Three Rules, Same Outcome

In my series over the past three weeks, the same pattern has shown up in three different places.

AI governance: ISACA found that 90% of organizations believe employees are using AI tools. Only 38% have a formal policy. KPMG found half the U.S. workforce uses AI at work without knowing whether it's allowed.

Compliance programs: Gartner found that only 37% of compliance leaders are confident they can measure program effectiveness. The investment is real. The evidence that it changes behavior is not.

Mandatory disclosure: When the SEC required companies to report material cybersecurity incidents within four business days, firms started filing disclosures for incidents that didn't meet the materiality threshold. A rule designed to produce cleaner signals produced strategic noise instead.

Three domains. Three rules. Same outcome.

Here's what the research says about why.

Doshi, Dowell, and Toffel (Strategic Management Journal, 2013) studied how thousands of establishments responded to a mandatory environmental disclosure program. Responses weren't uniform — they were moderated by organizational characteristics. The fastest improvement came from establishments near their headquarters and those owned by private firms. Same mandate, different organizations, different outcomes.

Haapamäki and Sihvonen (International Journal of Accounting Information Systems, 2026) analyzed 3,440 cybersecurity disclosures filed under the SEC's new 10-K requirement. Disclosure quality varied with firm size, auditor quality, and peer practices — and firms' actual cyber histories showed no influence at all. Strategic discretion persisted under the mandate. And the market's response to these newly required disclosures? Minimal. Investors and analysts barely reacted.

The DOJ — in its own Corporate Enforcement Policy — draws the same distinction. "Paper programs" versus effective ones. And what separates them isn't the document. It's culture, leadership commitment, and reporting trust. Characteristics that predate the rule and persist regardless of it.

The pattern across all of it: the rule changes what organizations are required to do. It rarely changes what they are.

We keep passing rules that tell companies what to do — and the companies that were already going to do it, do it. The ones that weren't, don't. The rule itself changes very little.

No. 005 in the Threshold Effects series. First published on LinkedIn, August 3, 2026.