A regulatory change log is the running record of every rule, guidance note, consultation and enforcement action that might affect your business: where it came from, what it says in a sentence, whether it is relevant and why, who owns it, the key dates, and where it stands. An AI agent can capture and summarise. A person decides relevance.
What is the log for?
Regulatory change management starts with knowing what has changed. The log is that knowledge, in one place, with a decision against each item. It answers the question a supervisor or auditor will ask: "how did you know about this, and what did you do?". An item without a decision is a gap; an item marked "not relevant" without a reason is a weak point.
The log is the front of the process. Relevant items move on to a regulatory change impact assessment, which does the detailed mapping. The log tracks that the assessment happened and the change was closed.
When should items be added?
Continuously. Most teams watch a fixed list of sources: regulators' publications, legislation, standard-setters, industry bodies. An agent can monitor those sources daily, capture new items, remove duplicates and draft a one-line summary and a proposed relevance. Whether an AI agent can track regulatory change explains what it does well and where it falls short, chiefly on items that are relevant for reasons not visible in the text.
A compliance analyst reviews new items at least weekly, confirms or changes relevance, and assigns owners.
How do you fill in each column?
- Item ID and date captured. When you became aware, not when it was published.
- Source and type. Issuing body; consultation, final rule, guidance, speech, enforcement action, court decision.
- Jurisdiction. Where it applies.
- Summary. One sentence on what it changes.
- Key dates. Response deadlines, publication of final rules, effective dates, exactly as stated in the source.
- Relevance. Relevant, monitor, not relevant, with a reason in every case.
- Owner. A named person for relevant and monitor items.
- Assessment reference and status. Open, assessed, actions in progress, closed.
Agents themselves change over time too, and those changes go in their own record, the AI agent change log. Link the two when a regulatory change leads to an agent change.
The regulatory change log template
| ID | Captured | Source | Type | Jurisdiction | Summary | Key dates | Relevance and reason | Owner | Assessment ref | Status |
|---|---|---|---|---|---|---|---|---|---|---|
A filled sample
Five items from a hypothetical payments firm's log. Sources and items are illustrative.
| ID | Source | Type | Summary | Relevance and reason | Owner | Status |
|---|---|---|---|---|---|---|
| RC-101 | Conduct regulator | Consultation | Proposed guidance on treating customers in financial difficulty | Relevant: affects collections agent and contact strategy | Head of Collections | Assessed; response submitted |
| RC-102 | Data protection authority | Guidance | Expectations on automated decision-making transparency | Relevant: touches account closure decisions supported by agents | Data Protection Officer | Assessment open |
| RC-103 | Prudential regulator | Speech | Senior official on operational resilience priorities | Monitor: no new requirement; may signal future rules | Head of Operational Risk | Monitoring |
| RC-104 | Securities regulator | Final rule | Changes to investment fund disclosures | Not relevant: firm offers no investment products | Compliance Analyst | Closed |
| RC-105 | Conduct regulator | Enforcement action | Fine on another firm for failing to monitor outsourced customer contact | Relevant: lessons for oversight of agent-handled contact | Head of Compliance | Assessed; monitoring plan updated |
RC-105 is a useful pattern. Enforcement against another firm creates no new rule, but it shows what a regulator expects. The agent proposed "not relevant" because no rule changed; the analyst changed it to relevant, because the firm's agents handle customer contact on its behalf. That is the kind of judgement the review step exists for.
How does the log differ from a breach log?
A regulatory change log tracks external changes to the rules. A breach log tracks your own failures to meet them. They use different owners and processes, though a breach may reveal that a change was missed. How to log and assess regulatory breaches with an AI agent covers the second. The boundary for both is in AI compliance agents: second line, never the last word.
Questions people ask
How many sources should the agent monitor?
Every source that issues rules or guidance you are subject to, plus the standard-setters behind them. List them in the log's front sheet and review the list yearly.
Should "not relevant" items be kept?
Yes. They show the item was seen and considered. Many audit findings come from items that were missed or dismissed without a reason.
Can the agent assign owners?
It can propose an owner from a mapping of topics to roles. The analyst confirms, because ownership carries accountability.