Which obligations apply to a business does not depend on a single characteristic. Sector, size, legal form, the countries in which a business is active and the product or service being offered work together. If one of those factors changes, the outcome can shift, even without anything else in the organisation changing. Product is a factor that is often underestimated in this, because people think that only sector or size is decisive. That is not the case. A product change can by itself be enough to fall under a different regime, or to fall outside an obligation that previously applied.
Rules are often written around what a business actually brings to market: a physical product, a service, a financial instrument, something with digital components. If the nature of that product changes, the applicable supervisory framework, reporting obligation or chain responsibility often changes too. A business that adds a service to an existing product, incorporates a digital component, or positions a product differently, can thereby end up in a different regulatory category. This does not always happen with a clear tipping point. Often it is a gradual shift, which increases the risk that a business operates for a while under incorrect assumptions.
If the product changes, that can affect three things: which obligations apply, who within the organisation is responsible for them, and what evidence is needed to demonstrate that those obligations are being met. A new type of product can bring a new reporting obligation, require a different party as owner of a control, or cause an obligation that previously applied to lapse. This is not a fixed table you can consult; it depends on the precise nature of the product, the sector in which it is offered and the countries where it comes to market. The current text of the regulation applicable to your situation remains the place to verify that.
Product does not stand on its own. A product change can affect the sector classification, which in turn activates other obligations. It can also mean that a business becomes active in other countries, or that the scale of activities ends up in a different segment. Anyone who wants to understand what a product change means would therefore do well to also look at what changes to your obligations when the countries in which you are active change, because product and market area often together determine which regime applies. The same connection applies to sector: a product that at first glance remains unchanged can, through a different application, still fall under a different sector classification, something addressed in how you document your sector so that it holds up afterwards.
The core of demonstrability is not only knowing which obligations apply, but being able to show when and why that assessment was made. If a product changes, it is important that this change, the consideration given to its regulatory consequences, and the conclusion drawn from it, are documented. Not as a stand-alone note, but as part of a structure in which an owner, a piece of evidence and a control are assigned per obligation. How this is set up specifically for product is described in how you document your product so that it holds up afterwards. For businesses that operate in multiple countries at the same time, it is also relevant how those countries themselves are documented, because a product change in one country can have a different impact than in another, as explained in how you document the countries in which you are active so that it holds up afterwards.
A board that can demonstrate that the product has been periodically assessed for its consequences for the applicable obligations is in a different position than a board that only does this at the moment a supervisor or auditor asks about it. It is not about guaranteeing an outcome, but about being able to show that the question was asked, that it was answered seriously and that the conclusion has been documented somewhere with an owner attached. That is precisely what the Compliance Check is aimed at: not prescribing rules, but setting up the structure with which an organisation can demonstrate that it is in control, even if the product, sector or legal form changes in the meantime. For those who also want to know how legal form counts in that structure, there is how you document your legal form so that it holds up afterwards, and the same principle applies for size, described in how you document your size so that it holds up afterwards.
Keeping track of all these factors, assessing changes and documenting evidence takes time, and that time is filled somewhere within an organisation by people. Anyone who has once made clear which obligations apply and what work comes with that can then ask which part of that work should actually remain human work. The work scan from FTE TO AI calculates per task which part of the work can be taken over by AI, offering a fitting answer to the question that often follows the Compliance Check: not just what needs to happen, but who or what can best do it.
The Compliance Check is currently being developed. Anyone who wants to use it as soon as it becomes available can sign up for the waiting list.
Vraag maar welke verplichting op u van toepassing is, en waaraan u dat kunt aantonen.
Answers come from this site’s knowledge base. Not tailored advice, and not a scan of your company.