# Regulatory Mapping Tool

> Regulatory Mapping Tool

- Skill: `uitbreidenos/regulatory-mapping-tool` (Agent Skill)
- Install (CLI): `npx skillmds@latest add uitbreidenos/regulatory-mapping-tool`
- Raw SKILL.md: https://api.skillmd.com/api/skills/uitbreidenos/regulatory-mapping-tool/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: UitbreidenOS (https://skillmd.com/u/uitbreidenos)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/uitbreidenos/regulatory-mapping-tool

---

# Regulatory Mapping Tool

## When to activate

When identifying applicable regulations for AI systems, designing regulatory compliance controls, mapping specific regulatory requirements to operational procedures, assessing compliance gaps, or preparing for regulatory audits.

## When NOT to use

For legal advice or formal regulatory interpretation. This skill is for operational mapping: identifying which rules apply and designing compliance controls. For regulatory questions, consult qualified legal counsel.

## Instructions

### Regulatory Mapping Process

1. **Define System Scope**
   - Model name and business use case
   - Geographic scope: Where is model deployed? (US, EU, China, Canada, etc.)
   - Industry: What sector? (Finance, Healthcare, Employment, Consumer, etc.)
   - User/affected population: Employees, customers, vulnerable groups?
   - Decision type: Consequential (loan, hiring, medical) or advisory (recommendation)?

2. **Identify Applicable Regulations**
   
   Use this framework to identify relevant regulations:
   
   **Jurisdiction-Based:**
   - EU: GDPR, AI Act, sector-specific (ePrivacy, financial regulations, healthcare)
   - US: FTC Act, FCRA, HIPAA, EEOC employment rules, NIST AI RMF guidance, state laws (CCPA, etc.)
   - Global: Consider where data flows, where model is deployed
   
   **Industry-Specific:**
   - **Finance:** SEC disclosure rules, FINRA, banking regulations, Fair Lending laws (FCRA, ECOA)
   - **Healthcare:** HIPAA, FDA (if medical device), state licensing boards
   - **Employment:** Title VII, EEOC guidance, state hiring laws, anti-discrimination rules
   - **Consumer Protection:** FTC Act, CCPA, state consumer protection laws
   - **Automated Decision-Making:** AI Act (EU), state algorithmic transparency laws
   
   **Risk-Based:**
   - **High-stakes decisions:** Additional scrutiny (hiring, credit, criminal justice)
   - **Vulnerable populations:** Children, elderly, low-income require heightened protection
   - **PII/sensitive data:** GDPR, CCPA, HIPAA, state privacy laws
   
   **Decision type-based:**
   - **Consequential (deny/approve decisions):** Fair lending, employment discrimination, due process rules apply
   - **Ranking/scoring:** Transparency and explainability requirements
   - **Advisory:** Fewer compliance requirements but still governance needed

3. **Map Regulatory Requirements to Specific Controls**
   
   For each applicable regulation, identify specific requirements:
   
   **Example: GDPR Requirements**
   
   | Article | Requirement | Operational Control |
   |---------|-------------|---|
   | Article 5(1)(a) | Lawful processing | Document lawful basis (consent, legitimate interest, contract, etc.); evidence of compliance |
   | Article 5(1)(b) | Specified purpose | Define AI system purpose in documentation; do not use for unrelated purposes |
   | Article 5(1)(c) | Data minimization | Use only features necessary for model purpose; justify each feature |
   | Article 5(1)(f) | Security | Encrypt PII; access controls; breach notification plan |
   | Article 13/14 | Transparency | Privacy notice to users explaining model and data use |
   | Article 22 | Right to explanation | Provide explanation of model decisions when consequential |
   | Article 35 | DPIA | Conduct Data Protection Impact Assessment for high-risk processing |
   | Article 37 | DPO | Appoint Data Protection Officer if processing requires |
   
   **Example: AI Act Requirements (EU) - High-Risk Systems**
   
   | Requirement | Operational Control |
   |---|---|
   | Risk classification | Classify model as prohibited, high-risk, or low-risk; document assessment |
   | Technical documentation | Maintain complete documentation of training, testing, deployment |
   | Conformity assessment | Third-party assessment required for high-risk systems |
   | Quality management | Implement QMS for AI development and monitoring |
   | Bias and fairness monitoring | Establish metrics and monitoring for discrimination |
   | Transparency and user info | Disclose that AI is making decisions; explain how it works |
   | Human oversight | Establish mechanisms for human review of decisions |
   | Record-keeping | Maintain audit logs and decision records for 3 years |
   
