AI regulatory obligations register and horizon scanning

What it does

It keeps the organisation's view of the law current. A register lists each obligation that applies, its source, the date it takes effect, the systems it touches, the control that meets it and the person responsible. Horizon scanning feeds it with new and amended requirements. Compliance or legal owns it. Scanning runs continuously, and the register is reviewed on a set cycle and whenever a significant change is published.

How to implement it

• Identify the regimes in scope by jurisdiction, sector and the organisation's role.
• Record each obligation at the level of the provision, with its application date.
• Map each obligation to a control and an owner, and record gaps.
• Monitor primary sources and regulators, and do not rely on summaries alone.
• Assess each change for impact and assign the response.
• Correct internal guidance and training when the law they cite changes.

Evidence it operates

Design: a register with sources, dates, controls and owners; a scanning procedure. Operation: change records showing an amendment identified and assessed; gap actions tracked to closure; updated guidance; reports of significant change to the governance forum.

Where it fits

Operates from strategy through operation. It is the primary control for untracked regulatory change, tells high-risk conformity assessment and registration when duties apply, and keeps the criteria for regulatory incident notification current.

Limits

A register records obligations and does not interpret them; much AI law is new and its meaning unsettled. Dates move, as the amendment of the EU AI Act's timetable showed, so an entry is only as good as its last check. The register covers law that is identified as relevant, and the harder task is recognising that a general law applies to an AI use.