Compliance is the next value lever PE can deploy across a whole portfolio

Every operating company I have run arrived with two systems already working on day one. Payments took cards, handled the card networks, and reconciled to the ledger. Marketing automation sent the nurture sequence when a lead filled in a form. Nobody wrote a scope of work for either. They came out of the box, and an operating partner could put the same two line items in front of every management team without an argument.

Compliance never came that way. It came as a consultancy's proposal, priced in hours, staffed by people who read regulations and chased suppliers for paperwork, and it had to be rebought company by company. When a fund asked what it could deploy across the whole portfolio, compliance was not on the list, because there was nothing to deploy. There was only a team to hire.

Here is the claim I want to defend. A function becomes a portfolio-wide value lever the moment it stops being sold as hours and starts shipping as a product. Payments and marketing automation crossed that line a decade ago. Compliance is crossing it now, and the firms that treat it as a product deployment rather than a consulting engagement will get market access, an evidence base, and audit readiness at a marginal cost the consulting model never allowed.

The return math moved to operations

Private equity's own literature sorts what a fund does to a company into three kinds of engineering. Kaplan and Strömberg's 2009 survey names financial engineering (leverage and management equity), governance engineering (small boards that meet often and replace managers early), and operational engineering, the newer practice of applying "industry and operating expertise" through operating professionals and a value-creation plan.¹ Gompers, Kaplan and Mukharlyamov surveyed 79 firms managing over $750 billion and found that increasing revenue was "identified by PE investors as being important in over 70% of their deals," against 36 percent for cost reduction before the deal and 47 percent after.²

What has changed since those surveys is the price of doing nothing. Bain's 2026 Global Private Equity Report puts it bluntly: in the low-rate era, "steadily rising multiples ... powered over 50% of all buyout returns," and a typical deal needed about 5 percent annual EBITDA growth to return 2.5x. With borrowing at 8 to 9 percent and leverage closer to 30 to 40 percent, the same return now needs "something closer to 10%–12%" EBITDA growth over five years.³ Bain's heading for this is "12 is the new 5."

A fund cannot find 12 percent a year deal by deal. It needs levers that work in every company at once, which is why operating partners build portfolio playbooks. The question is what qualifies.

What makes a lever portfolio-wide

Three properties, in my experience, separate the levers that deploy everywhere from the ones that stay in the deck.

The interface is set outside the company. Card acceptance works the same way in a dental chain and a machine shop because the networks and the acquirers define it, not the merchant. Stripe's hosted checkout documentation says it plainly: "We enable cards and other common payment methods for you by default," and tax collection is one parameter, automatic_tax: {enabled: true}.⁴ A portfolio company does not negotiate with Visa. It integrates.

The marginal cost of the next deployment is near zero. HubSpot's launch post for Workflows described the shape of marketing automation as a product: pick a starting condition "such as a contact completing a form," add emails and delays, no code.⁵ Rolling that out to the eleventh company costs the same as the tenth. A consultant's eleventh engagement costs the same as the first.

The output is measurable at the fund level. Authorization rate, take rate, and lead-to-opportunity conversion roll up across companies with no translation. Tom Libeg of Grant Thornton, on why portfolio-wide AI programs stall: "You can't walk into a portco and mandate an AI deployment. Management teams have their own priorities. What moves them is evidence."⁶ Evidence is easier to produce when every company measures the same thing.

Payments and marketing automation pass all three. That is the whole reason they came out of the box.

Why compliance failed the test

ISO 37301, the international compliance management standard, defines compliance as "meeting all the organization's compliance obligations," and compliance obligations as "requirements that an organization mandatorily has to comply with as well as those that an organization voluntarily chooses to comply with."⁷ Read that as an operator and the problem is visible. Compliance is a changing set of obligations applied to a changing set of products and suppliers, and keeping the two aligned has meant reading, chasing, and judging. All three were labor.

The spend pattern shows it. Thomson Reuters' 2022 survey of almost 500 compliance practitioners found 30 percent of compliance functions outsourcing some or all of their work, and 66 percent expecting the cost of senior compliance staff to rise that year.⁸ That survey leans toward financial services, so treat it as directional for manufacturing. The Crain study for the National Association of Manufacturers puts the federal regulatory burden at $29,100 per employee per year for US manufacturers and $50,100 for those with fewer than 50 employees, with environmental rules 19 percent of the total.⁹ Whatever you make of the methodology, that is the line the consultants were billing against.

So compliance had a standardized interface all along, the regulation itself, and failed the other two tests. Every deployment was a new team, and no two companies measured the same thing, so nothing rolled up to the fund.

The mechanism

What changed is that the reading and the chasing became software, and the regulation supplied the interface.

Start with what the regulation demands, because it is more concrete than most operators assume. Under the EU's RoHS directive, a manufacturer placing electrical equipment on the market must "draw up the required technical documentation and carry out the internal production control procedure in line with module A of Annex II to Decision No 768/2008/EC," then "draw up an EU declaration of conformity and affix the CE marking," and "keep the technical documentation and the EU declaration of conformity for 10 years after the EEE has been placed on the market." Materials assessed against a harmonised standard published in the Official Journal "shall be presumed to comply."¹⁰ Read as a data model, that is an obligation, an evidence requirement, a retention period, and a presumption rule.

