Every major regulatory wave creates a market: lawyers, DPOs, auditors, consultants, RegTech, public affairs, training and certification.
5.1Compliance has become an industry
The GDPR invented a profession: DPOs, privacy lawyers, compliance consultants. The AI Act is creating the same pull with AI governance, auditors, notified bodies, documentation tools and compliance software.
The big historical winners are law firms, large consultancies and RegTech: OneTrust internationally, Didomi, Dastra or Naaia on the French side.
5.2Demand is structural
The regulated perimeter is exploding: entities under NIS2, employers using AI in HR, platforms under the DSA, crypto players under MiCA, administrations under cloud doctrines and public algorithms. Massive lobbying signals a simple reality: the rules matter.
5.3The jobs
- In companies: DPO, digital lawyer, compliance officer, AI governance officer, policy officer, trust & safety.
- With regulators and in government: CNIL, Arcom, ANSSI, the AI Office, DINUM, ministries, PEReN.
- Internationally: digital diplomacy, the UN, the OECD, the Council of Europe, standardisation.
- In the public debate: think tanks, NGOs, research, tech journalism and civic tech.
5.4Who captures the value?
Value is shared between firms, RegTech, certifiers, auditors, training providers, certification platforms and sometimes the regulators themselves, as with DSA supervision funded by a fee on very large platforms.
Key takeaway for entrepreneurs
Regulatory complexity is the market. The most open niche: making combined GDPR + AI Act + NIS2 compliance simple and affordable for SMEs, mid-sized companies and local authorities.
Sources
IAPP on the privacy profession and the AI Governance Professional certification; Corporate Europe Observatory; documentation of the RegTech vendors cited.
Finished this module?
Your progress is saved on this device.