Reg Change

Explanation

Reg Change checks whether the bank reliably detects new or amended regulations relevant to an AI system and re-reviews the system against them in time, so controls do not silently drift out of compliance after a rule changes (for example a new RBI circular on automated lending or a privacy-law amendment). It matters because regulatory obligations evolve constantly, and an undetected change can leave a deployed model non-compliant for months. The metric and method are Regulatory Change Detection & Re-review — the control monitors regulatory sources, judges relevance, and routes affected systems back through assessment. To implement, instrument a horizon-scanning pipeline that ingests regulatory feeds and publications (using summarisation, RAG and document-extraction to filter for relevance), map each change to the AI systems and requirements it affects, open a tracked re-review task with an owner and due date, and log detection time, relevance decision, affected systems and closure — aligned to RBI legal/regulatory compliance, NIST GOVERN 1.1 and ISO Clause 4.2 on interested parties. The threshold is that 100% of relevant changes trigger a re-review within 30 days; missing that window is an immediate-priority breach that must be escalated and the overdue re-review expedited.