Compliance-by-design implies that you take relevant regulatory frameworks into account in every technical choice from the very beginning. PCI DSS scope requirements impact network design; GDPR data residency requirements dictate where databases are provided, and automated compliance tests are executed in the CI/CD pipeline on every deployment. When compliance is evaluated only at the end of the development cycle, findings often necessitate architectural changes rather than incremental configuration fixes.