Regulatory change management software tracks new laws, rules, guidance and enforcement orders, decides which apply to an institution, and follows each through to updated policies, procedures, systems and controls before its effective date. Products sold under that name range from alert services, which send summaries and stop there, to systems that score, map, assign and track every change. The difference matters because the institution stays responsible for the result. A Federal Reserve examiner's guidance on change management is explicit that even with "a reliable vendor, the institution remains responsible for ensuring that the output from vendor-provided systems and services meets regulatory requirements." This guide sets out what to ask of any product, including Botminds' Regulatory Change Management, whose answers are given as a reference point.
What is regulatory change management software?
It is software that carries part or all of the change cycle: finding new items, deciding what applies, tracing impact, assigning work and keeping the evidence. Three kinds of product share the name, and a buyer should know which one is on the table before comparing prices, because they take different parts of the work off the team.
Three kinds of product sold as regulatory change management software
| Kind | What it does | What stays with your team |
|---|---|---|
| Alert and regulatory intelligence services | Find and summarise new laws, rules and guidance by topic or jurisdiction | Applicability, scope, mapping, owners, dates and evidence |
| Trackers and GRC workflow modules | Hold the change register, tasks, approvals and reports | Reading the sources, applicability and mapping, then entering it all |
| Agentic change management systems | Read, score against your footprint, map to your sections and controls, assign and track, with people signing the decisions | The unclear calls, the scope signature, the wording, the board report |
How to choose regulatory change management software: twelve questions
Choose on what the product misses, what it decides alone and what it leaves for an examiner to read, not on its feature list. The twelve questions below test exactly that, in five groups: coverage, verdicts, mapping and scope, control, and proof. Each can be answered with a demonstration on your own data, which is the only answer worth having.
Twelve questions for any regulatory change management software
- Which sources does it read, and how often?
Every federal regulator that supervises you, every state you lend in, bulletins, and enforcement orders, on a cycle measured in hours.
- Does it catch removals as well as additions?
Withdrawn guidance, rescinded rules and delayed compliance dates change policies too.
- Does it read orders against other institutions?
An order against a peer is a free test of your own controls.
- Does every item get a verdict with a reason?
Including the ones that do not apply. Silence is not a verdict.
- What happens to unclear items?
They should go to a named person and never close by default.
- How are “does not apply” verdicts checked?
A person should re-read a sample on a fixed cycle.
- Does it scope against your own products and states?
Including the licence or authority behind each, not a generic industry profile.
- Does it map to your policy sections, controls and systems?
Quoting the rule passage and your passage side by side.
- Who assigns owners, and from what?
From your ownership map, never outside it, with backups.
- Can the tool change a policy or move a date?
It should be able to do neither without a named person.
- Can internal audit export the whole trail?
From publication to verdict, signature, redline approval, closed task and retest.
- How do we test it on our own past rules first?
A replay of last quarter against your footprint, compared with what your team did.
Coverage: what does it read, and what does it miss?
Coverage is the question vendors answer most confidently and test least. Ask for the source list against your footprint: each federal agency that supervises you, the Federal Register and each agency's own bulletins, and for each state you lend in, its register, its legislature and its banking department. Then ask how often each is read. A weekly digest misses windows that the rules themselves make short: the 2026 Regulation Z threshold adjustments were published on December 15, 2025 and took effect on January 1. For the cadence question in more depth, see how to keep up with regulatory changes.
Ask specifically about removals. On May 12, 2025, the CFPB withdrew 67 guidance documents in one Federal Register notice, from policy statements to advisory opinions and circulars, with the withdrawals "applicable as of May 12, 2025" (90 FR 20084). A tool that only flags new obligations would have said nothing, yet any policy or procedure citing one of those documents needed review. Ask also whether the tool reads enforcement orders against other lenders: they show what a regulator considers a control failure in your own product lines.
The sources a change program watches, and how the verdicts route
Verdicts: does every item get one, with a reason?
