Is Regulatory Risk Outgrowing Your Company Secretary Operating Model?

51% of governance professionals experienced a near-miss compliance event. The warning is difficult to ignore 

Regulatory risk is becoming harder for Company Secretaries to manage because the challenge is no longer limited to statutory filings. 

According to Diligent’s 2026 Global State of Legal Entity Compliance research, 51% of governance professionals surveyed experienced at least one near-miss compliance event. 

At the same time, 47% identified technology gaps and legacy systems as a major challenge. Diligent also found that 74% of Company Secretaries, General Counsel and legal operations leaders had seen their remit expand during the previous two years. 

Together, those figures reveal an important shift in the profession. 

Company Secretaries remain responsible for ensuring that corporate obligations are handled correctly. However, they are also becoming more involved in internal controls, ownership transparency, cyber governance, sustainability reporting, regulatory change, entity management and emerging technology. 

As a result, regulatory risk is becoming less about remembering deadlines and more about understanding how different risks and responsibilities connect. 

A missed confirmation statement matters. Yet so does an inaccurate beneficial ownership record, a weak internal control process, an unsupported sustainability disclosure or a cyber governance framework that cannot demonstrate board oversight. 

The modern Company Secretary therefore needs to understand these risks, even where another function owns the technical detail. 

The Company Secretary does not need to own every regulatory risk. Increasingly, however, they need to understand whether the governance around that risk is working. 

Read More: Statutory & Regulatory Compliance 

Executive Takeaway 

In 2026, Company Secretaries should have clear visibility over at least eight major regulatory risk areas: 

• Companies House reform and identity verification 

• People with Significant Control and beneficial ownership 

• Internal controls and the UK Corporate Governance Code 

• Cyber security and board accountability 

• Operational resilience for regulated firms 

• Sustainability and climate reporting 

• Cross-border entity compliance 

• Data, technology and AI governance 

A ninth issue cuts across all of them: the quality of the governance infrastructure supporting compliance. 

Although these risks are different, the governance response is often similar. 

Company Secretaries need: 

• Clear regulatory ownership 

• Reliable entity and director information 

• Forward compliance planning 

• Board-level reporting 

• Documented decision processes 

• Evidence of review and challenge 

• Effective escalation 

• Systems that reduce dependence on individual memory 

The strongest Company Secretary functions will not try to become technical specialists in every field. 

Instead, they will ensure that responsibility is clear, the board receives the right information and evidence exists when scrutiny arrives. 

1. Companies House reform is changing the basic rules of corporate compliance 

For UK companies, one of the most immediate regulatory changes comes from the Economic Crime and Corporate Transparency Act 2023. 

Identity verification for directors and People with Significant Control entered its compulsory phase on 18 November 2025. 

Companies House requires existing directors to provide their personal code through the relevant confirmation statement process. New directors must provide the required information when they are appointed or when a company is incorporated. 

Where one director holds appointments across several companies, the same verified identity can support those appointments. However, the personal code still needs to be connected with each relevant appointment. 

By July 2026, Companies House was publishing quarterly information on compliance with the verification requirements. 

This shows that the reform has moved firmly from policy design into implementation and monitoring. 

What Company Secretaries need to monitor 

A group may need visibility over: 

• Which directors have verified their identity 

• Which PSCs have completed verification 

• Which personal codes have been submitted 

• Which entities still require action 

• Whether overseas company directors are compliant 

• Whether external filing agents are properly authorised 

The administrative burden can grow quickly where individuals hold several appointments across a corporate group. 

Therefore, identity verification should not sit in an isolated tracker. 

It should form part of the wider director and entity governance record. 

Explore More: Company Formation & Structuring 

2. PSC and beneficial ownership risk is becoming more serious 

Ownership transparency is another area requiring greater attention. 

The Department for Business and Trade’s 2026 statutory guidance on People with Significant Control reinforces the requirement for companies to identify and report people who exercise significant influence or control. 

Failure to comply can have serious consequences. 

However, identifying control is not always straightforward. 

