Section 1
Why triage is forced, not optional
Start with why you have no choice but to prioritize. This is the fixed-cost story again, and it is the load-bearing fact under everything that follows. Compliance is mostly a fixed cost that does not shrink with your firm. KfW Research's Mittelstandspanel (Fokus Nr. 495, April 2025, around 10,000 firms) found the German Mittelstand spends about 7 percent of its working time on bureaucracy, roughly 32 hours per firm per month, and that solo self-employed people spend the most, 8.7 percent of their time, with the burden falling as firms grow. The IMPULS-Stiftung and IfM Bonn found the same in money: bureaucracy costs a small firm around 6.3 percent of revenue against roughly 1.3 percent for the largest, nearly five times the relative load. At the macro level the ifo Institut put the drag of excessive bureaucracy on German output at about 146 billion euros a year. Here is what those numbers mean for a specific overloaded owner. A large firm resources compliance fully because it has a department to do it. You cannot. You physically do not have the hours to give every obligation its full due, so you are already, today, giving some of them less. That is not a moral failing you can fix by trying harder. It is a capacity constraint fixed by arithmetic. The only open question is whether you allocate your scarce compliance hours deliberately, or let them get allocated by whichever letter arrived most recently and scared you most. That reframe is the whole piece. You are not choosing whether to triage. You are only choosing whether to triage well.
Section 2
The tool: risk-weighted, not guilt-weighted
Most owners rank obligations by anxiety. The rule that came with the scariest letter, or the one their competitor mentioned, gets the attention. Anxiety is a terrible sorting function because it tracks vividness, not cost. The fix is to sort every obligation by expected cost of ignoring it, which has three factors you can actually estimate: Expected cost of doing nothing = penalty if caught × probability of enforcement × how irreversible the damage is. A rule with a large penalty, active enforcement, and irreversible consequences (losing a license, a safety failure that hurts someone, a tax debt that compounds) is one you resource fully, no matter how much time it costs. A rule with a trivial penalty, near-zero enforcement, and fully reversible consequences (a documentation nicety you can produce retroactively if anyone ever asks, which they will not) is one you can rationally defer, on purpose, without guilt, and revisit if the enforcement picture changes. The behavioural science here is not subtle. People systematically over-weight vivid, recent, low-probability threats and under-weight boring, high-probability ones. The scary letter about a small fine gets your Saturday; the slow-building tax documentation problem that will actually cost you gets ignored because it is dull. Sorting by the arithmetic instead of the adrenaline is most of the edge. It is also almost the entire content of "doing nothing well": you are not doing nothing about everything, you are doing nothing about the cheap-to-ignore obligations so you can do everything about the expensive ones. To build this into a real framework rather than a slogan, run three models against it: comparative statics for why triage is forced, behavioural and base-rate reasoning for how to weight it, and a hard historical analog for where it ends if you push it too far.
Section 3
Model 1: Comparative statics, the burden that forces the choice
Move one variable, firm size, and hold the rest still. As the firm shrinks, fixed compliance costs become a larger share of a smaller base, and, more importantly for this piece, a larger share of a fixed pool of owner-hours. The KfW curve (8.7 percent of time for solo operators, falling with size) is that relationship drawn from real firms. The strategic consequence: below some size, full compliance with every obligation is not merely expensive, it is arithmetically impossible within the hours available. The large firm is on a part of the curve where full compliance fits inside its capacity. You are on a part of the curve where it does not. Pretending otherwise, trying to fully resource everything, does not produce full compliance. It produces an exhausted owner who does everything badly and still misses the one rule that mattered. Triage is what the curve demands, not what a weak operator settles for. Comparative statics: the equilibrium-shift lens • Assumes: you can move size alone; compliance is genuinely fixed-cost against a fixed pool of owner-hours. • Fits because: below a size threshold, total obligation exceeds available capacity, forcing allocation. • Breaks when: the owner actually has slack hours they are wasting elsewhere. Then the constraint is discipline, not capacity, and "I have to triage" becomes an excuse. • Counteracts: the guilt narrative that says a good owner complies with everything. At your size, no one can. • May reinforce: using "I am small" to justify neglecting things you do have time for. Be honest about which it is.
