# AI Regulatory Readiness Checklist and 12-Month Plan Getting ready for what lands in the next year: a 12-month calendar, a gap assessment against incoming obligations, a remediation roadmap with cost and dependencies, and a board briefing template. **Who this is for:** The compliance lead planning the next year of AI regulatory work and reporting it upward. Source playbook: https://aigovernance.com/playbook/prepare-for-ai-regulation --- ## 12-month AI regulatory calendar _Everything with a date in the next 12 months, by jurisdiction._ ### Template | Date | Jurisdiction | Obligation | Type | Systems affected | Readiness | Owner | |---|---|---|---|---|---|---| | YYYY-MM-DD | | | new rule / deadline / guidance / standard | | not started / in progress / ready | | ### Worked example | Date | Jurisdiction | Obligation | Type | Systems | Readiness | Owner | |---|---|---|---|---|---|---| | 2026-12-31 | US-NYC | LL144 annual bias audit | deadline | Resume Screener | ready | People Ops | | 2027-02-15 | EU | expected AI Office guidance on Art. 6(3) | guidance | Resume Screener | monitoring | EU Compliance | | 2027-06-30 | US-CA | ADMT rules compliance date | deadline | Fraud Scoring, Resume Screener | in progress | US Compliance | ### Acceptance criteria - The calendar covers a rolling 12 months and is refreshed monthly. - Each entry has a readiness state and an owner. - Expected (not yet final) guidance is included as "monitoring", with the trigger to firm it up. --- ## Compliance gap assessment _Each incoming obligation against current state and the action required to close it._ ### Template | Incoming obligation | Current state | Gap | Required action | Effort | Priority | |---|---|---|---|---|---| | | | | | S / M / L | H / M / L | ### Worked example | Incoming obligation | Current state | Gap | Required action | Effort | Priority | |---|---|---|---|---|---| | CA ADMT: pre-use risk assessment | risk assessments exist, not in the ADMT format | format + specific content | build an ADMT-format template; run for 2 systems | M | H | | CA ADMT: consumer opt-out for our customers | no opt-out tooling shipped | product feature | ship opt-out API + notice templates | L | H | | EU Art. 6(3) guidance (expected) | derogation not claimed | possibly none, depends on guidance | re-run classification when guidance lands | S | M | ### Acceptance criteria - Every calendar item with an obligation has a gap assessment row. - Effort and priority are assigned so the roadmap can be sequenced. - "No gap" conclusions are stated explicitly with reasoning. --- ## Remediation roadmap _The sequenced plan: action, owner, deadline, cost, and what it depends on._ ### Template | Action | Owner | Deadline | Cost estimate | Dependencies | Status | |---|---|---|---|---|---| | | | YYYY-MM-DD | | | not started / in progress / done / blocked | ### Worked example | Action | Owner | Deadline | Cost estimate | Dependencies | Status | |---|---|---|---|---|---| | Ship consumer opt-out API + notice templates | Product | 2027-04-30 | ~1.5 eng-months | design sign-off | in progress | | Build ADMT-format risk assessment template | Compliance | 2027-03-15 | ~0.5 FTE-month | legal review of format | not started | | FRIA for Resume Screener | Legal | 2026-10-31 | external counsel ~$15k | oversight design final | in progress | ### Acceptance criteria - Every gap has at least one roadmap action with an owner and a deadline. - Cost estimates and dependencies are recorded so trade-offs are visible. - Blocked items name the blocker and who owns clearing it. --- ## Board and executive regulatory briefing _A short, recurring briefing so leadership is not surprised by an AI regulatory obligation._ ### Template > One to two pages. Delivered on a set cadence to the board or a committee. - **What is coming in the next 12 months:** the 3-5 items that matter, in plain terms - **Where we stand:** ready / on track / at risk for each - **Investment required:** headcount, budget, product work, with the ask - **Key risks if we do nothing:** enforcement exposure, deal impact, reputational - **Decisions requested:** budget approval, prioritisation calls, risk acceptance - **What changed since last briefing** ### Worked example - **Coming:** CA ADMT rules (Jun 2027); EU AI Act high-risk applicability (Dec 2027); expected EU Art. 6(3) guidance. - **Where we stand:** ADMT at risk (product work not started); EU high-risk on track; guidance monitored. - **Investment:** ~2 eng-months for ADMT opt-out tooling; ~$25k external counsel for FRIA and format review. - **Risks if we do nothing:** ADMT non-compliance blocks CA enterprise renewals (~$1.2M ARR exposure); EU high-risk gap limits EU expansion. - **Decisions requested:** approve the ADMT product work for Q1; approve external counsel spend. - **Since last time:** CO SB205 amendment moved its date; reflected in the calendar. ### Acceptance criteria - The briefing is delivered on a set cadence, not only when something breaks. - It states a clear readiness status and a specific ask. - It ties regulatory gaps to business impact leadership cares about. --- ## Governance controls this kit produces evidence for - **CMP-002**: The calendar and its monthly refresh are the regulatory and standards monitoring workflow. - **MGV-003**: The remediation roadmap is a governance-program milestone plan with owners and dates. - **CMP-004**: The gap assessment captures soft-law and expected-guidance obligations alongside binding ones. - **HOC-007**: The board briefing template is board reporting on regulatory risk with decisions requested. - **BRD-005**: Readiness status across obligations is an input to the governance maturity assessment.