The Cost of Complexity: When Regulation Becomes a Business Risk
By Alexandra Loli, Ph.D., Publisher and Editor-in-Chief | Business Partners, Sep-Oct, 2026

Regulation is an essential part of a modern economy. It protects citizens and businesses, establishes common standards, strengthens trust, and creates the conditions for fair competition. But regulation also has a cost, and when rules become excessively complex, overlapping, unpredictable, or difficult to implement, that cost can become significant.

For businesses, complexity is rarely an abstract concern. It is measured in time, resources, delayed decisions, additional compliance requirements, and uncertainty. The burden can be disproportionate for smaller companies, while for larger investors, a lack of clarity or predictability can influence where and whether capital is deployed. This matters because competitiveness today is shaped not only by tax rates, infrastructure, skills, energy costs, and access to finance but also by the quality of the regulatory environment.

Greece has made substantial progress in becoming a more attractive and credible investment destination. Protecting that progress requires us to look beyond the number of reforms or regulations introduced and focus equally on how effectively they work in practice. The challenge, therefore, is not deregulation. It is better regulation: clear, proportionate, coherent, stable, and designed with an understanding of its cumulative impact on businesses and the economy.

This is precisely why the evolution of AmCham Greece’s Legislative Reforms Committee into the Business Environment and Legislative Affairs Committee is so timely. Its broader mandate reflects a broader reality: Legislation cannot be considered separately from competitiveness, innovation, investment, and growth.

One of the greatest strengths of AmCham Greece’s committees is their ability to evolve alongside the issues facing the business community. As those challenges change, so must the way we examine them. The transformation of our Legislative Reforms Committee into the Business Environment and Legislative Affairs Committee reflects exactly this principle.

The change is more than a new name. It recognizes that legislation today operates within an increasingly interconnected business environment. European and national regulation, AI and data governance, labor and social security frameworks, intellectual property, technology, compliance obligations, and institutional effectiveness all increasingly intersect. A rule introduced in one area can have consequences across investment, operations, innovation, employment, and competitiveness. This makes dialogue between policymakers and the business community more important but also more demanding.

The role of AmCham Greece is to bring together expertise from different sectors, understand how legislation functions in practice, identify unintended consequences, and contribute constructive, evidence-based recommendations that improve both policy outcomes and the business environment. Under the leadership of Mina Zoulovits, and with the valuable contributions of its members, the Business Environment and Legislative Affairs Committee brings together precisely the depth of legal and business expertise required for this task.

I look forward to the Committee’s work as a driving force for dialogue, practical insight, and meaningful recommendations and to its important contributions to AmCham Greece’s continuing work toward a more competitive and forward-looking business environment.

Companies today must transform continuously and fast to keep pace with technological developments, AI, and rapidly changing business models. Regulation should support this transformation, not become an additional obstacle to it. Yet regulatory complexity is creating risks in two different, and sometimes contradictory, ways.

Regulatory effectiveness should be measured not by the volume of rules, but by whether they provide clarity, protection, and room for responsible growth

On the one hand, businesses face an accumulation of rules pursuing similar compliance objectives without sufficient coordination. The EU has significantly expanded its regulatory framework for technological developments, often through detailed legislation that can create overlaps and ambiguities. A cybersecurity or data breach, for instance, may trigger notification requirements under the GDPR, NIS2, DORA, and the Cyber Resilience Act, potentially involving different authorities, deadlines, and auditing and reporting requirements. This complexity increases operational costs, creates additional compliance difficulties, especially for SMEs, and may undermine competitiveness, particularly where complex procedures and operations are involved, such as in large scale business with multiple business units. While each framework may have a legitimate objective, their cumulative or contradictory effect can lead to duplicated processes, increased administrative burdens, and substantial compliance costs, particularly for businesses operating across sectors.

On the other hand, businesses can face regulatory gaps that leave critical questions insufficiently clarified. As companies increasingly deploy AI, for example, important issues remain open under existing legal provisions. Questions such as who bears liability when an AI system causes harm, who owns intellectual property in AI-generated content, and who is responsible for unlawful, misleading, or infringing AI-generated content remain insufficiently addressed to provide adequate legal certainty. Such uncertainty can hinder productivity, investment, innovation, and market entry, particularly where businesses must prioritize risk avoidance. Hence, regulatory uncertainty can be as detrimental to investment and innovation as excessive regulation.

In any case, the answer, in all legal sectors, is not more regulation, but better regulation: clear, concise, coordinated, technology-neutral, and with proportionate rules. In this context, the new Business Environment and Legislative Affairs Committee’s aim is to:

• identify legal challenges for businesses, their employees, and their intellectual property rights (IPR) in the current fast evolving business landscape;
• engage in talks with market stakeholders across Greece, the EU, and the US;
• facilitate dialogue and the exchange of expertise; and
• contribute to discussions regarding the adoption of practical proposals and potential solutions for consideration by businesses and policymakers.

