On A Strategic Management Approach to the New EU Risk-Based Compliance Regulations

CEOs cite the rise of disruptive digital technologies at the top of the list of trends that have had the greatest impact on how they are now leading their organisations. Companies require advanced data analytics, better artificial intelligence-driven processes, and reliable cybersecurity to meet ever-changing threats. To remain competitive and compliant, it is essential that the top management team and the board understand the strategic implications of new and proposed EU regulations calling for risk-based compliance. Although many law firms are creating new compliance departments eager to step in to serve as their clients’ compliance team, compliance is too important a function to outsource. In-house counsel may seek outside advice to better understand how the regulations apply to aspects of their firm's business. But we submit that this sea change requires in-house counsel to work with management to develop a core managerial competency we call strategic compliance management. It may also require in-house counsel to work with national regulators to develop the rules of the road. For example, companies must proactively address demands for increased user rights, including transparency about how personal data are used, and become more skilled at managing the costs of compliance.