AI rules change across technology, data protection, prudential supervision, outsourcing, consumer protection and cybersecurity. A regulatory-change process should therefore map obligations to actual AI systems and controls, not keep a collection of disconnected legal summaries.
Maintain an obligation register
For each rule, record scope, effective date, affected role, system, required evidence, accountable owner and implementation status. Link the entry to the AI inventory and risk classification so that a change in use case automatically triggers a review.
Prioritise by impact
Prioritise systems that affect customers, capital, claims, credit, financial crime, payments, employment or critical operations. Include transitional provisions, guidance updates and supervisory expectations. Escalate uncertainty instead of quietly treating it as low risk.
Test implementation
Compliance testing should sample production workflows, supplier records, disclosures, human reviews, incident logs and monitoring. Closure requires evidence that the control operates, not only that a policy was approved. The European Commission AI framework and AI Act are useful anchors for an obligation map.