Regulatory change register

The Regulatory Changes page is a horizon-scanning register. You log regulatory developments (new laws, amendments, standard revisions), assess whether each one applies to your organization and how hard it hits, link the affected requirements and controls, assign an owner, and record what was done about it. Use it whenever a regulator, standards body, or legal update lands on your desk. It lives at /regulatory (side nav: Regulatory Changes).

Before you start

• The Regulatory Changes module is off by default. An admin must turn it on in Settings > Modules (Governance, risk and compliance group).
• Any signed-in member can log and assess changes once the module is on.
• Optional: requirements in your library and controls in Controls and evidence, so the Assess dialog has something to link to.

The lifecycle

Every change moves through these statuses: New > Assessing > Applicable or Not applicable > Actioned (for applicable changes).

Log a change

1. Open Regulatory Changes in the side nav.
2. Click Log Change (top right).
3. In the Log Regulatory Change dialog, fill:
   • Title (required), for example KEBS KS 1758-2 revision, fresh produce.
   • Source / regulator, for example KEBS, EU, OSHA.
   • Reference, for example LN 42/2026.
   • Jurisdiction, for example Kenya, EU, federal (US).
   • Summary: what changed and why it might matter to you.
   • URL: a link to the source text.
   • Published date and Effective date (date picker buttons).
4. Click Log change.

The change appears in the register with status New. The pencil icon edits these fields later. If a URL is set, the external-link icon on the row opens it in a new tab.

Assess a change

1. On a New change, click Start assessment if you want to park it in Assessing while you research. This step is optional; you can assess directly.
2. Click Assess on the row.
3. In the Assess dialog, fill:
   • Applicability: Applicable or Not applicable.
   • Impact level: Not assessed, None, Low, Medium, or High.
   • Applicability rationale: why this change does or does not apply to you.
   • Owner: a member of the organization, or Unassigned.
   • Affected requirements: tick requirements from the library. Type in the filter box to narrow the list.
   • Affected controls: tick controls from your registry, with the same filter.
4. Click Save assessment.

The row now shows the applicability status, an impact tag (red for High, magenta for Medium), the owner, and counts like 3 requirements and 2 controls. You can reopen Assess any time before the change is actioned.

Mark a change actioned

Only changes with status Applicable show this button.

1. Click Mark actioned on the row.
2. Fill Action summary (required): what was done, for example procedures updated, controls added, training run.
3. Click Mark actioned.

The status flips to Actioned, today's date is stamped as the actioned date, and the summary shows under the row. This closes the loop for that change.

Watch the stats and the 90-day horizon

The stat chips above the register always cover the whole register, even when filters are on:

• New: logged but not yet assessed.
• Assessing: assessment in progress.
• Applicable not actioned: your live compliance exposure. Turns orange when above zero.
• High impact: assessed High and still open. Turns red when above zero.
• Effective ≤90d: open changes whose effective date falls within the next 90 days (today counts, day 90 counts). Turns orange when above zero.

A change inside the 90-day window also gets a highlighted (magenta) Effective <date> tag on its row. Changes that are Actioned or Not applicable are never flagged, whatever their date.

Filter and search

• Status filter: All statuses, New, Assessing, Applicable, Not applicable, Actioned.
• Impact filter: All impact levels, None, Low, Medium, High.
• Search box: matches title, reference, source, and jurisdiction.

Delete a change

Click the bin icon on the row, then confirm Delete in the dialog. The change and its assessment are permanently removed.

Try it

• Turn on the Regulatory Changes module in Settings > Modules. Expected: Regulatory Changes appears in the side nav.
• Click Log Change and save one with only a title. Expected: a row with a blue New tag; the New chip counts 1.
• Edit the change and set an effective date 30 days from today. Expected: a magenta Effective <date> tag and Effective ≤90d counts 1.
• Click Start assessment. Expected: the tag turns to Assessing and the Assessing chip counts 1.
• Click Assess, pick Applicable, impact High, write a rationale, tick one requirement and one control, and save. Expected: tags for Applicable, Impact: High, 1 requirement, 1 control; the Applicable not actioned and High impact chips count 1.
• Set the Impact filter to High. Expected: only that change shows; the chips do not change.
• Type part of the title into Search. Expected: the register narrows to matching rows.
• Click Mark actioned, write an action summary, and save. Expected: a green Actioned tag with today's date, the summary under the row, and the exposure chips drop back to 0.
• Delete the change and confirm. Expected: a "Regulatory change deleted" toast and an empty register.

If something goes wrong

• Regulatory Changes is missing from the side nav. The module is off. Enable it in Settings > Modules. Typing /regulatory while it is off redirects to the dashboard.
• The page says "No regulatory changes yet". Normal empty state. Click Log Change.
• "No regulatory changes match the filters". A status or impact filter, or the search box, is hiding everything. Clear a filter to see the rest of the register.
• Log change will not save. Title is required; the button does nothing while it is empty.
• Mark actioned will not save. Action summary is required.
• The Assess dialog says "No requirements in the library yet" or "No controls in the registry yet". Install a standards module (see Library, scoping, gap) or create controls (see Controls and evidence) first. You can still save the assessment without links.
• A change with a past effective date is not flagged. By design. The 90-day chip only counts open changes with an effective date from today forward.
• The link icon complains "Invalid URL". The URL field needs a full address including the scheme, for example https://example.gov/notice.