A person may qualify as a PSC through: 

• More than 25% of shares 

• More than 25% of voting rights 

• The right to appoint or remove a majority of directors 

• Significant influence or control 

• Influence or control through a trust or firm 

The updated statutory guidance also makes clear that control can arise through constitutions, shareholder agreements and other arrangements. 

In other words, control does not always follow obvious share ownership. 

For complex structures, the Company Secretary therefore needs to recognise when routine register maintenance has become a matter requiring legal interpretation. 

Key ownership risks to monitor 

• Shareholder changes not reflected in central records 

• Voting rights that differ from economic ownership 

• Shareholder agreements that create additional control rights 

• Trust structures 

• Holding companies in other jurisdictions 

• Outdated PSC information 

• Differences between local and group records 

• Beneficial ownership changes following transactions 

The risk is not simply that the register is wrong. 

It is that the organisation cannot explain why it believes the register is right. 

3. Provision 29 turns internal controls into a board evidence issue 

The revised UK Corporate Governance Code 2024 creates an important new governance requirement for companies within scope. 

Provision 29 applies to accounting periods beginning on or after 1 January 2026. 

It requires boards to monitor and review the effectiveness of the company’s risk management and internal control framework. That review covers material financial, operational, reporting and compliance controls. 

The annual report must also include a board declaration on the effectiveness of material controls at the balance sheet date. 

The Financial Reporting Council has said that many companies expect to identify around 30 to 50 material controls. Some financial services businesses may identify more. 

This creates a significant governance coordination task. 

The Company Secretary may not test controls personally. Nevertheless, they should understand: 

• Who determines which controls are material 

• Which board or committee reviews them 

• What evidence supports management’s conclusions 

• How control weaknesses reach the board 

• What remediation is underway 

• How the board reaches its final declaration 

• Whether minutes record meaningful review and challenge 

Without a strong process, directors could be asked to make a declaration that the organisation cannot properly support. 

For that reason, Provision 29 should not be treated simply as an annual report drafting exercise. 

It is a year-round governance process. 

Read More: Corporate Governance Support 

4. Cyber risk is now a board governance issue 

Cyber security was once treated mainly as a technology issue. 

That position is becoming increasingly difficult to defend. 

The UK Government’s Cyber Governance Code of Practice sets out actions that boards and directors should take ownership of across cyber risk management, strategy, people, incident planning and assurance. 

It expects boards to establish clear ownership, integrate cyber into wider risk management and receive appropriate information about the organisation’s cyber position. 

Recent National Cyber Security Centre data also points to continuing weaknesses. 

Only 24% of large organisations assess wider supply-chain cyber risks. Meanwhile, 57% of medium organisations have a formal cyber strategy. 

What should the Company Secretary be asking? 

The governance questions include: 

• Is cyber formally allocated within the board structure? 

• Does the board receive regular reporting? 

• Is the information understandable to non-technical directors? 

• Are cyber incidents subject to clear escalation procedures? 

• Does the board test crisis governance? 

• Are third-party risks considered? 

• Is cyber included within internal assurance? 

• Do board minutes show meaningful challenge? 

The Company Secretary does not need to become a cyber specialist. 

However, they should be able to assess whether the board is governing cyber risk effectively. 

That distinction matters. 

5. Operational resilience requires evidence that governance works during disruption 

For financial services firms, operational resilience remains another major regulatory concern. 

The Financial Conduct Authority requires firms within scope to identify important business services, set impact tolerances and develop the ability to remain within those tolerances during disruption. 

The transition period ended on 31 March 2025, by which point firms were expected to have completed relevant mapping and testing. 

In March 2026, the FCA published further observations on operational resilience after reviewing firms’ annual self-assessments. 

The regulator identified both good practice and areas where further improvement is needed. 

For the Company Secretary, the question is not simply whether management has completed an assessment. 

The board should understand: 

• Which business services are important 

• Where material weaknesses remain 

• Whether impact tolerances have been tested 

• What major third-party dependencies exist 

• How incidents are escalated 

• What lessons follow disruption 

• Whether agreed remediation has been completed 

Moreover, the board record should show that directors considered these matters. 

