In a company of twelve people, compliance belongs to somebody who was hired to do something else. It sits with the finance manager, the operations lead, or the founder, and if the firm sells into the European Union from the United Kingdom, or across a border inside the Union, it answers to two rulebooks that arrived without a job description between them.
The weight has been measured. The 2025 Eurobarometer survey of small and medium-sized enterprises covered more than 17,000 companies, 13,000 of them across the twenty-seven member states, and 64 per cent of EU SMEs named regulatory complexity as the main barrier to their growth, ahead of late payments at 39 per cent and access to finance at 27 per cent. The European Commission reported the result on 18 July 2025, and its own simplification programme concedes the point with a target cut of at least 25 per cent in administrative burden for all businesses, at least 35 per cent for SMEs, against 37.5 billion euro of recurring administrative cost identified for the 2024 to 2029 mandate. Where the reformed United Kingdom regime and the unchanged EU one have diverged, in the detail more than the headline, is set out in our earlier piece on the dual regime. This article asks what keeping up with both costs the person who has to do it, and whether what they find when they look is correct.
Take the national picture first, because it has official statistics behind it. The Health and Safety Executive's key figures for Great Britain covering 2024/25, released on 20 November 2025, record 964,000 workers suffering work-related stress, depression or anxiety, inside 1.9 million people with a work-related illness and 40.1 million working days lost to work-related illness and injury, and stress, depression or anxiety accounts for 52 per cent of all work-related ill health. A caution belongs beside those figures: the HSE does not identify regulatory or compliance workload as a named cause within them, and we have found no source that does. What they establish is the scale of what workplaces already carry before anybody opens a rulebook.
The profession that does compliance full time has reported its own condition. Corporate Compliance Insights surveyed more than 300 compliance professionals for its Compliance Officer Stress and Mental Health Report 2025, published on 26 February 2025. Fifty-one per cent said they feel burned out at work, 49 per cent had experienced anxiety-related difficulties in the past year, only 27 per cent said they were adequately resourced, and 78 per cent work more than 41 hours a week. Officers reporting into a structure they judged ineffective showed roughly double the rate of high job-related stress, 60 per cent against 31 per cent, which points at how the job is arranged more than at the temperament of whoever holds it. And these are the people who do compliance as their whole job, while the person in the firm of twelve has the same rulebook and no department behind them.
The same survey also carries evidence that points the other way. Burnout is down from 59 per cent in 2022, and self-rated effectiveness has risen to 73 per cent from 57 per cent over the same period.
The standing of the job is improving faster than the resourcing of it.
Then there is the question of whether what they find is right. Researchers at Stanford, publishing in the Journal of Empirical Legal Studies in 2025, hand-scored 202 preregistered legal queries put to the paid professional AI legal research tools, and those tools returned incorrect or misleading information on between roughly one in six and one in three queries. The European Broadcasting Union and the BBC published a wider study on 22 October 2025, covering 22 public service media organisations in 18 countries with more than 3,000 responses assessed by working journalists: general-purpose AI assistants misrepresented news content in 45 per cent of answers, 20 per cent contained major accuracy problems, and outdated information sits among those named problems on the broadcasters' own reading.
Our own monitoring finds the same staleness in published compliance guidance. Eleven published statements about European compliance deadlines were recorded on 21 August 2026 and checked again on 25 August 2026, each page archived with a SHA-256 hash of the exact bytes returned and a timestamp in UTC. By then at least 32 days had passed since Regulation (EU) 2026/1744, the instrument that corrects them, was published in the Official Journal on 24 July 2026.
All eleven were unchanged. None had been corrected. Every one was still wrong.
The eleven sit across four kinds of publisher: regulatory deadline trackers, international and United Kingdom law firms, a compliance guidance publisher, and a data protection consultancy, and none of the four moved faster than any other. Four of the pages carry their own last updated or last reviewed line, each dated before the instrument landed and untouched since, though the Official Journal event falls inside that window for three of them. A freshness stamp records when somebody last looked at a page, and it says nothing about whether the law moved after they did.
One page needs no percentage at all. SI 2026 No. 881 was made on 28 July 2026, and Part 2 of it came into force on 25 August 2026. On the very day the duty arrived, a reader of that page was told it was due by 31 August, six days away, on a page byte-identical to our archive of four days earlier. Two dated observations set a floor: these eleven were still uncorrected after at least 32 days, and how long a correction takes is unmeasured here, because none has happened.
Six days, on a stale page.
Hiring the problem away turns out to have numbers of its own. Barclay Simpson, a compliance recruiter, reports in its 2026 UK compliance salary guide that 93 per cent of organisations find it challenging to hire the right compliance people, while base salaries were broadly flat last year, a decline in real terms, and three quarters of employers plan rises of only 1 to 4 per cent for 2026. The guide states no sample size, so read it as one recruiter's account, and what it describes is a shortage of the right skills. A firm of twelve was never winning that auction anyway, with the junior London band starting around £40,000 before employer costs, so the work waits for nobody and lands on the person already there. A wrong page used to stay a wrong page and stop there, and published guidance travels further now: AI search systems read what is published and answer from it continuously, so one uncorrected sentence becomes an unlimited number of confident answers, each delivered without the hedge a careful writer would have put around it. The broadcasters' study is that process measured, and a stale compliance page has become a source, feeding readers who will never see the page.
That turns the question of where compliance information comes from into a business decision, and one a reader can take deliberately. Google Search allows preferred sources to be set, after which those sources appear more often in Top stories and in a From your sources section of that reader's own results. Choosing a source you have checked, and keeping it chosen, is the cheapest control there is over what the machine hands back later.
What ComplianceSME did about the mess is a short list. The GDPR system is free, for every business, under the EU and the UK regimes alike, and the company law library is free for the United Kingdom and for each of the twenty-seven European Union member states, twenty-eight nations in all. Each system is written to the instrument itself, kept simple, built to be run. Every one carries a training module holding the regulation, and AI literacy is trained at the start of every session, so the person at the keyboard knows what the model can and cannot be trusted with.
There is a reason for that beyond price. The person carrying compliance in a small firm is being asked to make sense of a mess they did not create, on top of the job they were hired to do, and an ordered workday ending in results they can trust and put in front of somebody else is a different working life from one spent guessing. We hold that as a position.
For the person in the company of twelve, none of this shrinks the rulebook. What changes is what happens when they go looking. The free assessment returns the obligations that apply to their business and leaves out the ones that do not, the company law library for their country is there, and so is the GDPR system, and a checked source set as a preferred one means the next answer comes back from something somebody stood behind. Looking something up stops being a research project with an uncertain answer waiting at the end.