The EU's Cybersecurity-and-AI Action Plan: The Checklist D2C Brands Actually Need in Europe

Direct answer: The EU's new cybersecurity-and-AI action plan is a bloc-wide coordination effort aimed at advanced AI model risks, not a product feature you can bolt on later. For D2C brands selling into Europe, the practical takeaway is that any AI-powered personalization, chat, or recommendation feature on your storefront now needs to be visibly explainable, auditable, and easy to disable — which is a design and UX problem as much as a legal one.

In July 2026, the European Commission published an action plan on Cybersecurity and AI, coordinating how member states respond to risks tied to advanced AI models. This is not a single new regulation with a specific compliance deadline attached — it is a coordination framework, meaning individual enforcement details will roll out unevenly across member states over the coming months. A precise timeline for enforcement in any given country is not publicly available yet, and no specific brand, fine amount, or penalty figure has been named in the plan as reported. What is clear from the announcement is the direction: security and AI risk are now being treated as one policy area rather than two separate conversations, and this affects any consumer-facing business using AI on its digital properties in the EU. For D2C brands, this lands squarely on the website and app experience — the part of the business customers actually see and interact with.

What the EU's Action Plan Actually Covers

The plan coordinates member-state responses to risks from advanced AI models — think large language models powering chatbots, recommendation engines, and generative content tools that D2C brands increasingly bolt onto their storefronts. It sits alongside, rather than replaces, existing frameworks like GDPR and the EU AI Act's risk-tiering approach. The Commission's framing treats cybersecurity vulnerabilities and AI model risk as intertwined: an AI feature that mishandles customer data isn't just a privacy problem anymore, it's categorized as a security exposure too.

For a D2C brand, this matters because most AI features on modern ecommerce sites — a chat assistant that answers sizing questions, a recommendation widget that uses purchase history, a dynamic pricing or personalization layer — sit exactly at this intersection. They process customer data, they make automated decisions that affect what a shopper sees or pays, and they typically run on third-party model APIs your team doesn't fully control end to end. The action plan signals that regulators are going to look harder at that chain: what data goes in, what the model does with it, and whether the customer-facing experience makes any of that visible or reversible.

It's worth being precise about what the plan is not. It is not a product specification, it doesn't hand down a single certification badge you can slap on a checkout page, and it doesn't name specific companies or set a hard EU-wide compliance date. What it does is signal that the Commission wants member states pulling in the same direction on advanced AI model risk, treating it as a security-adjacent category rather than leaving each country's data protection authority to interpret AI risk purely through a privacy lens. That distinction matters for a D2C brand because it changes who might eventually be asking questions about your AI features — not just a privacy regulator, but potentially a cybersecurity authority evaluating whether your systems create exploitable exposure through the way they handle model inputs and outputs.

The practical upshot for a lean D2C team is that "AI risk" stops being a single-department concern. It used to be reasonable to let your data or privacy lead own AI compliance questions in isolation. Under a framework that links AI risk to cybersecurity, the same feature might need sign-off that touches engineering security practices, data governance, and customer-facing design all at once. That's a heavier lift for a small team, but it's also a clarifying one: it forces you to actually document how an AI feature works end to end, which most fast-moving D2C brands haven't done for every tool they've adopted over the past two years.

Why "Coordinated" Matters More Than It Sounds

A coordinated EU-wide response means brands can't assume compliance in one member state translates cleanly to another, at least not yet. If you sell across Germany, France, and the Netherlands from one storefront, you may face slightly different interpretation and enforcement timing in each. That uncertainty itself is a design constraint: your website's data handling and AI-disclosure UX needs to be built to the strictest plausible reading, not the most lenient one, so you're not rebuilding country-by-country as guidance solidifies.

There's also a practical sequencing question worth thinking through now. Historically, EU digital policy has tended to start with guidance and voluntary codes of conduct before moving to formal enforcement mechanisms with defined penalties — that's roughly how GDPR's early years played out, and how the AI Act's risk-tiering rolled in gradually rather than all at once. It's reasonable to expect a similar pattern here: early guidance, sector-specific interpretation from national authorities, and enforcement action arriving unevenly as individual countries build out their own capacity to assess AI-related cybersecurity risk. For a D2C brand, that means the sensible move isn't to wait for a fully formed rulebook — it's to build the underlying transparency and documentation now, because that groundwork holds its value under almost any version of the eventual specifics.

