AI Regulatory Applicability Matrix and Compliance Calendar

The base layer for tracking what applies to you: an applicability matrix of systems against jurisdictions and regulations, a deadline calendar, and a monitoring subscription list so a new rule does not arrive as a surprise.

Who this is for: The compliance owner building the first structured view of the organization's AI regulatory exposure.

Download the kit (Markdown) ↓3 artifacts. Every table also copies as CSV.

1. Regulatory applicability matrix

Spreadsheet

AI systems down one axis, regulations across the other, with the applicability trigger and current status in each cell.

Template

System	Jurisdiction(s)	Regulation	Applicability trigger	Applies?	Key obligations	Status
<system>			<what makes it in scope>	Yes / No / Monitoring		Not started / In progress / Compliant

Worked example

System	Jurisdiction(s)	Regulation	Applicability trigger	Applies?	Key obligations	Status
Resume Screener	EU	EU AI Act (high-risk)	Annex III employment use; affects EU applicants	Yes	risk mgmt, tech docs, human oversight, FRIA, registration	In progress
Resume Screener	US-NYC	Local Law 144	automated employment decision tool used on NYC candidates	Yes	annual bias audit; candidate notice	Compliant
Support Copilot	EU	EU AI Act (limited risk)	AI interacting with people	Yes	transparency: users told they interact with AI	Compliant
Fraud Scoring	US	state UDAP + fair lending analogues	consumer impact	Monitoring	disparate impact review	In progress

Acceptance criteria

✓Every AI system is assessed against every regulation that could apply, with the trigger written down.
✓"No" and "Monitoring" verdicts have a one-line reason, not just a blank.
✓Each applicable cell links to where the obligation detail and evidence live.

2. Compliance calendar

Spreadsheet

Deadlines by jurisdiction and system, so the next obligation is always visible.

Template

Date	Jurisdiction	Regulation	Obligation	Systems affected	Owner	Status
YYYY-MM-DD						on track / at risk / done

Worked example

Date	Jurisdiction	Regulation	Obligation	Systems affected	Owner	Status
2026-12-31	US-NYC	LL144	annual bias audit published	Resume Screener	People Ops	on track
2027-12-02	EU	EU AI Act	stand-alone Annex III high-risk obligations apply	Resume Screener	Compliance	at risk (FRIA pending)
2028-08-02	EU	EU AI Act	product-embedded high-risk obligations apply	(none currently)	Compliance	monitoring

Acceptance criteria

✓Every applicable obligation with a date is on the calendar.
✓Each entry has an owner and a status that is reviewed on a set cadence.
✓Dates are kept current as deadlines shift (the EU AI Act high-risk dates moved once already).

3. Regulatory monitoring subscription list

Spreadsheet

The feeds that would tell you about a new or changed obligation, with an owner per source.

Template

Source	Type	What it covers	Check cadence	Owner
<agency feed / newsletter / registry>	official / secondary		daily / weekly / monthly	<name>

Worked example

Source	Type	Covers	Cadence	Owner
EUR-Lex + EU AI Office updates	official	EU AI Act delegated acts, guidance	weekly	EU Compliance
US state legislature trackers	secondary	state AI bills (CO, CA, TX, ...)	weekly	US Compliance
Sector regulator bulletins (banking, health)	official	supervisory guidance on AI	weekly	Sector leads
National standards bodies	official	ISO/IEC and national AI standards	monthly	AI Gov Lead

Acceptance criteria

✓Every jurisdiction where the organization operates has at least one monitored source.
✓Each source has an owner and a check cadence.
✓A relevant finding from monitoring opens a calendar entry and, if needed, a review task.

Governance controls this kit produces evidence for

Completing the artifacts above gives you a head start on the evidence requirements for these controls.

CMP-001

The applicability matrix is the multi-jurisdiction regulatory compliance mapping.

CMP-004

The matrix and calendar together track non-legislative and soft-law obligations alongside binding ones.

CMP-002

The monitoring subscription list is the international standards and regulatory monitoring workflow.

HOC-001

Applicability assessment depends on a per-system risk classification.

CMP-007

Rows flagging EU AI Act high-risk status feed the conformity assessment process.

This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.

Decide what to implement next

Assess your governance gaps, then create an action plan with owners and target dates. Build and export without an account; sign in when you want to save your plan.

Start the AI governance assessment →