> Wouldn't you know up front when you're choosing a stack whether they meet your compliance demands?

No, not always. Good luck with the refactor (complete rebuild?) when the time comes.