   **Example: FCRA Requirements (US Fair Lending)**
   
   | Requirement | Operational Control |
   |---|---|
   | Permissible purpose | Ensure model used only for credit decisions (not other purposes) |
   | Adverse action notice | When credit is denied, provide notice explaining why; right to dispute |
   | Dispute procedures | Establish process for consumers to dispute model decisions and correct data |
   | Accuracy | Validate training data accuracy; monitor model for errors |
   | Non-discrimination | Ensure model does not discriminate based on protected class (race, gender, age, etc.) |
   
   **Example: EEOC Guidance on AI in Hiring (US)**
   
   | Requirement | Operational Control |
   |---|---|
   | Disparate impact analysis | Monitor hiring outcomes by protected class (race, gender, age) |
   | Transparency | Job applicants informed that AI is used in hiring; high-performing candidates subject to human review |
   | Validation | Ensure model predicts job performance; establish baseline (human hiring performance) and compare |
   | Record-keeping | Maintain records of hiring decisions, model inputs, outcomes by protected class for 1+ years |
   | Reasonable accommodation | Process for applicants to request accommodations if AI excludes them |

4. **Assess Compliance Gaps**
   
   For each requirement, evaluate:
   - Is control currently implemented? (Yes/No/Partial)
   - What evidence exists? (Policy, procedure, audit trail, logs)
   - What is the gap? (Missing, undocumented, untested)
   - What is the risk if not addressed? (Regulatory enforcement, litigation, reputational)
   
   **Gap Assessment Template:**
   
   | Regulation | Requirement | Current Status | Evidence | Gap | Risk Level | Remediation |
   |---|---|---|---|---|---|---|
   | GDPR | Lawful basis documented | Partial | Consent form signed; not documented in records | Consent not logged/tracked | Medium | Create consent tracking database |
   | GDPR | DPIA completed | No | N/A | No DPIA started | High | Conduct DPIA by [Date] |
   | AI Act | Risk classification | Yes | Risk assessment completed | N/A | Low | Update quarterly |
   | FCRA | Adverse action notice | Yes | Process documented | Unclear if all denials get notice | Medium | Audit process; test with sample |
   | EEOC | Disparate impact analysis | Partial | Quarterly monitoring report | Limited to hiring outcomes; not updated since Q1 | High | Establish monthly monitoring dashboard |

5. **Design Compliance Roadmap**
   
   Prioritize and sequence remediation:
   
   **Priority 1 (Critical - implement before deployment):**
   - High-risk gaps in critical regulations
   - Gaps affecting consequential decisions (loan, hiring, medical)
   - Gaps in fairness/anti-discrimination controls
   
   **Priority 2 (High - implement within 90 days):**
   - Medium-risk gaps in core regulations
   - Gaps in documentation/transparency
   - Gaps in monitoring procedures
   
   **Priority 3 (Medium - implement within 6 months):**
   - Low-risk gaps
   - Gaps in less-critical regulations
   - Enhancements beyond compliance baseline

6. **Document Regulatory Assessment**
   
   Prepare Regulatory Mapping document including:
   - Applicable regulations identified
   - Regulatory requirements mapped to controls
   - Compliance assessment (current state)
   - Gaps and risk assessment
   - Remediation plan with timeline
   - Sign-off by Legal and Compliance

