Risk · R-101 · Governance & Accountability
Untracked regulatory change
New or amended AI obligations, including changed application dates, are not identified and translated into controls in time.
- Severity
- Medium
- Audience
- Heads-of
- Frameworks
- Clause 6 · GOVERN 1
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-10
What it is
The law on AI is moving. Obligations arrive in phases, dates are amended, guidance and codes of practice are issued, and several jurisdictions and sector regulators act at once. An organisation's controls reflect the law as it was understood when they were designed. The risk is that nobody is tracking what has changed and working out what it requires.
How it happens
- Horizon scanning covers the organisation's traditional regulators and not AI-specific law.
- A change is noted and no one is assigned to assess it.
- Reliance is placed on summaries that are themselves out of date.
- Amendments to dates are missed, so work is planned to the wrong timetable.
Why it matters
Obligations are missed, or effort is spent preparing for requirements that have moved. Published statements, policies and training that cite superseded law mislead the people who rely on them.
Warning signs
- No register lists the AI obligations that apply and when.
- Internal guidance cites provisions that have been replaced.
- No owner is named for monitoring AI regulation.
- Recent amendments are news to the teams they affect.
Mitigating controls
Primary controls
- AI regulatory obligations register and horizon scanning Directive
- Records obligations and application dates and updates them as the law changes. The AI obligations that apply to the organisation, and the dates from which they apply, are recorded, mapped to controls and owners, and updated as the law and guidance change.
Supporting controls
- AI governance forum and escalation Directive
- Decides the response to a change. A committee with defined membership, authority and escalation routes decides on high-tier approvals, risk acceptance and exceptions, and reports to the board.
- Independent assurance and internal audit of AI Detective
- Tests that the register is complete and acted on. Second-line review and internal audit cover AI governance and the highest-tier systems on a risk-based plan, test systems as well as documents, and track their findings to closure.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| ISO/IEC 42001:2023 | Clause 6 | Planning & risk Changes to the management system are planned. |
| NIST AI Risk Management Framework (AI RMF 1.0) | GOVERN 1 | Policies, processes and practices for AI risk are in place and effective Legal requirements are understood and managed. |
Sources
- ISO/IEC 42001:2023 – AI management systems ISO/IEC · framework
- NIST AI Risk Management Framework (AI RMF 1.0) NIST · framework
Related terms
How to cite
Axiom Verity (2026). Untracked regulatory change. Reference Library, R-101. https://axiom-verity.com/risks/untracked-regulatory-change. Reviewed 2026-11-10.
Found an error or a better source? Report a correction.