Regulatory effectiveness should ultimately be measured not by the volume of rules, but by whether they provide clarity, protection, and room for responsible growth.

Over-regulation is a particularly intense challenge for European listed companies. The EU market features a unique overlay of strict, bloc-wide transparency directives and regulations combined with local member-state enforcement, creating a regulatory landscape of unparalleled density.

The regulatory burden on Greek and other EU listed issuers is so heavy that the European Commission, backed by major economic reviews such as the Draghi Report, has made cutting red tape a core economic priority to safeguard EU market competitiveness. This is not merely a policy aspiration; it is an acknowledgment that the current framework is stifling growth.

The financial impact of EU legislation is material, especially for Greek small and medium-sized listed issuers by international standards. Substantial amounts are diverted to administrative overhead—such as specialized ESG auditors, data compliance officers, and legal teams—instead of being reinvested into core operations. In the tax sphere, over-reporting burdens, poorly drafted legislation, and misalignment between commercial and tax laws compound this uncertainty, deterring investment and entrepreneurship.

In this environment, compliance risk takes on a heightened, systemic dimension. The potential for legal penalties, financial forfeitures, and material reputational loss when an organization fails to act in accordance with industry laws and regulations is no longer a checklist item; it is a major operational threat that can severely damage a company’s market valuation.

Compliance risk and business risk can no longer be viewed in isolation; in the European regulatory landscape, they have completely fused

Most critically, compliance risk and business risk can no longer be viewed in isolation; in the European regulatory landscape, they have completely fused together. When a company faces over-regulation, compliance risk directly creates, amplifies, and shapes business risk—the threat to a company’s longterm operational viability, profitability, and strategic goals. Addressing this fusion is now an imperative for every EU-listed issuer.

Regulatory complexity is not an abstract burden. In Greece, where the economic and social fabric rests on small, very small, and medium-sized enterprises, and on individual entrepreneurial acumen, sophisticated compliance frameworks can feel disproportionate to the resources available to absorb them. Single-member companies and smaller family businesses often lack the legal, financial, and organizational capacity that larger corporations take for granted. In the absence of an HR department, compliance officer, or in-house counsel to track every new obligation on hiring, working hours, remote work, or social security contributions, each new rule lands directly on the owner’s desk, competing with the daily demands of running the business. Each new reporting obligation, data protection rule, or sustainability disclosure is not merely technical; it is a real cost measured in time, money, and, at times, existential risk.

Yet this difficulty should not be read as an argument against compliance. It is an argument for how compliance is built and enforced. Sustained, rigorous adherence to a compliance culture, however painful at first, tends to change behavior over time. What begins as an externally imposed obligation gradually becomes habit and eventually, ideally, a near-automatic practice embedded at every level of an organization, from ownership down to the newest employee.

Effective regulation is not measured by the number of penalties issued but by the extent to which it shapes conduct before violations occur

That transformation, however, cannot rest solely on the regulated. Supervisory and enforcement authorities must also adopt compliance as their own operating mindset rather than simply treating it as a checklist for sanctions. Effective regulation is not measured by the number of penalties issued but by the extent to which it shapes conduct before violations occur. When enforcement is calibrated, proportionate, and oriented toward guidance rather than punishment alone, smaller businesses are far more likely to internalize compliance as a genuine value, not a threat to survival.

Complexity has a cost. But if regulator and regulated both treat compliance as a shared discipline, that cost can become an investment in resilience.

Greece’s audiovisual economy is a growth story. According to a recent IOBE study, the sector’s gross value added (GVA) rose by 78% in current prices between 2013 and 2024. Investment more than doubled, and Greece’s GVA share of GDP converged with the EU27 average. Yet piracy grows alongside the legal market and adapts faster than the rules meant to contain it. For rights holders and investors, the problem is sometimes the legal system itself, not the absence of law.

Greek copyright law has long provided criminal protection for intellectual property. The weakness is in how that protection works in practice. Per CEPEJ data, criminal cases before Greek courts of first instance averaged 223 days in 2022, against a European median of 133. In piracy cases, that delay decides the outcome. Infringers switch IP addresses or domains before judgment is issued, so rulings arrive too late to matter.

Regulatory complexity has deepened the problem. Successive amendments to the Greek Code of Criminal Procedure and criminal laws can create interpretive uncertainty instead of speeding up cases. New criminal procedures against end users of pirated content have added volume without adding capacity, and prosecutors’ offices now carry a backlog. For producers and investors, every reform resets expectations and makes enforcement outcomes harder to predict. This is how regulation might become a business risk.

