If compliance sits everywhere, what should Legal own?

Safetrac was proud to sponsor Forefront Events’ Legal Counsel Summit VIC 2026 at Marvel Stadium in Melbourne. During her spotlight session, Safetrac CEO Deborah Coram asked senior in-house legal professionals where compliance sits, what gets in the way, and where their current approach is weakest. Their answers point to a growing legal challenge: responsibility is shared across the business, but accountability is often less clear.

When a compliance failure reaches legal, it is rarely legal that clicked the link, made the claim, handled the data, ignored the hazard, or missed the escalation… Yet legal is expected to explain what happened, what should have happened, and what the organisation can prove.

That gap between accountability and control is a daily problem for in-house legal teams.

At the Legal Counsel Summit, 69 percent of respondents said legal compliance was shared across multiple functions. Just 24 percent said it sat primarily in Legal. That reflects how organisations operate. Compliance is shaped by decisions made every day across people and culture, technology, sales, operations, finance, risk and the executive team.

“Compliance can be shared across the business, but ownership still needs to be clear. Legal’s role is to help turn regulatory requirements into day-to-day practice and make sure the organisation can show that its approach is working,” said Deborah Coram, CEO, Safetrac.

Asked about the biggest barrier to coordinated compliance, 39 percent of respondents selected a lack of time or resources. Unclear ownership followed at 20 percent, with siloed teams at 17 percent.

This was one room, not a sector-wide study, but the pattern was telling. The pressure point for legal is not simply access to regulatory information, another policy or another dashboard. It is turning obligations into action across a business with competing priorities and limited capacity.

Legal cannot solve that by becoming the default owner of every compliance activity. And nor should it.

The stronger model is distributed execution with central assurance. Legal translates obligations into clear expectations and controls, requires named owners, defines escalation thresholds, challenges performance and sets the standard of evidence the organisation must retain. The people who control the relevant processes remain accountable for operating those controls.

Five tests of defensibility

The 5E framework offers a practical way to test whether that operating model works. It moves the conversation beyond whether a policy exists or a course was completed.

Together, the five areas help legal check whether the organisation’s compliance approach is working.

The standout result here was engagement. 65 percent of respondents said this was their organisation’s weakest area, with evidence as a distant second at 13 percent. Many organisations can show that information was sent or training was completed. Far fewer can show that people understood the requirement and could apply it under pressure.

“Good compliance training is about more than completion. People need to understand what is expected and know how to apply it when it matters,” said Deborah Coram, CEO, Safetrac.

Privacy, cyber and AI make the problem immediate

More than half of the room (62 percent) identified privacy, cybersecurity, data governance and AI as their organisation’s biggest legal compliance risk. No other risk category came close.

The concern is reflected in recent regulatory and court action. The Office of the Australian Information Commissioner reported a record 1,205 data breach notifications in 2025, up 8 percent on 2024.

The legal consequences are also visible. In a recent ASIC action, the Federal Court ordered FIIG Securities to pay a $2.5 million penalty over cybersecurity failures. The admitted failures extended beyond technology to inadequate resources, failures to follow internal policies, no mandatory cybersecurity awareness training and no annually tested incident response plan.

The matter involved the specific obligations of an Australian financial services licensee, however, the case is a useful reminder that policies alone are not enough. Organisations need to fund, apply, and test their controls, and keep evidence that they have done so.

Where legal should focus

There are three practical places to start.

1. Be specific about ownership.
2. Check understanding, not just attendance.
3. Design the evidence before it is needed.

Rather than owning every compliance activity, Legal needs confidence that obligations are clear, owners are named, people know what to do, issues are escalated, and evidence is available when needed.

Legal adds the most value by giving the business a clear framework for making compliant decisions, even when Legal is not in the room, and being able to show that the framework works.