A tool that surfaces only what it thinks applies leaves no evidence about everything else. Ask to see the verdict on an item the tool decided did not apply, and the reason. In the solution's sample data, on a fictional lender called Kestrel Bank, the agents read 918 items in 30 days from 41 sources; three applied, five needed a person, and every other item carries a one-sentence reason such as "Deposit accounts only; no lending product". The reasons are what make an examiner's or an auditor's sample testable.
Then ask who decides the unclear items. In the solution, the applicability scorer never closes a "may apply"; it goes to the regulatory change lead. A weekly sample of "does not apply" verdicts, 5% by default, is re-read by a person, and anyone can send an item for a second look. A vendor should be able to say who checks its negatives and how often.
Every item, every verdict, every reason, and a second look on the negatives
Mapping and scope: is it your footprint, or a generic one?
A tool that scopes by industry ("applies to mortgage lenders") pushes the real work back onto the analyst. Ask whether it scores each item against your own product and state footprint, and whether that footprint notes the authority behind each square, because some state rules bind licensees and not banks. Then ask what it maps to. The useful answer is your policy sections, controls and systems, with the rule passage and your passage quoted side by side, because the OCC expects systems to be included in change management "to re-test results when regulatory changes occur" (OCC Comptroller's Handbook). A mapping that stops at "update the lending policy" leaves the system and the retest to memory.
Weak and strong answers to the questions that separate tools
| Question | A weak answer | A strong answer |
|---|---|---|
| Does every item get a verdict? | “We surface everything relevant to you.” | Every item read is scored applies, may apply or does not apply, with a one-sentence reason you can see. |
| Who decides unclear items? | “The system’s confidence score handles that.” | A named person in your team, by setting; the tool never closes them. |
| What does it map to? | “Relevant regulatory topics and your policy titles.” | Your numbered sections, controls, systems and forms, quoting both texts. |
| Who assigns owners? | “You can assign from the dashboard.” | Assigned from your ownership map, with backups, never outside it; a person confirms. |
| Can it change a policy? | “It updates your documents automatically.” | Read-only; it drafts a redline and the policy owner approves. |
| Can it move a date? | “Deadlines adjust to your workload.” | No. It nudges and escalates; only a named person can move a date. |
| What can audit see? | “A summary report each quarter.” | Every step, verdict and signature, exportable for any period. |
Control: what may the tool do without a person?
Ask what the tool may do on its own, and get it in writing. The four things that should always need a person are deciding an unclear item, confirming a scope, approving a policy change and moving a date. In the solution, the regulatory change lead signs each scope with an electronic signature that states its meaning; each policy owner approves, edits or sends back the drafted redline; the chief compliance officer signs the board summary and is the only person who can move a date. The agents have read-only access to policies.
"Although a financial institution may hire a reliable vendor, the institution remains responsible for ensuring that the output from vendor-provided systems and services meets regulatory requirements."
Allison Burns, Senior Examiner, Federal Reserve Bank of Minneapolis
Vendor oversight itself is under revision. On September 11, 2026, the Federal Reserve, FDIC, NCUA and OCC proposed new third-party risk management guidance; "when finalized, the federal bank regulatory agencies plan to rescind existing third-party risk management guidance and replace it" (joint press release). Until then the 2023 interagency guidance applies. Either way, Treasury's advice holds for AI-based tools in particular: check AI use cases "for compliance with existing laws and regulations before deployment" (U.S. Treasury). How the solution's agents divide the work with people is set out in AI regulatory change management.
Is regulatory change management software better than a spreadsheet or an alert service?
Better than either when the time and the exam risk sit after the finding: in verdicts, mapping, owners and evidence. For a small footprint, a disciplined spreadsheet can satisfy an examiner if it logs every item with a reason, a signed scope, owners, dates and closure; it breaks down on volume and on evidence, because reasons for setting items aside go unrecorded and edits leave no trace. Many teams already pay for an alert service and ask whether they need more. The honest answer depends on where their hours go. An alert service shortens finding; it leaves verdicts, mapping, owners, dates and evidence to the team. A change management system is worth its cost when those later steps are where the time and the exam risk sit.