Where the system works, it does so through focus. The Committee for the Notification of Online Infringement of Copyright and Related Rights (EDPPI) issues expedited blocking orders against infringing websites, giving rights holders a tool that moves closer to the speed of infringement.

When threats evolve weekly, the most valuable thing the law can offer is certainty

The regulatory framework does not need piecemeal amendments. A stable, coherent framework that courts can apply consistently and investors can plan around is key for growth in every sector. When threats evolve weekly, the most valuable thing the law can offer is certainty.

Who pays for regulatory complexity? Not the large corporation with a dedicated compliance department and outside counsel on retainer. The bill lands squarely on the desk of small and medium-sized enterprises (SMEs), the businesses least equipped to absorb the cost, yet most essential to Greece’s economic future.

Every new EU framework—from GDPR to the AI Act, CSRD, and DORA—arrives with legitimate purpose, but each also brings implementation costs that scale inversely with company size. While a multinational company spreads compliance across thousands of employees, a Greek SME with thirty staff must divert its most senior people from commercial operations to regulatory interpretation. That diversion is a hidden tax: not a line item in any budget, but a measurable drain on productivity, innovation, and the willingness to take entrepreneurial risk.

In Greece, the problem is compounded. Businesses must navigate not only the EU regulatory layer but also a national transposition process that is frequently delayed, adds requirements absent from the original directive, and splinters across ministerial decisions and administrative guidance. For SME owners, the question is no longer what the law requires, but rather which version of the law applies today—and the cost of getting it wrong falls entirely on them.

The answer is not less regulation; it is regulation designed with its end payer in mind: standardized compliance toolkits for smaller businesses, meaningful regulatory impact assessments that measure cumulative burden, and transposition timelines that give enterprises room to adapt rather than scramble.

Complexity is a policy choice. So is simplicity. We should start choosing differently.

Complexity is a policy choice. So is simplicity. We should start choosing differently.

Regulation in the field of European social security coordination has always been a complex matter. Even standardized procedures, such as the S1 and A1 forms, may appear predictable, yet an entitlement may be clearly established and still be costly to operationalize. Meanwhile, platform work, highly mobile workers, and digital nomads are testing the traditional boundaries of coordination rules, while even fundamental concepts, such as that of the employer, are being redefined.

The cost of complexity is not borne by businesses alone; it ultimately spills over to workers and the wider market

Against this background, two costs arise. The first is regulatory: Businesses require sophisticated legal assistance to navigate an evolving regulatory environment. The second is operational: Even an established right requires administrative implementation through different registration systems and mechanisms of cross-border cooperation.

The cumulative burden translates into time, organizational resources, delays and reduced predictability, creating real transaction costs for businesses. For SMEs in particular, this burden may be passed on through higher prices, influence hiring and workforce mobility decisions, or even reduce a company’s willingness to pursue new opportunities in other markets. The cost of complexity, therefore, is not borne by businesses alone; it ultimately spills over to workers and the wider market.

In this new reality, compliance is only the starting point; the challenge is to translate legal certainty into efficient cross-border implementation. As the EU social security coordination framework moves towards a crucial amendment, its rules must be legally sound, administratively interoperable, and predictable in practice, reducing the time and resources businesses devote to compliance, while ensuring that complexity does not become a burden to cross-border mobility.

Few areas illustrate the cost of regulatory complexity more clearly than digital regulations. Over the past decade, businesses operating in Greece and across the EU have been required to navigate an expanding web of rules, including the GDPR, NIS2, DORA, eIDAS, the Cyber Resilience Act, the AI Act, the Data Act, and the Critical Entities Resilience (CER) framework. While these instruments are all designed to build trust and resilience in the digital economy, in practice, taken together, they often create fragmentation, duplication, and legal uncertainty.

Meaningful simplification requires greater coherence across legal frameworks, clearer regulatory guidance, and closer cooperation with authorities

One striking example of this complexity, which we increasingly encounter when advising clients, is the challenge of incident response. What appears to be a single operational event may fall within the scope of multiple regulatory regimes, including the GDPR, NIS2, DORA, eIDAS, and CER, thus triggering parallel notification obligations. Organizations, particularly those operating across sectors and countries, must therefore assess the same incident through various legal lenses and, in some cases, notify several authorities across different jurisdictions, each applying its own deadlines, materiality thresholds, and procedural requirements—all while responding to the incident itself.

