June 11, 2026
By Vanguard Law & Governance Unit with the work of Anu Bradford, Cary Coglianese, Daniel J. Solove, Mary Schapiro, and John Ruggie.

The New Cost of Global Reach

For much of the modern global economy, multinational companies assumed that scale would create coherence. A company could build global products, global platforms, global supply chains, global governance standards, and global customer relationships. Local variation existed, but the strategic logic was integration. The more the enterprise could standardize, the more it could reduce cost, increase control, and accelerate growth.

That logic is now under pressure.

The global regulatory environment is fragmenting. Data rules are diverging. Sustainability disclosure regimes are moving at different speeds. Trade policy is becoming more political. Corporate governance standards are increasingly shaped by local values, national security priorities, and economic sovereignty. In one jurisdiction, regulators may demand transparency. In another, they may restrict data transfer. In one market, companies may be expected to disclose climate risks. In another, disclosure may be politically contested or legally challenged. In one economy, governments may encourage cross-border investment. In another, they may treat the same transaction as a strategic control issue.

The result is a difficult operating problem. Multinationals must comply locally without losing enterprise coherence. They must adapt to regional regimes without creating a patchwork of inconsistent practices. They must preserve flexibility without appearing opportunistic. They must manage regulatory arbitrage without undermining trust.

This is no longer a narrow legal challenge. It is a strategy challenge.

The companies that navigate regulatory divergence well will not be those that merely hire more compliance personnel or produce more local manuals. They will be those that redesign their global operating architecture. They will know which standards must be global, which can be regional, which should be local, and which cannot be compromised. They will treat regulatory complexity not only as cost, but as a source of competitive differentiation.

Why Divergence Is Accelerating

Regulatory divergence is not accidental. It reflects a deeper shift in the world economy. Governments are no longer content to let global markets define the rules of cross-border business. They are asserting control over data, capital, energy, supply chains, technology, sustainability, labor standards, ownership, and national security.

Data is the clearest example. The European Union continues to anchor its approach in privacy, fundamental rights, and regulated international transfers. The European Commission’s international data-transfer framework is built around adequacy decisions and transfer tools that allow cross-border flows only when protections remain in place. China has developed a tiered cross-border data regime under which personal information and important data may be transferred abroad only through defined compliance mechanisms, including security assessments, certifications, or standard contracts depending on the category and scale of the transfer. The United States, by contrast, remains more sectoral and fragmented, with state privacy laws, federal agency enforcement, and industry-specific rules rather than one comprehensive federal privacy statute.

Sustainability reporting is diverging as well. The European Union has built a broad reporting architecture through the Corporate Sustainability Reporting Directive and European Sustainability Reporting Standards, although the scope and timing have been adjusted through political negotiation and simplification efforts. California has moved forward with climate disclosure laws requiring emissions and climate-risk reporting from large companies doing business in the state, while litigation continues around aspects of the regime. At the U.S. federal level, the SEC proposed in May 2026 to rescind the climate disclosure rules it adopted in 2024, signaling a significant retreat from a national mandatory climate disclosure framework.

Trade and industrial policy are also fragmenting. Tariffs, export controls, forced-labor rules, foreign investment review, subsidy regimes, and counter-extraterritoriality measures increasingly shape where companies can source, produce, sell, and share technology. China’s 2026 industrial supply-chain and counter-extraterritoriality regulations, for example, expanded tools available to respond to foreign sanctions, export controls, forced-labor restrictions, and other extraterritorial measures. For multinationals, this creates direct compliance conflict: obeying one jurisdiction’s requirements may create legal or political exposure in another.

Governance expectations are fragmenting too. Beneficial ownership rules, board accountability standards, ESG obligations, anti-corruption requirements, audit expectations, and stakeholder rights differ across markets. A company may face investor pressure for global consistency while regulators demand local adaptation.

This is the new reality: globalization has not disappeared, but the rules governing globalization are no longer converging.

The Failure of the Old Compliance Model

Many companies still manage regulatory divergence through a legacy model. Headquarters sets global policy. Regional legal teams interpret local rules. Business units request exceptions. Compliance teams track obligations. External counsel is engaged when complexity rises. This model can work when regulatory differences are limited or predictable. It struggles when divergence becomes structural.

The first failure is fragmentation. Local teams solve local problems in ways that create enterprise inconsistency. One region adopts strict data controls. Another uses broader consent language. One market builds a climate disclosure process aligned with European standards. Another treats sustainability as voluntary communications. One business unit negotiates supply-chain audit rights. Another does not. Over time, the company no longer has one compliance architecture. It has many.

The second failure is latency. Regulatory change often reaches the enterprise too late. A new rule is identified by local counsel, summarized for regional management, escalated to headquarters, translated into policy, and eventually operationalized. By then, deadlines may be close, systems may not be ready, and business decisions may already have been made.

