Why "Compliance by Design" Beats Retrofitting AI Governance