Preparing for regulatory change
Identifies where existing policies and controls fall short of a named regulation, taking account of current regulatory text and recent guidance. Provides a prioritised remediation plan to support readiness decisions.
— Risk & Compliance
Regulatory gap assessment
Assesses current policies, controls and supporting evidence against regulatory requirements, producing a gap assessment and prioritised remediation plan for reviewer approval.
- Risk & Compliance
- Human review built in
- Traceable reasoning
- Runs anywhere
2–3 weeks → ~25 minutes
For a typical multi-document review workflow
No coding required
- Input
- Named regulation and assessment scope
- Output
- Requirement-by-requirement regulatory assessment
- Runs in
- Skillsize · ChatGPT · Claude · Copilot
- Export
- SKILL.md · MCP
- Time saved
- ~2–3 weeks per run
— USE CASES
What people use Regulatory gap assessment for
Reviewing compliance assurance
Gives advisory teams a requirement-by-requirement assessment grounded in available evidence. Distinguishes control gaps from missing documentation so findings reflect what the evidence supports.
Planning remediation investment
Defines corrective actions with proposed owners, effort estimates and dependencies. Gives leadership a practical basis for allocating resources and agreeing priorities.
Supporting formal review
Produces an evidence-based report for reviewer approval, with clear compliance judgements and the rationale behind identified gaps.
What it works from
- Named regulation and assessment scope
- Current regulatory text and recent regulator guidance
- Policies and procedures
- Control documentation and compliance registers flavour
What you get back
- Requirement-by-requirement regulatory assessment
- Compliance classifications covering compliant, partially compliant, non-compliant and not evidenced
- Evidence references and rationale for findings
- Regulatory gap register flavour
— HOW IT BEHAVES
How Regulatory gap assessment produces its result
The mechanics behind this specific template — what it reads, what it calculates, and where a human stays in the loop.
Scored against your criteria
Each risk is assessed against criteria you control and weight, so the same standard applies to every risk in the risk universe in scope.
Risk, control and policy documentation pulled into one schema
Every risk is captured in the same field structure, so records drawn from different documents and sources stay comparable.
Whole sets of risk, control and policy documentation at once
All of your risk, control and policy documentation is processed as one set, so patterns across documents surface instead of being read one file at a time.
Live research on the risk universe in scope
Current external sources on the risk universe in scope are researched during the run rather than recalled from training data, and every source travels with the output.
Human sign-off before the write-up
The run pauses for a person to confirm the risks that matter before the deliverable is composed.
Composed as work product
Findings on the risk universe in scope are written up as a document that reads like professional output, with each claim tied back to a risk.
Why this is expensive by hand
Regulatory gap assessments often leave advisory teams reconciling legal requirements, regulator guidance and uneven evidence across the organisation. Preparing for regulatory change is the typical trigger — identifies where existing policies and controls fall short of a named regulation, taking account of current regulatory text and recent guidance. Provides a prioritised remediation plan to support readiness decisions. Done properly it is defensible; done at pace it becomes a judgement call nobody can retrace. And "properly" usually means 2–3 weeks of manual work.
How this Skill produces it
Here the same job runs as a Skill. Your material goes in; requirement-by-requirement regulatory assessment comes out, alongside compliance classifications covering compliant, partially compliant, non-compliant and not evidenced. The judgement is built in — how items are broken up, what standard they are held to, and where the run stops for a human review. The practical effect: 2–3 weeks of manual work becomes a ~25 minutes run, held to an identical standard on the tenth engagement as on the first.
Who it's for
- Internal audit and risk functions
- Compliance and controls teams
- Second-line functions reporting to committees
- Risk consultants running assessments
Run it in Skillsize — or export it anywhere
Regulatory gap assessment exports as a structured SKILL.md file and is MCP-ready, so the same method runs in ChatGPT, Claude, Copilot or your own AI products. Adapt it to your methodology, and the intelligence stays yours — not locked to one vendor.
ChatGPTClaudeCopilotAI Products (MCP)
Related Skill Templates
More Risk & Compliance templates →Risk & Compliance
Data Subject Access Request (DSAR) Engine
Assesses a data subject access request end to end and returns a governed decision on whether to fulfil it, fulfil it in part, refuse it with reasons or extend the deadline, having verified identity, mapped the request to the systems that actually hold the data and held the outcome for a data protection sign-off before anything is disclosed.
Risk & Compliance
Findings consolidation
Fans multiple audit or review reports into individual findings, deduplicates repeats, and sorts them by severity into one consolidated register with sources retained.
Risk & Compliance
Audit evidence mapping
Pairs a full evidence set against every audit assertion or PBC item to produce a coverage matrix, naming the assertions nothing supports and the documents supporting nothing.
Risk & Compliance
Claims Coverage Triage Engine
Reads a submitted claim against the policy wording that governs it and returns a coverage assessment showing whether it appears covered, potentially excluded or in need of specialist review, mapped clause by clause and never issued without a handler's sign-off.
Risk & Compliance
Incident Severity & Response
Assesses a reported incident against your response playbook and policies, assigns the severity band the evidence supports, and returns the matching response plan with the notifications, owners and timelines that band requires.
Risk & Compliance
Privacy / Data-Transfer Approval
Assesses personal-data processing and cross-border transfers against privacy policy and jurisdiction rules, producing a documented approval outcome with conditions, policy evidence and grounds for referral.