The third failure is overcentralization. Some companies respond to divergence by trying to impose one global standard everywhere. This can reduce complexity, but it can also create unnecessary cost or local resistance. A standard that is appropriate for Europe may be too burdensome for a low-risk market. A data architecture designed for one jurisdiction may limit product functionality elsewhere. A sustainability reporting process designed for the strictest regime may produce information that is not material or useful in another.

The fourth failure is opportunism. Other companies move in the opposite direction and exploit the least demanding jurisdiction. That may reduce short-term cost, but it can damage trust if investors, employees, customers, or regulators conclude that the company is using fragmentation to avoid responsibility.

The strategic challenge is to avoid all four failures: fragmentation, latency, overcentralization, and opportunism.

From Compliance Burden to Operating Architecture

The better approach is to treat regulatory divergence as an operating architecture problem.

An operating architecture defines how the company makes decisions across markets. It determines which rules are universal, which are regional, and which are local. It defines where authority sits. It creates data flows, accountability structures, escalation pathways, and evidence systems. It allows the company to comply differently where necessary while remaining coherent as an enterprise.

The first layer is the global minimum standard. These are rules the company applies everywhere, regardless of local law. They usually reflect core commitments: anti-bribery, sanctions screening, basic privacy protections, cybersecurity hygiene, human rights principles, financial integrity, board reporting, and accurate books and records. The global minimum should be high enough to protect the enterprise but not so broad that it becomes unworkable.

The second layer is regional adaptation. Some regulatory regimes are too important to handle country by country. Europe, China, the United States, and other major blocs increasingly require regional operating models. A European data and sustainability architecture may need to differ from a China data and localization architecture. A U.S. model may need to account for state-level variation, litigation risk, and federal uncertainty. Regional adaptation allows the company to manage clusters of rules without abandoning global oversight.

The third layer is local specificity. Some obligations are jurisdiction-specific: licensing, reporting deadlines, labor rules, tax filings, entity governance, product labeling, procurement requirements, and sector approvals. These must be handled locally, but within enterprise controls. Local variation should be visible, documented, and connected to the company’s global risk system.

The fourth layer is strategic exception management. Not every difference should become a permanent exception. Companies need a formal process for approving deviations from global standards, documenting the business rationale, assessing risk, and setting expiration or review dates. Without exception discipline, local flexibility becomes hidden fragmentation.

This layered architecture gives companies a way to remain globally coherent without pretending the world is still converging.

The Data Divergence Problem

Data is where regulatory divergence becomes most operational. Data does not respect borders naturally. It moves through cloud systems, customer platforms, HR systems, analytics tools, AI models, vendor environments, customer service centers, and shared enterprise applications. A single global company may process employee data in one region, customer data in another, product telemetry in a third, and AI training data across several jurisdictions.

Regulators, however, increasingly treat data as sovereign, sensitive, or rights-bearing.

The EU’s approach focuses on whether personal data transferred outside the European Economic Area receives adequate protection. This requires companies to assess transfer mechanisms, contractual clauses, risk factors, and safeguards. China’s approach requires companies to classify data, assess whether personal information or important data is being exported, and use approved mechanisms such as security assessments, certifications, or standard contracts. The United States lacks one unified framework, but state privacy regimes, sector laws, enforcement actions, and contractual obligations create their own complexity.

For companies, the implication is that data architecture must become jurisdiction-aware. A global data lake may be efficient, but it may not be legally viable. A centralized AI training pipeline may improve model performance, but it may create cross-border transfer risk. A shared HR platform may simplify operations, but it may require additional controls for employee data in certain markets.

The solution is not simply localization. Full localization can be costly, inefficient, and strategically limiting. The better approach is controlled interoperability. Companies should map data flows, classify data by sensitivity and jurisdiction, define approved transfer pathways, apply technical safeguards, and design systems that can adapt to different regulatory requirements.

In practical terms, this means data governance must be embedded into product design, vendor selection, cloud architecture, AI deployment, and market entry. Privacy can no longer be a document attached at the end of a project. It must become a design constraint from the beginning.

Sustainability Divergence and the Reporting Burden

Sustainability reporting illustrates a different kind of divergence. Unlike data, where regulators often restrict flows, sustainability regulation often demands more information. But the scope, methodology, audience, and enforcement expectations differ across jurisdictions.

The EU has moved toward broad sustainability reporting that includes environmental, social, and governance information. The ISSB standards are designed to create a global baseline focused on financially material sustainability-related disclosures. California’s climate disclosure laws create obligations for large companies doing business in the state. The U.S. federal approach has become more uncertain after the SEC proposed rescinding its climate disclosure rules.

