Waiting on compliance rules can pay, but waiting on supplier data never does

On 13 April 2026, the day American manufacturers and importers were due to start filing reports on per- and polyfluoroalkyl substances (PFAS) with the Environmental Protection Agency (EPA), the agency published a final rule moving the start to 31 January 2027. It was the third time the date had moved. The original was 12 November 2024.¹

Five months later, on 11 September 2026, the European Union's Cyber Resilience Act (CRA) began requiring manufacturers to report actively exploited vulnerabilities in their products: an early warning within 24 hours, a full notification within 72. That date did not move, and the duty covers products already on the market, not only new ones.²

A manufacturer that put off its PFAS reporting work in 2024 looks prudent today. One that put off knowing what is inside its connected products now has 24 hours to say which of them contain a component nobody inventoried. Both boards made the same call. What separated them was what the wait could buy.

My claim: waiting on a compliance decision pays only when the delay can bring news that would cancel the work. A rule under active revision can produce that news. The supplier data that several rules read cannot, so a delay there is a cost with nothing on the other side of the ledger.

The case for waiting is real

Economists have a precise account of why waiting can be worth money, and it deserves a hearing before anyone calls deferral irrational. Robert Pindyck's survey of irreversible investment treats the right to delay as an option, a real option, and makes the argument in two steps. A firm that can delay gets "an opportunity to wait for new information about prices, costs, and other market conditions before it commits resources." Investing kills that option, and "this lost option value must be included as part of the cost of the investment."³ Money spent on a compliance program is mostly sunk: consultant hours, supplier surveys, integration work.

Firms behave as the theory predicts. Huseyin Gulen and Mihai Ion found a strong negative relationship between corporate investment and a news-based index of policy uncertainty, and found it "significantly stronger for firms with a higher degree of investment irreversibility."⁴

The last two years paid the firms that waited. The EU's stop-the-clock directive of April 2025 pushed reporting under the Corporate Sustainability Reporting Directive (CSRD) for the second wave of large companies from financial year 2025 to 2027. In February 2026 the Omnibus I directive then limited that reporting to companies with more than 1,000 employees and more than €450 million in turnover.⁵ The deforestation regulation, due to apply in December 2024, moved to December 2025 and then to December 2026.⁶ A European manufacturer with 600 employees that skipped its CSRD preparation in 2024 made the right call. It is now out of scope.

What a wait can buy

The theory that justifies waiting also says when it stops. Ben Bernanke's 1980 paper on irreversible investment showed that the incentive to wait depends only on the outcomes that would make you regret committing: "only the left side of the outcome distribution is relevant; this formalizes the idea that waiting is done principally for reasons of caution."⁷ Economists call this the bad-news principle. Good news, such as a rule confirmed or a date held, adds nothing to the value of waiting, because you would have gone ahead anyway.

That turns the decision into arithmetic a board can run. In the simplest one-period version, let C be the part of the program's cost that bad news would let you avoid, p the probability that such news arrives during the wait, and D the cost of delay over the same period: the manual work that continues and the exposure that builds as deadlines arrive. Waiting beats acting when p × C is greater than D. Put another way, the wait pays only if the odds of canceling news exceed D ÷ C. If a year of delay costs a fifth of the program, you need better than one-in-five odds that something will make the program unnecessary.

Don Reinertsen's rule for product development applies here: "If you only quantify one thing, quantify the cost of delay."⁸ Most deferral decisions quantify neither D nor p. They compare the program's price with zero. Pindyck makes the same point from the other direction: "The less time there is to delay, and the greater the cost of delaying, the less will irreversibility affect the investment decision."³

One program, three decisions

The mistake is to treat "the compliance program" as one investment with one p. It is at least three decisions, and each has its own odds.

The first is data: what is in each part, which supplier made it, what they declared and when, which software components ship in which product. The second is filing: the reports, registrations and formats that one specific rule demands. The third is the system the work runs in.