Why Design, Not Just Legal, Has to Own Part of This

It's tempting to route this entirely to legal or compliance and consider it handled. That undersells the problem. A privacy policy update satisfies a paperwork requirement; it does nothing to change what a customer actually experiences when they land on a product page with an AI-generated recommendation, or open a chat window that's quietly powered by a third-party model. Regulators focused on AI risk are, by design, looking at outcomes and experiences, not just documentation — whether a customer could reasonably understand what's happening and whether they have a genuine ability to control it.

This is precisely where interface design work earns its place in the compliance conversation. A well-designed disclosure doesn't just exist somewhere on the page; it appears where the customer's attention already is, in language that matches how they actually think about the interaction ("this suggestion is based on your recent browsing" rather than legal boilerplate about "automated processing"). A well-designed opt-out doesn't just technically exist; it's discoverable within one or two taps, and using it doesn't visibly punish the customer with a worse experience. Getting these details right is a genuine design discipline, not a formality to check off after the legal language is finalized.

Why This Matters Specifically for D2C Brands Selling Into Europe

D2C brands have a structural exposure that larger enterprise retailers sometimes don't: they run lean, they lean hard on AI-powered personalization and automation to compete with bigger players, and they often plug in third-party AI tools (chat widgets, recommendation engines, review-summarization tools) without a formal review process. That's efficient, but it also means a brand's AI footprint can be larger and less documented than its team realizes.

If you're a D2C brand with European customers — whether you're headquartered in Europe or shipping there from elsewhere — this action plan raises the bar on three fronts:

• Transparency: customers and regulators increasingly expect a visible, accurate answer to "is this recommendation or response AI-generated, and on what data was it based?"
• Control: shoppers need an obvious, working way to opt out of AI-driven personalization without breaking their ability to browse or check out.
• Traceability: your team needs to be able to explain, on request, what an AI feature on your site actually does with customer data — which means your UX and your backend data flows have to agree with each other.

None of this is exotic. It's closer to the accessibility and cookie-consent work most D2C brands already went through — except the previous rounds were mostly about disclosure banners, and this one touches actual product behavior: chat interfaces, personalization logic, and how those are presented on-screen.

What Changes in Practice for Your Website and App

The shift is less "add a new checkbox" and more "make your AI features legible." Concretely, a European-facing storefront or app should be able to answer these questions through its interface, not just its privacy policy:

1. Where does the customer encounter AI (chat, recommendations, search ranking, dynamic content)?
2. Is that clearly labeled at the point of interaction, not buried in a footer link?
3. Can a customer turn it off and still complete a purchase normally?
4. Is there a human-reachable fallback if the AI feature gives a wrong or unhelpful answer?

Answering these well is fundamentally an interface design problem. It's the difference between a chat widget that quietly injects AI-generated product suggestions and one that clearly frames itself as an assistant, states what it's basing suggestions on, and offers a plain path to a human or a manual browse option. Brands that already run good international ecommerce operations — with clear currency, tax, and localization handling — tend to have the infrastructure discipline to adapt this faster, because they're already used to designing for multiple regulatory contexts inside one storefront rather than treating Europe as an afterthought.

This localization discipline turns out to be a useful mental model for the AI transparency problem too. A brand that already builds region-specific tax and currency logic into its checkout has effectively already solved the harder engineering problem — conditionally rendering different behavior based on customer location without fragmenting the codebase into separate country builds. The same architecture pattern extends naturally to conditionally surfacing AI disclosures, consent language, and opt-out mechanics per market. Brands starting from scratch on both fronts at once face a heavier lift, but it's still very doable as a scoped project rather than a full platform rebuild.

It's also worth separating two categories of change here: what's visible to the customer, and what's true underneath. You can update copy and add a toggle relatively quickly, but if the underlying data flow still sends full behavioral history to a third-party model regardless of what the toggle says, you've created a disclosure that's technically false. This is the trap fast-moving teams fall into most often — the UI says one thing because someone updated it in a sprint, while the actual integration still does what it always did because nobody connected the two. Closing that gap requires the design and engineering side of the audit to happen together, not in sequence.

