When regulations exist but aren’t enforced

There’s something uniquely frustrating about building in a market where the rules exist, but no one bothers to enforce them. At first glance, it might seem like an ideal environment for innovation. Less red tape, fewer watchdogs, more freedom. But if you’re building something in the compliance or security space, that lack of enforcement can turn into quicksand.

Take GDPR or CCPA. Those laws created a flood of urgency. The fines were real, the headlines loud, and the stakes high. Startups rushed to fill the gap with SaaS tools that helped businesses stay compliant. And companies, both big and small, moved quickly to adopt them because they had to. That urgency created an ecosystem. It attracted investors, fueled startups, and moved markets. But in places where similar laws exist on paper but lack teeth, it’s a different game entirely. Businesses start doing the math. No enforcement means no real consequence. So why spend money fixing a problem that no one’s asking them to fix?

That’s where the challenge sets in. As a startup, how do you create urgency when the law doesn’t? How do you make a product feel essential when your customers see it as optional? Even if they understand the value, they may not act on it. Without the pressure of fines or audits, compliance becomes something to think about later. Maybe.

It gets harder still. Price becomes a sticking point. Budgets shrink. Sales cycles drag. Your product, once positioned as a shield against liability, starts looking more like a luxury. And suddenly, you're not just selling a tool. You're selling belief. You're asking customers to do the right thing without being forced to.

In these kinds of markets, you have to shift. You educate, yes. But not with fear. Fear fades. Instead, you talk about trust. You talk about how protecting data isn’t just about checking boxes. It’s about credibility, about building a brand that people want to do business with. You shift the spotlight from fines to future value. You stop selling compliance and start selling confidence.

Sometimes that means reframing the product entirely. Not “this keeps you out of trouble,” but “this helps you run cleaner, smarter, safer.” You speak to companies that care about global standards. You find the ones thinking two steps ahead, not just the ones avoiding risk.

It’s a slower road. But in many ways, it’s a more honest one. Because at the end of the day, markets respond to signals. Enforcement is a signal. So is neglect. And just like poverty changes what people buy, lax regulation changes what businesses prioritize.

If you're building in this space, it’s not enough to be right. You have to be relevant. You have to align with how people make decisions in the real world. Sometimes, that means rethinking the pitch entirely. Not because your product isn’t valuable, but because value means different things depending on who’s listening.