## Example

**Scenario:** US fintech company deploying AI model to predict loan defaults. Model used for pre-approval screening. Model affects both consumer loan applicants and business loan decisions.

```
# Regulatory Mapping: Loan Default Prediction Model

## 1. System Scope

**Model:** Loan Default Risk Predictor (LDP)  
**Business Purpose:** Pre-approval scoring for consumer auto loans and small business lines of credit  
**Geographic Scope:** All 50 US states + DC; some international customers (secondary market)  
**Affected Parties:** Consumer loan applicants (primary; FCRA protected); business applicants (secondary; less regulated)  
**Decision Type:** Consequential (affects loan approval/denial/interest rate)  
**Data Scope:** Credit bureau data, bank account data, transaction data  

---

## 2. Applicable Regulations - Identified

### Primary (Direct Impact)

**Federal Fair Lending Laws:**
- Fair Credit Reporting Act (FCRA, 15 U.S.C. § 1681)
- Equal Credit Opportunity Act (ECOA, 15 U.S.C. § 1691)
- Fair Housing Act (FHA, 42 U.S.C. § 3601) - if used for mortgage or housing-related credit
- Community Reinvestment Act (CRA) - if depository institution

**Consumer Privacy Laws:**
- Gramm-Leach-Bliley Act (GLBA) - financial privacy rules
- California Consumer Privacy Act (CCPA) - if California customers
- State privacy laws (NY BitLicense, MA requirements, etc.)

**AI/Algorithmic Transparency Laws:**
- NY Local Law 144 (algorithmic accountability; requires notice that AI used in decisions)
- State consumer protection laws (FTC Act enforced by states)
- NIST AI Risk Management Framework (guidance, not binding but increasingly expected)

**Industry Guidance:**
- FDIC/Fed/OCC Fair Lending Guidance (2023)
- EEOC AI Guidance (emerging standards for employment; not directly applicable but principles informative)

### Secondary (Indirect)

**Data Security:**
- State data breach notification laws
- PCI DSS (if credit card data handled)
- FTC Safeguards Rule (for financial institutions)

**International (if applicable):**
- GDPR (if EU customers; less likely for consumer loans but assess)
- UK AI Bill (if UK expansion planned)

---

## 3. Regulatory Requirements Mapped to Controls

### FCRA Compliance (Fair Credit Reporting Act)

| FCRA Requirement | Application to LDP Model | Operational Control Required | Current Status | Gap |
|---|---|---|---|---|
| **Permissible Purpose** | Model must be used ONLY for credit decisions (loan/credit limit/interest rate). Cannot use for marketing, employment, insurance, etc. | Document model's permitted use case; restrict model API access to loan decisions only | Yes — documented in model card | None |
| **Accuracy** | Ensure model training data is accurate; monitor for systematic errors | Validate training data sources; quarterly accuracy audits; retraining pipeline | Partial — accuracy audit not currently scheduled | Medium: Implement quarterly audit schedule |
| **Adverse Action Notice** | When loan is DENIED (or credit terms unfavorable), provide consumer with notice explaining the reason and right to dispute | When model score triggers decline, system must provide adverse action notice (not just model score) | Partial — adverse action sent but insufficient explanation of model factors | Medium: Enhance notice to explain top factors influencing score |
| **Dispute Procedures** | Consumer can dispute accuracy of data/decision; company must reinvestigate | Establish process for loan applicants to dispute model decisions; escalate to human review | No — not currently implemented | High: Critical for compliance; implement dispute intake form and process |
| **Non-Discrimination** | Model cannot discriminate based on protected class (race, color, religion, national origin, sex, marital/family status, age, receipt of public assistance) | Monitor outcomes by protected class; conduct disparate impact analysis; identify proxy variables | Partial — demographic monitoring attempted but incomplete; no disparate impact analysis | High: Implement comprehensive disparate impact testing |
| **Fair Credit Reporting Practices** | Follow FTC guidelines for consumer information use | Privacy notice (privacy policy), consent practices, data security | Yes — privacy policy and consent in place | None |

**FCRA Assessment:** Partial compliance. Critical gaps in dispute procedures and disparate impact analysis.

---

### ECOA Compliance (Equal Credit Opportunity Act)

| ECOA Requirement | Application to LDP Model | Control | Status | Gap |
|---|---|---|---|---|
| **Non-discrimination** | Cannot discriminate based on sex, marital status, age, race, color, religion, national origin, receipt of public assistance, or exercise of consumer rights | Ensure model not trained on protected class features; monitor for proxy discrimination | Partial — no protected class features used explicitly, but proxy risk assessed | Medium: Document proxy variable risk; implement monitoring |
| **Adverse Action Notice** | Similar to FCRA; consumer right to know why credit was denied | See FCRA adverse action notice requirement | Partial | Medium: (same as FCRA) |
| **Appraisal Independence** (if mortgage-related) | Independent appraisals required; model cannot override | Not applicable to auto/business loans | N/A | None |

**ECOA Assessment:** Largely aligned with FCRA compliance. Focus on disparate impact and proxy discrimination.

---

### NY Local Law 144 (Algorithmic Accountability; if customers in NY)

| Requirement | Application to LDP | Control | Status | Gap |
|---|---|---|---|---|