The App Side: Analytics and Consent Have to Line Up

If your D2C brand runs a companion app, the same logic extends to how you track behavior to power AI features. This is where mobile app analytics practices intersect directly with the compliance question: if your app collects granular behavioral data to feed a personalization model, your analytics instrumentation and your consent UX need to describe the same thing. A common failure pattern is analytics teams tracking more than the consent screen discloses, simply because the two were built by different teams at different times. Auditing that gap — what you collect vs. what you disclose vs. what powers an AI feature — is a concrete, doable project, and it's exactly the kind of cross-functional review that tends to get skipped when a brand is moving fast.

There's a useful parallel in regulated-adjacent product design outside ecommerce. Teams building things like custom medical appointment booking software have long had to design interfaces where every automated suggestion or scheduling decision needs to be explainable to a user and auditable after the fact. D2C brands haven't traditionally needed that discipline, but the direction of EU policy is pushing consumer commerce toward the same standard: automated decisions that touch a customer need a visible trail.

How to Actually Approach This: A Practical Checklist

Rather than waiting for member-state-specific enforcement detail (which, again, isn't fully public yet), D2C brands can get ahead of this with design and audit work that pays off regardless of exactly how enforcement lands:

• Inventory every AI touchpoint on your storefront and app — chat, recommendations, search, dynamic pricing, generated content, image tools. Most teams underestimate this list.
• Label AI interactions clearly, at the moment of interaction, in the customer's language and locale — not as a generic disclaimer elsewhere on the site.
• Build a real opt-out path that doesn't degrade the core shopping experience. If turning off personalization breaks navigation, that's a design failure, not a compliance one.
• Reconcile analytics collection with consent language so what you track matches what you disclose, especially data feeding AI features.
• Document data flow for each AI feature — what data goes to which model, hosted where, retained how long — so your team can answer a regulator or a customer support escalation without a fire drill.
• Review this per major EU market rather than assuming one implementation covers all member states, given the plan's coordinated-but-not-uniform structure.

This is squarely UX and interface work layered on top of a governance question, and it's why brands increasingly bring in dedicated UI/UX Design & Branding support for this kind of project rather than treating it purely as a legal memo to file away. The interface is where trust or friction actually happens — a well-labeled, well-controlled AI feature reads as more premium, not more restrictive, to a European shopper who's grown used to seeing consent and transparency done badly elsewhere.

Sequencing this checklist matters too. Running the inventory before touching any interface saves rework, because you'll often discover that two or three separate tools are quietly doing similar things — one plugin personalizing search results, another personalizing email content, a third summarizing reviews — each added by a different person at a different point without anyone stepping back to look at the combined picture. Consolidating overlapping tools during this process isn't strictly required by the action plan, but it's a natural byproduct of doing the audit properly, and it usually simplifies the disclosure and opt-out work that follows since you're managing fewer distinct AI touchpoints rather than more.

It's also worth planning for how this checklist interacts with your product roadmap rather than treating it as a one-off cleanup sprint. Any new AI feature your team ships after this audit should go through the same disclosure and data-flow questions before launch, not after a customer or reviewer flags a gap. Building that review step into your existing design and product process — a short checklist attached to your feature launch template, for instance — costs very little to set up now and prevents the same audit from needing to be repeated from scratch every time your storefront adds a new personalization or automation tool.

What This Kind of Work Typically Costs

Scope varies with how many AI touchpoints your storefront and app actually have, but most D2C brands doing this kind of transparency and control audit fall into one of these tiers:

Tier	Typical scope	Price
Essential	Single storefront audit, AI touchpoint inventory, labeling and disclosure UX updates	$1,000
Growth	Multi-market storefront + app, opt-out flow redesign, analytics-consent reconciliation	$2,000
Enterprise	Full data-flow documentation, multi-region rollout, ongoing design governance for new AI features	$4,000+

These are starting reference points for the kind of engagement this work usually requires, not a fixed quote — the right tier depends on how many markets, features, and existing design debt you're carrying into the project.

Key Takeaways

• The EU's July 2026 action plan coordinates cybersecurity and AI-risk policy bloc-wide — it's a direction signal, not yet a single fixed compliance deadline, so build to the strictest plausible interpretation.
• D2C brands are exposed because they lean on AI personalization and chat tools that often lack formal review or clear customer-facing disclosure.
• The practical fix is UX work: label AI touchpoints clearly, build real opt-out paths, and make sure analytics collection matches what you disclose to customers.
• Multi-market EU brands should expect uneven enforcement timing by country and design for consistency rather than waiting for uniform guidance.
• Document data flow per AI feature now so your team isn't scrambling to answer a regulator or a customer question later.
• Treat this as an opportunity to make your storefront's AI features feel more trustworthy and premium, not just compliant.

