---
# === IDENTITY ===
id: consulting/recipes/regulatory-landscape-audit/2026
canonical_question: "How do you audit regulatory landscapes across geographies with severity and triage scoring?"
aliases:
  - "Regulatory landscape scan across jurisdictions"
  - "How to map regulations by severity and enforcement timeline"
  - "Multi-jurisdiction regulatory inventory and chaos gradient mapping"
entity_type: execution_recipe
domain: consulting > recipes > Regulatory Landscape Audit
region: global
jurisdiction: global
temporal_scope: 2026-2027

# === VERIFICATION ===
last_verified: 2026-03-30
confidence: 0.85
version: 1.0
first_published: 2026-03-30

# === TEMPORAL VALIDITY ===
temporal_validity:
  status: volatile
  last_breaking_change: "Initial release — regulatory landscape methodology v1.0"
  next_review: 2026-09-26
  change_sensitivity: high

# === CONSTRAINTS ===
constraints:
  - "Client must provide complete jurisdiction inventory before audit begins — auditing unknown markets wastes budget"
  - "Regulatory data has a half-life — severity scores expire within 6 months as enforcement priorities shift"
  - "Delegated acts and implementing regulations change faster than primary legislation — track separately"
  - "Enforcement prediction accuracy degrades beyond 18-month horizon — flag long-range predictions as speculative"
  - "Chaos gradient calculations require minimum 3 data points per regulatory domain per jurisdiction"

# === SKIP CONDITIONS ===
skip_this_unit_if:
  - condition: "User needs the full compliance moat engagement, not just the audit"
    use_instead: "consulting/recipes/compliance-moat-engagement-playbook/2026"
  - condition: "User needs competitor analysis, not regulatory mapping"
    use_instead: "consulting/recipes/competitor-compliance-benchmarking/2026"
  - condition: "User needs a single-jurisdiction deep dive, not multi-jurisdiction scan"
    use_instead: "Search knowledgelib.io for the specific jurisdiction's compliance rule card"

# === AGENT HINTS ===
inputs_needed:
  - key: jurisdiction_count
    question: "How many jurisdictions need to be audited?"
    type: choice
    options: ["1-3 jurisdictions", "4-10 jurisdictions", "10-25 jurisdictions", "25+ jurisdictions (global)"]
  - key: regulatory_domains
    question: "Which regulatory domains should be covered?"
    type: choice
    options: ["data privacy only", "environmental/sustainability only", "financial compliance only", "all applicable domains", "specific domains (specify)"]
  - key: depth
    question: "What depth of analysis is needed?"
    type: choice
    options: ["inventory only (list regulations)", "severity scored (with triage)", "full chaos gradient mapping", "full with enforcement timeline prediction"]

# === EXECUTION METADATA ===
execution:
  required_inputs:
    - name: "Jurisdiction inventory"
      source: "client/legal-or-compliance"
      format: "spreadsheet"
    - name: "Industry classification"
      source: "client/strategy"
      format: "text"
    - name: "Current compliance certifications"
      source: "client/compliance-department"
      format: "document"

  outputs:
    - name: "Regulatory Landscape Map"
      format: "spreadsheet + visual heatmap"
      description: "Complete inventory of applicable regulations per jurisdiction with severity scores, enforcement timelines, and chaos gradients"
    - name: "Severity Triage Matrix"
      format: "structured JSON + PDF"
      description: "Regulations ranked by severity tier: market exclusion, operational restriction, fine-based, reputational"
    - name: "Chaos Gradient Report"
      format: "PDF"
      description: "Rate-of-change analysis per regulatory domain showing which areas are moving fastest and where pre-positioning opportunities exist"

  tools_required:
    - name: "Regulatory Intelligence Database"
      purpose: "Track regulatory changes and enforcement actions across jurisdictions"
      tier: "paid"
      cost: "$1K-$3K/engagement"
      alternatives: ["EUR-Lex (EU, free)", "Federal Register (US, free)", "Manual legal research"]
    - name: "Spreadsheet Tool"
      purpose: "Regulatory inventory and scoring matrices"
      tier: "free"
      cost: "$0"
      alternatives: ["Google Sheets", "Excel", "Airtable"]

  credentials_needed:
    - service: "Thomson Reuters Regulatory Intelligence"
      type: "Subscription access"
      where_to_get: "https://www.thomsonreuters.com/en/products-services/risk-fraud-and-compliance.html"
      free_tier_limits: "N/A — use free alternatives (EUR-Lex, Federal Register) for budget engagements"

  estimated_duration: "5-7 days"
  estimated_cost: "$3K-$12K depending on jurisdiction count and depth"

