AI Use Case: Regulatory Change Management

Regulatory Change Management: The Process Problem AI Can’t Fix Alone

Most large financial institutions know they have a regulatory change management problem and have tried to fix it. A surprising number which have already gone through expensive remediation projects find themselves back in the same place: policies out-of-sync with local law, global frameworks that don’t translate into local procedures, and compliance teams doing manual reconciliation that should have been solved years ago. The issue is not a lack of tools. Most organizations have treated this as a technology problem when it is really a process and governance problem that technology can support but not solve on its own. That distinction matters more now than ever. Boards and senior leadership are pushing large corporate compliance functions to demonstrate AI-driven efficiency and cost reduction. At the same time, regulators are scrutinizing exactly how those AI tools are being governed and controlled. Satisfying both requires more than buying the right software.

The “Alignment” Challenge

Global institutions face two alignment challenges simultaneously: keeping local policies current with local law across dozens of jurisdictions, and ensuring those local policies stay consistent with the firm’s global framework. Both need to happen on an ongoing basis, not in annual review cycles. The struggle is not caused by lack of technology. The difficulty arises where the underlying process is still manual, inconsistent across markets, and dependent on the availability and quality of SMEs in each location. When a regulator issues new guidance, the question is not whether someone eventually notices. It is whether the right people are reviewing it, assessing its impact, and tracking changes through to completion in a way that holds up to regulatory scrutiny. Without programmatic change, this will inevitably lead to gaps in coverage, application and most importantly…non-compliance.

Where AI Actually Helps

There is a tendency to debate AI in compliance at the extremes: it will either eliminate compliance roles, or it cannot handle the nuance the work requires. Neither position is particularly useful in solving regulatory change management. The real opportunity is to make the slow, inconsistent, labor-intensive parts of the process become faster and more reliable, without removing human judgment from consequential decisions. To understand what that looks like in practice, it helps to move past the general concept of “AI agents” and look at what they actually do at each step. A well-designed regulatory change management system is not a single AI model ingesting regulations and producing answers. It is a set of discrete, purpose-built agent functions assembled into a workflow. One agent monitors designated regulatory sources and identifies new or amended rules. Another classifies the change by jurisdiction, topic, and risk area. Another extracts the relevant text and maps against existing local and global policy language. Another scores the risk and flags where gaps exist. Another generates a redlined policy amendment with full citations to the source material. A final packaging function assembles the output into a structured record ready for SME review. Each of these functions is built, tested, and validated independently before it is composed into a workflow. That architecture matters for a reason that goes beyond efficiency. It supports validation of the workflow whereby a function is validated at the component level, you know what it does and what its failure modes are. You are not certifying a black box. You are certifying known, documented building blocks that can be reused across jurisdictions and regulatory domains without rebuilding from scratch each time. None of these agents should make the final determination. That remains with the SME, who reviews the output, agrees applicability, approves or modifies the recommended policy language, and decides whether the change has local impact, global impact, or both. The AI compresses the time and effort required to get to that decision point. The judgment at the decision point remains human. A process where AI makes determinations can be a liability. A process where AI does the analytical heavy lifting and a qualified SME approves the consequential decision is defensible to a regulator and sustainable inside the organization.

An AI-Enabled Regulatory Change Management Process Which Meets Regulatory Requirements

Deploying AI in a compliance function is more than an operational decision; it is a risk and governance determination. Regulators are closely examining how firms are integrating AI within control functions. The firms which face the hardest questions will be those which cannot clearly explain how their AI tools work, who is accountable for the outputs, and how errors are caught and corrected. The component-based architecture described above is not just an engineering decision. It is a governance choice. When each agent function is validated independently, the explainability and audit trail are built into the design rather than added after the fact. Every output can be traceable to source documentation, with configuration identifiers and run histories attached. When a regulator asks how a particular policy recommendation was generated, there is a documented answer at every step of the chain. Beyond architecture, firms which will succeed are those which build ongoing controls around the process itself. That means regular performance monitoring to catch drift or degradation in agent outputs, periodic testing against known regulatory changes to verify the system is still producing accurate results, and a clear escalation path when an agent produces something that does not pass SME review. It also means incorporating the AI-enabled process into the firm’s existing assurance or quality control function. That level of discipline is also a stronger position than most manual processes can offer. A well-documented, AI-assisted workflow with consistent SME oversight tends to hold up to regulatory examination better than a process that relies on individual judgment and institutional memory varying by market. The goal is not just a faster process. It is one that produces a defensible, consistent record across every jurisdiction it touches.

What Good Looks Like

Firms which succeed tend to start narrow: one jurisdiction, one regulatory domain, particularly with one that has been well documented and successfully tested, before expansion. They map the existing process before touching a tool, so they understand where AI can be embedded without disrupting what already works. Explainability and auditability are treated as requirements from day one, not features to be added later. The technology is ready. The harder work is designing a process around it that your people will use, your boards and regulators will accept, and your organization can sustain. In this link, IMAG will guide you through our program of AI Enabled Regulatory Change Management: AI Regulatory Change Management