How to maintain the regulatory obligations register with an AI agent

An obligations register stays useful only if every row has an owner, a source and a control, and someone notices when any of them changes. The agent does the noticing and drafting: it proposes new entries, keeps mappings current and flags stale rows. Named owners accept their obligations, and compliance approves every change.

What is the register, and who owns it?

A regulatory obligations register lists what the firm must do under the rules that apply to it, broken into individual obligations. Each row typically holds the source text and reference, the entities and business areas in scope, the accountable owner, the policies and procedures that deliver it, the controls that evidence it, and the last date it was reviewed. In the UK, under the Senior Managers and Certification Regime, many firms map obligations to the senior manager responsible, which makes the register part of the accountability map.

Compliance owns the register; business owners own their rows. The register decays quietly: rules change, teams reorganise, controls are retired, and the register keeps saying the old thing. It is similar in shape to two other registers an agent can help maintain: the record of processing activities for data protection, and the inventory of AI agents for agent governance.

What does the agent prepare, and what does a person approve?

1. Agent, depth 1: reads the inputs. Approved regulatory change assessments, the regulatory change log, the policy library, the control register and the organisation chart.
2. Agent, depth 2: drafts new rows from approved impact assessments: obligation text, reference, scope, proposed owner and proposed mappings. Every row stays in draft until accepted.
3. Agent, depth 2: drafts amendments where a rule, policy or control changes: the old and new text, and the reason.
4. Agent, depth 1: runs integrity checks. Rows with no owner, owners who have left, mappings to retired policies or controls, sources that have been revoked or superseded, and obligations with no control at all.
5. Person, row owner: accepts or rejects new rows and amendments for their area.
6. Person, compliance: approves the change to the register and resolves disputes about ownership.
7. Agent, depth 1: produces views for others: obligations by senior manager, by entity, by product, and the obligations feeding regulatory returns.

Which controls apply, and what evidence does each leave?

Rows enter only from approved assessments. The agent does not decide on its own that a new obligation exists. It drafts from an impact assessment a person has approved, such as one produced by assessing the impact of regulatory change. Evidence: each row links to its approved assessment.

Owner acceptance recorded. An obligation nobody has accepted is not owned. Evidence: acceptance name and date on each row.

Version history kept. Every change to a row is recorded with who proposed it, who approved it and why. Evidence: the register's history, which shows what the firm thought it had to do at any past date.

Integrity report run on a schedule. Evidence: dated reports and the actions taken on each finding.

Source text quoted. The register holds the regulator's words, not a summary. Evidence: the quoted text and reference, checkable against the source.

What should you measure?

• Rows without an accepted owner, which should be none for long.
• Rows mapped to retired policies or controls.
• Obligations with no control, a direct gap.
• Time from approved change assessment to updated register.
• Owner rejections of the agent's drafts, and why.

Where does it usually go wrong?

Granularity chosen badly. A register with one row per regulation is too coarse to map; one row per sentence is too fine to own. Agree the unit, usually a single requirement a single owner can evidence, and hold the agent to it.

Ownership by job title that no longer exists. Reorganisations break ownership. The agent should check owners against the current organisation chart, not only against the leavers list.

Mappings that are assumed, not tested. A row says a control delivers an obligation, but nobody has checked the control does what the obligation needs. The register should show when each mapping was last tested.

Guidance mixed with rules. Regulator guidance, speeches and supervisory letters inform how rules are applied but are not rules themselves. Mark the type of each source so the register does not overstate what is required.

The register as an end in itself. A perfect register that nobody uses changes nothing. The useful views, by owner and by control, should feed monitoring plans, management information and the attestations senior managers make about their areas.

The stance on compliance agents overall is in AI compliance agents.

Where Pryme fits

In Pryme, the register is read by agents as a sealed source alongside the policy library, so a compliance agent checking a decision can cite the obligation it relates to. The agent maintaining the register drafts at depth 2; accepting or approving rows sits outside its role scope, and each refusal and each held change is filed.