Section 4
Model 2: Behavioural and base-rate reasoning, weighting the choice honestly
The triage only works if your probability estimates are honest, and human probability estimates are predictably biased. Two corrections do most of the work. First, correct for vividness. The obligation attached to the frightening story is not necessarily the costly one. Ask for the actual enforcement rate and the actual penalty, in numbers, not in dread. Most owners have never once looked up how often a given rule is actually enforced against firms like theirs. That single lookup reprices half the list. Second, correct with the base rate. For any obligation, the reference-class question is: of firms like mine that quietly under-resourced this exact rule, what share actually suffered a material consequence in a year? For a large, well-enforced tax obligation, that share is high and rising, so you resource it. For an obscure documentation duty, it is close to zero, so you defer it and sleep fine. Starting from the frequency instead of the fear is the core of disciplined non-compliance. It converts a moral panic into a portfolio decision. There is a trap inside this model, and it is the dangerous one, so I am going to name it hard. Base rates drift. A rule that was near-never enforced can become heavily enforced overnight when the state gets a new tool. The obligation you correctly deferred in 2022 can become the one that sinks you in 2026, not because you changed but because enforcement did. Which brings us to the historical analog, and to the reason "just don't comply" is a strategy with an expiry date printed on it. Behavioural and base-rate reasoning: the humility lens • Assumes: enforcement rates and penalties are knowable and roughly stable over your planning horizon. • Fits because: owners demonstrably mis-weight vivid low-probability risks against dull high-probability ones. • Breaks when: enforcement regime-shifts. A stable base rate is exactly the assumption that fails when the state digitizes detection. • Counteracts: panic-driven, guilt-driven allocation of compliance hours. • May reinforce: complacency, if you treat a low historical base rate as permanent. It is not.
Section 5
Model 3: The Southern-European analog, where the road actually goes
If selective non-compliance is a spectrum, its far end is the informal economy, and Southern Europe is the fully worked example. It is worth looking at clearly, because it is both a proof of concept and a warning, and most people only take one of those two lessons. The proof of concept: informality at scale is a real, stable equilibrium, not a fringe. Estimates vary by method, but the CEPR has put Greece's shadow economy near 36 percent of GDP and Italy's around 31 percent, with Spain and Portugal around 24 percent, against a developed-country average near 17 percent. Other 2024 measures for Italy are lower (around 21 percent), but the direction is unambiguous: in these economies, a very large share of activity runs partly or fully outside the formal compliance system, concentrated in cash-heavy sectors like construction, hospitality, and care work. Firms and workers choose informality, the IMF notes, precisely to avoid taxes, social contributions, and labour and product regulation. In other words, the Southern-European informal firm is running the exact cost-benefit calculation this article describes, all the way to its logical end. It found that for a huge swath of activity, the expected cost of non-compliance was lower than the cost of compliance, and it acted on that. Now the warning, which is the half people skip. That equilibrium has brutal second-order costs, and they land hardest on exactly the small operators who chose it. An informal firm cannot enforce contracts cleanly, cannot access formal credit, cannot bid for the contracts that require documentation, cannot scale past the size where cash-in-hand stops working, and cannot sell itself as an asset because on paper it barely exists. The CEPR frames the shadow economy as weakening public finances, deepening inequality, and eroding institutional trust. At the firm level that abstraction has a concrete meaning: informality caps your ceiling. You trade the compliance burden for a growth cage, and you do not feel the bars until you try to grow. And here is the part that turns the analog from a cautionary tale into a live warning for you specifically: the informal equilibrium is being dismantled by technology in real time. Greece added over 2 billion euros in tax revenue in 2024, driven largely by connecting cash registers to card-payment POS systems and expanding digital transactions. Not by hiring inspectors. By making the transactions machine-visible. The base rate for getting away with informality did not drift. It collapsed, because the detection tool changed. Every operator who had priced their strategy on the old enforcement probability got repriced without warning. The Southern-European analog: the historical-consequence lens • Assumes: the structure that let informality persist (cash, low digital detection) resembles your situation closely enough to transfer the lesson. • Fits because: the informal firm is running this exact non-compliance calculation to its endpoint, so its outcomes are your extrapolation. • Breaks when: your legal grey-zone triage (deferring low-risk admin) is treated as equivalent to their illegal informality (hiding revenue). These are different in kind, not just degree; do not let the analog blur the line. • Counteracts: the fantasy that non-compliance scales for free. It caps your ceiling and its detection risk is rising. • May reinforce: a moralizing dismissal of Southern-European operators as simply dishonest, which misses that they are responding rationally to a worse compliance-to-benefit ratio than yours.