# === DISTRIBUTION ===
canonical_source: "https://knowledgelib.io/consulting/recipes/regulatory-landscape-audit/2026"
suggested_citation: "Source: knowledgelib.io — AI Knowledge Library (verified 2026-03-30)"

# === RELATED UNITS ===
related_kos:
  depends_on: []
  feeds_into:
    - id: "consulting/recipes/compliance-moat-engagement-playbook/2026"
      label: "Master engagement playbook that consumes this audit"
    - id: "consulting/recipes/competitor-compliance-benchmarking/2026"
      label: "Competitor benchmarking uses regulatory map as baseline"
    - id: "consulting/recipes/compliance-moat-scorecard-generation/2026"
      label: "Scorecard uses severity rankings for moat valuation"
  related_to:
    - id: "consulting/recipes/constraint-weaponization-workshop/2026"
      label: "Workshop uses hardest constraints identified here"

# === SOURCES ===
sources:
  - id: src1
    title: "FinTech, RegTech, and the Reconceptualization of Financial Regulation"
    author: Arner, D.W. et al.
    url: https://doi.org/10.1093/jiel/jgx036
    type: academic_paper
    published: 2017-10-01
    reliability: authoritative
  - id: src2
    title: "Corporate Sustainability Reporting Directive (CSRD)"
    author: European Commission
    url: https://finance.ec.europa.eu/capital-markets-union-and-financial-markets/company-reporting-and-auditing/company-reporting/corporate-sustainability-reporting_en
    type: official_docs
    published: 2023-01-01
    reliability: authoritative
  - id: src3
    title: "The Brussels Effect: How the European Union Rules the World"
    author: Bradford, A.
    url: https://doi.org/10.1093/oso/9780190088583.001.0001
    type: academic_paper
    published: 2020-01-14
    reliability: authoritative
  - id: src4
    title: "Toward a New Conception of the Environment-Competitiveness Relationship"
    author: Porter, M.E. & van der Linde, C.
    url: https://www.jstor.org/stable/2138392
    type: academic_paper
    published: 1995-09-01
    reliability: authoritative
  - id: src5
    title: "EU AI Act — Regulation (EU) 2024/1689"
    author: European Parliament
    url: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
    type: official_docs
    published: 2024-07-12
    reliability: authoritative
---

# Regulatory Landscape Audit

## Purpose

This recipe produces a comprehensive regulatory landscape map covering all applicable regulations across the client's jurisdictions, scored by severity tier, enforcement timeline, and rate of change. The output includes a severity triage matrix that ranks regulations by competitive impact (market exclusion vs. fine-based vs. reputational), chaos gradient calculations showing which regulatory domains are evolving fastest, and pre-positioning opportunity flags for regulations still in draft or delegated-act stage. [src1, src3]

## Prerequisites
<!-- Agents: verify ALL prerequisites before executing. Missing prerequisites = failed execution. -->

- [ ] **Jurisdiction inventory** — complete list of countries/regions where client operates or plans to enter
- [ ] **Industry classification** — client's primary and secondary industry codes (NAICS, SIC, or NACE)
- [ ] **Current compliance certifications** — list of existing certifications (ISO 27001, SOC 2, GDPR compliance, etc.)
- [ ] **Product/service description** — sufficient to determine which regulations apply (data processing, manufacturing, financial services, etc.)

