Financial services firms are receiving an increasing volume of regulatory updates, guidance and supervisory communications. But identifying a development is only the first step in managing regulatory change.
Organisations must also determine whether a requirement applies to them, assess the potential impact, assign responsibility and demonstrate that the necessary changes have been implemented.
For firms relying on spreadsheets, email alerts and disconnected internal processes, maintaining that chain of activity can become increasingly difficult. The risk is not always that a compliance team makes the wrong decision. It may be that an important development is overlooked, an action is not assigned or an implementation deadline is missed.
As regulatory change becomes more continuous, firms need to consider how technology can connect monitoring, interpretation, implementation and evidence.
The problem with disconnected processes
Regulatory failures do not always begin with a major oversight. Sometimes the problem is a consultation paper that was not flagged, an amendment that was not mapped or a deadline that remained in someone’s inbox.
Relying on manual processes can make it harder to identify these gaps, particularly when firms are monitoring developments across multiple jurisdictions and regulatory bodies.
RelyComply highlights the risk of relying on individual employees and disconnected processes to keep track of regulatory developments.
“Most regulatory failures don’t begin with a bad decision, but rather with something nobody noticed: a consultation paper that wasn’t flagged, an amendment that wasn’t mapped, a deadline that sat in someone’s inbox,” the company says.
The challenge extends beyond monitoring publications. Once a development has been identified, firms must establish which legal entities, products, processes, controls and systems are affected. They must then document decisions, allocate ownership, track implementation and maintain an audit trail.
As regulatory volumes and organisational complexity increase, spreadsheets and manually maintained obligations registers can become bottlenecks.
Glenn Espinosa, founder and CEO of Luthor, argues that the difficulty lies in managing the full process rather than simply keeping track of new requirements.
“The issue is not just tracking change, it’s understanding the impact, assigning ownership, and proving what was done,” Espinosa says.
This distinction is important. Regulatory awareness tells a firm what has happened, but effective regulatory change management requires it to establish what the development means for the business and ensure the response is completed.
A firm may identify a new requirement and update its internal documentation, but that does not necessarily mean the relevant operational processes or controls have changed. Without clear responsibility and evidence, compliance teams may struggle to demonstrate that the response was effective.
AI can support interpretation, but accountability remains human
AI is increasingly capable of handling the initial stages of regulatory analysis. It can review large volumes of information, compare regulatory documents, summarise amendments and identify potential impacts on a firm’s existing framework.
These capabilities can reduce the time compliance professionals spend searching for and organising information. However, the technology does not remove the need for people to assess how requirements apply to a particular business.
Espinosa believes AI can take on much of the first-pass work, but that human judgement remains necessary when regulatory interpretation involves ambiguity or business-specific context.
“The opportunity is not to automate judgement. It is to automate the work around judgement,” he says.
This distinction is particularly important when a regulatory requirement could affect different firms in different ways. An automated system may identify a relevant provision, but deciding how it should be interpreted and implemented requires an understanding of the organisation’s activities, existing controls and risk exposure.
Nir Carciente, head of RegTech at ACA Group, also emphasises the importance of combining technology with compliance expertise.
“Technology helps with volume, consistency and tracking. Experienced practitioners provide the context to assess significance and decide what should happen next,” Carciente says.
The combination allows firms to use automation to manage repetitive tasks while retaining professional oversight of material decisions.
It also highlights the importance of maintaining visibility over the information used to reach a conclusion. Compliance teams need to understand why a regulatory development has been considered relevant, what action was recommended and who approved the response.
AI-generated summaries and alerts can help identify potential issues, but they should not become a substitute for a documented decision-making process.
From monitoring to implementation
One of the biggest challenges in regulatory change management is ensuring that a decision leads to action.
A regulatory update may affect several areas of a business, including policies, risk assessments, systems, customer communications and employee procedures. If these activities are managed separately, it can be difficult to establish whether the organisation has completed the necessary work.
Carciente argues that firms need more than another stream of regulatory alerts or isolated AI tools. Instead, they need a way to connect information, decisions, actions and evidence across their compliance programmes.
“Firms do not need another stream of alerts or a set of isolated AI features. They need a practical way to connect information, decisions, work and evidence across the compliance program,” he says.
This means linking the original regulatory source to the relevant obligation, internal policy, risk, control, system and action. When a requirement changes, firms should be able to assess which parts of their operating model may need to be updated.
It also makes it easier to establish ownership. Rather than leaving teams to interpret and implement changes independently, organisations can assign responsibilities and track progress through to completion.
For firms with limited internal resources, external compliance expertise and managed services may also help provide the capacity needed to maintain these processes.
Carciente stated, “At ACA, we see the best results when technology and compliance expertise are used together.”
He adds that managed services can provide the capacity to carry out and maintain work after compliance professionals have assessed the significance of a regulatory development and decided how the organisation should respond.
The objective is not to automate every regulatory decision. It is to help firms identify changes, assess their impact, complete the response, test the outcome and retain a clear record of the process.
Why continuous change management matters
Regulatory change is no longer something firms can necessarily treat as a series of isolated projects. A periodic review process assumes that regulatory developments arrive in manageable batches. But firms must also consider ongoing guidance, supervisory expectations, amendments and changes to the markets in which they operate.
Espinosa argues that this requires a corresponding change in how organisations manage their compliance responsibilities.
“Regulatory change is no longer periodic, so the operating model cannot be periodic either,” he says.
Continuous monitoring can help firms identify relevant developments as they emerge, rather than relying on the next scheduled review to uncover them. However, monitoring is only one part of the process. Organisations must also assess the implications, assign actions and ensure that implementation is completed.
The same approach should apply when a firm’s own business changes. New products, markets, vendors and processes can alter its regulatory exposure, even when the underlying rules remain unchanged.
A continuous model therefore needs to account for developments in both the regulatory environment and the organisation itself.
For Carciente, the aim is to give compliance professionals better information and clearer responsibility, rather than remove them from the process.
“The aim should not be to automate every regulatory decision. It should be to help firms identify change, assess its impact, complete the response, test the outcome and retain a clear record of the process,” he says.
As regulatory demands continue to grow, firms will need to move beyond simply collecting alerts and summaries. The ability to connect regulatory intelligence with decisions, implementation and evidence will become increasingly important. AI can help make that process faster, but effective regulatory change management will still depend on clear accountability and the expertise to determine what a change means for the business.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