Getting the audit and interface work right before enforcement details firm up puts you ahead rather than reacting under deadline pressure. If you want help mapping your AI touchpoints and redesigning the disclosure and control UX around them, book a meeting with our team.

Frequently Asked Questions

What exactly is the EU's Cybersecurity and AI action plan?

It's a July 2026 European Commission plan that coordinates how EU member states respond to risks from advanced AI models, treating AI risk and cybersecurity as a connected policy area rather than two separate tracks. It doesn't replace existing rules like GDPR or the AI Act — it sits alongside them as a coordination framework.

Does this apply to my D2C brand if I'm not headquartered in the EU?

Yes, in principle — EU digital policy generally applies based on where your customers are, not where your company is registered. If you ship to or serve customers in EU member states, your storefront's handling of their data and any AI features they interact with fall within scope.

Is there a specific compliance deadline I need to hit?

Not a single bloc-wide deadline as of this writing — the plan is a coordination framework, and specific enforcement timing will likely vary by member state. That uncertainty is itself a reason to start now rather than wait for a fixed date.

What counts as an "AI feature" on my storefront for this purpose?

Anything that uses a model to personalize, recommend, generate, or automate a customer-facing decision — chat assistants, product recommendation engines, AI-generated product descriptions, dynamic search ranking, and AI-driven pricing or promotions all count.

My chatbot is a third-party plugin — am I still responsible for it?

Generally yes. Using a vendor's AI tool doesn't remove your responsibility for how it handles your customers' data or what it shows them. You need to understand and be able to explain what that plugin does, even if you didn't build it in-house.

How is this different from GDPR, which I already comply with?

GDPR governs personal data handling broadly. This action plan specifically layers AI model risk into the security conversation, meaning regulators may look at AI features through a cybersecurity risk lens in addition to a data-privacy lens. The two overlap but aren't identical.

What's the biggest practical risk for a D2C brand right now?

Having AI features on your site or app that your own team can't fully explain — what data feeds them, where that data is processed, and what a customer can do to opt out. That gap is what creates both regulatory and reputational exposure.

Do I need to remove AI features from my storefront to be safe?

No. The direction is toward transparency and control, not elimination. A well-labeled, well-governed AI feature with a working opt-out is the goal, not the absence of AI.

How do I find out which AI touchpoints my storefront actually has?

Start with an audit across your storefront, checkout flow, and app: list every place a recommendation, generated text, chat response, or personalized ranking appears, and trace each back to the tool or model producing it. Most teams find more touchpoints than they expected once they look systematically.

What does "labeling" an AI interaction actually look like in the UI?

It's a small, clear signal at the point of interaction — for example, a chat widget stating it's an AI assistant before the first response, or a "recommended for you" module noting it's personalized based on browsing history, with a link to adjust that.

How much does an AI-disclosure UX audit cost?

For a single storefront, this typically falls under an Essential-tier engagement starting around $1,000, covering an AI touchpoint inventory and updated labeling and disclosure UX. Multi-market or multi-app scope moves into Growth or Enterprise tiers.

How long does this kind of project usually take?

A single-storefront audit and UX update can often be scoped and executed in a few weeks. Multi-market rollouts with analytics reconciliation and documentation take longer, depending on how many AI features and regions are involved.

What's an "opt-out path" and why does it need to be a UX decision, not just a settings toggle?

It's the mechanism letting a customer turn off AI-driven personalization or chat. It needs UX attention because a poorly designed opt-out that breaks navigation or hides the toggle defeats the purpose — the goal is a real, findable, working option that doesn't degrade the shopping experience.

Does this affect email marketing personalization too?

The action plan is focused on AI model risk broadly, and personalization engines used in email marketing that rely on AI-driven segmentation or content generation would reasonably fall under the same transparency expectations, even though the plan doesn't call out email specifically.

What should my customer support team be able to answer about our AI features?

At minimum, what an AI feature does, what data it uses, and how a customer can opt out or reach a human instead. If support can't answer this consistently, that's a sign your internal documentation needs work before your public-facing disclosures do.