## Constraints
<!-- Hard rules. Agents: enforce throughout execution. Violating these = broken output or legal risk. -->

- Jurisdiction inventory must be complete before starting — auditing unknown markets wastes budget and produces incomplete maps. [src3]
- Severity scores have a 6-month half-life — regulatory priorities shift with enforcement actions, court rulings, and political changes. Date-stamp all scores. [src1]
- Delegated acts and implementing regulations must be tracked separately from primary legislation — they change faster and create the real compliance burden. [src2]
- Enforcement predictions beyond 18 months are speculative — flag with uncertainty ranges.
- Chaos gradient requires minimum 3 historical data points per domain per jurisdiction — fewer produces unreliable slopes.

## Tool Selection Decision

```
Which path?
├── Budget allows regulatory intelligence platform
│   └── PATH A: Platform-Assisted — Thomson Reuters/LexisNexis + manual analysis
├── Budget is limited, few jurisdictions
│   └── PATH B: Manual Research — EUR-Lex, Federal Register, manual legal research
├── Client has in-house legal team available
│   └── PATH C: Collaborative — consultant framework + client legal execution
└── AI-augmented approach
    └── PATH D: AI + Manual Validation — LLM research + expert validation layer
```

| Path | Tools | Cost | Speed | Output Quality |
|------|-------|------|-------|---------------|
| A: Platform-Assisted | Thomson Reuters, LexisNexis | $3K-$5K | 5-6 days | Excellent — comprehensive, validated |
| B: Manual Research | EUR-Lex, Federal Register, gov sites | $0-$500 | 7-10 days | Good — thorough but slower |
| C: Collaborative | Consultant framework + client legal | $1K-$2K | 5-7 days | Good — leverages client expertise |
| D: AI + Manual | LLM research + expert validation | $500-$1K | 4-6 days | Good — fast but requires validation |

## Execution Flow

### Step 1: Jurisdiction and Domain Mapping

**Duration**: 1 day
**Tool**: Spreadsheet + client intake data

Build the regulatory audit matrix: rows = jurisdictions, columns = regulatory domains. Populate the matrix header with all jurisdiction-domain combinations that need analysis.

Regulatory domains to assess per jurisdiction:
- Data privacy and protection (GDPR, CCPA, LGPD, PIPA, etc.)
- AI and algorithmic regulation (EU AI Act, state-level AI bills, etc.)
- Environmental and sustainability (CSRD, CBAM, ESPR, etc.)
- Financial compliance (SOX, Basel III, MiFID II, etc.)
- Industry-specific (HIPAA, FDA, FCC, etc.)
- Consumer protection (product safety, advertising standards)
- Employment and labor (FLSA, Works Council requirements, etc.)

**Verify**: Matrix covers all jurisdiction-domain combinations. No jurisdictions missing from client inventory.
**If failed**: Cross-reference with client's entity structure and subsidiary registrations to catch missing jurisdictions.

### Step 2: Regulation Inventory

**Duration**: 2-3 days
**Tool**: Regulatory intelligence platform or manual research

For each cell in the jurisdiction-domain matrix, identify all applicable regulations. Record for each regulation:
- Full name and citation
- Effective date (or expected effective date if not yet in force)
- Applicability criteria (revenue thresholds, employee counts, data processing volumes)
- Current enforcement status (active, phased-in, announced, draft)
- Key obligations (what must the company do)
- Penalty structure (fines, market exclusion, criminal liability)

**Verify**: Each jurisdiction-domain cell populated with at least primary regulations. No obvious gaps (e.g., EU jurisdiction missing GDPR).
**If failed**: If regulation database incomplete for specific jurisdictions, engage local legal counsel or use client's existing legal advisors.

### Step 3: Severity Tier Scoring

**Duration**: 1-2 days
**Tool**: Scoring framework + spreadsheet

Score each regulation on the severity triage matrix using four tiers:

- **Tier 1 — Market Exclusion**: Non-compliance means product cannot be sold in the market (e.g., EU ESPR product bans, CE marking requirements). Score: 10.
- **Tier 2 — Operational Restriction**: Non-compliance restricts specific business activities (e.g., data transfer bans under GDPR, license revocation). Score: 8.
- **Tier 3 — Financial Penalty**: Non-compliance results in fines proportional to revenue (e.g., GDPR 4% of global turnover, AI Act 7% of global turnover). Score: 6.
- **Tier 4 — Reputational/Administrative**: Non-compliance results in administrative orders, public disclosure, or reputational damage. Score: 3. [src2, src5]

Apply a multiplier for enforcement probability based on recent enforcement actions in the jurisdiction (active enforcement = 1.5x, moderate = 1.0x, low = 0.5x).

