A 23-person AI agency in Los Angeles operated across multiple jurisdictions — clients in the EU, the US, Canada, and Australia. In early 2025, they missed the deadline for a mandatory compliance requirement under the EU AI Act because nobody on the team was tracking the phased implementation timeline. The agency had deployed a hiring assistance tool for a European client that fell under the "high-risk" classification, and the transparency and documentation requirements that had gone into effect caught them flat-footed. The client faced a potential regulatory inquiry, held the agency responsible, and the emergency compliance remediation cost $165,000 in engineering time, legal fees, and documentation work. The agency also lost two prospective EU clients who asked about AI Act compliance during the sales process and were not satisfied with the answers.
AI regulation is not a single law you read once and comply with. It is a rapidly expanding, multi-jurisdictional, multi-layered regulatory landscape that changes quarterly. The EU AI Act has phased implementation through 2027. US states are enacting AI legislation independently — Colorado, California, Illinois, Connecticut, Texas, and others. Sector-specific regulations from the FDA, SEC, FINRA, and other bodies add another layer. International frameworks from Canada, Australia, the UK, Brazil, and others create additional obligations for agencies with global clients.
Without a systematic approach to tracking these regulations, compliance becomes a matter of luck — and luck runs out. A regulatory compliance tracker is the tool that turns the chaos of multi-jurisdictional AI regulation into a manageable, actionable system.
Why You Need a Compliance Tracker
The Volume of Regulation Is Overwhelming
As of early 2026, there are over 50 distinct AI-related regulations, guidelines, and frameworks across major jurisdictions. New proposals emerge monthly. Existing regulations are amended and clarified regularly. No individual can keep track of all of them through casual monitoring.
Regulations Have Different Timelines
The EU AI Act alone has provisions that take effect at different dates through 2027. US state laws have different effective dates. Sector-specific guidance has its own timeline. Tracking when specific requirements become enforceable is as important as understanding what those requirements are.
Your Obligations Depend on Your Context
Not every regulation applies to every AI product. Your obligations depend on the type of AI system, the jurisdiction where it is deployed, the sector it operates in, the data it processes, and who it affects. A compliance tracker maps your specific products and services to their specific regulatory obligations.
Clients Expect You to Know
Enterprise clients increasingly ask about regulatory compliance during the sales process. "How do you comply with the EU AI Act?" "What is your approach to Colorado's AI governance requirements?" "Are you prepared for the FDA's AI medical device framework?" If you cannot answer these questions confidently and specifically, you lose deals to agencies that can.
Designing Your Compliance Tracker
Component 1: Regulatory Inventory
The foundation of your compliance tracker is a comprehensive inventory of relevant AI regulations.
For each regulation, track:
- Regulation name and identifier — Official name, bill number, or regulation identifier
- Jurisdiction — Geographic scope (EU, specific US state, federal, country)
- Regulatory body — Which authority administers and enforces the regulation
- Scope — What types of AI systems, data processing, or activities are covered
- Key requirements — Summary of the main obligations (transparency, documentation, testing, human oversight, etc.)
- Risk classifications — If the regulation uses risk tiers (like the EU AI Act), document the classification criteria
- Effective dates — When different provisions take effect (phased implementations)
- Penalties — Maximum penalties for non-compliance
- Enforcement status — Is the regulation being actively enforced? Are there known enforcement actions?
- Guidance documents — Links to regulatory guidance, FAQs, and implementation guides
- Last updated — When the regulation was last amended or updated
Key regulations to include in your initial inventory:
EU regulations:
- EU AI Act (comprehensive AI regulation with risk-based classification)
- EU AI Liability Directive (liability framework for AI systems)
- GDPR as applied to AI (data protection for AI data processing)
- Sectoral AI requirements (medical devices, financial services)
US federal:
- Executive Order on Safe, Secure, and Trustworthy AI
- NIST AI Risk Management Framework
- FTC enforcement actions and guidance on AI
- SEC guidance on AI in financial services
- FDA guidance on AI in medical devices
- EEOC guidance on AI in employment
US state:
- Colorado AI Act
- California AI transparency and safety legislation
- Illinois Artificial Intelligence Video Interview Act
- Connecticut AI disclosure requirements
- Texas AI governance requirements
- Other state-level AI bills
International:
- UK AI regulatory framework
- Canada Artificial Intelligence and Data Act (AIDA)
- Australia AI governance framework
- Brazil AI regulation
- Singapore AI governance framework
- Other jurisdictions where your clients operate
Component 2: Product-Regulation Mapping
Map each of your AI products and services to the specific regulations that apply to them.
