# Legal Compliance Regulatory Change Impact

> Converts a regulatory change into an atomic obligation register, tests applicability before assuming the rule bites, maps each obligation to the existing control that satisfies it, and produces a dated remediation plan — refusing to state what a rule requires from a summary, a press article, or memory rather than the supplied provision text. Use when a regulator publishes a new or amended rule, a consultation closes, a supervisory statement or guidance lands, a compliance deadline is approaching, or someone asks what a change means for the business. Trigger on 'new regulation', 'regulatory change', 'what does this rule mean for us', 'impact assessment', 'compliance deadline', 'gap analysis against the rules', 'guidance published'. Not for reviewing a commercial contract's clauses (use legal-compliance-contract-review) or for writing the internal policy that implements the change (use legal-compliance-policy-drafting).

- Skill: `alihusains/legal-compliance-regulatory-change-impact` (Agent Skill)
- Install (CLI): `npx skillmds@latest add alihusains/legal-compliance-regulatory-change-impact`
- Raw SKILL.md: https://api.skillmd.com/api/skills/alihusains/legal-compliance-regulatory-change-impact/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: alihusains (https://skillmd.com/u/alihusains)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/alihusains/legal-compliance-regulatory-change-impact

---


## Purpose

Regulatory change assessments fail by paraphrasing. Someone reads a summary,
writes "we need to enhance monitoring", and eighteen months later the regulator
asks which paragraph that maps to. This skill breaks the instrument into atomic,
individually testable obligations tied to provision references, and treats "we
already do this" as a claim requiring evidence.

## Data classification

**Confidential, potentially privileged.** A gap assessment is a written record of
where the organisation does not comply. Assume a regulator or a claimant may see
it, and consider with counsel whether it should be produced under privilege.

**STOP CONDITIONS:**

| Trigger | Action |
| --- | --- |
| The work is part of, or responsive to, an investigation, enforcement action, skilled-person review, or litigation | Stop. Privilege and disclosure decisions come first. Route to counsel. |
| Counsel's advice or a without-prejudice regulator communication is pasted | Stop. Do not summarise or excerpt privileged material. |
| Customer, client or employee personal data is pasted as an example of the issue | Stop. Assessment works on obligations and controls, not on records. Ask for it to be removed. |
| Client positions, balances, transactions or account identifiers appear | Stop. Name the category, not the value; ask for a de-identified extract. |
| The user asks for a legal conclusion on whether the firm is in breach | Stop short of the conclusion. Produce the obligation, the evidence gap, and the question. Breach determination and any notification decision belong to counsel and the regulator-facing function. |

**NON-FABRICATION RULE.** Never state a requirement, threshold, deadline,
reporting frequency, or scope from memory, from a news summary, from a law-firm
briefing, or from a similar rule in another jurisdiction. Every obligation row must
quote or cite the supplied provision. Never assert that an existing control
satisfies an obligation without the control's documented description and evidence
of operation — an unevidenced "already covered" is the most expensive line in the
whole document. If the instrument text was not supplied, the output is
`SOURCE TEXT NOT SUPPLIED — no obligations can be extracted`.

## Prerequisites

- **Inputs (mandatory):** the text of the instrument, rule, or guidance — the
  actual provisions, not a summary.
- **Inputs (mandatory):** which regulator(s) and which jurisdiction(s) apply to the
  organisation. **Ask.** Do not assume; the same activity is regulated differently
  by different authorities, and multi-jurisdiction firms face overlapping and
  sometimes conflicting versions of the same duty.
- **Inputs (mandatory):** the entity's regulated permissions, activities, size and
  client categories — applicability turns on these.
- **Inputs (needed for gap assessment):** the current control set — policies,
  procedures, systems, reports — with owners.
- **Inputs (needed for planning):** the dates: publication, in-force, transitional
  end, first reporting date.
- **Access:** none required.

If the provision text is absent, stop. Everything else is guesswork wearing a table.

