Mapping a new regulation to your policies

Map a new regulation clause by clause, in both directions. An agent finds the policy clauses, procedures and controls that already meet each requirement, then reads each affected policy for what the regulation now demands of it. Where nothing matches, it drafts a gap statement. The policy owner decides whether each gap is real and how to close it.

What is the mapping, and who owns it?

When a new regulation arrives, the impact assessment asks whether it applies and how much work it creates. The mapping is the detailed layer underneath: a traceability matrix linking every requirement to the specific clause, step or control that satisfies it. Without it, a firm can say it complies but cannot show where. With it, a supervisor can pick any requirement and follow it to evidence.

Policy owners own the decisions; compliance owns the method and the matrix. The mapping is detailed, tedious and error-prone by hand, and an agent is well suited to the first draft. The decisions, especially for principles-based rules, are not. As principles-based regulation leaves the agent design to you argues, the regulator tells you the outcome and you must decide what it means for your operation.

What are the steps?

1. Person, compliance: fixes the inputs. The regulation text, the entities in scope, the policy set and control register to map against, with versions.
2. Agent, depth 1: breaks the regulation into requirements. Each with its reference and quoted text, classed as a rule (prescriptive), a principle (outcome-based) or guidance.
3. Agent, depth 1: maps forward. For each requirement, the clauses, procedure steps and controls that meet it, each link with a short reason.
4. Agent, depth 1: maps backward. For each affected policy, the requirements it now serves, which shows policies that will need rewording even if the substance is met.
5. Agent, depth 2: drafts gap statements. For each unmet or partly met requirement: what is required, what exists, what is missing, and options to close it. For principles, it sets out what the firm would need to decide rather than proposing an answer.
6. Person, policy owner: decides each gap. Real or not, how to close it, by when.
7. Agent, depth 2: drafts the policy wording for decided changes, in line with the owner's decision. Whether an agent should write the policy itself is covered in whether an AI agent can write compliance policies.
8. Person, compliance: approves the matrix as the firm's record of how it meets the regulation.

Which controls apply, and what evidence does each leave?

Two-way traceability. Forward and backward maps catch different errors. Forward finds requirements with no home; backward finds policies that cite the wrong rule or none. Evidence: both maps, kept with the matrix.

Coverage judged by a person. A link from requirement to clause is the agent's proposal. "This clause fully meets this requirement" is a judgement the owner records. Evidence: owner confirmation per link.

Principles flagged, not answered. For outcome-based requirements, the agent lists the decisions the firm must make and the evidence that would support each. Evidence: decision records for each principle.

Enforcement checked, not assumed. A policy clause that meets a requirement on paper means little if nothing enforces it. Where agents carry out the work, the policy must turn into bounds the agent actually meets; written AI policies do not bind agents, enforced bounds do. Evidence: for each requirement delivered by an agent, the bound or limit that enforces it.

What should you measure?

• Requirements with confirmed coverage, against the total.
• Links the owner rejected, which shows where the agent over-maps.
• Gaps found after the matrix was approved, by audit or supervisors.
• Time from regulation publication to approved matrix.

Where does it usually go wrong?

Keyword matching. A clause that mentions "record-keeping" is not necessarily the clause that meets a record-keeping requirement. Each link needs a reason that a reviewer can test.

Missing the processing and product dimension. Some new rules bite on what you do with data or how a product works, not on policy text. Route data-related requirements to DPIA screening for new processing, and product-related ones to reviewing a new product for compliance risk.

Partial coverage reported as full. A clause meets most of a requirement but misses one element, such as a timing or a record. The gap statement should name the missing element.

Matrix abandoned after approval. When policies change later, links break. The matrix should be re-run on every policy change in scope.

Over-mapping. Linking every vaguely related clause makes the matrix look complete and makes it useless. Fewer, stronger links are better.

Definitions that do not line up. The regulation defines a term, such as a customer category or a type of outsourcing, differently from your policies. A clause that looks like a match may cover a different population. The agent should compare definitions first and flag every difference before mapping any requirement that depends on them.

The stance on compliance agents overall is in AI compliance agents.