Regulation around AI is read in most boardrooms as news: a report comes out, someone shares it, it is briefly discussed and then it disappears again. That is a different act than tracking. News tells you that something has happened. Tracking tells you whether something you assumed still holds true. The difference seems small, but it determines whether regulation has an impact on your strategy or only on your inbox.
Regulation around AI is changing not because AI is a new topic, but because the underlying practice shifts every month. A law written twelve months ago assumed a division of work between human and system that has since shifted elsewhere: tasks that were then unthinkable to hand over to a system are now partly taken over, with human oversight that approves or rejects with reason, or fully taken over without anyone still looking at it. Regulation lags behind that practice, and that means every adjustment says two things at once: something about what is legally permitted, and something about what is apparently already happening. Anyone who looks only at the first misses the second.
Regulation does not come from a single source. There are legislative texts with their own timeline, there are supervisory authorities that anticipate them with guidelines, and there are sector agreements that move faster than legislation because an industry itself already has experience with what does and does not work. In addition, there is the practice of your own sector: what competitors announce often precedes what a supervisory authority says about it, and anyone who follows what competitors announce about AI sometimes sees regulation coming sooner than someone who only reads the official channels. A signal without a known origin is difficult to weigh; with a source, you also know how fast and how certainly it changes.
The right frequency depends on how directly an assumption touches on the topic. An assumption such as "for this task, human approval is legally required" deserves a fixed check, for example every quarter, because the chance that it shifts is real and the consequences of a missed shift are significant. An assumption further removed from the topic can be checked at a lower frequency, as long as that frequency at least exists. What does not work is waiting for a signal to announce itself: regulation does not report to you, it appears in a publication that you may or may not have seen.
A change in regulation means that a boundary has shifted: something that previously had to remain human work may now be partly taken over with oversight, or something that previously could be done without oversight must now have it. That is a fact about a framework, not about a decision. The decision on what you do with it — restructuring a task, deploying capacity differently, revising a process — is a separate step, with its own assessment. If that assessment touches on personnel, separate statutory requirements apply, independent of what is being tracked here.
A change in regulation is not confirmation that a task is now actually being taken over. The framework says what is permitted or required, not what a supplier already delivers, what already works internally, or what is reliable enough at this scale. Anyone who reads a regulatory change as "so now it can be done" skips a step: the question of whether it is technically and practically ready is separate from the question of whether it is legally ready. Both must hold true before an assumption is valid again.
The decision is never "regulation has changed, so we adjust something". The decision is: which assumption in our strategy was based on the old framework, and is that assumption still valid now that the framework has shifted. That is a question that does not belong to a single department. Legal and compliance functions see the text of the rule; the teams that do the work see whether practice already acts accordingly. Between those two views there is often room, and that is precisely why how the picture within a leadership team can diverge is relevant to this topic: a regulatory change that one function sees as minor and another sees as fundamental is a signal that the same assumption is being viewed differently.
Tracking regulation works best in combination with other outside signals. What suppliers announce often shows which application regulation is likely to touch on within a year, and anyone who tracks suppliers building AI into their product sometimes sees that sequence sooner than the supervisory authority itself that lays it down. That is the core of outside-in thinking in practice: not waiting for a change to present itself naturally in your own process, but actively looking at what is already moving outside before it becomes noticeable internally.
The underlying question with every regulatory change is not legal but operational: which work in this company, given the new framework, can genuinely be taken over by AI, partly with oversight or entirely. That question is answered per task with the work scan from FTE TO AI.
You can start with a question that does not need to have anything to do with legislation: which assumptions underlying your strategy have actually never been made explicit, and when was the last time someone checked them. The free assumption check is a short round in which you name your most important assumptions and see, for each one, when it was last confirmed. The full stress test, which places this alongside external signals and a self-plot of the leadership team, is under construction.
Stel uw vraag. Vaak zit de echte vraag een laag dieper — daar mag ik naar vragen.
Answers come from this site’s knowledge base. Not tailored advice, and not a scan of your company.