We Are Measuring the Value of Regulatory Change Management Wrong
Why a credible RegTech business case must extend beyond labor savings and ROI to effectiveness, resilience, and agility
A few months ago, I argued that organizations are measuring the value of third-party risk management wrong. The business case is too often reduced to questionnaires completed, workflows automated, labor saved, and perhaps a few technology subscriptions consolidated. Those things matter, but they represent only a narrow slice of the value that mature third-party risk management delivers.
I see the same problem in regulatory change management . . .
I work on a significant number of business cases and RFPs involving the evaluation, selection, justification, and implementation of regulatory change management solutions. These engagements span financial services, life sciences, healthcare, manufacturing, energy, technology, and other highly regulated sectors. The regulatory sources differ, the terminology changes, and the consequences vary, but the fundamental business challenge remains remarkably consistent: organizations struggle to articulate the value of regulatory change management beyond hours saved by compliance and legal teams.
That framing is too small.
My perspective comes from spending considerable time in the machinery of this market, not simply observing it from the balcony. In addition to supporting organizations through business cases, requirements development, RFPs, solution evaluations, and implementation strategies, I sit on FinTech Global’s Global RegTech Advisory Board. I have also worked closely with major global financial institutions and their FinTech and RegTech laboratories to put regulatory change technologies through their paces, separate genuine capability from polished demonstration, and test whether ambitious claims survive contact with real regulatory requirements.
Sometimes they do. Sometimes Toto pulls back the curtain.
In one evaluation I worked on for a global bank, a heavily promoted compliance and AI solution depended far more on human intervention behind the scenes than its presentation suggested . . . the Wizard of Oz with more the person behind the curtain and not AI. In another, another global bank I advised found that a prominent GRC and compliance technology provider failed to identify nearly 30% of the requirements supplied for evaluation. These are not stories told to embarrass providers or declare that technology does not work. They illustrate why RegTech business cases must be grounded in validated outcomes rather than branding, feature lists, or the theatrical confidence of a carefully choreographed demonstration.
This perspective will also frame several conversations I will be leading in New York this September. On September 29, 2026, I will return to the Global RegTech Summit USA, my third year participating in both its London and New York events, to moderate the Summit’s two keynote panels. During RegTech Week, I will also moderate a roundtable focused on a question that is becoming increasingly important to buyers, providers, compliance leaders, and executive teams: Making the Internal Case for RegTech: What Does a Credible ROI Look Like?
The word credible matters in in a business case . . .
Organizations are right to challenge exaggerated calculations built on theoretical fines, inflated automation assumptions, and spreadsheets in which every hour saved mysteriously becomes cash returned to the balance sheet. Yet many organizations make the opposite mistake. They measure only what is easy to count and ignore the broader value created when regulatory change is identified earlier, interpreted more consistently, connected to the right areas of the business, implemented more reliably, and used to support better strategic decisions.
Return on investment matters, but ROI is only one perspective on value. A complete business case for regulatory change management must address four dimensions:
- Efficiency
- Effectiveness
- Resilience
- Agility
Together, these provide a far more defensible picture of value than labor savings alone. We will get into that deeper into this article, but let us explore the foundation. In this article, I am treating regulatory change at a high-level. Breaking out the components of horizon scanning, to red-lining, to policy and control changes, and more, can be an article in itself. Concepts of these are portrayed below, but I am not breaking out all of the components in this article.
The Baseline Is Not Regulation; the Baseline Is Change
Organizations often talk about the “regulatory burden” as though regulation were a large but relatively static pile of documents sitting in the corner of the compliance department. In reality, the challenge is not simply the amount of regulation. It is the continuous movement of laws, rules, guidance, supervisory expectations, enforcement actions and priorities, reporting requirements, standards, interpretations, court decisions, and industry practices across jurisdictions.
The regulatory environment is a moving landscape, not a filing cabinet.
New regulation creates change, but so does . . .
- The revision of an existing rule.
- A regulator’s speech can alter supervisory expectations without changing a single line of formal regulation.
- An enforcement action can redefine how an organization understands an obligation.
- A reporting taxonomy can be updated.
- A regulator can change its examination priorities.
- A court can narrow or expand how a requirement applies.
- A jurisdiction can adopt a different implementation timetable.
