AI regulatory change management means giving software agents the reading, matching, mapping and tracking of new rules while people keep the judgements. Regulatory change management can be automated in its reading, matching, mapping and tracking, and should not be automated in its judgements. Each week brings new laws, proposed rules, bulletins and enforcement orders from several federal agencies and every state a lender works in; most do not apply, but each has to be read to find the few that do. Then each applying change must be scoped to products and states, traced to the policies, controls and systems it touches, given owners and dates, and reported. Botminds' Regulatory Change Management assigns the mechanical part of that sequence to seven agents and keeps four decisions with people. This page goes task by task through where the line falls and why.
Where a rule’s days go before and after agents take the reading and mapping
By email and spreadsheet · about 14 days
- Reading and deciding if it matters · 14%
- Scoping to products and states · 22%
- Finding sections and controls · 21%
- Agreeing owners and dates · 29%
- Tracker and board summary · 14%
With the agents · about 1 day
- Reading · 10%
- Scoping · 10%
- Sections and controls · 20%
- Owners and dates · 50%
- Reporting · 10%
Which regulatory change tasks can be automated?
The tasks that can be automated are the ones with a right answer that can be checked: what a document says, when it takes effect, which products and states it names, which policy sections quote the same provision, which owner the map gives for a section, and how many days remain. The tasks that cannot are the ones where the answer depends on a judgement the institution must stand behind: whether an ambiguous rule reaches a product, whether the scope is right, how a policy should be worded, and what the board is told.
The Federal Reserve examiner's five-step outline of change management is a useful frame, because examiners will use it too: identify changes, establish responsible parties, create action items, track due dates and report to management, then evaluate the change after implementation (Consumer Compliance Outlook, 2019). The table splits each step into its mechanical and its judgement parts.
The five steps of change management, split between agents and people
| Step | What agents take | What stays with a person |
|---|---|---|
| Identify the change | Read every source on a schedule; extract who issued it, what changed and when it takes effect; score it applies, may apply or does not apply, with a reason | Every “may apply”; a weekly second look at a sample of “does not apply” |
| Establish responsible parties | Look up owners and backups for each affected section in the ownership map | Confirming the scope and the owners, with a signature |
| Create action items | Find the policy sections, controls, systems and forms the change touches, quoting both texts; draft the smallest wording change | Approving, editing or sending back each redline |
| Track due dates and report | Count down every date; nudge owners; escalate open work; draft the board summary with citations | Moving any date; signing the summary |
| Evaluate after implementation | List the controls to retest and the cases to test them on | Testing, and deciding that the change worked |
Can AI track regulatory changes? Reading and scoring the volume
Yes, and tracking is where AI earns its keep, because almost everything read is discarded. Reading is the largest automatable task for that reason. In the solution's sample data, a fictional bank called Kestrel, the agents read 918 items in 30 days from 41 sources. Three applied. The rest were closed with a reason, and five needed a person. That ratio is the economic case for automation: the reading is mostly finding the few items that matter.
Thirty days of sample reading in Regulatory Change Management
918items
read from 41 federal, state and enforcement sources, each with a verdict and a reason
5of 918
needed a person’s decision
7.2s
to read one new Regulation Z rule, score it, map 5 policy sections and assign 5 owners
Sameday
from publication to scoped, owned work: the design target
The feed reader checks the Federal Register, nine state registers and legislatures, regulator bulletins and enforcement orders every 30 minutes. For each item it extracts what changed, who issued it and when it takes effect, keeping exact quotes with page and paragraph. The applicability scorer then compares the rule's scope (products, borrowers, states and type of entity) with the bank's product and state footprint and returns one of three verdicts with a one-sentence reason: a Regulation CC change is "Deposit accounts only; no lending product", a West Virginia pawnbroker amendment is out because the bank "does not offer pawn loans".
Two limits keep the scorer honest. It never closes a "may apply"; those go to the regulatory change lead. And a sample of its "does not apply" verdicts is re-read by a person every week, 5% by default. An enforcement order against another lender, for instance one requiring GAP refunds after early payoff, is scored for its lesson: it is not the bank's order, but the bank sells GAP on auto loans, so the scorer marks it may apply and asks a person whether the same control exists.
One rule read, scored, mapped and assigned, with each agent’s step and time
How to automate regulatory change management: mapping, where agents save the most days
Start where the days go. Mapping is the step that took the most analyst days and that agents shorten most, because it is a search across hundreds of documents for a provision the rule changes. On the sample rule, the impact mapper searched 312 policies and procedures and 486 controls and found five policy sections and five controls. For first mortgages it found the high-cost mortgage threshold in section 3.2 of the High-Cost Mortgage Policy, the pre-closing high-cost test control, and the high-cost test table in the loan origination system.
