The modern compliance challenge

A mid-sized European company in the financial sector must comply with over 200 regulatory requirements. GDPR, PSD2, MiFID II, AI Act, NIS2, DORA, Anti-Money Laundering Directives, sector-specific national regulations, EU directives, supervisory circulars. And every year, 10 to 20 new obligations are added.

The compliance officer has a scale problem. It is not that they do not know what they must comply with. It is that they cannot track everything, verify everything, and document everything with limited resources. AI does not solve the compliance problem. It solves the scale problem of compliance.

Where AI adds value

• Reading regulations: AI can process a 100-article Regulation and extract the obligations that apply to your company in minutes.
• Continuous monitoring: alerting when a new regulation that affects you is published.
• Cross-mapping: linking requirements from different regulations that overlap (GDPR + AI Act + NIS2 have overlapping data security requirements).
• Compliance evidence: generating documentation that demonstrates you are complying.

Regulatory mapping with AI

Regulatory mapping consists of identifying all regulations that apply to your organization and breaking them down into specific obligations. It is the foundation of any compliance program.

Identifying applicable regulations

My company has these characteristics:
- Sector: [financial/healthcare/technology/industrial/energy/other]
- Size: [employees] employees, [revenue] EUR revenue
- Countries of operation: [list]
- Activities: [list of main activities]
- Data processed: [types of personal/sensitive data]
- Critical infrastructure: [yes/no, type]
- Publicly listed: [yes/no]
- Obliged entity under AML Directives: [yes/no]

Identify ALL applicable regulations, organized by:

1. DIRECTLY APPLICABLE EU LEGISLATION
   (regulations, no transposition needed)

2. TRANSPOSED EU DIRECTIVES
   (indicate the national transposition law)

3. NATIONAL LEGISLATION

4. SECTOR-SPECIFIC REGULATION
   (circulars, binding guidance from the regulator)

5. STANDARDS AND FRAMEWORKS
   (ISO, NIST, COBIT, non-binding but expected by regulators)

For each: full name, date, status (in force/pending/planned),
compliance deadline if applicable.

Obligation breakdown

Break down the obligations of [regulation name] that apply to a
[sector] company with [characteristics].

For each obligation:
1. Article/section of the regulation
2. Specific obligation (what must I do)
3. Typical responsible person in the organization
4. Frequency (one-time/periodic/continuous)
5. Required compliance evidence
6. Penalty for non-compliance
7. Compliance deadline

Group by functional area:
- Corporate governance
- Data protection
- Information security
- Anti-money laundering
- Employment
- Tax
- Sector-specific

Format: table with the 7 columns.

Cross-mapping requirements

Many regulations require the same thing with different wording. Cross-mapping prevents you from duplicating work.

Compare the requirements of these 3 regulations on [information
security / data protection / AI governance]:

Regulation 1: [GDPR, relevant articles]
Regulation 2: [NIS2, relevant articles]
Regulation 3: [AI Act, relevant articles]

For each requirement:
1. What each regulation demands (summarized text)
2. Are they equivalent? (yes: complying with one satisfies the others)
3. Are they complementary? (require additional actions)
4. Are they contradictory? (regulatory conflict)

Generate an equivalence matrix that enables implementing a single
measure that satisfies multiple regulations simultaneously.

Format: table [Requirement | GDPR | NIS2 | AI Act | Unified measure]

Monitoring regulatory changes

Regulations change. New ones are published. Existing ones are amended. Others are repealed. A compliance officer needs to know the day it is published, not 6 months later during an audit.

Regulatory alert system

AI cannot monitor in real time (it does not browse the internet for you). But you can build a workflow:

1. Sources: subscribe to the relevant official journals (Official Journal of the EU, national gazettes, regulatory authorities, sector regulators).
2. Ingestion: automate collection with tools like n8n, Zapier, or RSS readers.
3. AI filtering: pass each publication through a classification prompt to determine if it affects you.
4. Impact analysis: for relevant regulations, use an impact analysis prompt.
5. Action: generate tasks in your management tool (Jira, Asana, Notion) with an owner and deadline.

Regulatory filtering prompt

Analyze the following regulatory publication and determine if it
affects my organization:

Organization: [sector, size, activities]
Publication: [title, source, date, summary text]

Respond ONLY:
1. Affects my organization: YES / NO / POSSIBLY
2. If it does: which functional area is impacted
3. Urgency: IMMEDIATE / 30 DAYS / 90 DAYS / INFORMATIONAL
4. Required action: [1 line]

If the answer is NO, do not provide further information.

Regulatory impact analysis prompt

The following new regulation affects my organization:
[name, date, summary of the regulation]

Analyze the impact:

1. NEW OBLIGATIONS
   - What must I do that I was not doing before?
   - Who is responsible?
   - What is the deadline?

2. MODIFIED OBLIGATIONS
   - What changes compared to the previous regulation?
   - Are my current controls still sufficient?