**Verify**: All regulations scored. No Tier 1 regulations missed — these are existential threats.
**If failed**: If enforcement data unavailable, default to 1.0x multiplier and flag as requiring local legal input.

### Step 4: Enforcement Timeline Prediction

**Duration**: 1 day
**Tool**: Regulatory intelligence platform + legal analysis

For each regulation not yet fully in force, predict enforcement timeline using triage logic:

- Legislation passed + implementing rules published --> enforcement within 6-12 months
- Legislation passed + delegated acts in draft --> enforcement within 12-24 months
- Legislation proposed + political consensus --> enforcement within 24-36 months
- Legislation proposed + political opposition --> enforcement uncertain, flag as speculative [src1]

Mark each regulation with enforcement confidence (high/medium/low) and earliest expected enforcement date.

**Verify**: All pending regulations have timeline predictions with confidence ratings.
**If failed**: For jurisdictions with opaque regulatory processes, use peer jurisdiction timelines as proxy (e.g., if EU has enacted, similar legislation likely within 2-3 years in aligned jurisdictions).

### Step 5: Chaos Gradient Mapping

**Duration**: 1 day
**Tool**: Spreadsheet + trend analysis

Calculate the chaos gradient for each regulatory domain per jurisdiction — the rate of regulatory change over the past 3 years:

- Count new regulations, amendments, enforcement actions, and guidance documents per domain per year
- Calculate the slope (accelerating, stable, or decelerating)
- Identify the steepest slopes — these are domains where regulatory requirements are changing fastest
- Flag domains with steepest positive slopes as pre-positioning opportunities [src3, src4]

The steepest slopes represent the highest compliance moat potential — competitors who are not already investing in these areas will face the highest catch-up costs.

**Verify**: Chaos gradients calculated for all domain-jurisdiction combinations with sufficient data (minimum 3 data points).
**If failed**: For domains with insufficient historical data, use qualitative assessment from regulatory experts and flag as estimated.

### Step 6: Pre-Positioning Opportunity Identification

**Duration**: 0.5-1 day
**Tool**: Analysis + report generation

Identify regulations still in draft or delegated-act stage where the client can influence outcomes or build compliance ahead of competitors:

- Regulations with open public comment periods
- Delegated acts still being drafted (opportunity to shape technical standards)
- Voluntary compliance programs that will likely become mandatory
- Industry standards that regulators are referencing (e.g., ISO standards becoming regulatory requirements) [src2]

For each opportunity, estimate the pre-positioning advantage: how many months head start does early compliance provide vs. waiting for final rules.

**Verify**: Pre-positioning opportunities identified with estimated advantage windows.
**If failed**: If no open comment periods or draft regulations found, focus on voluntary standards adoption as pre-positioning strategy.

## Output Schema

```json
{
  "output_type": "regulatory_landscape_map",
  "format": "spreadsheet + PDF + JSON",
  "sections": [
    {"name": "jurisdiction_domain_matrix", "type": "object", "description": "Complete matrix of jurisdictions x regulatory domains with regulation inventory", "required": true},
    {"name": "severity_triage_matrix", "type": "array", "description": "All regulations scored by severity tier with enforcement probability multiplier", "required": true},
    {"name": "enforcement_timeline", "type": "array", "description": "Pending regulations with predicted enforcement dates and confidence", "required": true},
    {"name": "chaos_gradients", "type": "object", "description": "Rate-of-change slopes per domain per jurisdiction", "required": true},
    {"name": "pre_positioning_opportunities", "type": "array", "description": "Draft regulations and voluntary standards with advantage windows", "required": true}
  ],
  "expected_sections": "5",
  "sort_order": "severity_score descending within severity_triage_matrix"
}
```

## Quality Benchmarks

| Quality Metric | Minimum Acceptable | Good | Excellent |
|---------------|-------------------|------|-----------|
| Jurisdiction coverage | > 80% of client markets | > 90% | 100% |
| Regulations identified per jurisdiction | > 5 primary regulations | > 10 | > 15 |
| Severity scoring completeness | > 80% of regulations scored | > 90% | 100% |
| Enforcement timeline predictions | > 60% with high/medium confidence | > 75% | > 90% |
| Chaos gradient data points | > 3 per domain | > 5 per domain | > 8 per domain |

**If below minimum**: Extend audit by 2-3 days, engage local legal counsel for sparse jurisdictions, or narrow domain scope to achieve depth.