| **Notice** | Notify consumers that automated decision system is used in hiring (not directly applicable to credit but principle is important) | For credit decisions, disclose that AI is used; explain how it works | Partial — privacy policy mentions model but not clear or prominent | Low: Add clear disclosure to loan application and adverse action notice |
| **Annual Bias Audit** | Audit for bias and disparate impact; document findings | Conduct and document annual fairness/bias audit | No — not currently audited | High: Critical for compliance; implement annual audit by [Date] |
| **Data Minimization** | Use only necessary data; justify use of each data source | Document why each data source is used; remove unnecessary features | Partial — features justified but not systematically reviewed | Medium: Conduct feature justification review |

**LL 144 Assessment:** Significant gaps. Not yet compliant; must implement before full deployment.

---

### State Consumer Protection / GLBA (Financial Privacy)

| Requirement | Control | Status | Gap |
|---|---|---|---|
| Privacy notice (what data you collect and how you use it) | Detailed privacy policy; model use disclosed | Yes | None |
| Consent (for some data sharing) | Opt-in consent for sharing with third parties | Yes — privacy policy includes consent mechanism | None |
| Data security (reasonable security measures) | Encryption, access controls, breach notification plan | Partial — encryption in place; access controls limited | Medium: Strengthen access controls |
| Breach notification | Notify affected users if breach occurs | Process documented | None |

---

## 4. Compliance Gaps & Risk Assessment

### High-Risk Gaps (Must remediate before deployment)

**Gap 1: Disparate Impact Analysis**
- **Regulation:** FCRA, ECOA
- **Requirement:** Monitor outcomes for discrimination; ensure model does not have disparate impact
- **Current State:** No systematic monitoring
- **Risk Level:** High — regulatory enforcement risk, litigation risk, reputational risk
- **Remediation:** 
  1. Conduct baseline disparate impact analysis (identify protected classes; compare outcomes)
  2. Establish quarterly monitoring
  3. Design mitigation if disparate impact detected (e.g., fairness constraints, manual review threshold)
  4. **Timeline:** By [Deployment Date - 4 weeks]; ongoing quarterly

**Gap 2: Dispute Procedures**
- **Regulation:** FCRA
- **Requirement:** Provide process for consumers to dispute decisions
- **Current State:** No documented process
- **Risk Level:** High — direct FCRA violation; regulatory enforcement likely
- **Remediation:**
  1. Design dispute intake process
  2. Document reinvestigation procedure
  3. Train staff on dispute handling
  4. Log all disputes and outcomes for audit trail
  5. **Timeline:** By [Deployment Date - 2 weeks]; before going live

**Gap 3: Bias Audit Procedures**
- **Regulation:** NY LL 144, FTC guidance
- **Requirement:** Conduct annual bias audit; document findings
- **Current State:** Audit not scheduled; no procedures defined
- **Risk Level:** Medium (regulatory expectation, not yet legal requirement nationally)
- **Remediation:**
  1. Define audit scope, methodology, protected classes
  2. Schedule annual audit before [Date]
  3. Document findings and remediation actions
  4. **Timeline:** First audit by [Date + 90 days]; then annually

### Medium-Risk Gaps (Remediate within 90 days of deployment)

**Gap 4: Enhanced Adverse Action Notices**
- **Regulation:** FCRA
- **Requirement:** Notice must explain decision; currently sent but lacks detail
- **Risk Level:** Medium — currently compliant but opportunity to enhance
- **Remediation:** Update notice template to include top 3 model factors; example: "Your application was not approved primarily due to: (1) High debt-to-income ratio, (2) Limited credit history, (3) Recent delinquency. You have the right to..."
- **Timeline:** Implement by [Deployment + 30 days]

**Gap 5: Access Control Enhancement**
- **Regulation:** GLBA, GDPR (if EU customers)
- **Requirement:** Restrict data access; log all access
- **Risk Level:** Medium — security and privacy risk
- **Remediation:** Implement field-level access control; log all credit bureau data access
- **Timeline:** Implement by [Deployment + 90 days]

---

## 5. Regulatory Compliance Status Summary

| Regulation | Critical Requirement | Status | Gap Level | Remediation Timeline |
|---|---|---|---|---|
| FCRA | Adverse action notice | Partial | Medium | Deployment + 30 days |
| FCRA | Dispute procedures | No | High | Before deployment |
| FCRA | Accuracy monitoring | Partial | Medium | Q1 Year 2 |
| FCRA | Permissible purpose | Yes | None | — |
| ECOA | Non-discrimination | Partial | High | Before deployment |
| ECOA | Disparate impact analysis | No | High | Before deployment |
| NY LL 144 | Notice of AI use | Partial | Low | Deployment + 30 days |
| NY LL 144 | Annual bias audit | No | Medium | Deployment + 90 days |
| NY LL 144 | Data minimization | Partial | Low | Deployment + 60 days |
| GLBA | Privacy & consent | Yes | None | — |
| GLBA | Data security | Partial | Medium | Deployment + 90 days |

**Overall Compliance Status:** CONDITIONAL APPROVAL

- **Before Deployment:** Remediate dispute procedures (Gap 2) and disparate impact analysis (Gap 1)
- **By Deployment + 30 days:** Remediate adverse action notices (Gap 4) and AI use disclosure (LL 144)
- **By Deployment + 90 days:** Remediate bias audit (Gap 3), data minimization (Gap 5), access controls (Gap 5)

---

## 6. Regulatory Compliance Roadmap