## Procedure

### 1. Applicability test — run before extraction

Answer, with the provision that decides each: does it apply to this entity type ·
these permissions or activities · these client or counterparty categories · this
jurisdiction and any extraterritorial reach · above or below any size threshold ·
within the transitional period or after. Record `APPLIES` / `DOES NOT APPLY` /
`UNCLEAR — question for counsel`, each with the citation. A single "UNCLEAR" on a
scoping provision blocks the rest — resolve it first rather than assessing both
branches in parallel.

### 2. Extract atomic obligations

One obligation per row. An obligation is atomic when it has a single actor, a
single verb, and a single testable outcome. "Firms must establish, maintain and
evidence a policy and report annually" is four obligations, not one.

| Field | Rule |
| --- | --- |
| Reference | The provision number. Mandatory. No row without one. |
| Obligation text | Quoted, not paraphrased |
| Actor | Who must do it — the entity, a specific function, a named officer role |
| Verb class | Prohibit / require an act / require a record / require a report / require a disclosure / require governance |
| Trigger | Continuous, event-driven, or periodic — with the period |
| Deadline | The date, or the event plus the elapsed time |
| Evidence expected | What a supervisor would ask to see |

Guidance and supervisory expectations are recorded as a separate class from
binding rules. Do not merge them; the response to each differs, and blending them
inflates the programme.

### 3. Map to existing controls — evidence, not assertion

| Status | Requires |
| --- | --- |
| Satisfied | Named control, its owner, its documentation, and evidence it operated in the period |
| Partial | Named control plus the specific element it does not cover |
| Not satisfied | Nothing exists |
| Unknown | Nobody could confirm — treat as Not satisfied for planning, and record the ownership gap separately, because it is its own finding |

"Business as usual" and "covered by the existing framework" are not statuses.
Reject them and ask which named control, owned by whom.

### 4. Assess impact per function

For each gap, state the affected functions and what specifically changes: policy
text, procedure, system change, data capture, new report, training, contract terms
with clients or vendors, disclosure, governance forum, records retention. Contract
and vendor impacts are the most commonly missed, because they need a counterparty's
agreement and therefore the longest lead time.

### 5. Plan backwards from the compliance date

Work back from the deadline, not forward from today. Every gap gets an owner
(role), a delivery date, and its dependency. Then apply the reality tests:

- Does any item require a system release? Check it against the release calendar.
- Does any item require a counterparty to sign something? Add negotiation time.
- Does any item require training? That is a capability item — route it onward.
- Is the first evidence date before the first reporting date? If not, the firm
  will report on a period it cannot evidence.
- What is the interim position if an item lands late? Name the compensating
  control, or state that there is none.

### 6. Output

Deliver: applicability determination with citations · obligation register ·
control mapping with evidence · gap list by function · plan with owners and dates
back-solved from the deadline · items requiring counsel · explicit list of
provisions not assessed and why. Date the assessment and record the version of the
instrument used — rules change during implementation, and an undated assessment
cannot be re-based.

## Boundaries

- **Not for** determining whether a breach occurred, or whether to notify a
  regulator. That is counsel's and the regulator-facing function's decision.
- **Not for** interpreting ambiguous provisions as though the answer were settled —
  ambiguity is an output, routed to counsel.
- **Not for** commercial contract review — that is
  `legal-compliance-contract-review`.
- **Not for** writing the resulting policy — that is
  `legal-compliance-policy-drafting`.

## Hand-offs

- Receives from: regulatory horizon scanning, or a regulator publication.
- Routes to: `legal-compliance-policy-drafting` for every gap needing a policy or
  standard change, carrying the provision reference with it.
- Routes to: `legal-compliance-policy-drafting` so each new obligation lands as a
  testable control statement with a defined evidence artefact.
- Routes to: `hr-training-needs-analysis` when an obligation creates a competence
  requirement with a date.
- Routes to: `legal-compliance-contract-review` when client or vendor terms must
  change to comply.