Every mapping quotes both texts: the rule passage that drives it and the policy passage it changes. That is what lets a policy owner check the mapping in seconds instead of re-doing it, and what makes the agent's work reviewable at all. The impact mapper has read-only access to policies. The redline drafter then proposes the smallest wording change that brings each section into line, showing the current text struck through and the proposed text with the new values.
The rule as published, each changed passage tied to a policy section and owner
Mapping is also where automation is most likely to be wrong in a way that matters, by missing a section that should have been found. The structural check is the footprint: if a product sits in the rule's scope but no section was mapped for it, the cell is reviewed rather than left blank. On the sample rule, auto loans were in scope with no change, and the reason is stated on the matrix rather than implied by an empty cell.
Assigning owners and watching dates
Assignment is automatable once the institution has decided, in advance, who owns each section, control and system. The owner assigner looks the owner up in the ownership map, uses the backup when the owner is away, and never assigns outside the map. It sets the due date by the institution's rule, by default 21 days before the effective date. On the sample rule, that made five owners due December 11 for a January 1 effective date.
The deadline watcher counts every date down each morning, nudges owners at 30 days and escalates open work to the chief compliance officer at 14. It cannot extend a date. That limit is deliberate: an agent that could move a date would turn a deadline into a suggestion, and the accountability in the chain from desk to board would erode one extension at a time.
Seven agents in Regulatory Change Management, and the people between them
Agent
Feed readerReads federal, state and enforcement sources every 30 minutes; extracts what changed, who issued it and when it takes effect.
Never: drops an item without a verdict
Agent
Applicability scorerApplies, may apply or does not apply, against the product and state footprint, with a one-sentence reason.
Never: closes a “may apply”
A person decides
Regulatory change leadDecides every “may apply” and confirms each scope with a signature.
Agent
Impact mapperFinds the policy sections, controls, systems and forms touched, quoting rule and policy side by side.
Never: edits a policy
Agent
Owner assignerAssigns each piece from the ownership map, with the due date set by rule.
Never: assigns outside the map
Agent
Redline drafterDrafts the smallest wording change in the house style.
Never: publishes a change
A person decides
Policy ownerApproves, edits or sends back each redline.
Agent
Deadline watcherCounts down dates, nudges at 30 days, escalates at 14.
Never: extends a date
Agent
Board summary writerKeeps the quarterly change summary current, every line cited.
Never: sends the summary
A person decides
Chief compliance officerSigns the board summary; alone can move a date.
Which decisions stay with people, and why the line falls there
Four decisions stay human: unclear applicability, scope confirmation, policy wording and what the board is told. They share a feature: each is a judgement the institution will be held to, and none has an answer the agent can check against a source. Whether a New York proposal on short-term installment lending reaches the bank's personal loans depends on how the bank structures them. Whether a policy should say more than the rule requires is a risk appetite question. Those calls are signed by a named person, with the meaning of the signature stated.
Will examiners accept AI for regulatory change management?
Examiners judge the outcome and the evidence, not the tool, and nothing in federal guidance forbids AI in this work; what they will not accept is a decision no person at the institution owns. The regulatory backdrop supports the split above rather than prescribing it. We found no federal regulator statement specific to AI in regulatory change management. What exists points the same way. Treasury's 2024 report lists "regulatory compliance" among the established uses of AI in financial services and says firms should check AI use cases "for compliance with existing laws and regulations before deployment" (U.S. Treasury). Regulators that use AI on the data institutions file told the GAO "they were not using AI to make decisions autonomously or relying on it as a sole source of input" (GAO-25-107197). And a Federal Reserve examiner's article on change management is plain that when a bank uses a vendor, "the institution remains responsible for ensuring that the output from vendor-provided systems and services meets regulatory requirements" (Consumer Compliance Outlook).
One point of model governance is worth knowing. The revised interagency model risk guidance of April 2026, which replaced SR 11-7, states that "generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance," and the agencies have said a request for information on AI is planned (SR 26-2). Until there is more, the defensible position is the one the examiner guidance already implies: the agent's output is evidence a named person reviews, not a decision.
Vendor risk rules apply to an AI tool like any other service. The federal banking agencies proposed new interagency third-party risk management guidance on September 11, 2026, and until it is final the June 2023 guidance stands (joint press release). In practice an examiner will ask what the tool does, who checks its output, how errors would be found, and what happens if the vendor fails; a tool whose every verdict carries a reason and whose every decision carries a signature answers most of those from its own records.