```
BEFORE DEPLOYMENT (Critical)
├─ Disparate impact analysis: complete baseline assessment
├─ Dispute procedures: design and document process
├─ Staff training: ensure staff understand FCRA/ECOA requirements
└─ Legal review: final sign-off on compliance posture

DEPLOYMENT + 30 DAYS (High Priority)
├─ Adverse action notice: implement enhanced template with model factors
├─ AI use disclosure: add clear disclosure to loan app and notices
└─ Monitoring dashboard: implement to track outcomes by protected class

DEPLOYMENT + 90 DAYS (Medium Priority)
├─ Bias audit procedures: define and document annual audit process
├─ Access control: implement field-level restrictions and logging
├─ Data minimization: review features; document justification for each
└─ Incident response: finalize procedures for regulatory inquiries

ONGOING (Continuous)
├─ Quarterly: disparate impact monitoring (protected class outcomes)
├─ Quarterly: adverse action audit (sample 10 denials; verify notice provided)
├─ Annually: bias and fairness audit (full assessment)
├─ Continuously: dispute intake and reinvestigation (log all)
└─ Continuously: incident response (escalate any signs of discrimination)
```

---

## 7. Approvals & Sign-Off

**Regulatory Compliance Assessment completed:** [Date]

- **Legal Counsel:** _____________________ Date: _____ [Confirms regulatory assessment and remediation plan]
- **Compliance Officer:** _____________________ Date: _____ [Confirms compliance roadmap feasible and resourced]
- **Model Owner:** _____________________ Date: _____ [Confirms ability to implement technical controls]
- **Executive Sponsor:** _____________________ Date: _____ [Approves deployment contingent on Gap 1 & 2 remediation]

**Deployment Authorized:** [Date] pending completion of Critical remediation items

**Follow-up Audit Scheduled:** [Date + 120 days]

---

## Regulatory Reference

**Federal:**
- FCRA: 15 U.S.C. § 1681
- ECOA: 15 U.S.C. § 1691
- GLBA: 15 U.S.C. § 6801
- FDIC/Fed/OCC Fair Lending Guidance (2023)

**State:**
- NY LL 144: Local Law 144 (2023)
- CA CCPA: California Consumer Privacy Act (2018)
- MA AI Transparency: "An Act Relative to the Oversight of Artificial Intelligence" (2023)

**International:**
- GDPR: Regulation (EU) 2016/679
- UK AI Bill (pending)

**Guidance:**
- NIST AI Risk Management Framework (2023)
- FTC "Endorsement Guides" for AI recommendations
```

---

## Regulatory Mapping Checklist

Ensure comprehensive assessment:

**Regulatory Identification:**
- [ ] Geographic scope identified (US/EU/other jurisdictions)
- [ ] Industry identified (finance, healthcare, employment, consumer)
- [ ] Decision type identified (consequential, ranking, advisory)
- [ ] All applicable regulations identified (federal, state, industry-specific)
- [ ] Regulatory landscape documented

**Requirements Mapping:**
- [ ] For each regulation, specific requirements identified
- [ ] Requirements mapped to operational controls
- [ ] Control implementation status assessed (yes/no/partial)
- [ ] Evidence of compliance documented

**Gap Assessment:**
- [ ] Current state vs. required state documented
- [ ] Risk level assigned to each gap (critical/high/medium/low)
- [ ] Remediation required or waived
- [ ] Resource requirements estimated

**Compliance Roadmap:**
- [ ] Remediation prioritized (before deployment vs. after)
- [ ] Timeline established with specific dates
- [ ] Owner assigned for each remediation
- [ ] Dependencies identified (order of implementation)

**Documentation & Approval:**
- [ ] Regulatory Mapping document prepared
- [ ] Gap assessment documented
- [ ] Compliance roadmap documented
- [ ] Sign-off from Legal, Compliance, and Executive Sponsor
- [ ] Follow-up audit scheduled