Anyone who asks how often a compliance obligations register changes is assuming a fixed frequency. There isn't one. A register changes when something changes that matters: a new activity, an acquisition, a subsidiary in another country, a change in the text of a directive or in the way a member state transposes it. Some organizations see nothing change for months. Others see an obligation appear or disappear after a single decision in Brussels or a single legislative change in one of the countries where they operate.
That means the question isn't "how often", but "what are you monitoring, and how often do you look". A register that was drawn up once and then left in a drawer is, at some point, a snapshot of a situation that no longer exists.
There are two sources of change, and they are often confused with each other. The first is the organization itself: growth, contraction, a new market, a new chain of suppliers, a merger. This kind of change is usually visible from within the organization itself, because someone makes a decision about it.
The second source is regulation. A European directive sets a framework, but how your sector determines which esg rules apply is not fixed once and for all: thresholds, definitions and scope can be adjusted. And even without a change at European level, the national implementation can change, because a member state adjusts its transposition. That is the core reason why national gold-plating is structurally underestimated: a company that knows the European text often thinks it is done, while the country where it is established has filled in the rule slightly differently, or has since revised that interpretation.
A register that wants to be taken seriously therefore cannot rely on a fixed review cycle alone. An annual update is a minimum, not a guarantee. If an acquisition takes place in the meantime, a subsidiary is created in another country, or a member state adjusts its legislation, the register is out of date from that moment on, regardless of when the next scheduled update was due.
This is also why how do you keep track of national gold-plating without a subscription jungle is a different question from how often the register is revised. Keeping track is a continuous activity that is separate from the question of when a formal revision takes place. An organization can decide to formally revise the register every quarter, and still be caught off guard in the meantime by a change that no one noticed.
It is not the case that a well-organized register automatically notifies you when something changes. A register is a result, not an alarm system. It records what applied at a given moment: which obligation was applicable, who had been made responsible for it, what evidence belonged to it and which control addressed it. As soon as the underlying situation or regulation changes, someone has to flag that and update the register. That step — the flagging — lies outside the register itself.
This also touches on the question who should own an obligation. An owner who is only responsible for supplying evidence at a fixed moment misses the change that takes place in between. An owner who is also responsible for following their own obligation notices that change sooner. The register records that choice, but does not make it.
A board that wants to demonstrate that it is in control must not only show what applied at a given moment, but also that a way of working exists to notice changes. That is a different kind of evidence than an obligation itself: it concerns the process, not the outcome. What what does an assurance statement ask of your file shows is that an assurance provider does not only look at the content of the register on a given date, but also at the plausibility that the register will survive that date: is there a mechanism that notices change, or does everything depend on the memory of one person.
This shifts the question "how often does a compliance obligations register change" to a question a board can actually answer itself: is there someone who is looking, and how often.
Monitoring changes, keeping track of national gold-plating and reassigning ownership are tasks that take time, and that time is usually not evenly distributed: part of it is purely flagging and administration, another part requires judgment. The work scan from FTE TO AI calculates, per task, what portion of that work can be taken over by AI, so it becomes clear where people remain needed and where the monitoring itself can already be supported.
Vraag maar welke verplichting op u van toepassing is, en waaraan u dat kunt aantonen.
Answers come from this site’s knowledge base. Not tailored advice, and not a scan of your company.