I think you’re looking at this the wrong way. The fact that companies can sell their regulatory obligations as a positive PR move is the carrot to get them to do it well and be proud of it. Stick only is how you get half-assed left to rot technically compliant implementations.