The Ultimate Guide to Regulatory Horizon Scanning in the EU

Regulatory horizon scanning is an essential element of compliance management in the European Union. You not only need to understand the legislation that applies to your business today, but you must also anticipate the regulations and guidance that will affect you in the coming months and years.

As regulators look to build confidence in the markets, protect employees and manage the challenges of trending topics like cybersecurity and the use of AI, the rate of regulatory change in the EU has accelerated significantly. Within just a few years, compliance teams have had to prepare for:

• The AI Act
• The EU Whistleblowing Directive
• The Corporate Sustainability Reporting Directive (CSRD)
• The Corporate Sustainability Due Diligence Directive (CSDDD)
• The Omnibus I Directive, adjusting both CSRD and CSDDD
• The EU Listing Act’s adjustments to legislation such as the Market Abuse Regulation (MAR) and the Markets in Financial Instruments Directive (MiFID II)

This list continues with many more pieces of legislation and their associated delegated acts, regulatory technical standards, supervisory guidance and phased implementation dates. In fact, a study by the European Policy Information Center (EPICENTER) found that the regulatory volume in the EU had doubled between the Treaty of Lisbon in 2010 and 2024.

Organisations that are reactive and only respond once legislation is in force often have less time to update policies, redesign controls, train employees and allocate resources. Regulatory horizon scanning allows you to be proactive and prepared for change.

This article explores what regulatory horizon scanning is, how to build an effective process and the tools and best practices compliance teams need to stay ahead of the shifting regulatory landscape.

Regulatory horizon scanning vs regulation monitoring

Regulatory horizon scanning looks outward at new and emerging regulation, identifying the proposals, consultations and reforms that could reshape your obligations five years from now or beyond. Regulation monitoring focuses on the rules you already follow, tracking the amendments and guidance that could change those obligations over the next year or two. Effective compliance depends on both: scanning to anticipate what is coming and monitoring to keep pace with what is already in force.

The regulatory horizon scanning process (Step-by-step)  

Regulatory horizon scanning requires a structured process to ensure you gain a comprehensive view of legislation that will impact your business in the medium to long term. Here is a step-by-step guide to building your scanning framework.

1. Define your regulatory footprint

You need to build a scope for your scanning that works out what you do and do not need to keep track of. If you do not define these parameters at this stage, you could collect large volumes of irrelevant information and still, as a result of overwhelm, miss important developments. You should map:

• The countries in which you operate or plan to operate
• The legal entities, licences and regulated activities in each market
• The EU and national regulators that supervise those activities
• The products, services and business lines in scope
• The regulations, standards and policy areas that already apply
• Emerging topics that could affect your strategy.

For example, a listed financial services company might monitor MAR, MiFID II, DORA, sustainable finance rules and the AI Act at EU level. It may also need to follow national company law, employment rules and guidance from the competent authorities in every Member State where it operates.

Record this information in a central workspace and keep this footprint up to date as you enter a new market, launch a new product or change your business model in some other manner.

2. Use authoritative sources

Once you know the scope for your regulatory horizon scanning, you can build your programme on credible primary sources of news about upcoming regulatory events. Look for official feeds first. Commentary from law firms and industry bodies can help you interpret the changes, but they should not replace the official text.

Here are some useful European Union sources:

• EUR-Lex⁠ for EU legislation, consolidated texts and the Official Journal
• European Commission Have Your Say⁠ for consultations, calls for evidence and planned initiatives
• European Parliament Legislative Observatory⁠ for the progress of legislative files
• ESMA consultations⁠ for securities and capital markets developments
• EBA⁠ for banking standards, guidelines and consultations
• EIOPA⁠ for insurance and pensions developments
• The relevant national competent authorities (NCAs) for policy areas in the jurisdictions in which you are present for domestic guidance, enforcement priorities and the details of the exact implementation of laws in their areas.

Track the full life cycle of a regulatory development. This can include Commission initiatives, draft legislation, Parliament and Council negotiations, technical standards, delegated acts, guidelines and implementation deadlines. Each stage will help you finesse your controls.

3. Filter and assess relevance and impact

You may find an update to a law from an official source, but that does not mean it will apply to your organisation. You need a robust triage process to separate what is meaningful and impactful for you. For each item, ask:

• Does it apply to one of our entities, activities, products or markets?
• Is it a proposal, consultation, final rule or supervisory expectation?
• When could it take effect?
• What is the likely impact?
• Which policies, controls, systems or disclosures could it affect?
• Does it require immediate action or continued monitoring?

Once you have these answers, you can classify each development by relevance and urgency. Prioritise each development with a simple rating system. For example:

• High: likely to apply and requires significant operational change
• Medium: potentially relevant or limited in impact
• Low: unlikely to apply, but worth retaining for reference

Keep a record of the reason for your decision and provide enough detail so that people looking back in the future to review it can understand the context. Automated tools can help you make this decision, with human oversight to ensure it is correct.