Mapping dimensions:
- Product or service — Which AI product or service are you assessing?
- Applicable regulations — Which regulations apply based on the product's characteristics, jurisdiction, sector, and data processing?
- Risk classification — Under each applicable regulation, what risk classification does the product fall under?
- Specific requirements — What specific obligations does each regulation impose on this product?
- Current compliance status — Is the product currently compliant with each requirement?
- Compliance gaps — Where does the product fall short of requirements?
- Remediation plan — What actions are needed to close compliance gaps?
- Remediation timeline — When must gaps be closed (aligned with regulatory effective dates)?
Mapping process:
- Assess each product against each regulation in your inventory
- Involve legal counsel for complex classification decisions
- Document the rationale for classification decisions (especially for borderline cases)
- Review mappings when products change or when regulations are updated
Component 3: Timeline Tracking
Track regulatory deadlines and milestones in a centralized calendar.
Timeline elements:
- Effective dates — When do specific regulatory requirements take effect?
- Compliance deadlines — When must your products be compliant with new requirements?
- Reporting deadlines — When are regulatory reports or filings due?
- Review dates — When are your internal compliance reviews scheduled?
- Audit dates — When are external audits or assessments scheduled?
- Comment period deadlines — When do comment periods for proposed regulations close?
Timeline management:
- Maintain a regulatory calendar visible to all relevant team members
- Set alerts for upcoming deadlines (90 days, 60 days, 30 days before)
- Assign responsibility for each deadline to a specific individual
- Review the calendar monthly to ensure nothing is missed
- Update the calendar when new regulations or amendments are published
Component 4: Compliance Status Dashboard
Create a dashboard that shows your compliance posture at a glance.
Dashboard elements:
- Overall compliance status — Percentage of applicable requirements met across all products
- Product-level compliance — Compliance status for each product across applicable regulations
- Gap summary — Number and severity of open compliance gaps
- Upcoming deadlines — Regulatory deadlines approaching within 90 days
- Remediation progress — Status of gap remediation activities
- Recent regulatory changes — New regulations or amendments that affect your compliance posture
Dashboard governance:
- Update the dashboard at least monthly
- Review the dashboard in management meetings
- Share relevant portions with clients as appropriate
- Use the dashboard to prioritize compliance investment
Component 5: Change Monitoring
Track changes to the regulatory landscape that affect your compliance obligations.
Monitoring sources:
- Regulatory authority publications and announcements
- Legal industry publications and analysis
- AI governance organizations and research groups
- Law firm alerts and newsletters
- Industry associations and trade groups
- Peer agencies and community forums
Monitoring process:
- Assign responsibility for monitoring each jurisdiction and sector
- Set up automated alerts (Google Alerts, RSS feeds, newsletter subscriptions) for regulatory updates
- Review monitoring sources weekly
- Assess each new development for impact on your compliance posture
- Update the regulatory inventory, product-regulation mappings, and timeline when changes occur
Change assessment workflow:
When a new regulation or amendment is identified:
- Initial assessment — Determine whether the regulation is relevant to your products and clients
- Impact analysis — If relevant, assess the impact on each affected product and client engagement
- Gap identification — Identify new compliance gaps created by the regulation
- Remediation planning — Define actions needed to achieve compliance
- Timeline integration — Add effective dates and compliance deadlines to the regulatory calendar
- Communication — Notify affected teams and clients about the new requirement
Component 6: Documentation and Evidence
Compliance requires evidence. Your tracker should manage the documentation that demonstrates compliance.
Documentation categories:
- Policy documents — AI governance policies, data handling policies, bias mitigation policies
- Assessment records — Privacy impact assessments, bias assessments, risk assessments
- Testing records — Test plans, test results, and approval records
- Training records — Employee training completion and certification records
- Audit records — Internal and external audit reports
- Incident records — AI incident reports and remediation records
- Design documentation — Model cards, system documentation, architectural decisions
- Compliance reports — Regulatory filings and compliance attestations
Documentation governance:
- Define documentation requirements for each regulation
- Maintain documentation in a centralized, version-controlled repository
- Review documentation currency periodically
- Ensure documentation is accessible for audit and regulatory inquiry
- Retain documentation for the required period (typically the life of the AI system plus a defined post-retirement period)
Building the Tracker: Practical Implementation
Option 1: Spreadsheet-Based Tracker
For smaller agencies or those starting their compliance journey, a well-structured spreadsheet is a viable starting point.
