Regulation Must Become Agile to Remain Relevant

By applying principles from software development, regulators can improve regulatory performance in a fast-changing world.

Regulatory scholars and practitioners might be tempted to dismiss agile regulation as another yet another reform idea that is unlikely to deliver substantive benefits—much like other reforms of recent decades. But such an appraisal may be short-sighted.

Agile regulation is different from prior reforms because the problem that it seeks to address is different. Prior efforts sought to improve regulatory quality and regulatory burden. In contrast, integrating agile principles into the regulatory system might just be the most important step towards keeping a cumbersome regulatory system still relevant.

The concept of agile regulation is adapted from software development management principles published in 2001 to counter cumbersome sequential, systematic management processes. Because technology evolves quickly, the step-by-step approach favored by traditional quality managers proved a costly barrier for software developers who strived to innovate and sought to learn from experimentation during the design and build phases of software products. Competitive market pressures rewarded those software development teams that were faster, cheaper, and more relevant than their peers.

The software developers’ Agile Manifesto principles emerged in rebellion against time-consuming processes that hindered innovation. These principles emphasize frequent and robust communication between developers and customers. They encourage self-organizing teams, iterative learning, flexibility, and self-scrutiny for constant improvement. By applying the agile project management principles, developers accelerated production while also delivering higher quality products to their customers.

Many regulatory reform efforts have encouraged sequential steps not unlike the management processes confronting early software developers. Intended to serve the noble purpose of improving regulatory quality or reducing burden, regulatory development has often proven to be time-consuming to perform, and many of the steps are subject to lengthy intradepartmental oversight followed by interdepartmental oversight. It is often difficult to incorporate innovative approaches during regulatory development and even more difficult to learn from experimentation.

In recent years, digitization of the economy has accelerated the pace of innovation in a variety of sectors, including communications, transportation, and banking. Digital systems are now capable of performance-altering updates in minutes. In contrast, developing a technical regulation could require years, following necessary research and analysis, and then public comments and analysis.

As a result, regulators and the industries they regulate can be seen as operating on entirely different timescales. Digitization introduces new dimensions of risk that are strong candidates for regulatory solutions: cybersecurity, privacy, and resilience among them.

The timescale gap between the regulator and regulated threatens the relevance of regulatory approaches to manage risk to public well-being. The goal of agile regulation is to bridge the growing gap between the slower timescale of regulatory development and the faster timescale of innovation while also protecting the transparency, accountability, rigor, and relevance of our regulatory system.

Agile regulation will necessarily make a lasting and substantive impact because failure to bridge the growing timescale gap is tantamount to failing to regulate as necessary to protect public well-being from emerging risks.

Emerging cyber risks already galvanize a nervous public seeking assurance that artificial intelligence or cyber-vulnerable systems will be subject to some regulatory oversight. Agile regulatory processes would provide improved timeliness of regulatory response to emerging threats. Agile regulatory mechanisms—such as flexible rule designs—would allow for innovation while mitigating the greatest risks. Together, agile regulatory processes and mechanisms offer to serve as the struts, girders and beams in the bridge across disparate timescales of technology and regulation.

Fortunately, we are not starting without some examples of successful agile regulatory processes and mechanisms.

The general process of developing federal regulations has in the past sometimes incorporated some of what today would be considered agile best practices. For example, certain complex regulations are produced not by individuals working sequentially but by highly motivated interdisciplinary teams working together almost daily, often face-to-face. Similarly, certain regulations that are novel or likely to draw extended reviews are drafted with frequent feedback sought during early informal consultations with reviewers to minimize later delays.

Certain regulatory mechanisms already reflect agile principles. For example, performance standards that establish expected outcomes while avoiding prescriptive requirements are a form of agile regulation. They can be difficult to assess, but examples of specific successes are encouraging.

Alternatively, a dual regulatory system comprised of traditional standards and responsible oversight can serve as an agile mechanism that encourages product innovation while assuring performance. In another example, voluntary labeling regulations have been shown to be effective as well as agile.

There is much, much more opportunity to incorporate agile principles in regulation.

Regulatory practice leaders should encourage a work culture that rewards innovative ideas, efficient execution, collaborative communication, experimentation, and iterative design. Workflows and team assignments should be structured to allow for teamwork and collaboration, rather than sequential pass-the-draft-to-the-next-reviewer protocols.

Legislation that directs regulation could better incorporate agile principles by allowing for iterative approaches rather than one-size-fits-all forever standards. Regulatory sandboxes, performance-based standards, and—the holy grail—effective amendment of outdated statutes by Congress would go a long way towards ensuring a relevant effective regulatory system.

A relevant regulatory system is one that is able to keep pace with the risks, products, and services that must be governed. The broad impact of digitization supports the public expectation of faster, more transparent, and more accurate products, services, and systems from government as well as the private sector.

Regulatory practice necessarily moves more slowly than innovation, but applying concepts from the Agile Manifesto to the regulatory system can bridge the growing gap.