The consequences of fulfilling those obligations are numerous, and result in a substantial amount of pain, paperwork, audits, certification, and more.

Which means that the overhead of doing “one thing” becomes extraordinarily high

Doing “one thing” in a regulated environment, top to down, looks vaguely like this:

Governing body says
1. “you will be obligated to do this”
2. “here’s what outcome should be” and/or “here’s what your plan should look like”
3. “here’s how certifying fulfilment of obligation should look”

Operating body says
4.“here’s how we interpret that obligation”
5. “here’s how we interpret the outcome guidelines and/or implementation guidelines given”
6. “Heres how we plan to implement the fulfilment of our obligation”
7. “Here’s how we plan to show you that our implementation does fulfil the obligation and meets all criteria”
8. “Here’s how we plan to measure the efficacy of our implementation”
9. “Here’s how we plan to monitor ongoing fulfilment of the obligation”
10. “Here’s how we plan to be certifiable”

We are now on step 10. It’s been at least

* 4+ years of legislation work
* 4+ years of regulation work
For the governing body

* 2+ years of regulatory interpretation in the enterprise
* 1+ years of implementation planning
For the operating body

… and we haven’t started implementing anything yet