Structure:
- Sheet 1: Regulatory Inventory — All regulations with key metadata
- Sheet 2: Product-Regulation Map — Products mapped to applicable regulations with compliance status
- Sheet 3: Gap Register — Open compliance gaps with remediation plans and timelines
- Sheet 4: Timeline — Calendar view of regulatory deadlines
- Sheet 5: Change Log — Record of regulatory changes and their impact
Advantages: Low cost, easy to start, flexible, accessible.
Limitations: Manual updates, no automated alerts, difficult to scale, version control challenges.
Option 2: Project Management Tool
Use a project management tool (Notion, Asana, Monday.com) to manage compliance tracking as a project with tasks, timelines, and assignments.
Structure:
- Regulation database — Regulations as database entries with structured properties
- Product compliance boards — Kanban boards showing compliance status by product
- Gap tasks — Compliance gaps as tasks with assignees, due dates, and dependencies
- Timeline views — Calendar views of regulatory deadlines and milestones
- Dashboard views — Aggregated views showing overall compliance posture
Advantages: Better collaboration, assignment tracking, automated reminders, more structured than spreadsheets.
Limitations: Requires tool investment, may need customization, data integrity depends on manual entry.
Option 3: Dedicated GRC Platform
For larger agencies or those with significant compliance obligations, a dedicated Governance, Risk, and Compliance (GRC) platform provides comprehensive compliance management.
Capabilities:
- Automated regulatory change monitoring
- Compliance workflow automation
- Document management with version control
- Audit trail and evidence management
- Reporting and analytics
- Integration with other business systems
Advantages: Most comprehensive, automated updates, audit-ready, scalable.
Limitations: Higher cost, implementation effort, may be over-engineered for smaller agencies.
Operating the Compliance Tracker
Governance Cadence
Weekly:
- Review regulatory monitoring sources for changes
- Update compliance gap remediation status
- Check for approaching deadlines
Monthly:
- Review and update the compliance dashboard
- Assess any new regulatory developments
- Report compliance status to management
Quarterly:
- Conduct comprehensive compliance review across all products
- Update product-regulation mappings for any changes
- Review and update the regulatory inventory
- Assess compliance resource needs and budget
Annually:
- Full regulatory landscape assessment
- External compliance review or audit (if applicable)
- Compliance program effectiveness assessment
- Next-year compliance planning and budgeting
Roles and Responsibilities
- Compliance lead — Oversees the compliance tracker, manages the regulatory inventory, and coordinates compliance activities
- Legal counsel — Provides legal interpretation of regulations, reviews classification decisions, and supports compliance assessments
- Technical leads — Implement technical compliance requirements (documentation, testing, monitoring) for their respective products
- Project managers — Integrate compliance requirements into project plans and delivery processes
- Executive sponsor — Provides resources and authority for compliance activities
Client-Facing Compliance Tracking
Your compliance tracker should serve your clients as well as your agency.
Client compliance reports:
- Provide clients with regular compliance status reports for their AI products
- Document which regulations apply to their specific products and deployment contexts
- Communicate upcoming regulatory changes that affect their products
- Advise clients on compliance actions they need to take on their side
Sales support:
- Use your compliance tracker to demonstrate regulatory awareness and preparedness during sales processes
- Provide prospective clients with evidence of your compliance capabilities
- Differentiate your agency from competitors who cannot demonstrate compliance readiness
Your Next Step
Start building your regulatory inventory. Identify every AI regulation that applies to your agency's products and clients. For each regulation, document the key requirements, effective dates, and applicability to your product portfolio. Then map your top three products against the inventory to identify compliance gaps.
Do not try to build the complete tracker before you start — start with the regulatory inventory and product mapping for your most significant products and jurisdictions. Expand from there as you build the governance muscle.
The Los Angeles agency's $165,000 compliance remediation and lost client opportunities were the cost of not tracking regulations that were publicly available and well-announced. A compliance tracker would have surfaced the EU AI Act deadline months in advance and triggered proactive compliance work. The regulations are not hiding. You just need a system to track them.