Cross Regulatory Impact Analyzer Patrick Munro

Cross-Regulatory Impact Analyzer

Purpose

Most regulatory analyses treat regulations one at a time. This is fine when a business is subject to one regulation. It stops being fine the moment multiple regulations reach the same activity, because the real compliance questions live in the overlap: which obligation is stricter, which deadline comes first, what satisfies both, and what conflicts. This skill produces the analysis that single-regulation guides do not.

When to use

• New product or service launch where more than one regulation plausibly applies
• M&A due diligence on a target with multi-regulation exposure
• Strategic compliance planning where a siloed, regulation-by-regulation approach has hit its limits
• Complex client advisory on regulatory interactions
• Budget and resourcing estimation for multi-regulation programmes
• Triaging incident response playbooks where multiple reporting regimes trigger simultaneously

Analysis framework

The analysis proceeds in six phases. Each phase produces an output that feeds the next.

Phase 1: Scope determination

Identify which regulations apply based on:

• Product or service type: hardware, software, SaaS, IoT, AI system, platform, financial service
• Sector: financial services, healthcare, critical infrastructure, public sector, consumer, etc.
• Entity size: headcount, revenue, balance sheet (matters for NIS2, DORA size thresholds, SME carve-outs)
• Data processing: personal data types, volumes, special categories
• Geographic scope: EU-wide, specific Member States, third-country targeting
• Risk profile: safety, security, fundamental rights implications
• Designation status: VLOP/VLOSE (DSA), gatekeeper (DMA), critical ICT TPP (DORA), critical entity (NIS2/CER)

Document the inclusion rationale for each regulation. Document the exclusion rationale too, because "we considered X and concluded it does not apply because Y" is half the value of the analysis.

Phase 2: Obligation extraction

For each applicable regulation, extract:

• Core requirements: what must be done
• Deadlines: when compliance is required, distinguishing phased application dates
• Penalties: administrative fines, criminal sanctions, private rights of action
• Conformity or certification: assessment type, notified bodies, self-assessment vs. third-party
• Documentation: records, reports, impact assessments
• Ongoing obligations: monitoring, review, update, training

Cite articles precisely. Flag where obligations depend on delegated acts or guidance not yet adopted.

Phase 3: Overlap classification

Classify each interaction using this taxonomy:

• Reinforcing: multiple regulations require the same action. One implementation satisfies both.
• Complementary: regulations address different aspects of the same topic. Coordinate, do not duplicate.
• Duplicative: near-identical obligations with different wording. Single implementation, dual documentation.
• Conflicting: requirements appear contradictory. Need interpretation, legal opinion, or regulator engagement.
• Lex specialis: a sector-specific regulation prevails over a general one (e.g., DORA over NIS2 for financial entities).

The taxonomy matters because each classification triggers a different compliance strategy.

Phase 4: Priority matrix

Rank obligations on five axes:

1. Legal severity: prohibited practices > high-risk obligations > medium > low
2. Timeline: earliest deadline first
3. Dependency: prerequisites before dependents (you cannot build a DPIA before you have mapped processing)
4. Impact: highest business impact or penalty exposure first
5. Feasibility: quick wins vs. long-horizon builds

Produce a stack-ranked list. Do not produce one with "priorities" that has everything at priority 1.

Phase 5: Timeline coordination

Build an integrated timeline showing:

• All regulatory deadlines across regulations
• Dependencies between obligations
• Resource allocation points
• Milestones and checkpoints
• Buffer for delegated acts, guidance publications, and regulatory engagement

Deliverable forms: Gantt chart for implementation planning, calendar view for supervisory deadlines, dependency diagram where the interactions are the point.

Phase 6: Cost estimation

Estimate total compliance cost with explicit ranges and assumptions:

• Legal: external counsel, regulatory advice, opinions, litigation reserve
• Technical: system modifications, security measures, API development, SBOM tooling
• Personnel: compliance headcount, training, ongoing monitoring
• Certification: third-party assessments, audits, notified body fees
• Opportunity: delayed market entry, feature constraints, jurisdictional carve-outs

Ranges, not point estimates. Assumptions visible. Sensitivity analysis for the major drivers.

Output formats

Choose based on audience and use case.

Executive summary (1-2 pages)

For board or C-suite consumption.

• Applicable regulations at a glance
• Top risks and conflicts
• Five priority actions
• Total estimated compliance cost with range
• Recommended timeline with go/no-go gates

Detailed analysis (10-30 pages)

For legal and compliance teams.

• Scope determination with rationale
• Regulation-by-regulation obligation map
• Overlap and conflict analysis with classification
• Prioritized obligation list
• Integrated timeline
• Cost breakdown with assumptions
• Risk mitigation and open questions

Implementation roadmap (visual)

For programme management.

• Timeline chart colour-coded by regulation
• Dependencies visible
• Resource requirements marked at key points
• Milestones and gate decisions

Compliance matrix (spreadsheet)

For operational tracking.

• Row per obligation
• Columns: regulation, article, requirement, deadline, priority, cost, owner, status, evidence
• Filterable and sortable
• Progress tracking capability

Typical workflow

1. Intake. Gather product description, technical architecture, processing activities, target markets, entity profile.
2. Research. Verify current text of each applicable regulation. Note recent amendments, pending delegated acts, national implementations.
3. Scope. Apply inclusion criteria systematically. Document rationale. Address edge cases.
4. Extract. Build obligation maps per regulation, cited at article level.
5. Classify. Apply the interaction taxonomy to every pairwise interaction that matters.
6. Prioritize. Build the priority matrix. Stress-test it against timelines and resource constraints.
7. Estimate. Cost and timeline. Ranges with assumptions.
8. Produce. Choose the output format. Write it.