What a regulator does in its first year with a new power.

The instinct when a regulator gains a new power is to expect enforcement. What the one available worked example shows is correspondence.

Two features of that shape are worth naming because they repeat.

The letter is the instrument. A new regulator establishing a norm writes to far more firms than it investigates, and the letters work: 90% of the review publishers contacted acted without an investigation. A letter is not an opening position in a negotiation. It is the cheap path being offered once.

The fines concentrate. £4.2 million of the £4.7 million total was a single settlement. Year-one enforcement makes examples rather than sweeping — which means the probability of being fined is low and the consequence of being the example is not.

Three regulators about to do this

The Security Industry Authority becomes the regulator for premises under Martyn's Law, which it expects to come into force in spring 2027. It has never regulated premises capacity before.

The cyber regime brings managed service providers and data centres into scope with a 24-hour notification clock. Most of the firms affected have never had a regulator for this.

The Information Commissioner must produce a code of practice on AI and automated decision-making under regulations in force since 12 May 2026 — and the underlying duties have applied since 5 February 2026, so the guidance arrives after the obligation.

What the pattern suggests doing

1. Make sure a letter would reach somebody. A regulator writing to a generic address that nobody reads converts a cheap warning into an expensive investigation, and that is an administrative failure rather than a compliance one.
2. Do the assessment that each regime asks for, and keep it. In every one of these the first question is whether you looked. An assessment that concludes you are out of scope is a complete answer and costs an afternoon.
3. Do not buy against year one. The expensive response is to procure a compliance product before anybody knows what the regulator expects. The arithmetic on that rarely clears, and the guidance that would tell you what to buy has not been written.

What this does not tell you

One regulator, one year, one set of powers. The CMA's consumer enforcement is not the SIA's premises regime and a pattern drawn from a single case is a hypothesis rather than a finding. We are presenting it as the only worked example available, not as a law.

It also describes priorities rather than boundaries. Areas that received letters in year one can receive investigations in year two, and a firm reading "letters first" as "nothing happens first" has misread it.

The three regimes above have their own notes with their own sources: premises capacity, the 24-hour clock, and the AI code. The grid showing which of them reaches you is mostly empty for most firms.