Compliance by Design

The traditional pattern is to build first and let compliance review at the end, which leads to costly rework or launch delays. Designing compliance in means compliance specialists join product and system teams at the outset, requirements are written as design rules, and controls are automated where possible. Examples include a payment form that cannot be submitted without required disclosures, a workflow that blocks approval until a conflict check is done, or a data system that deletes records on schedule. The idea comes from privacy by design in data protection, where law now asks for it, and is spreading to areas such as financial crime, consumer protection and artificial intelligence. Compliance by default goes one step further: the most protective setting is the one that applies unless the user changes it. Rework after launch means rebuilding live systems and often contacting customers, which a design-stage rule avoids.

A retailer is building a pay-later option for its online checkout. Before coding starts, compliance, product and engineering agree that the cost summary must appear before the customer can click accept, and that consent for credit checks is recorded with a timestamp. Because these steps are built in, the app passes its pre-launch review without changes.