## Error Handling

| Error | Likely Cause | Recovery Action |
|-------|-------------|----------------|
| Regulation database incomplete for jurisdiction | Emerging market with limited digital records | Engage local legal counsel, use bilateral treaty databases as proxy |
| Severity scoring inconsistent across jurisdictions | Different legal traditions (common law vs. civil law) | Apply normalization framework accounting for legal system differences |
| Enforcement data unavailable | Jurisdiction does not publish enforcement statistics | Use news reports and legal journal analysis as proxy data |
| Chaos gradient shows negative slope | Regulatory domain stabilizing or deregulating | Document as finding — stabilizing domains have lower moat potential but lower compliance risk |
| Too many Tier 1 regulations identified | Client operates in heavily regulated industry | Prioritize by enforcement probability and market size — not all Tier 1s have equal urgency |

## Cost Breakdown

| Component | Budget ($3K-$5K) | Standard ($5K-$8K) | Comprehensive ($8K-$12K) |
|-----------|-------------------|---------------------|--------------------------|
| Jurisdiction mapping | $500 | $500-$1K | $1K-$1.5K |
| Regulation inventory | $1K-$2K | $2K-$3K | $3K-$5K |
| Severity scoring | $500-$1K | $1K-$1.5K | $1.5K-$2K |
| Enforcement timeline | $500 | $500-$1K | $1K-$1.5K |
| Chaos gradient mapping | $500 | $500-$1K | $1K-$1.5K |
| Pre-positioning analysis | — | $500-$1K | $1K-$1.5K |
| **Total** | **$3K-$5K** | **$5K-$8K** | **$8K-$12K** |

## Anti-Patterns

### Wrong: Treating all regulations as equal severity
Listing regulations without severity scoring. Result: client cannot prioritize compliance investments and either over-invests in low-risk areas or under-invests in existential threats. [src4]

### Correct: Score every regulation on the severity triage matrix
Tier 1 (market exclusion) regulations demand immediate attention regardless of enforcement timeline. Tier 4 (reputational) regulations can be deprioritized if budget is constrained.

### Wrong: Static one-time audit with no change tracking
Delivering the regulatory map as a point-in-time snapshot without chaos gradients or review dates. Result: map becomes stale within months, client makes decisions based on outdated regulatory intelligence. [src1]

### Correct: Include chaos gradients and enforce review dates
Every regulatory map should include rate-of-change data and explicit expiration dates for severity scores. Recommend quarterly refresh cadence for volatile domains.

### Wrong: Ignoring delegated acts and implementing regulations
Focusing only on primary legislation (directives, acts) and missing the implementing rules that create the actual compliance burden. Result: client achieves formal compliance with the headline law but fails operational compliance with the technical standards. [src2]

### Correct: Track delegated acts separately with faster review cadence
Delegated acts change faster and often contain the specific technical requirements. Track them separately from primary legislation and review monthly during active rulemaking periods.

## When This Matters

Use when an agent needs to produce a comprehensive regulatory map across multiple jurisdictions with severity scoring and change-rate analysis. This is the foundation for all subsequent compliance moat calculations — without accurate regulatory mapping, competitor benchmarking and moat valuations are unreliable. Requires jurisdiction inventory from client as input.

## Related Units

- [Compliance Moat Engagement Playbook](/consulting/recipes/compliance-moat-engagement-playbook/2026)
- [Competitor Compliance Benchmarking](/consulting/recipes/competitor-compliance-benchmarking/2026)
- [Constraint Weaponization Workshop](/consulting/recipes/constraint-weaponization-workshop/2026)
- [Compliance Moat Scorecard Generation](/consulting/recipes/compliance-moat-scorecard-generation/2026)