# AI Regulatory Applicability Matrix and Compliance Calendar

The base layer for tracking what applies to you: an applicability matrix of systems against jurisdictions and regulations, a deadline calendar, and a monitoring subscription list so a new rule does not arrive as a surprise.

**Who this is for:** The compliance owner building the first structured view of the organization's AI regulatory exposure.

Source playbook: https://aigovernance.com/playbook/regulatory-obligations-for-ai

---

## Regulatory applicability matrix

_AI systems down one axis, regulations across the other, with the applicability trigger and current status in each cell._

### Template

| System | Jurisdiction(s) | Regulation | Applicability trigger | Applies? | Key obligations | Status |
|---|---|---|---|---|---|---|
| <system> | | | <what makes it in scope> | Yes / No / Monitoring | | Not started / In progress / Compliant |

### Worked example

| System | Jurisdiction(s) | Regulation | Applicability trigger | Applies? | Key obligations | Status |
|---|---|---|---|---|---|---|
| Resume Screener | EU | EU AI Act (high-risk) | Annex III employment use; affects EU applicants | Yes | risk mgmt, tech docs, human oversight, FRIA, registration | In progress |
| Resume Screener | US-NYC | Local Law 144 | automated employment decision tool used on NYC candidates | Yes | annual bias audit; candidate notice | Compliant |
| Support Copilot | EU | EU AI Act (limited risk) | AI interacting with people | Yes | transparency: users told they interact with AI | Compliant |
| Fraud Scoring | US | state UDAP + fair lending analogues | consumer impact | Monitoring | disparate impact review | In progress |

### Acceptance criteria

- Every AI system is assessed against every regulation that could apply, with the trigger written down.
- "No" and "Monitoring" verdicts have a one-line reason, not just a blank.
- Each applicable cell links to where the obligation detail and evidence live.

---

## Compliance calendar

_Deadlines by jurisdiction and system, so the next obligation is always visible._

### Template

| Date | Jurisdiction | Regulation | Obligation | Systems affected | Owner | Status |
|---|---|---|---|---|---|---|
| YYYY-MM-DD | | | | | | on track / at risk / done |

### Worked example

| Date | Jurisdiction | Regulation | Obligation | Systems affected | Owner | Status |
|---|---|---|---|---|---|---|
| 2026-12-31 | US-NYC | LL144 | annual bias audit published | Resume Screener | People Ops | on track |
| 2027-12-02 | EU | EU AI Act | stand-alone Annex III high-risk obligations apply | Resume Screener | Compliance | at risk (FRIA pending) |
| 2028-08-02 | EU | EU AI Act | product-embedded high-risk obligations apply | (none currently) | Compliance | monitoring |

### Acceptance criteria

- Every applicable obligation with a date is on the calendar.
- Each entry has an owner and a status that is reviewed on a set cadence.
- Dates are kept current as deadlines shift (the EU AI Act high-risk dates moved once already).

---

## Regulatory monitoring subscription list

_The feeds that would tell you about a new or changed obligation, with an owner per source._

### Template

| Source | Type | What it covers | Check cadence | Owner |
|---|---|---|---|---|
| <agency feed / newsletter / registry> | official / secondary | | daily / weekly / monthly | <name> |

### Worked example

| Source | Type | Covers | Cadence | Owner |
|---|---|---|---|---|
| EUR-Lex + EU AI Office updates | official | EU AI Act delegated acts, guidance | weekly | EU Compliance |
| US state legislature trackers | secondary | state AI bills (CO, CA, TX, ...) | weekly | US Compliance |
| Sector regulator bulletins (banking, health) | official | supervisory guidance on AI | weekly | Sector leads |
| National standards bodies | official | ISO/IEC and national AI standards | monthly | AI Gov Lead |

### Acceptance criteria

- Every jurisdiction where the organization operates has at least one monitored source.
- Each source has an owner and a check cadence.
- A relevant finding from monitoring opens a calendar entry and, if needed, a review task.

---

## Governance controls this kit produces evidence for

- **CMP-001**: The applicability matrix is the multi-jurisdiction regulatory compliance mapping.
- **CMP-004**: The matrix and calendar together track non-legislative and soft-law obligations alongside binding ones.
- **CMP-002**: The monitoring subscription list is the international standards and regulatory monitoring workflow.
- **HOC-001**: Applicability assessment depends on a per-system risk classification.
- **CMP-007**: Rows flagging EU AI Act high-risk status feed the conformity assessment process.