A regulatory change impact assessment template takes one new or amended rule and records what it requires, whether it applies to you, which policies, processes, controls, systems and AI agents it touches, the gaps, the actions to close them, owners and deadlines, and who signed off. Fill one in for every change your log marks as relevant.
What is the assessment for?
Reading a new rule is the easy part. The work is mapping it onto your organisation: which product changes, which control needs a new test, which letter needs new wording. That is the argument of agents for regulatory change: the reading is not the work. The assessment is where the mapping is done and recorded.
It sits in the middle of regulatory change management. Changes arrive in the regulatory change log; the log marks which are relevant; each relevant change gets an assessment; the assessment produces actions that are tracked to completion.
When should you complete one?
As soon as a change is marked relevant, and again when it moves from consultation to final rules. Early assessments of consultations are lighter and focus on scale; final assessments are detailed and lead to actions.
An agent can do a lot of the first pass: summarise the requirement in plain words, search your policy library and process maps for affected areas, draft the mapping. How to assess the impact of regulatory change with an AI agent covers the method. Deciding whether the rule applies, how to interpret it, and what to change stays with the compliance owner and, where needed, counsel.
How do you fill in each section?
- Change details. Reference from the log, issuing body, status, effective date as stated in the rule.
- Requirements. Break the rule into individual obligations, each in one plain sentence.
- Applicability. Which entities, products, customers and channels each obligation reaches.
- Mapping. For each obligation: the policy, process, control, system and agent affected.
- Current state and gap. What happens today, and what is missing.
- Actions. What will close the gap, owner, deadline.
- AI agents. Changes needed to briefs, sources or limits, and whether re-certification is triggered.
- Sign-off. Accountable owner.
The regulatory change impact assessment template
Section 1: change details. Reference; issuing body; title; status; effective date; assessor; date.
Section 2: requirement map
| Obligation | Applies to | Policy | Process or control | Systems | AI agents affected | Current state | Gap | Action | Owner | Due |
|---|---|---|---|---|---|---|---|---|---|---|
Section 3: interpretation questions. Points needing counsel's view.
Section 4: sign-off. Accountable owner; date; next review.
A filled sample: AI transparency duty
A hypothetical EU bank assesses the transparency obligation in Article 50 of the EU AI Act, under which people must be told when they are interacting with an AI system. The effective date is taken from the Regulation and confirmed with counsel.
| Obligation | Applies to | AI agents affected | Current state | Gap | Action | Owner |
|---|---|---|---|---|---|---|
| Tell people they are interacting with an AI system | Retail chat, email support, phone assistant | Support agent; collections agent; phone agent | Chat agent states it is an AI agent; email agent signs off with team name only | Email and phone do not disclose | Add disclosure to email sign-off and phone greeting; update briefs | Head of Customer Operations |
| Disclosure must be clear and timely | Same | Same | Chat disclosure appears in the first message | None for chat | Test disclosure wording for phone agent with customers | Customer Experience Lead |
| Records show the disclosure was made | Same | Same | Chat transcripts kept; phone not recorded for disclosure | Phone | Log greeting in verdict record | Platform Lead |
Section 3 recorded one question for counsel: whether emails drafted by an agent and approved by a person count as interaction with an AI system. Section 4: signed by the head of compliance; brief changes logged as re-certification triggers for the three agents.
The AI agents column turned a legal text into three brief changes, each with an owner. Without it, the obligation would have sat in a policy document while the email agent kept signing off as a team.
Where Pryme fits
In Pryme, a change to an agent's brief to meet a new rule is versioned and treated as a re-certification trigger, so the agent's behaviour is proven against the new requirement before it goes live. Whether an AI agent can track regulatory change covers the monitoring side, and AI compliance agents: second line, never the last word the boundary.
Questions people ask
Should the agent decide whether a rule applies?
It can propose, with reasons. The compliance owner decides, because applicability can turn on legal interpretation and business facts the agent may not see.
How detailed should obligations be?
One sentence each, specific enough to test. If an obligation cannot be turned into a control test, it probably needs splitting.
Who tracks the actions to completion?
The compliance owner of the change, using your normal issue tracker, with each action linked back to the assessment and the log entry.