The act says, "OK, it’s good, and you can break those regulations for 6 months or 12 months." For this period you need to, of course, still keep consumer protection, cyber security, etc., in mind, but, most importantly, if this fails you need to write a post-mortem and have the society know why it fails.