How to assess the impact of regulatory change with an AI agent

Let the agent do the mapping and keep the judgement with people. The agent reads the change, splits it into obligations, maps each one to the policies, controls, products and owners it touches, and drafts an impact rating with its reasoning. The compliance lead and the business owners decide the real impact, the actions and the deadlines.

What is a regulatory change impact assessment, and who owns it?

A regulator publishes a final rule, a consultation outcome or new guidance. Someone has to answer three questions: does it apply to us, what in our framework does it touch, and how much work is needed by when. That answer is the impact assessment, and it sits inside the wider discipline of regulatory change management.

Ownership usually sits with the compliance function, often a regulatory change lead, but the assessment is only credible when the owners of the affected policies, processes and systems agree with it. The agent does the reading and cross-referencing that takes analysts days, so the people who must agree spend their time on judgement. Reading is the cheap part; as we argue in agents for regulatory change, the reading is not the work, and an assessment built only on summaries will miss what matters.

What are the steps?

1. Person, regulatory change lead: logs the change. Source, publication type, the entities in scope and a provisional owner go into the regulatory change log. The agent does not decide what enters the log.
2. Agent, depth 1: splits the text into obligations. Each obligation is quoted in the regulator's words with its paragraph reference, any stated effective date, and whether it is new, changed or guidance on an existing requirement.
3. Agent, depth 1: checks applicability. Against the firm's entities, permissions, products and customer types. Where applicability turns on interpretation, it says so rather than choosing.
4. Agent, depth 1: maps each obligation to the framework. Policies, procedures, controls, systems, products and the named owner of each, citing the current version of every document it maps to.
5. Agent, depth 2: drafts the impact rating. For each obligation: no change, wording change, process change, system change or new capability, with its reasoning and the evidence it relied on.
6. Person, policy and business owners: challenge the draft. They confirm or change the rating for the items they own. Changes and reasons are recorded against the agent's draft.
7. Agent, depth 2: drafts the action plan. Actions, owners and target dates, working back from the effective date, in the impact assessment template.
8. Person, compliance lead: approves the assessment and, where the change is material, takes it to the relevant committee.
9. Agent, depth 1: tracks actions to closure and flags any that slip past their date.

Which controls apply, and what evidence does each leave?

Quoted, referenced obligations. The agent never keeps a paraphrase as its only record of an obligation. Evidence: each line carries the source text and paragraph number, so a reviewer can check the split against the original.

Versioned mapping. Every link to a policy or control names the version mapped. If the policy changes during the assessment, the link shows as stale. Evidence: the version stamp on each mapping row.

Draft kept beside decision. The agent's rating and the owner's final rating are both kept, with the reason for any change. Evidence: a record of disagreements, which is also your best data on where the agent is weak.

Named approval. The compliance lead's sign-off is filed against the final version, not a draft. The agent cannot mark an assessment approved.

Interpretation flags. Where the text is ambiguous, the agent records the alternative readings and stops. Evidence: a list of open interpretation questions, each closed by a named person or by counsel.

What should you measure?

• Time from publication to approved assessment, by type of change.
• Owner overrides of the agent's rating, and in which direction. Consistent under-rating of system changes, for example, tells you to adjust its brief.
• Obligations missed at the split, found later by owners or by audit. This is the measure that matters most.
• Mapping accuracy: links that owners reject as wrong or irrelevant.
• Actions closed by their target date, and how many were re-dated.

Where does it usually go wrong?

Summaries treated as assessments. A neat summary of a long consultation paper feels like progress but answers none of the three questions. Insist on obligations, mappings and ratings, each referenced.

Mapping to an unversioned library. If the policy library holds superseded drafts beside current documents, the agent maps to whatever it finds. Fix the library before you rely on the map.

Applicability decided by default. An agent that says a change applies whenever it is unsure floods owners with irrelevant items; one that says it does not is worse. Make "uncertain" an explicit outcome that goes to a person.

Owners who rubber-stamp. When the draft is right most of the time, owners stop reading it. Sample their confirmations and track how often they change anything at all.

No link to breaches. A change assessed too late, or an action that misses its effective date, can become a breach. Route missed dates into the process for logging and assessing regulatory breaches.

Where Pryme fits

In Pryme, the policy library reaches the agent through the Pryme Context Protocol as sealed facts, so every mapping cites a specific, current version. The agent is certified to depth 2, enough to read and map and to draft ratings and plans. Approval sits outside its role scope, so an attempt to mark an assessment approved is refused and filed. The wider position is set out in AI compliance agents.