A drafted redline waiting for its owner: the rule, the current text, the proposal
Is AI accurate enough for regulatory change management? How to test it
Accurate enough to read and route, if it is tested on your own past rules and checked every week; never accurate enough to sign. No regulator publishes an accuracy benchmark for this work, so the test has to be your own. An automated process is only as good as its worst silent failure, so test the failures that would be silent. Three are worth measuring on your own last quarter before trusting any tool, including this one: items the reader never saw, items scored "does not apply" that did apply, and sections the mapper missed. The first is a source-coverage test, the second a re-read of a sample, the third a comparison with a mapping done by hand for a few known rules. The OCC's expectation that a bank "re-test results when regulatory changes occur" (OCC Comptroller's Handbook) applies to the change process itself.
Before you let agents take part of the change process
- Every item read gets a verdict and a reason
An item that disappears without one is the failure you will not see.
- Unclear items cannot close themselves
“May apply” goes to a named person, every time.
- “Does not apply” is sampled by a person
A small weekly sample is the only check on the verdicts nobody else re-reads.
- Every mapping quotes both texts
The rule passage and the policy passage side by side, so a person can check it quickly.
- Agents cannot change a policy
Read-only access; drafts are drafts until the owner approves.
- Agents cannot move a date
Nudges and escalations, yes; extensions, only by a named person.
- Each agent step is logged with its timing
So internal audit can follow the work, not only the result.
On the sample month the numbers to watch were simple: 918 items read, 5 that needed a person, and 99.5% closed with a reason a reviewer can check. The number that matters most cannot be read from the screen at all: how many "does not apply" verdicts a person would overturn. That is what the weekly sample measures, and a buyer should ask any vendor for that rate on their own data, not a demonstration set.
What to look for in AI regulatory change management software
Look for reasons on every verdict, quotes on every mapping, your own footprint in every score, and hard limits on what the agents may do. Many products sold as AI for regulatory change are alert services with summaries added; they shorten the reading but leave the scoping, mapping, owners and evidence where they were. The difference shows up in the file an examiner reads.
An AI alert service against agentic regulatory change management
Alert service with AI summaries: A summary of each new item, filtered by topic.
Agentic change management: A verdict for your products and states, with a one-sentence reason.
Alert service with AI summaries: Filtered out or left unread; no record of why.
Agentic change management: Closed with a reason a person can sample.
Alert service with AI summaries: Found by your analyst.
Agentic change management: Mapped with the rule passage and the policy passage quoted side by side.
Alert service with AI summaries: Agreed by email.
Agentic change management: Set from your ownership map, by your due-date rule.
Alert service with AI summaries: The alert and whatever your team wrote down.
Agentic change management: Verdict, signed scope, approved redline, closed tasks and retest, in one trail.
Alert service with AI summaries: Rarely stated.
Agentic change management: Close an unclear item, edit a policy, move a date or send the board summary.
Botminds' Regulatory Change Management is the second kind, built for lenders and banks that work across several products and states. It is not the right buy for every institution: a single-product, single-state lender with a short policy library may need little more than a good alert service and a disciplined tracker. The fuller set of questions to put to any vendor is in choosing regulatory change management software.
What examiners will ask to see from such a process is covered in the regulatory change impact assessment an examiner reads, and what has to be in place before the agents start in setting up a regulatory change management system. To watch the seven agents work on one rule, start from Regulatory Change Management.
Questions people ask
Can AI read the Federal Register and tell me whether a rule applies to my bank?
It can read it and propose a verdict with a reason, if it knows your product and state footprint. The solution's scorer compares a rule's scope with that footprint and returns applies, may apply or does not apply. The unclear ones still need a person, and so does the final scope.
Does automating regulatory change management reduce headcount?
It changes what the compliance team spends its time on more than how many people it needs. In our estimate, a rule's reading and mapping fall from about eight working days to under half a day, while agreeing owners and dates becomes half of what is left. Smaller teams tend to use the time on testing and on the "may apply" calls they used to rush.
What does agentic AI mean in compliance work?
An agent is AI software that carries out a defined task on its own, such as reading a source, scoring an item or drafting a redline, rather than only answering questions. In compliance the useful design gives each agent one job, read-only access where possible, and a list of things it may never do, with people signing the decisions in between.
Can AI draft the policy changes a new rule requires?
It can draft the smallest wording change for each mapped section, with the rule passage beside it, which saves the owner the blank page. It should not publish one: in the solution the redline drafter only drafts, and nothing in the policy library changes until the section's owner approves, edits or sends it back.
Is an AI change-management tool a model under model risk guidance?
The April 2026 interagency guidance leaves generative and agentic AI out of its scope pending further work, and excludes "deterministic rule-based processes". That is not an exemption from oversight: existing law and third-party risk expectations still apply, and the institution remains responsible for the output.