Regulatory Change Monitor

Overview

Scans official regulatory sources for new or updated rules, guidance, and enforcement actions relevant to the user's compliance scope. Produces a deduplicated, impact-classified digest with plain-language summaries and recommended next steps.

Workflow

<Definition - Regulatory Impact Levels> Each finding is classified into one of three impact levels:

• Informational: Guidance documents, advisory opinions, or notices that do not impose new obligations. No immediate action required, but awareness is recommended.
• Action Required: Final rules, amendments, or enforcement actions that create new obligations or modify existing ones. The user's compliance team should review and plan implementation before the effective date.
• Urgent: Rules with imminent effective dates (within 30 days), enforcement actions against entities in the user's industry, or emergency orders. Immediate review is necessary. </Definition - Regulatory Impact Levels>

<Definition - Rule Lifecycle> Regulatory rules move through distinct stages:

• Proposed: Published for public comment. Not yet binding. May change substantially before finalization.
• Final: Comment period closed. Rule text is fixed. Compliance obligations begin on the stated effective date.
• Effective: The rule is now in force. Regulated entities must comply.
• Enforced: The regulator has taken action (fines, consent orders, cease-and-desist) against entities for non-compliance. </Definition - Rule Lifecycle>

<Definition - Common Regulatory Bodies> Key sources by jurisdiction and scope:

• US Financial: SEC (Securities and Exchange Commission), CFTC, FINRA, OCC, CFPB
• US Healthcare: FDA, HHS, CMS
• US Data/Cyber: FTC, CISA, NIST (frameworks, not binding rules)
• US General: Federal Register (primary publication vehicle for all federal agencies)
• EU: European Commission, European Data Protection Board (EDPB), EU Official Journal
• UK: FCA, ICO, MHRA, UK Statutory Instruments
• AI Governance: NIST AI RMF, EU AI Act (via Official Journal), state-level AI bills (US)
• Environmental: EPA, EU ETS, UK Environment Agency </Definition - Common Regulatory Bodies>

<Workflow - Regulatory Change Scan description="End-to-end regulatory change monitoring and digest generation." tools=[web_search, url_fetch, file_write, run_python, open_in_session_tab] triggers=["check for regulatory changes", "what's new in GDPR", "regulatory update", "compliance news", "any new SEC rules", "monitor regulations for us"]

1. [Ask user] Gather any missing inputs: scope, jurisdiction, industry, and lookback period. If the user's request implies specific values (e.g., "what's new in GDPR" implies scope=data_privacy, jurisdiction=eu), confirm the inferred selection rather than presenting the full menu. If fails: if a required input (scope, jurisdiction, or industry) is still missing after asking, re-ask for that specific input and do not start the scan until it is provided.

2. [Agent] Build a search plan based on the confirmed inputs. Map each scope-jurisdiction pair to the relevant regulatory bodies (per the Common Regulatory Bodies definition). For each body, construct targeted search queries combining the body name, the industry context, and a date range matching the lookback period. Example queries: "SEC final rule financial services site:sec.gov", "EDPB enforcement decision 2026", "Federal Register AI governance". If fails: if a scope-jurisdiction pair maps to no known regulatory body, note the gap to the user and continue with the pairs that do map.

3. [Agent] Execute web searches for each regulatory body in the plan. For each search, collect the title, URL, publication date, and snippet. Run searches in batches grouped by jurisdiction to maintain organization. Store raw results in a working list. If fails: if a search returns no results or errors, record that body as 'no results' and continue with the remaining searches rather than stopping.

4. [Agent] For each result that appears relevant based on title and snippet, fetch the source page to confirm: (a) it is an official publication from the regulatory body, not a third-party summary, (b) it falls within the lookback period, (c) it relates to the user's scope and industry. Discard results that fail any of these checks. Trace third-party mentions back to the official source URL when possible. If fails: if a source page cannot be fetched, discard that result and note the unverified item rather than including an unconfirmed finding.

5. [Think] Deduplicate the confirmed findings. Group by underlying regulatory action (same rule number, docket, or enforcement case). Merge entries that reference the same action from different sources into a single finding, preserving all source URLs. Classify each finding by lifecycle stage (Proposed, Final, Effective, Enforced) and impact level (Informational, Action Required, Urgent). Calculate days remaining until effective dates or comment deadlines. Flag jurisdiction overlaps per Rule 8.

6. [Agent] Using run_python, sort findings by impact level (Urgent first), then by effective date proximity. Format the digest using the Regulatory Alert Digest template. Include all required fields for each finding. If fails: if sorting or formatting errors, fall back to presenting the findings unsorted and report the formatting error to the user.

7. [Agent] Write the formatted digest to a file and open it in the session tab for the user to review. File name format: regulatory_digest_YYYY-MM-DD.md. If fails: report the specific write or open error and present the digest inline instead.

8. [Ask user] Present a summary count (e.g., "Found 3 Urgent, 5 Action Required, and 8 Informational changes"). Ask if the user wants to drill into any specific finding, adjust the scope for future scans, or export the digest in a different format. If fails: if the user does not respond, leave the saved digest available and end without further changes.

</Workflow - Regulatory Change Scan>

<Template - Regulatory Alert Digest>

markdownCopy code
# Regulatory Change Digest

**Scope:** {{scope}}
**Jurisdictions:** {{jurisdiction}}
**Industry:** {{industry}}
**Period:** {{lookback_start}} to {{lookback_end}}
**Generated:** {{current_date}}

---

## Urgent

### [Finding Title]
- **Source:** [Regulatory Body Name](official_url)
- **Lifecycle Stage:** [Proposed | Final | Effective | Enforced]
- **Publication Date:** YYYY-MM-DD
- **Effective Date:** YYYY-MM-DD (X days remaining)
- **Comment Deadline:** YYYY-MM-DD (if applicable, X days remaining)
- **Jurisdiction:** [US | EU | UK | Multiple]
- **Overlap Flag:** [Note if conflicting requirements exist in another jurisdiction]

**Summary:** Plain-language description of what changed or was published. Two to four sentences covering the substance of the rule or action.

**Who is affected:** Description of which entities, products, or activities fall under this rule based on the published scope.

**Recommended action:** What the compliance team should evaluate, review, or prepare. Not legal advice. Framed as "Review with legal counsel whether..." or "Evaluate whether your organization's current practices align with..."

---

## Action Required

(Same structure as Urgent, repeated for each finding)

---

## Informational

(Same structure, repeated for each finding)

---

## Notes

- Findings are sourced exclusively from official regulatory body publications.
- This digest does not constitute legal advice. Consult qualified legal counsel for interpretation and applicability determinations.
- "Proposed" rules are not yet binding and may change before finalization.

</Template - Regulatory Alert Digest>