- A regulator may withdraw guidance but replace it with a broader expectation of judgment and accountability.
- New technology, such as AI, requires interpretation of existing regulation and legislation in this new context.
- And . . . deregulation is still regulatory change . . .
When a rule is removed, simplified, delayed, reinterpreted, or replaced, the organization still has to determine what changed, where it applies, what controls can be adjusted, whether policies should be revised, what evidence must be retained, and whether relaxing one requirement creates exposure somewhere else. Removing a rule does not magically update policies, controls, systems, products, contracts, training, reporting processes, and data models across the enterprise.
This is not theoretical. In 2026, U.S. authorities have continued reviewing and modernizing regulatory frameworks, including initiatives specifically intended to streamline regulatory processes and reduce fragmented requirements. Meanwhile, the European Commission has acknowledged that the volume and complexity of supervisory data requirements have grown substantially and that existing approaches can create significant inefficiencies.
The wind may change direction, but the crew still has to reset the sails.
Organizations therefore need regulatory change management to address the full lifecycle of change:
- What changed?
- Does it apply to us?
- Why does it matter?
- What parts of the organization are affected?
- What must be changed internally?
- Who owns the response?
- When must it be completed?
- How do we know the change was implemented correctly?
- What evidence demonstrates that conclusion?
- How do we monitor whether the response remains effective?
The business does not comply with a regulatory alert. It complies through the coordinated adaptation of policies, procedures, controls, products, services, technology, data, training, contracts, third-party relationships, reporting, and human behavior.
That is where the real work begins.
How Regulatory Change Solutions Have Evolved
The first generation of regulatory change technology was primarily about content. Solutions collected regulatory publications, legal updates, notices, enforcement actions, and related materials into searchable repositories. This was useful because organizations no longer had to visit hundreds of regulatory websites, subscribe to countless newsletters, or rely entirely on individuals remembering which sources to check.
However, aggregating more content did not necessarily create more intelligence. In some organizations, it merely replaced an overflowing email inbox with an overflowing regulatory portal.
The next generation added filtering, categorization, workflow, and collaboration. Organizations could identify jurisdictions, topics, regulators, business areas, and types of change that were potentially relevant. Updates could be assigned for review, decisions could be documented, tasks could be created, and deadlines could be tracked. This moved regulatory change management beyond information retrieval and into managed process.
The market then evolved toward regulatory intelligence and obligation management. More advanced solutions began to normalize regulatory content, identify obligations, compare versions, classify requirements, suggest applicability, and map change to internal policies, risks, controls, processes, products, services, legal entities, jurisdictions, systems, data, and third parties.
This was a significant architectural advance. The technology was no longer simply telling the organization that a regulator had published something. It was helping the organization understand the relationship between external regulatory change and its internal business environment.
Natural-language processing, machine learning, knowledge graphs, taxonomies, ontologies, and now generative and agentic AI are accelerating this evolution. Modern solutions can assist with summarization, relevance scoring, version comparison, obligation extraction, impact analysis, routing, gap identification, drafting, and evidence collection. But the destination should not be an impressive demonstration in which AI summarizes a 300-page rule in six seconds.
The destination is faster, more consistent, and more defensible organizational adaptation.
Regulators themselves have been exploring machine-readable and machine-executable regulation and reporting for years. The FCA and Bank of England demonstrated that regulatory requirements could be translated into machine-understandable formats, mapped to organizational data, and potentially executed through more automated reporting processes. The European Banking Authority’s Data Point Model similarly provides a structured, machine-readable representation of reporting concepts, relationships, definitions, and validation rules.
These developments point toward a future in which regulatory content is increasingly structured and digital/computable. But even in that future, organizations will still require governance, interpretation, accountability, judgment, and assurance. A machine may identify a potential obligation, but the organization remains accountable for deciding how that obligation applies and demonstrating that its response is appropriate.
Technology can accelerate the journey. It cannot inherit accountability for the destination.
Regulatory Change Management Within the GRC Architecture
Regulatory change management should not operate as an isolated RegTech island. It is part of a broader GRC architecture and ecosystem connecting external change to internal governance, risk management, compliance, and assurance.
