Vanilla options on GCP would not be certified for specific regulatory requirements. You would need to be -- in the cases of government regulations -- need to be running Assured Workloads.
As to your question of why: maintaining compliance is expensive, especially if you're accustomed to pushing prod code changes hundreds of times per quarter.
https://cloud.google.com/assured-workloads
As to your question of why: maintaining compliance is expensive, especially if you're accustomed to pushing prod code changes hundreds of times per quarter.