The Ecodesign for Sustainable Products Regulation goes further and makes the model explicit. Its digital product passport is "a set of product information requirements" carried by a data carrier and a unique product identifier, built on interoperable standards, machine-readable, and meant to let authorities verify compliance and let repairers and recyclers do their work.¹¹ When the regulator specifies the schema, the interface has been set outside the company in exactly the way card networks set it for payments.

On the software side, the field's current approach to regulatory text is to stop treating it as prose. Chung and colleagues, in a paper accepted to the 2026 Web Conference, convert a regulation into a policy graph of "normalized subject-constraint-context-condition tuples" linked by explicit cross-references, convert the real-world situation into a context graph of entity-relation triples, and run a compliance gate that does deterministic structural matching before any language-model judgment, with exceptions handled by defeasible logic. On GDPR scenarios the structured approach beat plain language-model and retrieval-augmented baselines by 4.1 to 7.2 points of micro-F1 and by 12 to 20 points on recall-weighted F2, the metric that matters when a missed violation is worse than a false alarm.¹²

The same idea applies to evidence. ISO 19011 defines audit evidence as "records, statements of fact or other information, which are relevant to the audit criteria and verifiable," and audit findings as the "results of the evaluation of the collected audit evidence against audit criteria."¹³ A supplier's declaration of conformity, a material declaration, a test report: each is a document from which typed facts can be extracted and mapped to obligations in the policy graph. The chasing becomes a queue of open evidence requirements per part and per supplier, with a due date and a status. The judging becomes a verdict function over extracted rules and extracted facts, with ambiguous cases routed to a person.

Put the layers together and compliance now passes the three tests. The interface is the regulation and its schemas. The marginal deployment is a configuration: this company's products, this company's suppliers, the same obligation model. The fund-level metric is evidence coverage, the share of obligations for which verifiable evidence exists, and it means the same thing in every company.

The strongest objection

The obvious objection is that language models are unreliable readers of law. Dahl, Magesh, Suzgun and Ho tested exactly this and found legal hallucinations "occurring between 58% of the time with ChatGPT 4 and 88% with Llama 2, when these models are asked specific, verifiable questions about random federal court cases," and that the models "cannot always predict, or do not always know, when they are producing legal hallucinations."¹⁴ Anyone putting a model between a regulation and a product decision has to answer that.

The answer is that the paper measures open-ended recall, asking a model what the law says with nothing in front of it, which is the design the mechanism above forbids. The regulation is in the policy graph, extracted and reviewed once. The evidence is in the context graph, extracted from a document that exists. The verdict is a deterministic function over both. The model reads; it does not remember. Dahl's result is the strongest argument I know for that separation.

A second objection is that portfolio-wide levers may be a selection story. Bloom, Sadun and Van Reenen found PE-owned plants better managed than family-run ones, with the largest gap in monitoring practices, but wrote that "we cannot distinguish selection from treatment effects."¹⁵ Fair. My reply is only that compliance evidence is the rare lever whose effect is directly observable: the technical file either exists for every product or it does not.

The third is adoption. FTI's May 2026 survey of 200 fund and operating leaders found 36 percent "using AI across use cases" and only 7 percent at "enterprise scale."¹⁶ Grant Thornton's survey found 9 percent of private equity respondents confident they could pass an AI governance audit within 90 days.⁶ Both numbers say the same thing: funds are deploying models faster than they are producing evidence about them, which is the failure mode compliance software exists to prevent.

The worked example

At Certivo, the deployment for a new company is the model above run on that company's bill of materials. The regulations are already in the rule layer, with the AI setting the strictest defensible reading of each obligation, and the business allowed to relax it with a recorded reason: one program requires a full material declaration and a certificate of conformance, another accepts the certificate alone. Supplier documents come in, facts come out, and each part carries a verdict and a list of what evidence is still missing. The human in the loop owns the relaxations and the residue.

Three outputs matter to an operating partner. Market access: the technical documentation and declaration of conformity that RoHS requires before a product can carry a CE mark exist as a byproduct of the verdict, which is the difference between shipping into Europe this quarter and next year. Evidence: every verdict traces to a document, a rule, and a date. Audit management: when a customer, a market-surveillance authority, or a buyer's diligence team asks, the ten-year file is a query rather than a project. None of it needed a scope of work.

What it means for the operating partner

Three decisions follow.

Put compliance in the 100-day plan as a product deployment, with the same status as the payments migration. If the vendor's proposal is priced in hours, it is not the thing this essay describes.

Report evidence coverage at the portfolio level, by obligation and by company, the way you report authorization rates. Coverage is the metric that tells you which company cannot ship into which market, which is a revenue fact before it is a risk fact.

Diligence the evidence base as an asset. A ten-year retention obligation means the file outlives your hold period, and a buyer will read it. A company that can produce it on request has already answered the questions that stretch an exit.

The consulting model made compliance a cost you paid to avoid a fine. The product model makes it a system that decides where you can sell and proves it. Payments went through this shift and became a lever every operating partner takes for granted. Compliance is going through it now, and the firms that notice first will have a lever the rest of the market is still buying by the hour.

— Kunal