In the evolution of GRC, the System of Record remains essential and foundational. It provides the authoritative inventory of regulations, obligations, interpretations, applicability decisions, mappings, policies, risks, controls, issues, actions, evidence, and accountability. Without this foundation, regulatory change management becomes a collection of alerts and tasks with no durable institutional memory.
However, the System of Record is no longer enough.
GRC 7.0 – GRC Orchestrate introduces the System of Orchestration across and above the System of Record. Regulatory change management is one of the clearest examples of why this orchestration is needed. External change has to be sensed, interpreted, connected, routed, acted upon, validated, and continuously monitored across the enterprise.
Within this architecture:
- The System of Intelligence monitors regulatory sources, filters noise, identifies relevance, compares versions, extracts obligations, analyzes impact, detects patterns, assesses exposure, and supports interpretation and decision-making.
- The System of Action routes assessments, assigns accountability, initiates policy and control changes, coordinates implementation, triggers training, gathers evidence, manages exceptions, and escalates delays or conflicts.
- The System of Configuration enables the organization to adapt taxonomies, workflows, rules, models, mappings, reports, applications, and agents as its business, regulatory environment, and operating model change.
- The Digital Twin of the organization allows the organization to model the impact of regulatory change on the business and its processes, services, policies, controls, and accountability and reporting structures. Or it can model if the organization goes into a new regulatory geography or goes into a new line of service or product offering what to expect.
This architecture connects regulatory change management with policy management, compliance obligations, enterprise and operational risk, internal controls, product governance, third-party risk, information security, privacy, quality, environmental health and safety, training, issues, investigations, audit, assurance, and operational resilience.
That integration matters because regulatory change rarely affects only one compliance team. A new requirement may affect a product design, customer disclosure, data field, third-party contract, reporting process, control, system configuration, training curriculum, and audit procedure simultaneously.
Organizations do not drown in regulations; they drown in disconnected handoffs.
A regulatory change solution creates limited value if it identifies an applicable requirement but cannot connect that requirement to the business processes and controls that must change. It creates limited value if it assigns tasks but cannot demonstrate whether implementation reduced exposure. It creates limited value if it stores decisions but cannot show an auditor or regulator how the organization moved from external source to internal obligation, from obligation to action, and from action to verified outcome.
The mature architecture closes that loop . . .
The Value Model: Efficiency, Effectiveness, Resilience, and Agility
The business case becomes more credible when regulatory change management is evaluated across the four dimensions of GRC value defined by GRC 20/20 Research, not just ROI (efficiency). And I agree that every one of these four dimensions can be quantified and not just qualified. And I have done a lot of work in building business cases and value measurement in a quantified context.
1. Efficiency: Using Time, Money, and Expertise Better
Efficiency is the traditional ROI discussion. It is also the easiest dimension to quantify.
Regulatory change processes often involve significant amounts of repetitive manual work: checking sources, downloading publications, reading lengthy documents, copying information into spreadsheets, forwarding emails, holding applicability meetings, reconciling duplicate interpretations, chasing owners, updating trackers, preparing status reports, and reconstructing evidence for audit or regulatory examination.
Technology can reduce this administrative burden through source aggregation, automated collection, filtering, deduplication, summarization, classification, routing, workflow, reminders, dashboards, and reusable mappings. If effective (the next area of value) can reduce the number of irrelevant updates analysts review, shorten triage time, eliminate duplicate assessments, and reduce the effort required to prepare management and regulatory reports. However, the organization can make bad processes more efficient . . . they are still bad processes.
Useful efficiency measures include:
- Hours spent monitoring regulatory sources
- Cost per regulatory update reviewed
- Percentage of updates determined to be irrelevant
- Time from publication to initial triage
- Time from triage to applicability decision
- Number of duplicate reviews across functions or jurisdictions
- External legal and consulting spend
- Administrative time spent chasing actions
- Time required to prepare regulatory, audit, and board reporting
- Number of spreadsheets, email folders, and disconnected repositories retired
- Capacity created for higher-value analysis
However, organizations should be careful when converting every saved hour into a hard-dollar financial return. If a compliance analyst saves 500 hours, the organization does not automatically receive a check for 500 hours of salary. The credible value may be capacity: the ability to absorb more change without adding headcount, reduce dependence on contractors, improve analytical depth, or redirect skilled professionals from administrative mechanics to interpretation and engagement with the business.