This creates a reporting architecture problem. Companies do not want separate data systems for every jurisdiction. At the same time, they cannot assume one report will satisfy all requirements. Materiality standards differ. Assurance expectations differ. Scope 3 emissions requirements differ. Timing differs. Legal risk differs. Investor expectations may exceed regulatory minimums in some markets and conflict with political expectations in others.

The strategic response is to build a common data backbone with modular reporting outputs.

The common backbone should include emissions data, energy use, climate-risk analysis, governance processes, supply-chain information, controls, assurance evidence, and financial impact assessment. The modular outputs should then be adapted to CSRD, ISSB, California, investor, customer, lender, or voluntary reporting needs.

This approach reduces duplication while preserving local compliance. It also improves credibility. A company that reports different sustainability numbers in different jurisdictions without a clear explanation will lose trust. A company with one controlled data foundation and jurisdiction-specific presentation will be better positioned.

The larger point is that sustainability reporting is becoming a data-management problem as much as a communications problem. Companies that treat it as annual narrative production will struggle. Companies that treat it as an enterprise information system will gain efficiency and credibility.

Trade, Sanctions, and the Compliance Conflict

Trade regulation creates the most acute conflict between jurisdictions. Data and sustainability rules may be difficult to reconcile, but trade and sanctions rules can require companies to choose among incompatible demands.

A U.S. export control may restrict the transfer of advanced technology to a foreign customer. A foreign countermeasure may penalize compliance with that restriction. A forced-labor import ban may require supply-chain documentation that local law or political conditions make difficult to obtain. A sanctions rule may prohibit dealings with a designated entity, while local law may restrict termination. A national security review may require commitments that affect the company’s global operating model.

This is why trade compliance can no longer be treated as a shipping function. It belongs at the center of enterprise risk.

Companies need visibility into product classification, customer identity, beneficial ownership, end use, country of origin, supplier location, technology transfer, software access, and employee nationality restrictions where applicable. They also need a decision process for conflicts of law. When two regimes point in different directions, the company must know who decides, what external advice is required, how the board is informed, and how the decision is documented.

This is especially important in sectors connected to semiconductors, AI, cloud infrastructure, defense, energy, critical minerals, pharmaceuticals, telecommunications, and advanced manufacturing. In these sectors, regulatory divergence is not incidental. It is part of the competitive environment.

Regulatory Arbitrage Done Right

Regulatory arbitrage is often treated as a negative term. It suggests exploiting gaps between jurisdictions to avoid higher standards. That form of arbitrage can damage credibility and invite enforcement. But there is another form of regulatory arbitrage that is strategically legitimate.

Regulatory arbitrage done right means designing the enterprise to operate where rules, capabilities, incentives, and customer needs align. It means choosing jurisdictions not simply because they are less demanding, but because they support the company’s long-term strategic model. It means locating data processing, manufacturing, research, capital, and governance functions in places where regulatory stability and operational capability reinforce each other.

For example, a company may choose to build a European sustainability reporting center because EU requirements are more developed and can serve as a high-quality foundation for global reporting. It may choose to localize certain China data operations because the market opportunity justifies a China-specific architecture. It may choose to place advanced manufacturing in jurisdictions that offer both subsidies and reliable export-control alignment. It may choose to avoid certain markets because the compliance conflict is too severe.

The difference between responsible and irresponsible arbitrage is transparency of rationale. Responsible arbitrage is based on strategic fit, risk analysis, and governance. Irresponsible arbitrage is based on avoiding accountability.

Boards should insist on this distinction. The company should be able to explain why a function is located where it is, what regulatory risks the choice creates, and how the decision supports long-term value.

The Flexible Global Architecture

The companies best positioned for regulatory divergence will build flexible global architectures around five capabilities.

The first is regulatory sensing. The company needs an early-warning system that tracks emerging rules across data, sustainability, trade, AI, competition, ownership, sanctions, and governance. This should not be a passive legal newsletter process. It should be tied to business impact: which products, markets, systems, contracts, and customers are affected?

The second is obligation mapping. Companies should maintain a live inventory of major regulatory obligations by jurisdiction and business function. This map should show overlaps, conflicts, deadlines, accountable owners, and required evidence. Without obligation mapping, the enterprise cannot distinguish between noise and material risk.

The third is modular operating design. Systems should be built to adapt. Data platforms should support jurisdictional controls. Reporting systems should produce different outputs from a common data foundation. Contracts should include regulatory change clauses. Supply chains should allow rerouting where feasible. Governance processes should allow local variation under central oversight.

The fourth is decision-right clarity. Divergence creates tradeoffs. Local leaders understand market realities. Headquarters protects enterprise coherence. Legal understands compliance risk. Business leaders understand commercial urgency. The company needs defined decision rights for when local compliance conflicts with global policy, when market opportunity conflicts with risk appetite, and when regulatory requirements conflict across jurisdictions.

