Regulatory change & policy horizon scanning

Compliance, legal and public-affairs teams must notice every relevant new law, delegated act, guideline, consultation and court-driven reinterpretation — across many jurisdictions and languages — and work out what it means for their own obligations. AI now crawls official sources, filters the flood down to what matters for this organisation, explains the change in plain language with citations, diffs it against the previous text and drafts an impact assessment mapped to internal policies and controls. Humans keep the legal judgement; AI removes the reading and triage burden.

Problem & value

• Today: compliance officers subscribe to dozens of newsletters, RSS feeds and law-firm alerts, read them manually, forward them by email and maintain obligation registers in spreadsheets. Coverage gaps (a missed regulator Q&A, a national transposition, a non-English consultation) are common, and evidence that a change was assessed is hard to produce for auditors.
• Volume: the scale is the problem. Corlytics states regulators publish around 30 million pages of text per year [1]; CUBE reports monitoring 750 jurisdictions and processing 10 million data points annually [2]. Vendors' figures, but they show why manual reading does not scale.
• EU wave 2024–2027: AI Act, DORA, NIS2, CSRD/ESRS (plus the Omnibus simplifications), CSDDD, Data Act, Cyber Resilience Act, Machinery Regulation, EUDR, Batteries Regulation, PPWR — each with delegated/implementing acts, guidelines and national laws. Even an SMB manufacturer is now hit by several regimes at once.
• AI value: broader coverage at lower cost, earlier warning (drafts and consultations rather than final texts), consistent relevance decisions with a written rationale, faster impact assessment, and an auditable trail of "seen → assessed → actioned".

Variants

• Financial services (largest market): regulatory change management linked to an obligations library and GRC controls (EBA/ESMA/EIOPA, BaFin circulars such as MaRisk/BAIT successors, DORA RTS).
• Life sciences & medtech: MDR/IVDR guidance (MDCG documents), EMA/FDA guidance, pharmacovigilance rule changes → feeds HLTH-017 regulatory writing.
• Industry / product compliance (Mittelstand): product regulation, harmonised standards, REACH/RoHS restrictions, EUDR, export-control lists, packaging rules — often combined with KNOW-009 norms Q&A.
• Energy & utilities: BNetzA determinations, EnWG amendments, network codes.
• Public affairs / policy monitoring: tracking legislative procedures, committee votes and consultations to engage early (stakeholder mapping touches personal data of politicians — see GDPR).
• Public sector: ministries and municipalities tracking EU law requiring transposition or affecting administrative practice; inputs to legislative drafting (LANG-034).
• Private / freelancers: lightweight alerts on tax, rental or employment law changes; usually covered by publishers' newsletters plus a general AI assistant.

How it works

1. source registry (official journals, regulators, parliaments, consultations, standards, news)
2. collection (APIs/feeds/SPARQL where available, else crawler + change detection)
3. parsing & normalisation (HTML/PDF
4. text, metadata: CELEX/ELI, dates, legal basis)
5. dedup & versioning (consolidated vs. amending act; diff against previous version)
6. translation (where needed) + embedding/indexing (hybrid BM25 + vectors)
7. relevance filtering against an applicability profile (jurisdictions, entity type, products, licences)
8. summarisation with citations + key dates (entry into force, application, transposition deadline)
9. impact mapping: retrieve affected obligations/policies/controls
10. draft impact assessment
11. human review (compliance owner accepts/rejects, assigns tasks) ← human-in-the-loop
12. GRC / ticketing tasks, horizon dashboard, audit log

• Collection should prefer machine-readable primary sources: the EU Publications Office's Cellar repository offers a SPARQL endpoint plus RSS/Atom feeds [5]; the German Bundesgesetzblatt is published officially online with RSS and newsletter [6]; legislation.gov.uk offers an open API [7]. Regulator websites without feeds need a crawler with change detection.
• Relevance filtering is the core AI task: a first-stage embedding/classifier filter removes the bulk, then an LLM judges remaining items against the applicability profile and writes a short rationale. Thresholds are tuned for high recall — a missed change is costlier than a false alert.
• Impact mapping is retrieval over the internal obligation register (RAG), followed by an LLM that proposes which obligations change and how. Mapping to controls is a proposal, never an automatic edit.
• Human-in-the-loop: compliance owner confirms relevance, interpretation and tasks; legal counsel signs off on interpretations with legal effect.