An alert service and a change management system, step by step
Alert service: Yes: summaries by topic or jurisdiction.
Change management system: Yes: every source on your list, read on a short cycle.
Alert service: Left to your analyst, usually with no reason written down.
Change management system: Scored against your footprint, with a reason; unclear items to a person.
Alert service: Left to your analyst.
Change management system: Mapped to your sections, controls and systems, quoting both texts.
Alert service: Negotiated by email; tracked in a spreadsheet.
Change management system: From your ownership map, with due dates by rule and escalations.
Alert service: Assembled when asked.
Change management system: Produced as the work happens; exportable.
How much does regulatory change management software cost, and how to compare it?
Prices are set by vendors case by case and are rarely published, so compare on what drives them and on what the software replaces. The drivers are predictable: how many jurisdictions and sources are read, how many products and policy sections the footprint covers, how many people use it, and how much implementation work the vendor does. Ask for a price on your own footprint, not a tier.
What drives the price, and the question that tests it
| Price driver | Why it matters | Ask the vendor |
|---|---|---|
| Jurisdictions and sources | Every state added is a legislature, a register and a regulator to read | Which of our states are covered at the source, and how often each is read? |
| Footprint and library size | Mapping effort scales with products, sections and controls | Is mapping to our sections included, or an add-on? |
| Users and roles | Owners across business lines need access to approve their sections | Do policy owners and auditors count as paid users? |
| Implementation | The inventory and replay are most of the go-live effort | What do you configure, and what must we prepare? |
The fair comparison is against analyst days. Compliance officers in credit intermediation earned a mean of $94,090 in May 2025 (BLS), and a rule that applies to several products can take two weeks of reading, scoping, mapping and chasing by email, on our estimate. Count how many such rules your team handled last year and how many items it read to find them; that is the cost the software has to beat. The full arithmetic, with the cost of compliance by bank size, is in the cost of compliance for banks.
How to test regulatory change management software before buying
The last question decides the purchase: ask to run the tool on your own last quarter before relying on it. Give it your footprint, policy library and control inventory, let it re-score the publications of the past 90 days, and compare its verdicts and mappings with what your team did. Disagreements are the useful output. Each is either a miss by the tool, a miss by the team, or a gap in your inventory, and you want to know which before go-live. What to have ready for that replay is listed in setting up a regulatory change management system.
What a mapped rule should look like: the passage, the section, the owner
We offer the same test for Regulatory Change Management: your products and states, your policy library and the last month of rules. It is built for banks, credit unions and consumer lenders working across several products and states, where the scoping and mapping are the heavy part. A single-product lender in one state may be well served by an alert service and a disciplined tracker, and should buy accordingly. To see the sample version first, start from Regulatory Change Management.
Questions people ask
What is regulatory change tracking software?
Usually a tracker: a register of changes with owners, tasks, due dates and reports, sometimes part of a GRC platform. It records the work but does not do the reading or the applicability calls, so it pairs with an alert service or an analyst. Ask whether it keeps a reason for every item set aside, which most trackers do not require.
Does the software need to cover state law?
If you lend in more than one state, yes, at the source: each state's legislature, register and banking regulator. State coverage is where products differ most and where programs most often leak, so ask for the source list state by state rather than a count of jurisdictions.
What should a regulatory change management RFP include?
The twelve questions above, your source list and footprint state by state, the roles that need access, a sample of your policy library, and a requirement to replay a recent quarter. Ask for the verdict and reason on items the tool decided did not apply, not only those it flagged.
Do we need a tool that uses AI?
Not necessarily. What matters is that reading and mapping keep up with the flow and that judgements stay with named people. AI agents make the first part cheaper; they do not remove the need for the second, and they should be tested like any vendor output.
What should a regulatory change management demo show?
A rule published that week, processed against a footprint like yours; the verdict and reason on an item the tool set aside; one mapping with both texts quoted; who signs what; and the audit export for the item. A demo built only on the vendor's own showcase rules shows the interface, not the fit.