Hugh Courtney, Jane Kirkland and Patrick Viguerie sorted strategic moves under uncertainty into big bets, options and "no-regrets moves," which they defined as "moves that will pay off no matter what happens."⁹ The data layer is a no-regrets move. For a company that keeps selling the product, no plausible news cancels it. The EU's restriction on PFHxA (perfluorohexanoic acid) sets a limit of 25 parts per billion in consumer textiles, footwear, food-contact paper and cosmetics from 10 October 2026.¹⁰ Whatever scope EPA finally sets for its PFAS reporting rule under the Toxic Substances Control Act (TSCA), the question underneath is the same one: which PFAS are in what you make or import. From December 2027 the Cyber Resilience Act requires manufacturers to "identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials."² The 24-hour reporting duty that began this month already assumes you can answer that question. For the data layer, p is close to zero, and so is the value of waiting. There is an edge to this. Data that only one rule asks for belongs with that rule's filing and can wait with it. The no-regrets layer is the part and component data that several rules read.

The filing layer is an option in Courtney's sense, and here the case for waiting holds. The 600-person company that built its sustainability reporting format in 2024 bought a format for a rule it no longer falls under. Wait on a filing when a published proposal to amend the rule exists, and set the date you will stop waiting.

The system layer is what Jeff Bezos called a two-way door: "Many decisions are reversible, two-way doors."¹¹ A compliance system is reversible on one condition, that the data can leave it in a usable form. Put the export terms in the contract, and choosing the tool becomes the cheapest of the three decisions to get wrong.

Run it on a mid-sized maker of connected industrial equipment that sells into Europe and the United States. Supplier material declarations and a component inventory: act now, because several rules on its calendar read them. The CRA reporting process: act now, because the date held and the duty already covers its installed base. CSRD: below 1,000 employees it is out of scope, and above that the first report covers financial year 2027, so the filing work can be scheduled against a known date. TSCA PFAS reporting: collect the data now and wait on the filing.

The irreversible cost sits on the waiting side

Real-options logic favors waiting because the investment cannot be undone. In compliance, the least reversible loss in the whole decision happens while you wait.

Software engineers measure knowledge concentration with the truck factor, "a metric proposed by the agile community as a tool to identify concentration of knowledge in software development environments." In a study of 133 popular open-source projects, 65 percent had a truck factor of two or less.¹² I would bet that many compliance functions at mid-sized manufacturers run with a truck factor of one: the person who knows which supplier's declaration is stale and why a part was cleared in 2019. In 2026 the US manufacturing quit rate has run between 1.3 and 1.5 percent a month.¹³ Applied to one person, that is roughly a one-in-six chance of a resignation within a year, before counting retirement, and tenured specialists quit less than the average worker. Whatever the true figure for your team, the knowledge that leaves does not come back when the budget is approved.

Why the default is to wait anyway

If the arithmetic is this clear, why do boards defer the data layer? Two findings explain most of it.

William Samuelson and Richard Zeckhauser showed that "individuals disproportionately stick with the status quo," and that "the more options that were included in the choice set, the stronger was the relative bias for the status quo."¹⁴ Amos Tversky and Eldar Shafir then measured what one extra good option does. Offered a single attractive CD player on sale, 34 percent of subjects chose to wait and learn more about other models. Offered two attractive players, 46 percent waited.¹⁵ The second player told them nothing new about the first. It added conflict, and the conflict produced the delay.

A vendor evaluation with three credible finalists is that experiment at company scale. The deferral it produces waits for information about the tools, the layer where a wrong choice is cheapest, while the cost of delay accrues on the layer where no information is coming. Bezos's rule of thumb was that "most decisions should probably be made with somewhere around 70% of the information you wish you had," and his reason was that for a company good at course correcting, "being wrong may be less costly than you think, whereas being slow is going to be expensive for sure."¹¹

What a board should ask

When a compliance program comes up for deferral, three questions settle most of it.

What news are we waiting for, and would it cancel any of this work? If nobody can name a pending proposal that would change the scope, the wait is buying nothing.

Which layer does the delay touch? Deferring a filing under a rule that is being rewritten is a reasonable option. Deferring supplier data means paying D with no p on the other side.

Who holds the knowledge today, and what is our truck factor? If the answer is one name, the cost of delay includes a loss that no later budget can buy back.

Reinertsen has another principle: "Every decision has its optimum economic timing."⁸ For some compliance work in 2025 the right time was later, and the companies that waited were paid for it. For the part and component data that several rules read, the right time was the first time a regulator asked for it.

— Kunal