I appreciate recent EU regulations choosing to penalize corporations on the basis of a percentage of revenue.

It effectively mandates a lower-limit on spend for budgeting purposes.

Sure, that money might be spent ineffectively... but corporations will figure it out if their only options are to

1. Not invest in regulatory compliance at all and get fined for noncompliance.

2. Throw money at the problem, spend it inefficiently, and STILL get fined for noncompliance.

3. Throw money at the problem, spend it well enough to pass muster, avoid fines.