Data preparation

Two data sets are needed: the external sources (official journals, regulators, parliaments, consultations, standards) and the internal context against which relevance is judged. The external side is mostly machine-readable (EUR-Lex Cellar with SPARQL and feeds, Bundesgesetzblatt RSS). The internal side is the hard part: obligation registers, policies, control lists and contracts. In an SMB these live in Excel sheets, Word and PDF policies on file shares, the DMS and the heads of one or two people.

Typical gaps: no central obligation register, outdated or duplicate policy versions, scanned documents, no mapping of products, sites and licences to legal domains, and unclear owners.

Preparation steps: - Create an applicability profile: jurisdictions, entity type, products, licences, sectors. - Consolidate policies and obligations into one current set with owners (PREP-004, PREP-013) and metadata for retrieval (PREP-010). - OCR scanned policies and contracts (PREP-006, DOC-014). - Set up feeds and crawlers with change detection and keep a glossary of legal terms (PREP-015). - Collect past impact assessments as gold examples (PREP-016).

Effort share: medium, about 25–35 percent, mainly the obligation register. See GUIDE-003.

Implementation paths

Which path for whom

• SMB — A: regulatory-change platforms and legal-database modules monitor official sources reliably and need no own pipeline; the process is standard.
• Enterprise — B: impact mapping to the own obligation register, policies and GRC tickets needs integration that products only partly cover.
• Developer — B: primary sources (EUR-Lex Cellar, Bundesgesetzblatt) offer APIs and feeds, so a cloud-API pipeline is fast to build; self-hosting needs HW3 and is rarely worth it.
• Public — B: EU-region or sovereign cloud APIs suit authorities with legal-text monitoring, subject to procurement rules.

Path A — Buy (recommended for regulated firms and most SMBs)

• Regulatory intelligence / change-management platforms: CUBE (UK; "Intel" product, 750 jurisdictions claimed) [2], Corlytics (Ireland, EU; includes ClauseMatch policy management) [1], Ascent RegTech (AscentHorizon / AscentFocus) [3], Regology (now part of Bloomberg Industry Group) [4], Archer (Regulatory Change Center, with a claimed 95% obligation-extraction accuracy) [8], plus the regulatory-change modules of Wolters Kluwer, LexisNexis and Thomson Reuters, and GRC suites (ServiceNow, MetricStream, IBM OpenPages) that ingest such feeds.
• Legal publishers with AI (DE/EU): beck-online with Noxtua (European legal AI, EU-hosted; C.H.Beck investing in the partnership) [9], juris, Wolters Kluwer Deutschland — strong for German-language law and commentary.
• Public-affairs monitoring: political-monitoring services that track EU and national procedures.
• SMB option: a publisher alert service plus an AI assistant on top is often enough; full RegTech platforms are priced for financial institutions.
• Choose A when: you need curated, expert-reviewed coverage across many jurisdictions and an obligations library you cannot build yourself. Check: source list per jurisdiction, latency, citation to primary text, EU hosting, export of the obligation taxonomy (avoid lock-in).

Path B — Build on cloud APIs

• Models: EU-provider or EU-region LLMs — Mistral (La Plateforme, EU), Claude/GPT/Gemini via EU-region endpoints (AWS Bedrock Frankfurt, Azure EU Data Zone, Google Vertex EU), or STACKIT / IONOS model hubs for German sovereign hosting. Use a reasoning model only for impact analysis; a cheaper model for relevance triage and summaries.
• Pipeline: feeds/SPARQL/crawler → n8n or Airflow → embeddings + hybrid search (OpenSearch, Elasticsearch, Qdrant, pgvector) → LLM triage and summarisation with structured outputs (relevance, rationale, dates, affected areas) → tickets in Jira/ServiceNow or the GRC tool.
• Deep-research agents (KNOW-015) can answer ad-hoc "what changes for us in X by 2027?" questions on top of the same index.
• Choose B when: your scope is narrow (one industry, few jurisdictions) and you already have an obligations register to map against.

