Compliance by design turns obligations into testable product, data, architecture and operating requirements before late reviews make change expensive.