European organisations have invested heavily in compliance since 2023. NIS2, DORA, the EU AI Act, GDPR: programmes are multiplying, budgets are rising, steering committees are meeting. Yet, according to a PwC analysis published in early 2026, nearly 58% of the GRC leaders surveyed say that their perceived level of risk exposure has not decreased despite the rise in compliance spending. This figure reveals a structural confusion: regulatory compliance and risk management are two distinct disciplines. One answers to the regulator. The other protects the organisation. Knowing which of the two you are really investing in is the first strategic question for any Chief Risk Officer.
The distinction that regulators do not draw clearly
NIS2 requires a risk management policy. DORA imposes resilience testing. The EU AI Act requires a conformity assessment before deployment. These obligations create an intense documentary activity (registers, policies, reports) that can give the illusion of mature risk management. The reality is more nuanced. An organisation can pass a NIS2 audit successfully and fall victim to a major cyber incident three months later, precisely because formal controls and real operational risks do not always coincide. This gap is not a failure of the regulatory framework: it is the consequence of a response designed to satisfy the auditor rather than to reduce exposure. The five signals below will help you diagnose this gap in your own organisation.
Signal 1: your GRC budget is structured by regulation, not by risk
If your budget lines are called "NIS2", "DORA" and "AI Act" rather than "critical infrastructure", "operational continuity" and "supplier risk", your allocation follows regulatory deadlines, not actual exposure. This structure creates predictable blind spots: risks that are not explicitly addressed by a text in force (an emerging technological dependency, a geographic concentration of providers, an attack vector not covered by current frameworks) remain outside scope. An organisation that truly manages risk allocates its resources where exposure is highest, regardless of the regulatory calendar. Compliance follows from this; it is not the driving force.
Signal 2: your dashboards measure control coverage, not risk reduction
"74% of controls are green." This metric is comforting and entirely useless for steering real risk. It tells you what you have declared you are doing, not what you have reduced. The indicators of operational risk management are read differently: average time to detect an incident, concentration of critical ICT providers below a substitutability threshold, change in residual risk score on priority assets quarter after quarter. If your reporting to the executive committee presents coverage rates but no change in residual risk, you have a compliance dashboard, not a risk management dashboard.
Signal 3: your incidents occur in areas declared compliant
This is the most revealing signal, and the most uncomfortable. If your security incidents, service interruptions or third-party failures regularly occur in scopes that your GRC programme had classified as compliant or low risk, there is a disconnect between your documentary mapping and operational reality. A qualified ICT provider that meets your DORA requirements can still cause a critical service interruption, if the qualification focused on contractual documentation rather than on effective continuity testing. Compliance of a scope does not guarantee the absence of risk within that scope.
Signal 4: your risk committee is less active than your compliance committee
Governance reveals an organisation's real priorities better than any written policy. If your compliance steering committee meets monthly with a full agenda, while your risk committee meets quarterly with a residual agenda, the implicit hierarchy is clear. Operational risk management requires a review frequency at least comparable to that of compliance: exposures change, threats shift, providers change their risk profile. An organisation that gives risk less structured attention than compliance is structurally investing in the wrong discipline.
Signal 5: you cannot quantify your change in risk from one year to the next
Ask your team directly: what is your level of operational risk exposure today, compared with twelve months ago? In which direction have you moved, and by how much? If your team can answer precisely on NIS2 or DORA coverage but not on this question, the diagnosis is made. Mature risk management produces a longitudinal measure of exposure: not perfect, but documented, discussed, and used to guide future investment. It is this measure that distinguishes a GRC programme that actually manages risk from one that documents its compliance.
How to assess your position
A GRC positioning review, compliance versus risk control, can be carried out in a few weeks: analysis of the indicators reported to the executive committee over the last twelve months, review of the budget structure and its alignment with the risk mapping, and interviews with operational managers to qualify the perceived gap between documentation and field reality. Presidio includes a residual risk management module that explicitly distinguishes coverage metrics from exposure metrics, allowing GRC teams to report both dimensions in parallel. See also our analysis of NIS2, DORA and EU AI Act convergence and our piece on supplier risk governance, or contact our team for a scoping interview.
Conclusion
Regulatory compliance is an obligation. Risk control is a competitive advantage. Organisations that confuse the two devote growing resources to satisfying auditors without necessarily reducing their operational exposure. The five signals described here are diagnostics, not judgements. Most GRC programmes started as responses to an urgent regulatory obligation, and have not yet made the transition to a risk steering logic. That transition is the next structuring challenge for Chief Risk Officers who want their programme to truly matter.