The sweet spot is in actually testing for, and enforcing regulations. Fund that part properly, and you're most of the way there. It should also not need to be said that the testing and enforcement cannot be outsourced to some corporation, and cannot be self reported.