Is this only relevant to large AI models like the ones powering ChatGPT-style chatbots?

The plan specifically targets "advanced AI model risks," which is broader than any single well-known chatbot — it covers the class of large, capable models increasingly embedded in commercial products, including many of the third-party tools D2C brands plug into their sites.

How does this interact with cookie consent banners I already have?

Cookie consent covers data collection broadly; this is a layer on top specifically about AI processing and model risk. You likely need to reconcile the two so a customer who declines certain tracking doesn't still get AI personalization built on data they thought they'd opted out of.

What happens if my analytics collect more than my privacy policy discloses?

That mismatch is exactly the kind of gap regulators and increasingly savvy customers notice. It's worth an internal audit comparing your actual analytics implementation against your stated disclosures, particularly for any data feeding AI-driven features.

Should I be worried about fines specifically?

Specific fine amounts tied to this action plan aren't publicly detailed yet, since it's a coordination framework rather than a single enforceable regulation with published penalties. The more immediate risk for most D2C brands is reputational and operational — not knowing your own AI data flows well enough to answer a customer or regulator confidently.

Does this affect how I design my app's onboarding flow?

If your app uses AI for personalization from first use — recommended products, tailored content — your onboarding should disclose that clearly and, ideally, let users set preferences around it rather than defaulting to full personalization silently.

What's the relationship between this plan and the EU AI Act?

The AI Act is the broader legislative framework classifying AI systems by risk tier; this action plan is a more immediate coordination effort focused specifically on cybersecurity and advanced-model risk, likely feeding into and complementing AI Act enforcement rather than replacing it.

Can I use the same disclosure design across all EU markets?

You can use a consistent design pattern, but the language, and possibly the specific disclosures, may need to adapt per market given the plan's coordinated-but-not-uniform rollout. Build your component system to support that variation rather than hardcoding one version.

What if I don't have the internal resources to audit this myself?

This is a common reason D2C brands bring in outside UI/UX support — an experienced team can run the touchpoint inventory and redesign the disclosure and control flows faster than a lean internal team juggling other priorities, and can benchmark against what's already working well elsewhere.

Is a generic "AI Disclaimer" page enough to cover this?

No — a buried disclaimer page satisfies neither the spirit of the plan nor customer expectations. The emphasis is on disclosure at the point of interaction, where the customer actually encounters the AI feature.

How does this affect product recommendation engines specifically?

If your recommendation engine uses AI to personalize product suggestions based on browsing or purchase history, that's a clear touchpoint needing disclosure and, ideally, an easy way for the shopper to see or reset what it's basing suggestions on.

What about AI-generated product descriptions or marketing copy?

If AI-generated content is customer-facing (product descriptions, blog content, marketing emails), transparency expectations are lower for pure content generation than for personalized decisions about a specific customer, but many brands choose to disclose AI-assisted content generation as a trust signal regardless.

Will this slow down how quickly I can launch new AI features?

It adds a design and documentation step, but it doesn't have to slow launches significantly if you build disclosure and opt-out patterns into your design system once, so every new AI feature reuses the same vetted components rather than starting from scratch.

How do I explain this to my leadership team without overstating the risk?

Frame it as a UX and documentation project with clear deliverables — an audit, updated interface patterns, and a data-flow record — rather than an open-ended legal risk. That framing tends to get budget approved faster than vague compliance language.

Does this apply differently to subscription-based D2C brands versus one-time purchase brands?

The underlying data and AI transparency expectations apply similarly either way, but subscription brands often have deeper behavioral data and more AI-driven retention or churn-prediction tooling, which means a larger and more sensitive AI footprint to document.

What role does UI/UX design actually play versus legal review?

Legal review tells you what needs to be disclosed and what controls need to exist; UI/UX design determines whether customers actually notice, understand, and can use those disclosures and controls. Both are needed, but the customer-facing outcome depends heavily on the design execution.

Should small D2C brands worry about this, or is it mainly a large-retailer issue?

Smaller brands are arguably more exposed in practice, since they're more likely to have added AI tools quickly without formal review, and less likely to have documentation ready if a customer or regulator asks a pointed question.

What's the first thing I should do this month?

Run the AI touchpoint inventory across your storefront and app. It's the foundation every other step depends on, and it's something your team can start immediately without waiting for further regulatory clarity.

