compliant?

Unfortunately, that question is becoming increasingly irrelevant. As AI evolves, compliance has become a moving target rather than a fixed destination. A better question is: Can we continuously identify our risks and demonstrate control over them?

A company can be compliant today and exposed tomorrow. New technologies, suppliers, regulations and business models can alter the risk landscape almost overnight. Regulators are not expecting companies to prove perfection, they simply require them to demonstrate competence.

This shift is visible across modern EU regulation. While public debate often focuses on technology, the most significant requirements concern governance, accountability, training, documentation, risk assessments, incident management and leadership oversight.

When regulators investigate a cyber incident, they rarely begin by asking which software was installed. They ask who was responsible, how risks were assessed, what training was provided, how decisions were documented and what actions were taken when warning signs appeared.

Over the past few years, I have participated in discussions with boards, management teams and compliance leaders across different sectors. What strikes me is that most of those conversations begin with uncertainty.

Most leaders already know that AI will transform their business (in most cases, it already is). So instead, they now ask: Who is responsible? What will regulators expect? How do we govern this? How do we avoid becoming tomorrow’s headline?

In my experience, the greatest challenge is a lack of clarity. Many organisations know they need to act. Far fewer know how to organise themselves to act responsibly. That is why the real competitive advantage today is not access to AI. It is the ability to make informed decisions about AI.

While investment in AI, cybersecurity and compliance technology continues to grow, investment in organisational capability often falls behind. Many businesses forget that while technology can be purchased, capability must be built.

A lot of organisations focus on acquiring tools while underestimating leadership engagement, employee competence, accountability and effective decision-making structures. Yet these are precisely the factors regulators increasingly expect to see.

Clients should focus less on individual compliance projects and more on building organisational resilience. Leadership teams must understand technology-related risks. Responsibilities must be clearly assigned. Employees need ongoing training. Risk assessments should be updated regularly, and decision-making processes continuously improved.

One practical starting point is visibility. Across Europe, AI is already influencing recruitment, procurement, customer service, investigations, finance and cybersecurity. Yet many organisations cannot confidently explain where AI is being used, who is accountable for it or how associated risks are monitored. Before organisations can manage risk, they must understand where it exists. You cannot govern what you cannot see.

Another lesson from recent regulatory developments is that compliance can no longer be delegated exclusively to legal, compliance or IT functions. Legal teams interpret regulations. Compliance teams design controls. Technology teams implement solutions.

But accountability usually sits with management and boards. European regulators are focusing less on what organisations do and more on how they make decisions. This places leadership at the centre of governance. Compliance should not be viewed as a cost of doing business. It is a condition for doing business.

Traditionally, lawyers, auditors, accountants and consultants were engaged when organisations faced disputes, investigations or regulatory change. Oftentimes, that is too late. Clients now need help building capability and the most valuable advisors will be those who can connect regulation, governance, technology and business strategy. Our role is evolving from answering questions to helping organisations build resilient decision-making frameworks.

Instead of analysing failures after they occur, we should help clients strengthen governance before incidents emerge. Cyber incidents rarely become regulatory crises because systems fail. They usually become regulatory crises because governance fails.

Perhaps the most surprising lesson from recent years is that some organisations investing most aggressively in technology are not necessarily the ones best prepared for regulatory scrutiny. The gap between technological sophistication and governance maturity is widening. Organisations are becoming smarter technologically while remaining vulnerable organisationally. That is a risk no software can solve.

The advisor of the future is a capability builder. Over the next decade, advisors creating the most value will be those helping organisations become more resilient, accountable and adaptable.

AI will evolve. Cyber threats will increase. Regulation will continue to expand. To succeed, organisations must focus on having the strongest capabilities. Capability creates trust, and in Europe’s new regulatory era, trust may be the most valuable asset an organisation can build, and the most expensive one to lose.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.