regulatory_change_brief v1.0.0

name: regulatory_change_brief description: "Track regulatory changes from first signal to a dated action plan: build a source watchlist, log and triage each development, decide applicability with reasons, assess impact across policies, systems, contracts, and training, and write a short impact brief with an action timeline worked back from the compliance date. Use when a new law, rule, guidance document, or enforcement action appears, when asked what is coming that affects us, or when maintaining a regulatory change register."

Regulatory Change Brief

Purpose

Most teams fail on regulatory change in one of two places. They hear about a change late, from a summary instead of the source, or they write one impact note and never turn it into owned work with dates. This skill covers both halves: a repeatable monitoring workflow that catches changes early, and an impact assessment framework that ends in a brief, a register entry, and an action timeline.

It is not legal advice. It produces a well sourced working brief that a lawyer or compliance lead can review fast because every date, threshold, and obligation traces to a primary text.

Workflow

1. Define the regulatory universe before monitoring anything

Write down, in one page:

• Jurisdictions: countries, states, or regions where the organisation operates, sells, hires, or stores data.
• Activities and products in scope, and the entity types involved.
• Regulators and standards bodies for each jurisdiction and activity.
• Existing obligations register or policy list, if one exists. Impact is always assessed against named existing artefacts, not in the abstract.

If there is no universe page, the watchlist will drift toward whatever makes news.

2. Build a tiered source watchlist

Tier sources, and record the tier in the register:

• Tier 1, primary: official gazettes and registers (Federal Register and Regulations.gov in the US, the Official Journal and EUR-Lex in the EU, the relevant national gazette elsewhere), regulator websites and RSS feeds, consultation portals, and the semiannual Unified Agenda on RegInfo.gov for US federal rulemaking in development.
• Tier 2, official explanation: regulator guidance, FAQs, speeches, enforcement notices, and press releases. Useful for how a rule will be applied. Never a substitute for the rule text.
• Tier 3, signal only: law firm alerts, trade press, vendor newsletters. Good for early warning. Every fact taken from a Tier 3 source must be confirmed in Tier 1 or 2 before it enters a brief.

Set a cadence per tier. A workable default: Tier 1 weekly for active jurisdictions, Tier 2 on publication alerts, Tier 3 as a monthly sweep. Record who checked what, and when.

3. Log every candidate change, then triage by stage

Enter each candidate in the change register (template in references/brief-and-register.md) with source link, publication date, and stage. Stage matters because it sets what action is even possible:

• Signal: bill introduced, consultation opened, Unified Agenda entry, regulator speech. Action: watch, and note comment or response deadlines.
• Proposed: notice of proposed rulemaking or draft text published. Action: assess likely scope, decide whether to comment, note the comment deadline.
• Adopted or final: final text published. Action: full applicability and impact assessment.
• Guidance or enforcement: regulator explains or enforces an existing duty. Action: check whether current practice matches the stated expectation.
• Changed after adoption: correction, delay, stay, repeal, or new implementing act. Action: reopen the original register entry, do not start a new one.

Triage within a set window, for example five working days from logging. A candidate that sits untriaged is the same as one never found.

4. Keep the dates separate

Regulatory instruments carry several dates, and they are not interchangeable. Record each one the instrument actually gives, and leave the rest blank instead of guessing:

• Publication date
• Comment deadline (proposed stage only)
• Entry into force or effective date
• Compliance date or date of application, if different from the effective date
• End of any transition, phase in, or grandfathering period
• Date enforcement is stated to begin, if the regulator states one

Two verified patterns explain why this matters. Under the US Administrative Procedure Act as summarised by the Congressional Research Service, a final rule generally cannot take effect until at least 30 days after publication, with stated exceptions, and agencies sometimes set a compliance date later than the effective date. In the EU, entry into force and date of application are distinct concepts: a regulation may enter into force, commonly on the twentieth day after Official Journal publication, and apply from a much later date. Building a plan against the wrong date is a missed deadline, so quote the date clause from the text itself.

