Architecting Regulatory Agility: The GCOA Framework for Decoupling Compliance Logic in Global E-Commerce Systems

Global online marketplaces face unprecedented pressure to embed evolving regulations into their software architecture. This paper presents an architectural case study of a large e-commerce platform's response to the EU General Product Safety Regulation (GPSR) and the Digital Services Act (DSA) by treating legal mandates as explicit design constraints. We propose the Generalized Compliance Orchestration Architecture (GCOA), a reusable, two-layer framework that achieves regulatory agility by decoupling compliance logic from core business functions. The architecture introduces two key, modular components: a configurable Regulatory Policy Engine (RPE) and a State Machine Manager (SMM). The Preventive Compliance Layer enforces ex ante product safety rules (GPSR) via a multistage validation pipeline at listing creation, while the Reactive Governance Layer manages ex post content governance (DSA) using automated notice-and-action workflows. Key technical elements include the SMM-driven “Listings On Hold” lifecycle state machine with an integrated appeal process, prioritized event handling for trusted flaggers, and an immutable Audit & Transparency Ledger (ATL) for verifiable accountability. The platform achieved on-time compliance by the regulatory deadlines with minimal impact on user experience. This work demonstrates that regulatory requirements can be met at scale through modular, automated architecture. This work is presented as an architectural case study rather than a controlled experimental evaluation; its contribution lies in demonstrating how regulatory requirements can be operationalized as modular, scalable system components at production scale.