Path C — Self-host (open source)

• Collection: Scrapy or Crawl4AI for regulator sites, changedetection.io for page-change alerts, direct use of Cellar SPARQL and official RSS feeds.
• Parsing: Docling or Marker for PDFs (gazettes, consultation papers).
• Index & retrieval: OpenSearch or Qdrant with multilingual embeddings (BGE-M3, multilingual-E5) and a reranker (bge-reranker-v2-m3).
• LLMs: Qwen3 (e.g. 30B-A3B / 32B), Mistral Small 3.x, gpt-oss-120b, or Llama-family models served with vLLM; strong German/French/Italian performance matters — test on your own languages.
• Hardware: HW2 suffices for triage and summaries with ~30B quantised models; HW3 (one 80–96 GB GPU) is the sensible minimum when the same server also drafts impact assessments with a larger reasoning-capable model.
• Choose C when: obligations registers, internal policy texts and impact assessments are confidential (e.g. bank supervisory topics, public-sector drafting) and must stay on-prem.

Path D — Custom training

Rarely worth it for the LLM itself. Useful targeted training: a relevance classifier (BERT-class or small LLM) fine-tuned on your own historic accept/reject decisions — a few thousand labelled alerts from the review queue are the natural training data and cut LLM cost and noise. Obligation-extraction models trained on a regulator's corpus exist in research (e.g. the ObliQA dataset of 27,869 questions over ADGM financial regulation [10]) but large vendors already offer this as a product.

State of the art (2026)

• LLM triage + RAG impact mapping has replaced keyword/taxonomy-only filtering in leading platforms; vendors now market "regulatory change agents" that take an item from alert to drafted impact assessment and proposed control updates (Regology, Archer, Ascent) [3][4][8].
• Obligation extraction (turning legal text into atomic "must/must not" statements) is the key technique; research such as RIRAG introduces metrics that check whether generated answers cover all relevant obligations without contradictions [10].
• Long-context models can read an entire regulation plus its delegated acts in one pass, which helps consistency, but retrieval with precise citation (article/paragraph, ELI/CELEX) remains necessary for auditability.
• Limits and failure modes: (1) recall gaps from missing sources — the AI cannot flag what was never collected; (2) confusing proposals, Council/Parliament positions and adopted texts; (3) wrong dates (entry into force vs. application vs. transposition); (4) hallucinated article numbers; (5) national gold-plating and guidance that only exists in PDF or in one language; (6) over-confident applicability judgements. Mitigate with source registry audits, mandatory citations, date extraction checks and human sign-off.

Shared resources & combinations

• Same retrieval stack (embedding-text + reranker + vector-db + search-engine + llm-general): KNOW-009 standards & compliance Q&A, KNOW-006 legal research, KNOW-013 knowledge graph of obligations, KNOW-015 deep-research agent — one index of legal texts serves all of them.
• Same monitoring/crawling pipeline (web-scraping + workflow-automation): LANG-017 competitive & market intelligence, LANG-018 social/media monitoring, KNOW-017 tender discovery; LANG-016 topic and trend detection over the collected corpus.
• Downstream: AGENT-018 continuous compliance & controls monitoring, SEC-009 security compliance (NIS2, DORA), SEC-022 AI-Act governance, DATA-020 regulatory reporting, LANG-024 marketing compliance review, HLTH-017 regulatory writing; LANG-026 consultation analysis and LANG-034 legislative drafting on the public-sector side; LANG-008 summarisation for executive digests.
• Hardware: one HW3 inference server (vLLM) can host the LLM and embedding models for this and the KNOW-family use cases.

Effort, cost & KPIs

• Path A: weeks to configure the applicability profile and workflows; enterprise RegTech licences are a significant annual cost driven by jurisdictions and modules; publisher alerts are cheap.
• Path B: 1–3 months for a narrow-scope pipeline; the main effort is the source registry and the obligations register, not the model. API costs are low relative to reviewer time.
• Path C: 2–4 months plus ongoing crawler maintenance (regulator sites change layout often).
• KPIs: source coverage (% of registered sources collected on schedule), recall on a "gold set" of known relevant changes, precision / alerts per reviewer per week, time from publication to assessed impact, % changes with documented assessment before effective date, audit findings.

