.png)
.svg)
.svg)
.svg)
.png)
.png)
.jpg)
%20F%20(1).jpeg)
.webp)
Login
As requirements on companies evolve, so should the manner in which you anticipate change and action changes to your policies to meet your obligations. This section explores how regulatory horizon scanning will evolve in the short, medium and long term.
Regulatory horizon scanning is a key element of maintaining compliance for companies. Understanding how the law is going to change and what that means for your current policies and procedures is essential to ensure you are ready for new obligations.
However, it is not a simple case of spotting a forthcoming change and making the necessary adjustments before moving on and forgetting about it. It is a complex and ongoing process that requires continual monitoring and a clear workflow to take you through identifying, assessing and acting on regulatory changes, as well as recording evidence of your activity at every step.
With legislation evolving continuously, remaining up to date with your requirements can be challenging. For example, the EU AI Act began phasing into force from 2024 before the 2026 AI Omnibus amended the obligations the original act had implemented. This meant that companies in the process of adjusting their policies had to swiftly change their focus and assess what the new rules meant for their organisation.
With the rate and complexity of regulatory change showing no signs of abating, the process of regulatory horizon scanning must develop to help organisations stay ahead. This article explores the issues compliance teams face, explores examples showing why scanning is essential and provides a timeline of future horizon scanning developments.
Key takeaways
Regulatory horizon scanning is an ongoing process that must turn new developments into assessments, assigned actions and evidence of the organisation’s response.- Organisations need to monitor EU and national law, as well as technical standards, regulatory guidance, enforcement activity and geopolitical events.
- A proactive approach gives compliance teams more time to assess the impact of a development and update affected policies before a requirement takes effect.
- AI and automated platforms will process regulatory information faster, but qualified professionals must still decide what applies and approve the response.
- Machine-readable regulation and connected compliance systems should make it easier to identify changes, link them to affected policies and keep a clear audit trail.
What makes the regulatory burden hard to manage?
There are multiple reasons why maintaining compliance in an age of rapidly developing legislation can be challenging to manage for compliance teams. These include:
- There are multiple levels of legislation that you need to consider when monitoring the shifting regulatory landscape. Not only must you be alert to changes to EU law, but also to national law in each of the countries in which you operate and industry standards as well.
- Each new piece of legislation comes with often-complex technical standards and implementing acts that you must decipher to truly understand what they mean for you and your policies. Compliance rests on you extrapolating the essential detail from dense texts.
- Different authorities may interpret or enforce the requirements of the legislation differently. The European Securities and Markets Authority (ESMA) has highlighted this as an issue relating to sanctions under the Market Abuse Regulation (MAR). For example, Sweden’s national competent authority (NCA) imposed only administrative fines for breaches of MAR in 2024, whereas 100% of Slovenia’s sanctions comprised cease-and-desist orders.
- Geopolitical matters can adjust companies’ obligations at short notice. Governments might impose sanctions or embargoes against other nations, for instance, that require companies to adjust their policies and procedures as a result.
From reactive to proactive compliance
Relying on a reactive approach to compliance is not sufficient, given these challenges. It increases the risk that you will miss important updates, preventing your company from meeting all of its obligations. Even if you do manage to stay on top of developments, the increased manual workload could become a burden for your team.
To benefit from robust regulatory horizon scanning in the future, you need to move from a reactive to a proactive approach:
|
Approach |
How the company manages regulatory change |
What horizon scanning looks like |
Likely outcome |
|
Reactive |
The organisation responds after the obligation changes, creating a compliance gap. |
Updates depend on individual employees, external advisors or regulator notifications. |
Teams work under pressure and may update policies or controls too late. |
|
Informed |
The compliance team receives regular updates and circulates relevant information to the business. |
Scanning improves awareness, but the processes for identifying, assessing and following up are separate and unconnected. |
The organisation knows what is changing, but the process of changing policies may face roadblocks. |
|
Proactive |
The organisation assesses developments early, assigns owners to policy changes and follows actions through to completion. |
Scanning connects regulatory developments to the affected policies, controls, teams and deadlines. |
The business gains more time to prepare and keeps clear evidence of its decisions and actions. |
Why robust horizon scanning is essential: Examples
- The Dutch regulator, Authority for the Financial Markets (AFM), started monitoring companies’ sustainability reports before the Corporate Sustainability Reporting Directive (CSRD) came into force. Their study found that companies still needed to explain more clearly how they decided which sustainability issues were material. This shows why horizon scanning should cover regulatory reviews and guidance as well as new laws. The scope of what comprises robust regulatory horizon scanning is wider than simply understanding the letter of the law.
- Sweden’s Finansinspektionen (FI) found that only 41 per cent of Swedish firms that have artificial intelligence in production say that they have a formally approved policy for their development and use of AI. This shows that the adoption of new technologies is now happening faster than policymaking can keep up with, leaving companies open to non-compliant activities, even when they have the best of intentions.
