What about audits in a serverless world? How do you approach that?
Wouldn't you know up front when you're choosing a stack whether they meet your compliance demands?
No, not always. Good luck with the refactor (complete rebuild?) when the time comes.
The number of actors in industries with particularly notable compliance requirements (like HIPAA) that have internally very weak, inaccurate, ideas of the actual requirements and who discover the pracctical meaning of key elements both long after they've been in force and long after they've relied on an inaccurate understanding is, well, non-negligible.