The result is a genuine compliance paradox: Regulations intended to enhance resilience can end up diverting resources away from it. Legal, compliance, cybersecurity, and operational teams often find themselves reconciling overlapping regulatory obligations under intense time pressure, at the very moment when their focus should be on containment, recovery, and business continuity. Complexity, in this sense, becomes a business risk in its own right, increasing costs, slowing decisionmaking, limiting efficiency, and multiplying legal exposure.

Encouragingly, the Digital Omnibus proposal, tabled last November and still under negotiation, represents a welcome step toward a more rationalized framework through common reporting templates and a single reporting channel. Differing materiality tests, separate user-notification duties, and divergent national interpretations will, however, persist. The broader lesson is that meaningful simplification cannot be achieved through procedural reforms alone. It requires greater coherence across legal frameworks, clearer regulatory guidance, and closer cooperation with authorities as prerequisites for resilience, innovation, and growth.

Over the past decade, policymakers and regulators have responded to mounting sustainability challenges by moving rapidly from guidelines and non-binding documents promoting voluntary corporate initiatives to mandatory regulatory frameworks. Organizations of all sizes have had to adapt to an increasingly complex landscape of legal obligations, reporting requirements, and compliance expectations. While this regulatory expansion has been criticized for creating administrative burdens, it has also provided a common set of rules, greater transparency, and a clearer foundation for decisionmaking.

While regulatory expansion has been criticized for creating administrative burdens, it has also provided a common set of rules, greater transparency, and a clearer foundation for decisionmaking

Today, however, the pendulum appears to be swinging in the opposite direction. Calls for simplification, with the declared objective of strengthening competitiveness, have prompted a revision of regulatory requirements across various sustainability domains. Yet, framing the debate as a choice between regulation and deregulation oversimplifies a much more complex challenge. The more relevant question is whether sustainability frameworks are enabling meaningful action, accountability, and longterm value creation.

Reducing unnecessary bureaucracy and improving the efficiency and usability of regulatory frameworks are legitimate objectives. Nevertheless, deregulation that extends beyond reasonable limits may produce unintended consequences. Rather than creating clarity, the absence of a coherent regulatory framework can lead to fragmentation, inconsistency, and increased uncertainty. In such an environment, companies may struggle to understand evolving expectations, while investors and other stakeholders may continue to demand sustainability performance that exceeds formal legal requirements.

In fact, where regulatory requirements are reduced or become less prescriptive, expectations do not necessarily diminish. In practice, gaps left by regulators are often filled by other accountability mechanisms, including investor requirements, financing conditions, and shareholder expectations. As a result, despite declared deregulation, companies may face increasing scrutiny regarding the credibility of their sustainability commitments, with disputes over sustainability claims, greenwashing allegations, and climate-related litigation becoming important drivers of accountability.

The challenge, therefore, is not to choose between excessive regulation and complete deregulation. Rather, policymakers should strive to establish a balanced framework that combines simplicity, legal certainty, and accountability. Such a framework should focus on material issues and outcomes, remain proportionate and predictable, and support innovation and longterm value creation. Sustainable progress requires not simply more or less regulation, but better regulation accompanied by responsible business action, transparent evidence, and collaboration across the wider ecosystem.

European financial regulation is no longer defined solely by legislation adopted by the EU legislature. It is constructed through successive, complex layers: directives and regulations, delegated and implementing acts, technical standards, national measures and, increasingly, guidelines, recommendations, and opinions issued by the European Supervisory Authorities (ESAs).

Regulatory complexity delays decisions, discourages innovation, and raises barriers to entry

Each layer may serve a legitimate purpose. Yet taken together, they create a framework so extensive, technical, and fast-moving that even specialized professionals struggle to follow it in full. For businesses, the cost extends well beyond legal and compliance budgets. Regulatory complexity delays decisions, discourages innovation, raises barriers to entry, and disproportionately favors larger institutions capable of absorbing continuous regulatory change.

Soft law captures the dilemma. Formally non-binding, it often acquires significant practical force through comply-or-explain mechanisms, supervisory expectations, and pressure for uniform application. It may therefore function as quasi-regulation, even though it occupies no clear place in the hierarchy of EU law and is not always directly amenable to effective judicial review.

The answer is not simply less European guidance. Divergent national supervisory practices fragment the single market, distort competition, and generate uncertainties of their own. In financial services, common rules cannot deliver a level playing field without genuinely convergent supervision. The better response is disciplined convergence: simpler legislative architecture; a clear boundary between technical guidance and law-making; proportionate compliance expectations; and effective judicial review wherever soft law produces material consequences. Regulatory complexity becomes a business risk when firms cannot determine, with reasonable certainty, what is required of them. European supervision should reduce that uncertainty, not add to it.