5. Decide applicability, with reasons

Answer these questions from the text, one by one. Do not skip to a verdict:

1. Jurisdiction: does the organisation have the presence, sales, users, or data the instrument targets?
2. Entity scope: does it cover this entity type and size, including any thresholds or exemptions stated in the text?
3. Activity scope: does it cover the specific activities, products, or data types involved?
4. Timing: which version of the organisation does it hit, current operations or a planned launch?
5. Carve outs: is there an exemption, derogation, or lighter regime that applies instead?

Verdicts, pick one and write the basis in one or two sentences citing the relevant article, section, or paragraph:

• Applies: full impact assessment required.
• Does not apply: record the reason and close the entry. A documented no is a real output, it stops the question coming back.
• Potentially applies: name the open question, who will resolve it, and the date by which it must be resolved.
• Cannot determine yet: the text is not final or a key fact about the organisation is missing. Name what is missing.

6. Assess impact across eight areas

For every item rated Applies or Potentially applies, work through: obligations (what is new, changed, or removed), policies and procedures, systems and data, contracts and vendors, people and training, reporting and disclosures, records and evidence, and risk if missed (penalty basis as stated in the text, licence or approval risk, contractual fallout). Score each area None, Low, Medium, or High using the rubric in references/brief-and-register.md, then set one overall rating. The rating follows the highest scoring area that carries a hard deadline, not an average.

7. Build the action timeline backwards

Start from the compliance or application date and work backwards, not forwards from today. Use bin/timeline.py to generate the milestone dates, then adjust for real dependencies:

• Brief issued and applicability decision signed off
• Gap analysis complete against named policies and controls
• Changes drafted (policy, system, contract, training)
• Changes approved through the normal approval path
• Changes live, with evidence collected
• Buffer before the compliance date for slippage

If the backwards timeline lands in the past, say so plainly in the brief and escalate. A plan that hides an already missed start date helps no one.

8. Write the brief, update the register, recheck

Deliver the one page brief (template in references/brief-and-register.md): what changed, source and stage, the dates that matter, applicability verdict with basis, impact by area, actions with owners and dates, and open questions. Update the register entry to match. Then set a recheck date: adopted rules get corrected, delayed, stayed, and supplemented with guidance, so a brief is a snapshot with a review date, not a permanent statement. Before any brief ships, recheck the primary source for corrections or a changed date.

Output Contract

Every run produces all three:

1. A change register entry with: ID, title, jurisdiction, regulator, source URL and tier, stage, all applicable dates recorded separately, applicability verdict with cited basis, overall impact rating, owner, status, and recheck date.
2. A one page impact brief for items rated Applies or Potentially applies, following the template in references/brief-and-register.md.
3. An action timeline with named owners and dates worked back from the compliance or application date, or an explicit statement that the timeline is already infeasible and has been escalated.

Operating Rules

• Primary text or it did not happen. Never state an obligation, threshold, penalty, or date from a summary, an alert, or memory. Open the instrument and cite the part that says it.
• Never invent or round a date. If the instrument gives a formula (for example, a set number of days after publication), show the formula and the computed date, and have the computation checked.
• Keep effective, compliance, and application dates in separate fields everywhere. Merging them is the most common and most costly error in this work.
• A Unified Agenda entry or a consultation is a signal, not a duty. Label proposed and signal stage items clearly so readers do not treat them as law in force.
• Document negative decisions. Does not apply, with a cited reason, is a finished piece of work.
• Flag legal judgment calls instead of making them. Interpretation disputes, privilege questions, and whether to comment on a proposal go to counsel, named as open questions in the brief.
• Date every brief and register entry with the date the source was last checked. Regulatory status changes, and an undated brief will be trusted long after it goes stale.
• No filler briefs. If nothing changed in a monitoring cycle, the output is one line in the register log saying so, with the sources checked listed. Do not pad it into a report.