In a company of twelve people, compliance belongs to somebody who was hired to do something else. It sits with the finance manager, the operations lead, or the founder, and if the firm sells into the European Union from the United Kingdom, or across a border inside the Union, it answers to two rulebooks that arrived without a job description between them.

The weight has been measured. The 2025 Eurobarometer survey of small and medium-sized enterprises covered more than 17,000 companies, 13,000 of them across the twenty-seven member states, and 64 per cent of EU SMEs named regulatory complexity as the main barrier to their growth, ahead of late payments at 39 per cent and access to finance at 27 per cent. The European Commission reported the result on 18 July 2025, and its own simplification programme concedes the point with a target cut of at least 25 per cent in administrative burden for all businesses, at least 35 per cent for SMEs, against 37.5 billion euro of recurring administrative cost identified for the 2024 to 2029 mandate. Where the reformed United Kingdom regime and the unchanged EU one have diverged, in the detail more than the headline, is set out in our earlier piece on the dual regime. This article asks what keeping up with both costs the person who has to do it, and whether what they find when they look is correct.

Take the national picture first, because it has official statistics behind it. The Health and Safety Executive's key figures for Great Britain covering 2024/25, released on 20 November 2025, record 964,000 workers suffering work-related stress, depression or anxiety, inside 1.9 million people with a work-related illness and 40.1 million working days lost to work-related illness and injury, and stress, depression or anxiety accounts for 52 per cent of all work-related ill health. A caution belongs beside those figures: the HSE does not identify regulatory or compliance workload as a named cause within them, and we have found no source that does. What they establish is the scale of what workplaces already carry before anybody opens a rulebook.

The profession that does compliance full time has reported its own condition. Corporate Compliance Insights surveyed more than 300 compliance professionals for its Compliance Officer Stress and Mental Health Report 2025, published on 26 February 2025. Fifty-one per cent said they feel burned out at work, 49 per cent had experienced anxiety-related difficulties in the past year, only 27 per cent said they were adequately resourced, and 78 per cent work more than 41 hours a week. Officers reporting into a structure they judged ineffective showed roughly double the rate of high job-related stress, 60 per cent against 31 per cent, which points at how the job is arranged more than at the temperament of whoever holds it. And these are the people who do compliance as their whole job, while the person in the firm of twelve has the same rulebook and no department behind them.

The same survey also carries evidence that points the other way. Burnout is down from 59 per cent in 2022, and self-rated effectiveness has risen to 73 per cent from 57 per cent over the same period.

The standing of the job is improving faster than the resourcing of it.

Then there is the question of whether what they find is right. Researchers at Stanford, publishing in the Journal of Empirical Legal Studies in 2025, hand-scored 202 preregistered legal queries put to the paid professional AI legal research tools, and those tools returned incorrect or misleading information on between roughly one in six and one in three queries. The European Broadcasting Union and the BBC published a wider study on 22 October 2025, covering 22 public service media organisations in 18 countries with more than 3,000 responses assessed by working journalists: general-purpose AI assistants misrepresented news content in 45 per cent of answers, 20 per cent contained major accuracy problems, and outdated information sits among those named problems on the broadcasters' own reading.

Our own monitoring finds the same staleness in published compliance guidance. Eleven published statements about European compliance deadlines were recorded on 21 August 2026 and checked again on 25 August 2026, each page archived with a SHA-256 hash of the exact bytes returned and a timestamp in UTC. By then at least 32 days had passed since Regulation (EU) 2026/1744, the instrument that corrects them, was published in the Official Journal on 24 July 2026.

All eleven were unchanged. None had been corrected. Every one was still wrong.

The eleven sit across four kinds of publisher: regulatory deadline trackers, international and United Kingdom law firms, a compliance guidance publisher, and a data protection consultancy, and none of the four moved faster than any other. Four of the pages carry their own last updated or last reviewed line, each dated before the instrument landed and untouched since, though the Official Journal event falls inside that window for three of them. A freshness stamp records when somebody last looked at a page, and it says nothing about whether the law moved after they did.

One page needs no percentage at all. SI 2026 No. 881 was made on 28 July 2026, and Part 2 of it came into force on 25 August 2026. On the very day the duty arrived, a reader of that page was told it was due by 31 August, six days away, on a page byte-identical to our archive of four days earlier. Two dated observations set a floor: these eleven were still uncorrected after at least 32 days, and how long a correction takes is unmeasured here, because none has happened.

Six days, on a stale page.

Hiring the problem away turns out to have numbers of its own. Barclay Simpson, a compliance recruiter, reports in its 2026 UK compliance salary guide that 93 per cent of organisations find it challenging to hire the right compliance people, while base salaries were broadly flat last year, a decline in real terms, and three quarters of employers plan rises of only 1 to 4 per cent for 2026. The guide states no sample size, so read it as one recruiter's account, and what it describes is a shortage of the right skills. A firm of twelve was never winning that auction anyway, with the junior London band starting around £40,000 before employer costs, so the work waits for nobody and lands on the person already there. A wrong page used to stay a wrong page and stop there, and published guidance travels further now: AI search systems read what is published and answer from it continuously, so one uncorrected sentence becomes an unlimited number of confident answers, each delivered without the hedge a careful writer would have put around it. The broadcasters' study is that process measured, and a stale compliance page has become a source, feeding readers who will never see the page.