3. OPERATIONAL IMPACT
   - Does it require process changes?
   - Does it require new technology or tools?
   - Does it require staff training?

4. FINANCIAL IMPACT
   - Estimated implementation cost
   - Penalty for non-compliance

5. ACTION PLAN
   - Specific actions ordered by priority
   - Implementation timeline

Automated compliance checks

Periodic checks are the core of operational compliance. AI can automate a large portion of these checks.

Automated checklist

Run a [monthly/quarterly] compliance check on
[area: data protection / security / AML / employment].

Current status provided:
[paste current status: active policies, implemented controls,
recent incidents, latest audits]

Verify:
1. Policies: are they up to date? (date of last review)
2. Controls: are they being executed as planned?
3. Incidents: have they been handled correctly? Lessons learned?
4. Training: is staff trained and up to date?
5. Documentation: is it sufficient to demonstrate compliance?
6. Regulatory changes: are there new obligations since the last check?

For each point:
- Status: COMPLIANT / NON-COMPLIANT / PARTIALLY COMPLIANT
- Required evidence
- Corrective action if applicable
- Owner and deadline

Internal policy verification

Compare our internal policy on [data protection / security /
AI usage / etc.] with current legal requirements.

Our policy: [paste policy text]

Applicable regulations: [list of regulations]

Identify:
1. GAPS: legal requirements not covered by our policy
2. EXCESSES: commitments in our policy that go beyond
   the law (may create unnecessary contractual obligations)
3. AMBIGUITIES: points an auditor would question
4. OUTDATED REFERENCES: references to repealed or amended regulations

For each gap: suggested text to add to the policy.

Gap analysis

Gap analysis is the exercise of comparing your current compliance status with what the regulation requires. It is the first thing an auditor does. Better that you do it first.

Structured gap analysis

Perform a [regulation] compliance gap analysis for my organization.

Regulation requirements: [list or regulation text]

Current status of my organization:
- Implemented policies: [list]
- Technical controls: [list]
- Operational processes: [list]
- Training completed: [description]
- Available documentation: [list]

For each regulation requirement:
1. Requirement (reference and description)
2. Status: COMPLIANT / NON-COMPLIANT / PARTIAL
3. Available evidence
4. Gap identified (if non-compliant)
5. Required corrective action
6. Estimated effort: LOW (< 1 week) / MEDIUM (1-4 weeks) / HIGH (> 1 month)
7. Priority: CRITICAL / HIGH / MEDIUM / LOW

Final summary:
- Overall compliance %
- Top 5 critical gaps
- Prioritized remediation plan

Audit preparation

Preparing for a regulatory audit (data protection authority, financial regulator, ISO audit) is a process that consumes weeks of work. AI can accelerate the preparation.

Evidence generation

Prepare the evidence documentation for a [regulation] audit
in the [functional area] area.

For each regulation requirement in this area:
1. Regulatory requirement (reference)
2. Implemented control (description of what we do)
3. Available evidence:
   - Type (document/record/screenshot/log/minutes)
   - Location
   - Date
   - Owner
4. Missing evidence that we need to generate
5. Typical auditor questions for this control
6. Prepared response

Organize in the auditor's usual review order.

Audit simulation

Act as a [regulation] auditor conducting a compliance audit.

My organization has provided this information:
[paste documentation]

As auditor:
1. What questions would you ask the compliance officer?
2. What additional documentation would you request?
3. What inconsistencies do you see in the presented documentation?
4. Where would you issue a non-conformity finding?
5. What improvement recommendations would you give?

Be critical and demanding. I prefer to find problems now
rather than during the actual audit.

Compliance reporting and dashboards

The compliance officer needs to report to the Board, Management, and regulators. AI can generate these reports.

Board report

Generate a quarterly compliance report for the Board of Directors.
Maximum 2 pages.

Period data:
[incidents, findings, regulatory changes, control status]

Structure:
1. Overall compliance status: GREEN / AMBER / RED
2. Regulatory changes this quarter that affect us
3. Compliance incidents (if any)
4. Status of open remediation plans
5. Emerging risks identified
6. Resources needed (if requesting from the Board)
7. Upcoming obligations with deadlines

Tone: executive, concise, risk-oriented.
No unnecessary technical jargon.

Key regulatory frameworks

For each framework, AI can assist you differently:

• GDPR: processing mapping, records of processing activities (Art. 30), DPIAs, standard contractual clauses, responding to data subject rights requests.
• NIS2: applicability analysis, identification of essential/important entities, incident notification requirements, security measures.
• DORA: mapping critical ICT providers, digital resilience testing, ICT risk management, register of ICT provider agreements.
• AI Act: AI systems inventory, risk classification, technical documentation, AI Literacy (Module LG04 in depth).
• ISO 27001: statement of applicability (SoA), risk treatment, Annex A controls, certification audit preparation.
• ENS (Spain): system categorization, security measure selection, conformity declaration.

Ejercicio practico

Puntos clave