PMP Practice: Classify compliance categories

Sora Kobayashi is developing a new clinical trial management system. During user acceptance testing, the compliance officer, Dr. Matteo Bernardini-Conti, halts the project immediately after discovering that patient consent data is being stored on servers located in a country that does not meet the data sovereignty requirements mandated by the European Medicines Agency (EMA). The project is now three weeks behind schedule, and the remediation will require migrating all test data to compliant infrastructure at significant cost. The infrastructure vendor was selected eight months ago based primarily on cost savings and technical capabilities. The project manager, Sienna Volkov, realizes that regulatory data residency requirements were documented in the initial compliance assessment but were not explicitly included in the vendor evaluation criteria. What should Sienna have done earlier to prevent this compliance failure?