The best efficiency story is not that the organization needs fewer intelligent people. It is that intelligent people spend less time doing work that machines can perform and more time exercising the judgment for which they were hired.
2. Effectiveness: Reducing Compliance Exposure
A process can become faster without becoming better, it needs to be more effective in reducing regulatory risk exposure.
That is why effectiveness must be measured separately from efficiency. A system that processes regulatory updates quickly but overlooks relevant changes, applies inconsistent interpretations, or fails to verify implementation has simply industrialized weakness.
Effectiveness asks whether the regulatory change management capability improves outcomes:
- Are relevant changes identified more consistently?
- Are applicability decisions more accurate?
- Are interpretations aligned across jurisdictions and business units?
- Are obligations mapped to the correct policies, risks, controls, processes, products, systems, data, and third parties?
- Are accountable owners identified earlier?
- Are implementation deadlines met?
- Are control gaps discovered before they become findings or violations?
- Can the organization demonstrate a clear and defensible decision trail?
- Are regulatory changes reflected in actual business behavior rather than merely marked complete in a workflow?
The value here includes reduced compliance/regulatory risk exposure, fewer missed obligations, fewer late implementations, fewer repeat findings, less remediation, stronger evidence, and more consistent interpretation.
One of the most important effectiveness measures is time at risk: the period between when a regulatory change becomes relevant and when the required internal response is fully implemented and verified. Every unnecessary day in that interval represents potential exposure.
Organizations should also measure the completeness and quality of their impact analysis. A requirement may be mapped to a policy but not to the system that executes the policy. It may be mapped to a control but not to the third party performing the control. It may be assigned to a business owner but never incorporated into training or testing. A shallow mapping can create a comforting green status while leaving the underlying exposure untouched.
Regulators are rarely impressed by a beautifully completed workflow when the business did not actually change.
Effectiveness therefore means measuring outcomes, not merely activity. The objective is not to prove that the regulatory change process was followed. The objective is to demonstrate that the organization understood the change, responded appropriately, and reduced the risk of noncompliance, customer harm, operational failure, or regulatory intervention.
3. Resilience: Absorbing Regulatory Shock Without Losing Control
Regulatory resilience is the ability to anticipate, absorb, adapt to, and recover from regulatory change without allowing the organization to fall into confusion, uncontrolled exposure, or operational disruption.
No organization can perfectly predict every regulatory development . . .
- Rules will be issued unexpectedly.
- Implementation dates will move.
- Courts will intervene.
- Regulators will change supervisory priorities.
- Political transitions will alter policy direction.
- Requirements will conflict across jurisdictions.
- New technologies and business models will create questions that existing regulation was never designed to answer.
A resilient regulatory change capability does not depend on everything happening according to plan. It is designed for motion.
Resilience value comes from earlier detection, stronger institutional memory, clearer ownership, better dependency mapping, more consistent escalation, and the ability to reprioritize when several material changes arrive at once. It reduces reliance on a few individuals who hold the regulatory map in their heads and whose absence can leave the organization navigating by folklore.
This is particularly important during deregulation. Organizations can create new exposure by removing controls too quickly, interpreting regulatory relief too broadly, or allowing different business units to respond inconsistently. A requirement may disappear while a related contractual commitment, consumer expectation, state requirement, industry standard, or risk appetite constraint remains in place.
Resilience asks whether the organization can model these dependencies before pulling regulatory bricks from the wall.
Useful measures include the time required to identify critical change, the number of overdue high-impact actions, concentration of regulatory knowledge in key individuals, percentage of critical obligations linked to controls and evidence, ability to reconstruct historical decisions, and the organization’s capacity to manage simultaneous changes without losing oversight.
It can also be quantified through avoided remediation, reduced emergency consulting spend, lower reliance on manual workarounds, fewer implementation crises, and reduced disruption to products, customers, and operations.
A lighthouse is not valuable because it makes the storm disappear. It is valuable because the storm does not remove the organization’s ability to navigate.
4. Agility: Turning Regulatory Intelligence Into Business Advantage
Agility is the dimension most often missed in the regulatory change business case.
Compliance has traditionally been portrayed as the department that says “no,” slows the business down, or arrives near the end of a strategic initiative carrying a list of reasons it cannot proceed. Mature regulatory change management should do the opposite. It should help the organization understand the boundaries of action early enough to make better decisions.