The fifth is evidence discipline. In a fragmented world, companies must prove what they did and why. Documentation should include risk assessments, transfer impact assessments, sustainability data controls, trade classifications, board minutes, contractual safeguards, approval records, and exception rationales. Evidence is no longer administrative. It is strategic protection.

Leadership in a Fragmented Regime

Regulatory divergence requires a different leadership posture. Executives must resist the temptation to treat local compliance as a defensive function. Local rules are now part of market strategy.

The CEO should ask whether the company’s global model still fits the regulatory map. A business designed for seamless data flows may need redesign if data sovereignty rules become central. A supply chain built around low cost may need reconfiguration if trade restrictions rise. A sustainability strategy built around voluntary reporting may need formal controls if disclosure obligations expand. A governance model built around headquarters authority may need adaptation where local boards and regulators demand more independence.

The general counsel should become an architect, not only an interpreter. The legal function must help design operating models that can survive divergence. That means working with strategy, finance, technology, procurement, sustainability, and regional leadership before commitments are made.

The CFO should understand the economics of compliance architecture. Fragmentation imposes cost, but poor design imposes more. Duplicative systems, late remediation, regulatory penalties, disrupted market access, and reputational damage are often more expensive than building flexible architecture early.

The chief information officer and chief data officer should treat regulatory requirements as system requirements. Data localization, access controls, retention rules, consent management, transfer mechanisms, and AI governance should be built into technology roadmaps.

The board should oversee the coherence of the whole. It should ask not only whether the company is compliant today, but whether its operating model can adapt tomorrow.

The Board Questions

Boards should ask seven questions.

Where are our greatest regulatory mismatches? Management should identify where data, sustainability, trade, governance, or product standards diverge most sharply across the company’s major markets.

Which rules are becoming strategic constraints? Not every regulation matters equally. The board should understand which rules affect growth, market access, product design, supply chains, capital allocation, or reputation.

Where are we overstandardized? A global rule may impose unnecessary cost if local risk is low or market needs differ.

Where are we undercontrolled? Local variation may create hidden risk if it affects core data, financial, trade, sustainability, or governance obligations.

What is our common data backbone? Whether the issue is privacy, AI, sustainability, or supply chains, the company needs reliable data to comply and make decisions.

How do we handle conflicts of law? The board should know who decides when compliance with one jurisdiction creates exposure in another.

Can we explain our regulatory architecture to investors, customers, and regulators? Complexity is acceptable if it is coherent. It is dangerous if it cannot be explained.

These questions elevate regulatory divergence from legal reporting to strategic oversight.

Complexity as Differentiation

Regulatory divergence will create winners and losers. Smaller companies may struggle with cost and complexity. Larger companies may struggle with bureaucracy and inconsistency. Digital companies may face data-transfer limits. Industrial companies may face trade barriers. Consumer companies may face sustainability disclosure and supply-chain verification. Financial institutions may face overlapping capital, sanctions, data, and conduct rules.

But complexity also creates opportunity.

A company that can comply across regimes can access more markets. A company with trusted data systems can serve regulated customers. A company with credible sustainability data can satisfy investors, lenders, and procurement teams. A company with disciplined trade compliance can move faster when competitors are delayed. A company with flexible architecture can enter, scale, or exit markets more effectively.

The competitive advantage is not compliance alone. It is the ability to convert compliance into operating trust.

Customers want partners that can handle data responsibly. Investors want companies that can manage disclosure risk. Governments want companies that respect local rules. Suppliers want predictable requirements. Employees want confidence that the enterprise is not improvising. Trust becomes more valuable when regimes diverge because stakeholders need assurance that the company can operate responsibly across borders.

The New Global Competence

The age of regulatory convergence is over. The next phase of globalization will be defined by fragmented regimes, regional blocs, sovereignty demands, and contested standards. Multinationals will still grow across borders, but they will do so in a world where the rules are less aligned.

The companies that succeed will not be those that seek a single perfect global rulebook. Nor will they be those that surrender coherence to local improvisation. The winners will build flexible architectures: global minimums, regional adaptations, local compliance, disciplined exceptions, and evidence systems that can withstand scrutiny.

This is the new global competence. It requires legal judgment, operational design, technology architecture, financial discipline, and leadership clarity. It requires companies to know when to standardize and when to adapt. It requires them to treat regulation not only as constraint, but as information about how markets are changing.

Regulatory divergence is often described as a burden. It is one. But for well-governed companies, it is also a test that weaker competitors may fail. The ability to operate coherently across fragmented regimes will become a mark of institutional strength.

In the next era of international business, global scale will matter less if it cannot be governed. The advantage will belong to companies that can be global without being rigid, local without being fragmented, and compliant without losing strategic ambition.