Operational resilience therefore brings together board governance, risk, technology and crisis management. 

6. Sustainability reporting is moving closer to mainstream corporate reporting 

Sustainability disclosure is another area Company Secretaries should watch closely. 

The UK Government published final UK Sustainability Reporting Standards S1 and S2 on 25 February 2026. 

UK SRS S1 covers general sustainability-related financial information. UK SRS S2 focuses on climate-related risks and opportunities. 

These standards matter because sustainability reporting increasingly intersects with board governance, risk and corporate reporting. 

A Company Secretary should therefore understand: 

• Which sustainability requirements apply 

• Which board committee oversees reporting 

• Who owns the underlying data 

• How materiality is determined 

• Which disclosures require board approval 

• Whether claims are supported by evidence 

• How sustainability information connects with financial reporting 

• What assurance expectations apply 

The Company Secretary may not calculate emissions or produce sustainability metrics. 

However, they often sit close to the governance process through which those disclosures reach the board. 

That gives the role an important challenge function. 

If management presents an ambitious sustainability claim, the governance question should be: 

What evidence allows the board to stand behind it? 

Explore More: ESG Reporting and Disclosure 

7. Cross-border compliance creates a visibility problem 

International organisations face a different type of regulatory risk. 

Different jurisdictions may have different: 

• Company laws 

• Filing deadlines 

• Director requirements 

• Beneficial ownership rules 

• Board procedures 

• Regulators 

• Reporting requirements 

• Document standards 

Consequently, strong local compliance does not always produce strong group oversight. 

This problem often appears where several local advisers operate independently. Each adviser understands their own jurisdiction, yet no one has a complete view across the group. 

A strong Company Secretary function should therefore maintain central visibility. 

Cross-border governance does not require every decision to be centralised. 

Instead, it requires enough visibility to allow the group to be governed properly. 

Read More: Company Secretary Outsourcing 

8. AI creates governance risk before many organisations have defined ownership 

Artificial intelligence is increasingly being used in legal research, compliance processes, board preparation, document drafting and corporate administration. 

That creates opportunity. However, it also raises new governance questions. 

For Company Secretaries, practical risks include: 

• Confidential board information entered into inappropriate tools 

• Inaccurate AI-generated minutes or summaries 

• Weak audit trails 

• Unclear responsibility for AI-assisted decisions 

• Bias or unreliable outputs 

• Data protection concerns 

• Excessive dependence on automated processes 

• Poor control over approved tools 

The governance response should not be to ban useful technology. 

Instead, organisations need clear rules covering: 

• Which AI tools may be used 

• What information may be entered 

• Who reviews outputs 

• Which activities require human approval 

• How confidential information is protected 

• How errors are escalated 

• What evidence is retained 

Company Secretaries are well placed to connect AI use with board accountability because they already sit close to the organisation’s decision processes. 

However, the principle should remain clear. 

Automation can support judgement. It should not obscure responsibility for it. 

9. The hidden regulatory risk is outdated governance infrastructure 

The eight risks above have one important factor in common. 

They depend on the organisation’s ability to manage information, responsibilities, decisions, deadlines and evidence. 

Many compliance failures do not begin with a misunderstanding of the law. 

They begin with poor systems. 

Diligent’s 2026 global entity compliance research found that many governance teams are managing expanding obligations while manual processes remain widespread. 

This matters because a Company Secretary can understand the regulation perfectly and still struggle if the operating model relies heavily on: 

• Spreadsheets 

• Separate calendars 

• Shared drives 

• Email reminders 

• Local databases 

• Institutional memory 

• Manual action tracking 

The risk grows quietly. 

For example, a filing may be overlooked. Ownership data may become inconsistent. A board action may remain open because nobody sees the exception. 

In each case, the professional may understand the obligation. 

The infrastructure fails to support them. 

Governance infrastructure should therefore be treated as part of the organisation’s regulatory control environment. 

A practical regulatory risk dashboard for Company Secretaries 

A strong Company Secretary function does not need to place every regulatory development into the board pack. 

