How to track regulatory updates with an AI agent

An agent can watch every regulator, standard-setter and gazette you name, log each publication, say what kind of document it is, quote what changed and map it to the policies and controls it touches. A regulatory change lead decides what applies. Policy and control owners decide what to do about it, and the agent tracks it to completion.

What is regulatory update tracking, and who owns it?

Regulators publish constantly: final rules, consultations, guidance, speeches, enforcement notices, letters to firms, and dates when earlier rules take effect. Tracking means nothing relevant is missed, each item reaches the person who must act, and the firm can show what it did. The reading is the visible part, but as agents for regulatory change: the reading is not the work argues, the work is deciding applicability and carrying the change through.

Compliance usually owns the process through a regulatory change lead. Policy owners, product owners and control owners own the response in their areas. The agent prepares and watches, consistent with our guide to AI compliance agents as second line, never the last word.

What are the steps, and at what depth?

1. Person, regulatory change lead: sets the source list. Which regulators, standard-setters and official journals, for which markets. Each source is named; the agent does not add its own.
2. Agent, depth 1: checks every source on schedule and records each new item: title, issuer, date, link to the stored copy.
3. Agent, depth 1: classifies the item. Final rule, consultation, guidance, speech, enforcement action, or a date taking effect. A speech is not a rule, and the record says so.
4. Agent, depth 2: summarises with quotations. What changed, quoted from the text, plus any dates and who it applies to as stated in the document.
5. Agent, depth 2: proposes applicability and owners. Which business lines, products, policies and controls are touched, and why, using your policy and control inventory.
6. Person, regulatory change lead: confirms applicability. Every "not applicable" is a person's decision, with a reason.
7. Agent, depth 2: drafts the impact note for each owner: the requirement, the current policy wording, the gap as the agent sees it, and questions to answer.
8. Person, owners: decide the response and its deadline. Policy changes follow the route in drafting policy updates for approval with an AI agent.
9. Agent, depth 3: tracks actions to closure and reports status to the change lead.

Which controls matter, and what evidence does each leave?

Every item is logged, relevant or not. If a supervisor asks whether you saw something, the log answers. Evidence: the item register with stored copies.

Dates are confirmed by a person. Effective dates drive deadlines, and a misread date is costly. The agent extracts them with the quoted sentence; the change lead confirms. Evidence: the confirmed date and who confirmed it.

Published text is external. A regulator's web page arrives from outside the firm. The agent quotes it; it does not paraphrase obligations into the policy library. Evidence: provenance on every summary.

"Not applicable" carries a reason. Evidence: the reason and decision-maker for every item closed without action.

Silent sources raise an alert. A source that publishes nothing for longer than usual, or whose page structure changes, may have broken the feed. Evidence: source health checks.

What should you measure?

• Time from publication to logging, by source.
• Time from logging to applicability decision.
• Items the change lead reclassified or re-mapped, as a check on the agent's reading.
• Open actions by owner and age, especially those near an effective date.
• Items found late: anything the firm learned about from another route before the agent logged it.

Where does it usually go wrong?

Consultations are treated as rules, or ignored. A consultation is not binding, but it predicts the rule. Track both, labelled differently.

Summaries replace reading. Owners act on the summary and miss a condition in the text. Each impact note should link to the full document and quote the operative passages.

Mapping misses cross-cutting rules. A change to outsourcing or data rules touches many owners. Let the agent propose several owners and let the change lead prune.

The inventory is out of date. Mapping is only as good as the list of policies, controls and products it maps against. If a product was launched without an inventory entry, no update will ever be routed to it. Review the inventory alongside the source list.

Training is forgotten. New rules often need staff to know something new. Link actions to training, as covered in whether an AI agent can track compliance training.

Closure is declared, not shown. An owner marks an action done without evidence. Require the changed policy, control or procedure to be attached; the method in tracking remediation actions with an AI agent applies here too.

Where Pryme fits

In Pryme, regulator publications arrive through the Pryme Context Protocol marked external, while your approved policies are sealed in the policy library. The agent can quote the first and compare it with the second, but it cannot change the policy library. Each applicability decision is filed with the name of the person who made it.