How does this affect A/B testing on AI-driven features?

If your A/B tests involve different AI behavior shown to different customer segments, you should be able to explain that variation if asked, and ideally ensure the disclosure and opt-out experience doesn't differ in a way that disadvantages one test group.

Does GDPR's "right to explanation" already cover this?

GDPR's provisions around automated decision-making are related but narrower in some readings, and this action plan pushes the expectation further by tying AI transparency directly to cybersecurity risk assessment, which is a distinct regulatory lens.

What happens if I sell through marketplaces (Amazon, Zalando) rather than my own storefront in the EU?

Marketplace-hosted listings are subject to the marketplace's own AI and data policies, but any AI features on your own site, app, or direct-to-consumer channels remain your responsibility to review and disclose properly.

How specific does my data-flow documentation need to be?

Documentation should be specific enough that someone unfamiliar with the feature could read it and understand what data goes in, which model or vendor processes it, where it's stored, and how long it's retained — a one-line description per feature is not sufficient.

Is this only about chatbots, or does it cover AI used in fraud detection and checkout security too?

AI used for fraud detection and checkout security is squarely within scope, arguably even more so given the plan's cybersecurity framing — these systems process sensitive transaction data and make automated decisions that can block or flag a customer.

What if my AI feature is provided by a vendor based outside the EU?

You remain responsible for how that vendor's tool handles your EU customers' data when it's embedded in your customer experience, regardless of where the vendor itself is based. Vendor contracts and data processing agreements become more important under this scrutiny.

Can better AI transparency actually become a competitive advantage?

Yes — European shoppers have grown increasingly skeptical of opaque personalization, and a storefront that clearly explains and lets customers control AI features can read as more trustworthy and premium compared to competitors who bury this in fine print.

How do I handle this across a multi-brand portfolio with shared infrastructure?

Audit each brand's customer-facing AI touchpoints separately even if the backend infrastructure is shared, since disclosure needs to match what each brand's customers actually see, not just what the underlying system does.

What's the risk of doing nothing right now?

The main near-term risk is being caught flat-footed once member-state enforcement details solidify — scrambling to document AI data flows and redesign disclosure UX under a deadline is far more expensive and disruptive than doing it proactively.

Does this plan affect influencer or affiliate-driven AI content tools?

If your brand uses AI tools to generate or personalize content shared through influencer or affiliate channels, and that content involves customer data processing, the same transparency principles reasonably apply, though enforcement specifics for third-party channels remain less defined.

How do I keep this from becoming a one-time project that goes stale?

Build AI touchpoint review into your regular design and product review cycle rather than treating it as a single audit — every new AI feature should go through the same disclosure and documentation checklist before launch.

What's a realistic budget range for an ongoing governance approach rather than a one-time audit?

Ongoing design governance for ecommerce brands managing multiple markets and AI features typically falls into the Enterprise tier, starting around $4,000+, reflecting the continuous review and updates needed as features and regulations evolve.

Will customers actually notice if I improve AI disclosure and control?

Increasingly yes — European shoppers are more attuned to data and AI transparency than a few years ago, and a clear, well-designed disclosure experience tends to reduce support inquiries and build trust rather than create friction.

How does mobile app design differ from web storefront design for this?

App design needs the same disclosure and opt-out principles but must account for more limited screen space and different consent patterns (like OS-level permission prompts), which requires careful integration between app UX and backend consent logic.

What if my AI feature only affects internal operations, not customers directly?

Internal-only AI tools (like inventory forecasting) carry different exposure than customer-facing features, since the plan's practical D2C impact centers on customer data and customer-facing decisions, though internal tools using customer data still warrant documentation.

How do I know if my current AI disclosure is "good enough"?

A reasonable test: could a customer support agent explain, in plain language, what an AI feature does and how to opt out, using only what's visible on the site or app itself — not internal documentation? If not, there's a gap worth closing.

What's the single most common mistake D2C brands make with AI features right now?

Adding AI-powered tools quickly for competitive reasons without a corresponding review of what data they touch or how that's disclosed to customers — speed without documentation is the pattern that creates risk later.

Where should I start if I want outside help with this?

Start with an AI touchpoint audit and disclosure UX review scoped to your actual storefront and app, which a UI/UX-focused team can typically complete faster than building the internal process from scratch, especially if design and compliance haven't previously worked closely together.