Doing so can create more noise than insight. 

Instead, regulatory reporting should distinguish between information the board needs and detail that management should handle. 

Board-Level Regulatory Dashboard 

This approach keeps the board focused on exceptions, decisions and areas requiring intervention. 

It also prevents regulatory reporting from becoming a long list of technical updates. 

The Lumorus View 

The Company Secretary’s regulatory role is shifting from tracking obligations to making regulatory accountability visible. 

That distinction matters. 

The profession should not become responsible for every piece of compliance inside an organisation. Doing so would be unrealistic and could weaken accountability by blurring ownership. 

Instead, Company Secretaries should help boards understand: 

• Who owns the risk 

• Whether the governance process is clear 

• Whether the right information reaches the board 

• Whether decisions are properly recorded 

• Whether agreed action is taking place 

• Whether evidence exists 

This is where the function creates strategic value. 

The Company Secretary does not need to know everything. 

They need to help ensure that the organisation knows who needs to know, who needs to act and how the board can see that it happened. 

Seven signs regulatory risk is outgrowing your operating model 

Company Secretaries should pay particular attention where: 

1. Compliance deadlines depend heavily on personal reminders. 

2. Different teams hold different versions of director or ownership information. 

3. Board regulatory updates are lengthy but rarely identify actions. 

4. Regulatory changes are discussed without assigning an accountable owner. 

5. Local entities escalate issues only when deadlines are close. 

6. Evidence has to be gathered retrospectively before audits or reviews. 

7. Governance continuity would be difficult if one experienced person became unavailable. 

These problems do not necessarily indicate poor performance by governance professionals. 

More often, they show that governance complexity has outgrown the infrastructure supporting the function. 

What Company Secretaries should do now 

The regulatory environment is too broad to manage reactively. 

A more resilient approach has five elements. 

1. Build one regulatory horizon 

Create a central view of material regulatory developments affecting governance, entities and the board. 

This does not mean tracking every regulatory announcement. Instead, focus on developments that require action, decisions or oversight. 

2. Assign ownership clearly 

Every material regulatory change should have an accountable executive or function. 

The Company Secretary can coordinate and monitor. However, accountability should remain with the person or function that owns the underlying risk. 

3. Connect regulation with the governance calendar 

Relevant board decisions, reporting deadlines and implementation milestones should appear in governance forward planning. 

This helps move regulatory change from information to action. 

4. Track evidence, not only completion 

A completed action should include evidence that the obligation was handled appropriately. 

Otherwise, a tick in a tracker may say more than the underlying governance process can support. 

5. Report exceptions 

Boards should receive matters requiring judgement, escalation or intervention. 

They do not need every compliance activity. 

Together, these steps reduce noise while strengthening control. 

Why CoSec Hub was built differently 

CoSec Hub was built around the principle that regulatory complexity requires both governance technology and experienced Company Secretary judgement. 

Technology can improve visibility. 

However, professional judgement remains essential when an issue requires interpretation, escalation or board attention. 

The technology layer supports 

• Entity Management 

• Compliance Calendars 

• Governance Forward Planning 

• Board Management 

• Contract Management 

• Statutory Registers 

• Board Action Tracking 

• Meeting Lifecycle Management 

The Governance Knowledge Centre provides 

• Company Secretary Expertise 

• Governance Operations Support 

• Compliance Monitoring 

• Board Administration 

• Governance Intelligence 

• Multi-Jurisdiction Governance Support 

• Governance Advisory 

Together, they provide a Technology-Enabled Company Secretary Retainer Service. 

This model matters because technology can tell the team that an obligation exists. 

Professional judgement determines what that obligation means, who should act and whether the board needs to know. 

Explore: CoSec Hub 

The Bottom Line 

The regulatory risks facing Company Secretaries in 2026 go far beyond traditional corporate compliance. 

Companies House reform, ownership transparency, internal controls, cyber governance, operational resilience, sustainability reporting, cross-border regulation and AI are placing new demands on boards and governance teams. 

No Company Secretary can be the technical expert in every one of those fields. 

Nor should they try to be. 

The more important role is to ensure that regulatory responsibility is clear, useful information reaches the board, important decisions are properly governed and evidence exists to show that obligations have been addressed. 

That requires a shift from reactive compliance administration towards proactive governance operations. 

The Company Secretary of the future will not create value by remembering everything. 

They will create value by building governance systems that ensure the organisation does not have to rely on memory in the first place. 

Continue Exploring Our Services

• For stronger governance and board accountability: Corporate Governance Support 

• For statutory and regulatory oversight: Statutory & Regulatory Compliance 

• For stronger board processes: Board & Shareholder Meetings 

• For entity formation and restructuring: Company Formation & Structuring 

• For scalable external governance capacity: Company Secretary Outsourcing 

• For stronger corporate reporting: Annual Report Services 

• For defensible board records: Minute Taking Solutions 

• For connected governance operations: CoSec Hub 

Strengthen your Company Secretary function before regulatory pressure exposes the gaps 

Regulatory pressure is expanding across identity verification, ownership transparency, internal controls, cyber governance, sustainability reporting, cross-border compliance and AI. 

As the remit grows, the operating model supporting the Company Secretary function matters just as much as the technical knowledge within it. 

That is why CoSec Hub is offering qualified Chartered Company Secretaries an opportunity to assess both the technology available to them and the infrastructure supporting their function. 

Get a 14-Day FREE Trial + Complimentary Company Secretary Functional Audit 

Experience CoSec Hub for 14 days and explore how the Company Secretary Command Centre and Governance Knowledge Centre can support your governance environment. 

Qualified Chartered Company Secretaries can also receive a complimentary Company Secretary Functional Audit. 

The audit provides a structured review of areas including: 

• Operating model 

• Responsibilities and decision rights 

• Capacity 

• Governance processes 

• Technology and systems 

• Compliance oversight 

• Information flows 

• Key dependencies 

• Escalation arrangements 

• Continuity and resilience 

The aim is not simply to identify more work. 

Instead, the review examines where the Company Secretary function is working well, where pressure or dependency may be building and where stronger infrastructure could improve control, visibility and board support. 

Exclusive offer for qualified Chartered Company Secretaries. 

Explore CoSec Hub and see how technology-enabled Company Secretary support can strengthen regulatory readiness. 

Lumorus: Better Business, Built on Purpose 

Lumorus is a global governance, ESG, Company Secretary and advisory firm headquartered in the UK and supporting organisations across Europe, Africa, Asia, the Caribbean, Canada, the Middle East and international markets. 

For more than 10 years, we have helped boards, leadership teams and organisations strengthen governance, accountability and organisational resilience. 

As regulatory expectations expand, Company Secretaries need governance infrastructure capable of keeping obligations, board activity, entity information and accountability connected. 

Can your governance team see the regulatory risks that matter before they become compliance failures? 

Contact Lumorus to explore how our Company Secretary services and CoSec Hub can strengthen governance operations, regulatory visibility and board-ready compliance. 

Current CoSec Hub offer: Qualified Chartered Company Secretaries can receive a 14-day free trial plus a complimentary Company Secretary Functional Audit. 

Email: [email protected] 

CoSec Hub + Governance Knowledge Centre: Where Automation Meets Governance Authority. 

Sources 

• Diligent – 2026 research on near-miss compliance events, technology gaps and expanding governance responsibilities. 

• Diligent – The Corporate Secretary’s Expanding Mandate Is Exposing an Outdated Operating Model. 

• Companies House – Director and PSC identity verification requirements. 

• Department for Business and Trade – 2026 statutory guidance on People with Significant Control. 

• Financial Reporting Council – UK Corporate Governance Code 2024 and Provision 29. 

• Financial Reporting Council – Provision 29 implementation guidance. 

• National Cyber Security Centre – Cyber Governance resources and board responsibilities for cyber security. 

• Financial Conduct Authority – Operational resilience requirements. 

• Financial Conduct Authority – 2026 operational resilience observations. 

• UK Government – UK Sustainability Reporting Standards S1 and S2, published February 2026.