That turns the question of where compliance information comes from into a business decision, and one a reader can take deliberately. Google Search allows preferred sources to be set, after which those sources appear more often in Top stories and in a From your sources section of that reader's own results. Choosing a source you have checked, and keeping it chosen, is the cheapest control there is over what the machine hands back later.

What ComplianceSME did about the mess is a short list. The GDPR system is free, for every business, under the EU and the UK regimes alike, and the company law library is free for the United Kingdom and for each of the twenty-seven European Union member states, twenty-eight nations in all. Each system is written to the instrument itself, kept simple, built to be run. Every one carries a training module holding the regulation, and AI literacy is trained at the start of every session, so the person at the keyboard knows what the model can and cannot be trusted with.

There is a reason for that beyond price. The person carrying compliance in a small firm is being asked to make sense of a mess they did not create, on top of the job they were hired to do, and an ordered workday ending in results they can trust and put in front of somebody else is a different working life from one spent guessing. We hold that as a position.

For the person in the company of twelve, none of this shrinks the rulebook. What changes is what happens when they go looking. The free assessment returns the obligations that apply to their business and leaves out the ones that do not, the company law library for their country is there, and so is the GDPR system, and a checked source set as a preferred one means the next answer comes back from something somebody stood behind. Looking something up stops being a research project with an uncertain answer waiting at the end.

More from ComplianceSME

Every claim and its source

64 per cent of EU SMEs naming regulatory complexity as the main barrier to growth, late payments at 39 per cent and access to finance at 27 per cent, from more than 17,000 companies with 13,000 across the twenty-seven member states: 2025 Eurobarometer survey of small and medium-sized enterprises, start-ups and scale-ups, reported by the European Commission on 18 July 2025. The simplification target of at least 25 per cent burden reduction for all businesses and at least 35 per cent for SMEs, against 37.5 billion euro of recurring administrative cost identified for the 2024 to 2029 mandate: European Commission simplification programme. 964,000 workers with work-related stress, depression or anxiety, 1.9 million people with a work-related illness, 40.1 million working days lost, and stress, depression or anxiety at 52 per cent of all work-related ill health: Health and Safety Executive, key figures for Great Britain 2024/25, released 20 November 2025. 51 per cent burned out, 49 per cent reporting anxiety-related difficulties in the past year, 27 per cent adequately resourced, 78 per cent working more than 41 hours a week, and more than 300 compliance professionals surveyed: Corporate Compliance Insights, Compliance Officer Stress and Mental Health Report 2025, published 26 February 2025. High job-related stress at 60 per cent against 31 per cent under a reporting structure judged ineffective, burnout down from 59 per cent in 2022, and self-rated effectiveness risen to 73 per cent from 57 per cent: same Corporate Compliance Insights report. Paid professional AI legal research tools returning incorrect or misleading information on between roughly one in six and one in three of 202 preregistered, hand-scored queries: Magesh, Surani, Dahl, Suzgun, Manning and Ho, Stanford, Journal of Empirical Legal Studies, 2025. AI assistants misrepresenting news content in 45 per cent of answers with 20 per cent carrying major accuracy problems, outdated information among them, across 22 public service media organisations in 18 countries and more than 3,000 journalist-assessed responses: European Broadcasting Union and BBC study, published 22 October 2025. The eleven published statements about European compliance deadlines recorded on 21 August 2026 and rechecked on 25 August 2026, each page archived with a SHA-256 hash of the exact bytes and a timestamp in UTC, all eleven unchanged, the four publisher types, and the four freshness-stamped pages: ComplianceSME monitoring record, second pass, 25 August 2026. Regulation (EU) 2026/1744, the instrument that corrects those statements, published in the Official Journal on 24 July 2026: Regulation (EU) 2026/1744, Official Journal 24 July 2026. SI 2026 No. 881 made on 28 July 2026 with Part 2 in force on 25 August 2026, and the page still stating 31 August on that day, byte-identical to the archive of four days earlier: SI 2026 No. 881; ComplianceSME monitoring record, second pass, 25 August 2026. 93 per cent of organisations finding it challenging to hire the right compliance people, base salaries broadly flat last year, three quarters of employers planning rises of only 1 to 4 per cent for 2026, and a junior London band starting around 40,000 pounds before employer costs: Barclay Simpson, 2026 United Kingdom compliance salary guide, which states no sample size. Preferred sources appearing more often in Top stories and in a From your sources section of that reader's own results: Google announcement of the Preferred Sources feature in Google Search, read 25 August 2026. The free GDPR system for the European Union and United Kingdom regimes, the free company law library for the United Kingdom and each of the twenty-seven member states, the training module carried by every system, AI literacy trained at the start of every session, and the free assessment returning only the obligations that apply: ComplianceSME published pages, read 25 August 2026. Every claim above verified 25 August 2026, with the full claims register held on file.