It's the same in edutech.  Aside from SOC2, my team spends an outsized amount of time on WCAG 2.2 compliance. Not to mention all the PII stuff.