Regulatory intelligence can shape product strategy, market entry, mergers and acquisitions, geographic expansion, customer experience, technology investment, third-party relationships, data architecture, and operating-model decisions. When the organization understands emerging requirements earlier, it can incorporate them into strategy and design rather than bolting them on after decisions have already been made.
This reduces costly rework and creates the confidence to move.
Agility can mean launching a compliant product sooner, entering a new jurisdiction with greater certainty, adapting a business model before competitors, identifying regulatory relief that makes an initiative viable, or building requirements into a technology development sprint rather than discovering them weeks before launch. You empower this with a digital twin of the organization and you enable the organization to leverage compliance agility as a competitive advantage.
The value can be measured through:
- Reduced delays to product and market launches
- Faster decisions on geographic expansion
- Less redesign caused by late regulatory discovery
- Earlier identification of regulatory barriers or opportunities
- Improved ability to model the impact of proposed rules
- Faster adaptation of policies, controls, products, and systems
- Increased business confidence in regulated decisions
- Revenue protected or accelerated through timely compliance readiness
This is where regulatory change management stops being a compliance cost center and becomes a business navigation capability.
The organization with better regulatory intelligence is not necessarily the organization that takes less risk. It is the organization that understands the terrain well enough to take the right risk, at the right time, with the right controls and evidence.
What a Credible Regulatory Change Business Case Looks Like
A credible business case does not begin with the technology demonstration. It begins with an honest baseline of the current operating environment.
Organizations need to understand how many regulatory sources they monitor, across how many jurisdictions/regulators, how many updates they receive, how many prove relevant, how long triage and assessment take, how many people participate, how much duplicate work occurs, how frequently deadlines are missed, how many findings trace back to regulatory change failures, and how much outside counsel or consulting support is required.
From there, the business case can quantify several layers of value . . .
- Direct cost value includes reduced external spend, retired systems, reduced contractor dependence, and avoided headcount growth.
- Capacity value measures the hours returned to legal, compliance, risk, operations, and business teams and how that capacity will be redeployed.
- Exposure value evaluates reductions in the probability and impact of missed obligations, delayed implementation, ineffective controls, regulatory findings, remediation, litigation, customer harm, product restrictions, and market-access issues.
- Resilience value captures improved preparedness, reduced implementation crises, better continuity of regulatory knowledge, and faster response to unexpected change.
- Agility value connects regulatory intelligence to faster product decisions, reduced launch delays, market entry, strategy execution, and competitive positioning.
Avoided-loss calculations should be conservative and transparent. A business case should not assume that purchasing a regulatory change platform eliminates the largest theoretical fine in every jurisdiction. It should identify realistic scenarios, estimate current exposure, document assumptions, and show how the solution and associated operating-model changes reduce either the probability or impact of those scenarios.
Technology alone does not produce the value. Value comes from the combination of technology, process, information, accountability, skills, governance, and organizational adoption.
That is what makes the business case defensible.
The End Game Is Business Confidence through Regulatory Confidence
The goal of regulatory change management is not to read more regulations. It is not to generate more alerts, populate more dashboards, or move tasks through workflow faster. It is not even to achieve the illusion that every regulatory uncertainty can be eliminated.
The goal is business confidence empowered by regulatory confidence
That means confidence that the organization can see meaningful change early enough to respond. Confidence that it can distinguish signal from noise. Confidence that interpretations are consistent and defensible. Confidence that obligations are connected to the parts of the business they affect. Confidence that accountable owners understand what must change. Confidence that implementation is complete, verified, and supported by evidence. Confidence that the organization can adapt without losing control.
Most importantly, it means confidence that regulatory change will inform strategy and decisions rather than merely interrupt them.
The value of regulatory change management cannot be measured solely by how much faster an analyst reads a regulatory notice. It must be measured by how effectively the organization converts external change into internal understanding, coordinated action, verified outcomes, and better business decisions . . .
- Efficiency gives the organization capacity.
- Effectiveness reduces regulatory/compliance risk exposure.
- Resilience preserves control through disruption.
- Agility enables the business to move with speed and confidence.
That is the fuller value of regulatory change management, and it is the business case the RegTech market needs to learn how to articulate.