E
ffective policy management ensures the insights from your horizon scanning are translated into timely, compliant internal policies. Together, they create a proactive compliance cycle that reduces risk and improves operational readiness.
For a deeper dive into building a strong policy framework, check out our Complete Guide to Policy Management.
The future timeline of regulatory horizon scanning
As requirements on companies evolve, so should the manner in which you anticipate change and action changes to your policies to meet your obligations. This section explores how regulatory horizon scanning will evolve in the short, medium and long term.
01. Short term
- AI will help compliance teams process regulatory information faster and reduce some of the work involved in preparing a response to changes. For example, it can use the details it finds on an identified regulatory change to suggest amendments to an affected policy, but a compliance professional must still check that the change applies to the organisation, assess its impact and approve the final wording. As with other aspects of work, AI speeds up the process of drafting policies, but people remain accountable for the decisions and content.
- Compliance teams are moving to replace their manual processes with platforms that offer an end-to-end service that integrates into their compliance processes. This includes:
- Automatic and continuous tracking of regulatory changes, updates and new laws from a wide range of different sources to gain a comprehensive and dynamic view of the regulatory landscape.
- A feed of relevant regulatory events, filtered by jurisdiction, topic and affected business department to help assign updates to stakeholders.
- Alerts as soon as a pertinent change arises to give the team the longest possible preparation time.
- Audit and evidence trail that records each step from discovery to assessment to action, showing that the company took the necessary steps for compliance if challenged later.
- An impact assessment of each regulatory change, allowing the compliance team overseeing the process to prioritise cases and assign them to teams with the capacity to carry out the necessary work.
- Obligation mapping to link the change to the relevant policy or policies that it affects, ensuring that you update all documents to meet the new requirements.
- Legal lineage that shows the direct connection between the active policy and the legal sources that determine what exactly your obligations are. This keeps your changes on track and shows you that they are comprehensive before they come into force.
- Gap analysis to show where different policy iterations differ, giving you oversight on how the policy has developed over time.
- Analytics dashboard to give you oversight on the status of each policy, the coverage of your policies against your obligations and any policy reviews that are overdue.
02. Medium term
Regulators are developing methods of making it easier for organisations to receive and understand details of legislative updates. This means publishing more information in formats that your software can read and compare.
As part of the wider Interoperable Europe project, the European Commission’s SORTIS initiative has led to the Reporting Requirement Metadata Vocabulary (RRMV), which creates a consistent structure and labels for regulatory content creation.
Its first full version appeared in December 2025. As organisations and technology providers adopt it, scanning tools should be able to find amendments faster, compare old and new requirements more accurately and reduce the need for people to trawl through large quantities of legal text to try and understand what is changing.
03. Long term
Although it is difficult to predict exactly how regulatory horizon planning will develop over the long term, here are some best-guess suggestions that are based on current technology and regulatory initiatives:
- Horizon scanning will connect more closely with policy management. Regulatory developments will likely link directly to risks, controls, products and business areas to help you understand their wider impact.
- Relevant developments will start a clear process. A system could notify the person responsible and open an impact assessment. It could then retain the decision, deadline, resulting policy changes and evidence that the work was completed.
- Teams will spend less time moving information manually. Better connections between compliance systems should reduce the need for copying and repeated data entry. Staff will no longer need to update several separate records whenever a development moves forward.
- Regulators will make greater use of data and supervisory technology. This could help them identify unusual activity or possible compliance gaps sooner. Organisations may face more targeted questions and have less time to assemble their supporting evidence.
- AI will assist legal analysis, but people will remain accountable. Fully autonomous interpretation is unlikely. AI may summarise a development or suggest where it could have an impact, while qualified professionals check the source, consider the organisation’s circumstances and decide what action to take.
What organisations should do now
- Define the regulators and subjects that are material to your business. Focus your monitoring on the authorities, jurisdictions and issues that could affect your organisation.
- Assign each development to an owner. Give a named person responsibility for assessing the update and completing any follow-up work.
- Set criteria for judging the impact of developments. Use consistent questions to decide whether an update applies, how significant it is, when action is needed and which parts of the business it affects.
- Link developments to policies. Identify the policies that may need reviewing whenever a relevant requirement changes.
- Keep related records together. Store the original source with your assessment, final decision, resulting actions and evidence of completion.
- Use a dedicated regulatory horizon scanning platform. Choose a system that brings relevant updates into one place and helps your team turn them into assigned, traceable actions.
Conclusion
Regulatory horizon scanning is about giving your organisation the time to make informed decisions, implement change in a controlled way and demonstrate that compliance is embedded into your governance processes. The organisations that gain the greatest value are those that treat regulatory horizon scanning as a continuous workflow, linking regulatory developments to policies, controls and accountable actions rather than looking at regulatory change for its own sake.
Manage the regulatory workload better with PolicyLog
PolicyLog provides an impact assessment of each change, maintaining a reference library of the relevant regulatory text. You can ensure oversight on the status of your policies, draft new text with the support of AI and publish policies to stakeholders so they always see the most recent version.