Regulatory changes

A feed of incoming regulatory developments, ranked by relevance, with a dated record that a named person read each one — and AI actions that help you decide what to act on first.

A directive amendment or a supervisory authority decision can undo a control mapping that took months to build; this module gives that watching work a home. Aegis ingests developments from external sources — the GDPRhub (a public database of European data-protection decisions) and other registered feeds — scores each for relevance, and lists them for review. You mark an item reviewed, leaving a dated record that you looked, or dismiss it as not applicable to your organisation.

You use that history to keep on top of the regulatory calendar; auditors use it to confirm you monitor change systematically — something ISO 27001, NIS2 (a European cybersecurity law), DORA (the EU operational-resilience regulation) and the EU AI Act all expect.

Who uses it

• Viewer and Contributor hold REGULATORY_READ: open and filter the feed, read any item, and run both AI actions. They cannot change the state of an item.
• Manager and Admin also hold REGULATORY_WRITE. Only they see Mark as Reviewed, Analyze impact and Dismiss — those buttons are hidden, not disabled, for everyone else.

What's on this screen

The header reads Regulatory Changes over the line "Track incoming regulatory updates and assess their impact on your compliance posture", with one button opposite: Relevance Triage (AI). There is no "add change" button — items arrive from the ingested sources.

Under the header runs a filter bar of four controls: a search box (placeholder "Search regulatory changes…"), a Search button, an All Sources dropdown built from the sources your tenant has actually ingested rather than a fixed list, and a view dropdown set to Active that you switch to Dismissed to see items set aside. The body is one table with five columns:

Selecting a row opens that item in a detail panel. The feed pages twenty rows at a time; below the pager sit two panels that stay empty until you use the AI actions, Saved AI insights and Action items from AI. A tenant that has ingested nothing sees the table's empty state instead of rows. To get your bearings:

1. Find the module in the left sidebar: selecting the Compliance group expands it and lists Regulatory Changes among its links.
2. Note the Relevance Triage (AI) button opposite the page title. It works on the whole open queue, not on one row.
3. Type into the search box to narrow the feed. The table reloads a moment after you stop typing.
4. Select the ? in the top bar to open in-app help over the page.
5. Your name at the top right opens the account menu and confirms your role — worth a glance, because the write actions appear only for some roles.

Narrow the feed and pick what to read

Every visible row in the captured screen was published on the same day, so narrow before reading.

1. Type a regulation name, authority or keyword into the search box. The table reloads with items whose title or summary matches.
2. Open the All Sources dropdown and pick one issuing body. A source you have never received items from does not appear in the list.
3. Read down the Relevance column and start with the red badges — the captured feed opens on a 100% row followed by several at 95%, against others scoring 0% to 15%. The score is a stored first-pass estimate, not a judgement you have to accept.
4. Switch the view dropdown to Dismissed to see what a colleague set aside, and back to Active for the review queue.

Read and review a change

Reviewing records that a person read the item, and on what date — which is what an auditor asks for, more than the headline itself.

1. Select a row. A detail panel opens over the page, headed Regulatory Change, with a relevance badge such as 95% — High Relevance and the action buttons beside it.
2. Read the Details block — source, identifier, publication date and relevance score — then the Summary, the item's text with the source site's formatting stripped out.
3. Where the item carries one, select View original document under Source Link; the issuing body's page opens in a new tab.
4. With REGULATORY_WRITE, select Mark as Reviewed. A green Reviewed badge replaces the button, the row behind updates, and a Review section records who reviewed it and when.

Dismiss what does not apply

Not every ingested decision concerns your organisation. Dismissing one takes it out of the active queue without deleting it, and records who did.

1. Open the item and select Dismiss. A toast reads "Change dismissed" and the item leaves the Active view.
2. The panel now shows a Dismissed section with the date and the person. There is no reason field on this screen — a Reason line appears only where one was recorded through the API.
3. To reverse it, set the view dropdown to Dismissed, open the item and select Restore to queue.

The AI assist

Three things here are AI-assisted. All draft; a person reads, decides and records. None marks an item reviewed, dismisses anything, or files work on your behalf.

• Relevance Triage (AI), in the page header, works across your open (non-dismissed) changes. Aegis ranks them itself — by stored relevance, review state and recency — and the model narrates that fixed ranking as an action plan with a next step per change. It never reorders or rescores, and reads nothing but your own open changes.
• Suggested actions, in the detail panel, turns one change and any impact analysis already on file into a prioritised checklist of actions. Every role that can read the module can run it.
• Analyze impact, in the detail panel and limited to REGULATORY_WRITE, queues a background job; a toast confirms "Impact analysis queued — results appear here when ready". Reopen the item later and the Impact Analysis section shows a summary, an overall relevance percentage, the date analysed, and a badge per affected framework such as GDPR — 80%; until then it reads "No impact analysis yet". This one writes back to the record: it replaces the stored Relevance score with its own figure and adds the frameworks it named to the item's Categories.

The two streamed actions run the same way:

1. Select Relevance Triage (AI) in the page header, or Suggested actions in an open change. A dialog opens on a short explanation of what the action reads and what it will not do.
2. Select Run Relevance Triage or Suggest Actions. Progress lines name each stage while the answer streams in.
3. When it finishes, take the text away with Copy, Export DOCX or Export PDF, or select Run again.
4. Save as record keeps it in Saved AI insights — on the change itself for Suggested actions, at the foot of the feed page for the triage. Create action item files it as work, shown in the Action items from AI panel and in Action items; a Viewer can save and export, but does not get that button.

Tips and limits

• You cannot add a change by hand, and the table has no export button — the only export here is of an AI result.
• There is no status pipeline beyond pending, reviewed and dismissed, and no effective-date reminders. A future-dated change will not chase you — create an action item for it instead.
• The Relevance score is first set at ingestion, from keyword and recency matching. It is not fixed: an Analyze impact run overwrites it with the analysis's own figure, and records 0% if the model's answer cannot be read. Scores vary widely across similar-looking items, so use them to order your reading, not to conclude anything.
• Each streamed action and each Analyze impact run is a billable AI action against the tenant's AI credits, so re-running one is not free.
• Impact analysis is asynchronous: after selecting Analyze impact, expect to come back to the item later — it will not fill in while you wait.

Where this connects

Standing alerts for particular regulations live in Regulatory alerts. A change usually points at requirements in Compliance frameworks, GDPR, DORA or the EU AI Act. Track the work it creates as a risk or an action item, and file the source document in Evidence; for a worked example, see the regulation scenario.