People & change

Involve early: management sponsors the topic; legal, compliance or the quality officer owns the applicability profile and the review of every alert. Department leads receive tasks and confirm impact. IT connects ticketing or GRC tools. Data owners of policies and registers must clean and name an owner for each document.

Works council: usually no co-determination under §87(1) no. 6 BetrVG, since the system analyses external legal texts, not employee behaviour. Check again if task assignments are tracked per person. Inform the works council anyway under §90(1) no. 3 BetrVG, because a work process is planned with AI.

Data protection: mostly no personal data; internal policies may name employees. A DPO review and an AVV (Art. 28 GDPR) with any cloud vendor suffice in most cases. DPIA normally not needed.

AI literacy: support the compliance team with training on verifying citations, dates and the difference between summary and legal advice (GUIDE-006, GUIDE-014).

Concerns: "A missed change is a liability." Tune for high recall and keep the legal owner accountable; the AI proposes, counsel signs off. "Will it replace lawyers?" It removes the reading load, not the judgement. Pilot with one regulation area before extending (GUIDE-009, GUIDE-008).

Risks, regulation & compliance

• EU AI Act: typically minimal risk — monitoring and summarising legal texts is not an Annex III use case and the system supports, rather than replaces, legal assessment. Providers and deployers must take AI-literacy measures for staff (Art. 4) [11]. If AI-generated summaries are published to inform the public on matters of public interest, Art. 50(4) disclosure applies unless the text has undergone human review/editorial control with editorial responsibility [12] — relevant for public bodies and associations publishing digests.
• GDPR: legal texts are not personal data, but public-affairs variants that profile politicians, officials or lobbyists process personal data (legitimate interest assessment, transparency, data minimisation). Internal policies and incident data used for impact mapping may also contain personal data — prefer EU hosting and a DPA with the vendor.
• Sector rules: banks and insurers must manage compliance risk demonstrably (e.g. MaRisk compliance function, DORA ICT governance); outsourcing a RegTech SaaS may count as ICT third-party service under DORA (register of information, exit strategy).
• Copyright / licensing: official texts are mostly free to reuse, but commentary, standards (DIN/ISO) and law-firm alerts are licensed — do not ingest them without rights.
• Liability: an AI summary is not legal advice; keep the primary text one click away and require a named human owner for every interpretation.

Getting started

1. Write an applicability profile: jurisdictions, entity type/licences, products, processes, and the 10–20 regimes that matter most.
2. Build a source registry for those regimes (EUR-Lex/Cellar, national gazette, regulators, parliament, consultations) and decide feed vs. crawl per source.
3. Create a gold set of 50–100 past changes you know were relevant to measure recall of any tool.
4. Pilot 2 vendors (Path A) or a narrow pipeline (Path B) for one regime (e.g. DORA or product regulation) for 8–12 weeks; compare recall, noise and time-to-assessment.
5. Connect accepted changes to your obligations register and GRC/ticketing, and log every decision for audit.

Sources

1. Corlytics — regulatory intelligence platform (incl. ClauseMatch; "30,000,000 pages" figure) — https://www.corlytics.com/
2. CUBE — regulatory intelligence (Intel, RegPlatform; 750 jurisdictions, 10 million data points) — https://cube.global/
3. Ascent RegTech — AscentHorizon / AscentFocus — https://www.ascentregtech.com/
4. Regology — regulatory change, compliance and research agents (acquired by Bloomberg Industry Group) — https://www.regology.com/
5. Publications Office of the EU — Cellar (SPARQL, RSS/Atom) — https://op.europa.eu/en/web/cellar
6. Bundesgesetzblatt online (official electronic publication, RSS, newsletter) — https://recht.bund.de/
7. legislation.gov.uk — Developer / Legislation API — https://www.legislation.gov.uk/developer
8. Archer — Evolv AI Compliance & Regulatory Change Center — https://www.archerirm.com/compliance-ai
9. Noxtua — European legal AI (C.H.Beck partnership) — https://www.noxtua.com/
10. Gokhan, Wang, Gurevych, Briscoe — RIRAG: Regulatory Information Retrieval and Answer Generation (ObliQA) — https://arxiv.org/abs/2409.05677
11. EU AI Act Service Desk — Article 4 AI literacy — https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4
12. EU AI Act Service Desk — Article 50 transparency obligations — https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50