According to recent regulatory commentary and enforcement signals across the UK and EU, regulators are increasingly reframing compliance as a product and contract design issue rather than a back-office legal exercise. Supervisory guidance and investigations now link risk directly to how technology is architected, configured, and commercialised, including tracking design, data access controls, cloud portability, and supplier terms. For founders, this shifts compliance impact upstream into product decisions, procurement strategy, and customer contracts, where regulatory expectations increasingly surface first.

What moves when compliance moves upstream

Treating compliance as a back-office function has an organisational consequence: it arrives after the decision. Product chooses an architecture, commercial agrees a model, and legal is asked to document what has already been settled. Where supervisory attention attaches to how a system is built, configured and commercialised, that sequence stops working, because by the time legal sees it the exposure is already in the code and in the customer base.

The change is less about doing more compliance work and more about doing it at a different point. The decisions that create regulatory exposure are made in product and procurement, weeks or months before anything reaches a contract.

What to check

• Whether anyone raises data and regulatory implications during product design, or only at launch review.
• Whether default configurations were chosen deliberately, since defaults attract more scrutiny than options.
• Whether cloud portability and data access were considered when the architecture was chosen, or inherited from it.
• Whether supplier terms are reviewed before a technical dependency becomes difficult to unwind.

Where this lands in the contract

Customer contracts are where product decisions eventually surface, usually as commitments the product cannot comfortably meet. A term promising data portability that the architecture makes expensive, or an access control commitment that does not match how permissions actually work, is a product problem discovered through a legal document.

The practical fix is sequencing rather than volume. Legal input at the point a decision is still open costs less and achieves more than review after it has hardened.