4. Assign ownership and act

Regulatory horizon scanning is important, but you need to ensure it leads to action as well. Assign each relevant development to a named owner. This may be a compliance specialist, lawyer, risk owner, policy owner or business lead.

Set a deadline for an initial assessment and then define the next steps, with dates, to maintain accountability in the process. These steps could be:

• Updating a policy or procedure
• Changing how a control works or looking for a better-suited alternative
• Revising customer or employee communication strategy
• Configuring a new system
• Preparing a regulatory submission
• Delivering training to employees
• Allocating budget or specialist support
• Responding to a consultation so that your company has a stake in its outcome.

Of course, there is a difference between small adjustments and major changes, such as when the EU Whistleblowing Directive required in-scope companies to implement reporting channels, impartial investigations and anti-retaliation measures.

For significant developments:

• Create an implementation plan with milestones, dependencies and senior oversight.
• Link the regulatory development to the affected policies, controls and obligations.Escalate to
• senior management to give them time to approve funding and recruit any necessary new staff.

5. Log evidence for audit and assurance

Keep a detailed record of your regulatory horizon scanning process to show that you took steps to ensure you were ready for regulatory changes. Record:

• The source you used to inform your regulatory horizon scanning and the publication date
• The regulatory development identified
• The entities or business areas you felt would be impacted
• The applicability and impact assessment you undertook
• The decision you made on whether to move forward with changes or not, with reasoning
• The person responsible for making the decision
• The actions assigned and their deadlines
• The final outcome and supporting evidence.

Retain the records for both closed and active events and review your process periodically to ensure you are making the correct decisions and for the correct reasons. This will provide an audit trail that shows you have a robust process in place.

Why regulatory horizon scanning matters

• Reduces compliance risk. Identifying regulatory developments early gives you more time to understand your obligations and implement the necessary changes, reducing the risk of missed deadlines, enforcement action and regulatory penalties.
• Supports strategic decision-making. Regulatory change can affect your business strategy and the investment decisions you make. It might also impact the products you have in development and other operational considerations. Regulatory horizon scanning gives your senior management the insight they need to plan ahead with confidence, rather than worrying about potentially having to make changes to projects midway through.
• Improves resource planning. Preparing for new regulations takes time and budget. By spotting these changes early, you can schedule your policy updates, employee training, technology projects and external support in a controlled and cost-effective manner.
• Strengthens audit readiness. A structured regulatory horizon scanning process creates evidence that your organisation actively monitors regulatory developments, assesses their impact and takes appropriate action. This means that you can be confident of your workflows during internal audits, regulatory inspections and board oversight activities.
• Builds a competitive advantage. Organisations that anticipate regulatory change can adapt more quickly than their competitors and may even influence future regulation by responding to public consultations before regulatory bodies finalise the new rules.

The 4 best practices for regulatory horizon scanning in the EU

Here are some best practices to bear in mind when carrying out regulatory horizon scanning:

• Start with regulation monitoring. Identify the EU and national rules that apply to your organisation in every member state where you operate.
• Start with primary sources. Prioritise authoritative updates from EU institutions, including ESMA, the EBA and the Publications Office of the European Union.
• Turn insight into action. Connect every relevant development to a clear workflow for assessment, ownership and any required changes to policies or controls.
• Maintain an audit trail. Record what changed, how you assessed it, who took responsibility and what action followed. This provides evidence of a consistent and accountable compliance process.

Manual vs automated regulatory horizon scanning

Regulatory change is accelerating. New rules, guidance, consultations and enforcement updates are arriving across multiple jurisdictions, while many compliance teams are expected to manage this growing complexity without a corresponding increase in resources.

The cumulative workload of regulation monitoring and regulatory horizon scanning involves looking at numerous sources for potential regulatory changes. It may be manageable for a smaller organisation, but it becomes increasingly difficult as the business grows.

As well as identifying developments, you need to determine what is relevant, understand which parts of the business may be affected and make sure the right people take action at the right time. This manual approach creates a significant burden that requires a dedicated solution.

• With a manual process, you can get lost among complex, but irrelevant information. The requirements for your business may be unclear and you might miss the connection between the regulatory change and the policies it affects.
• Automated regulatory horizon scanning does not replace the expertise of compliance professionals, but it reduces their workload and gives them better information and more time to apply their judgement. By providing pertinent updates from trusted sources into one place, filtering them according to your regulatory profile and notifying the appropriate users, a dedicated solution reduces repetitive administrative work, even as regulators step up the rate at which they introduce and amend legislation.

Compliance teams need to assess developments, identify affected policies, assign actions and record the decisions they make. This creates a clearer route from regulatory change to implementation. Rather than spending valuable time searching for updates and maintaining trackers that fail to cut through the noise effectively, you can focus on what each development means for the organisation.

Here is how manual and automated regulatory horizon scanning compare:

What to look for when you move to automated regulatory horizon scanning

The right regulatory horizon scanning process should keep you fully informed and help you guide your efforts to meet the challenges of emerging legislation. Here are the features you should look out for in a solution that will reduce your workload while supporting you to maintain robust compliance: