NIS2, the EU AI Act, data protection rules and other digital regulations: Companies are not short on rules. What is often missing is the structure needed to manage them effectively.