Section 6
The structure-break flag: this strategy has an expiry date
Every model above rests on enforcement probabilities being roughly stable. That assumption is failing, on purpose, right now, and it is the single most important thing to understand about selective non-compliance in 2026. The Greek POS story is the leading edge. The German version is e-Rechnung, mandatory structured electronic invoicing (via the Wachstumschancengesetz): receive-capability required from January 2025, issuing required for firms over 800,000 euros turnover from 2027, and for essentially all firms from 2028. Structured e-invoices are machine-readable by design. As invoicing, and eventually more of the compliance stack, moves onto formats a computer can read and cross-check automatically, the enforcement probability on whole categories of obligation is climbing toward one. The things you could quietly under-resource because no human was ever going to check are becoming the things an algorithm checks by default. This is the regime-break that reprices the entire strategy. Selective non-compliance was always a bet on low detection. Digitization is a policy machine explicitly built to raise detection. So the correct time horizon on any "defer this obligation" decision is shrinking. A rule that is safe to deprioritize in 2026 because enforcement is manual and rare may be auto-enforced in 2028 because the data flows to the authority automatically. The strategy does not become invalid. It becomes dated. You have to attach an expiry to every deferral and revisit it as the detection regime tightens.
Section 7
The framework, assembled
Put the models together into something you can run this quarter. Triage every obligation by expected cost of ignoring it (GEER, automate-first). List your recurring compliance duties. Score each: penalty × enforcement probability × irreversibility. For the high scores, do not triage at all, resource them fully, and where possible automate them so full compliance costs you no ongoing hours. e-invoicing, payroll, VAT filing: these are becoming both high-enforcement and highly automatable, which means the right move is not "defer" but "automate and forget." For the low scores, deliberately defer, and write down that you did and why. The failure mode: scoring by dread instead of data. If you have not looked up the actual enforcement rate, your score is fiction. Build the deferrals into a dated portfolio (RADAR). Do now: fully resource and, where you can, automate the high-expected-cost rules, because they pay off in every scenario. Hedge: keep a tax advisor on light retainer as insurance against the base-rate shifts you will not see coming, which is precisely what happened to Greek cash-only firms. Defer with a trigger: for each low-risk obligation you are deprioritizing, write the specific signal that will make you resource it (a change in enforcement, crossing a size threshold, a mandate deadline). The failure mode: an undated deferral. "Doing nothing" without an expiry is not a strategy, it is the Southern-European trap arriving on a delay. Check it against the base rate and the analog (CHAIN). The reference class says: firms that under-resource high-enforcement obligations get away with it right up until a detection tool changes, then get repriced all at once. The second-order prize of getting this right: by automating the high-enforcement, high-automatability rules now, you remove them from the triage list entirely, which frees your scarce hours for the genuinely low-risk deferrals where doing nothing really is free. The matrix-break flag: the base rates that make deferral safe are being rewritten by digitization faster than at any point in the paper era. Treat every enforcement probability as a decaying estimate, not a constant.
Section 8
What this ensemble cannot see
Three blind spots, named honestly. It cannot draw the ethical line for you. This framework is about legally deprioritizing low-risk administrative obligations under a hard time constraint. It is not permission to evade tax or hide undeclared work, which is a different thing with different consequences, as the Southern-European ceiling shows. The models optimize expected cost. They do not encode the line between minimal-viable compliance and fraud. You have to hold that line yourself, and the fact that the arithmetic sometimes favours the wrong side of it is exactly why arithmetic is not the only input. It cannot price your risk tolerance or your reputation. A repriced base rate is survivable for a firm with reserves and fatal for one living hand to mouth. The same deferral is prudent for one owner and reckless for another. The framework gives you the trade. Your balance sheet and your name decide whether you can afford to take it. And it cannot forecast the enforcement regime precisely. I can tell you digitization is raising detection, because Greece's POS numbers and Germany's e-Rechnung timeline are real. I cannot tell you exactly which obligation gets auto-enforced in which year. The ensemble can tell you the direction of the regime-break. It cannot give you the date, which is why every deferral needs a trigger instead of a deadline you invented.
Section 9
The fitness test
One question, this week. Take the compliance obligation you are currently ignoring with the most guilt, and the one you are ignoring with the least thought. For each, write down three numbers: the penalty if caught, the honest probability of enforcement (look it up, do not guess), and whether the damage is reversible. Then check: are you spending your worry on the high-cost one, or on the vivid one? If your guilt and your arithmetic point at the same obligation, you are triaging well, and you can do nothing about the rest with a clear conscience. If they point at different ones, your anxiety is managing your compliance, and it is doing a worse job than a spreadsheet would. Doing nothing is a real strategy. Doing nothing by accident is just the slow version of getting caught.