How Do You Know Which Regulations Apply to Your Business?

Check each requirement against the facts of your business: which legal entity does the work, what it actually does, where, for whom, and with what data. Then look at thresholds, exemptions, and dates. Write down what you found, who reviewed it, and what would make you look at it again.

That only works if your business profile is current. When it isn’t, a perfectly good regulatory alert lands and nobody can say with confidence whether it matters or not.

KEY TAKEAWAYS

• Applicability is decided provision by provision, for a specific entity, activity, and jurisdiction. Your industry and your headquarters location are inputs, not answers.
• The assessment rests on business facts. If nobody can show where a fact came from, treat it as unconfirmed.
• “Needs review” is a good answer, provided someone owns the missing fact.
• Link every decision to the source text, the facts you relied on, and the change that would reopen it.

‍WHAT DOES AN APPLICABILITY QUESTION LOOK LIKE IN PRACTICE?

Here’s an illustrative case. A software company signs its first hospital customer. Two weeks later, the hospital procurement team sends over a vendor questionnaire, and one question asks whether the company is a business associate under HIPAA.

Compliance opens the regulatory inventory. It was last updated before the healthcare product existed.

Before anyone can answer, someone has to find out what the new service does, what patient information it touches, if any, and whose behalf it acts. Sales may not know. Product may know but has never been asked in those terms.

The compliance record describes the old business, and the answers depend on the new one.

‍WHAT IS REGULATORY APPLICABILITY?

Regulatory applicability is whether a legal requirement covers a particular entity, activity, transaction, or set of circumstances.

The answer is rarely company-wide. A rule might reach one subsidiary but not its parent. It might cover one product, or only operations in one state. Plenty of provisions turn on a threshold, an exemption, or the role your organization plays in a transaction.

The useful question is narrow: which requirement applies to which part of our business, and why?

That decision feeds everything else in regulatory change monitoring: monitoring, impact assessment, and implementation. Bloomberg Regology’s Ultimate Regulatory Change Management Q&A Guide covers how those pieces connect.

WHAT INFORMATION DEFINES YOUR BUSINESS’S REGULATORY SCOPE?

You need a business profile that covers your entities, activities, jurisdictions, customers, and data relevant to an assessment, with evidence behind each fact and a person who confirmed it.

Industry labels don’t get you far. “Fintech” could mean a company that writes software for banks. It could also mean one that holds customer funds, moves money, lends, or does all of those through three different entities.

Build the profile from these inputs:

Record when the information was confirmed.

Here’s why. Say the profile states that a product never handles customer financial data. That claim should point to a data-flow map. Six months later a release adds a payment feature, and the map, the profile, and probably the applicability decision all need another look.

HOW DO YOU ASSESS WHETHER A REGULATION APPLIES?

Start with the requirement’s scope and definitions, then test them against verified business facts. Check conditions, exclusions, exemptions, and timing before you conclude anything.

An alert gets the question on your desk but doesn’t answer it. The conclusion still has to rest on legal text itself.

These five questions do most of the work.

1. Who is covered? Look at the entity types, legal roles, and activities the requirement describes.
2. Does the activity reach jurisdiction? Check where the customers are, where the work happens, and who the service is aimed at.
3. Which thresholds matter? Note the measurement period, how it’s calculated, and whether affiliate entities are counted together.
4. Is there an exclusion or an exemption? If you’re relying on one, write down why.
5. Where is the requirement in its life cycle? A proposal, a final rule, effective dates, and compliance deadlines are four different things.

Keep conclusions tight. A finding about one provision should not drift into a finding about the whole framework.

DOES HEADQUARTERS LOCATION SETTLE APPLICABILITY?

Where you’re incorporated is one fact among many.

The European Commission explains that GDPR can apply to businesses outside the EU when the processing relates to offering goods or services to individuals in the EU or monitoring their behavior there. European Commission guidance on GDPR.  

A U.S. company planning a European launch has to look at who it’s selling to, and what it does with their data. The address of its articles of incorporation won’t settle it.

DOES CUSTOMER INDUSTRY SETTLE APPLICABILITY?

Selling into a regulated industry doesn’t automatically make you regulated the way your customers are, but it’s your role that decides it.

HHS identifies covered entities and business associates as subject to the HIPAA Rules, with business associates directly liable for certain provisions. HHS guidance on covered entities and business associates. 

For the software company, “we sell to hospitals,” is the start of the analysis. The answer depends on what the service does and whether it handles protected health information for the hospital.

WHAT SHOULD YOU DOCUMENT IN AN APPLICABILITY DECISION?

Enough that a qualified reviewer who wasn’t in the room can follow the reasoning in practice.

In practice that means:

• Legal source: the provision, a link, and the version or the publication date.
• Business scope: the entity, activity, product, and jurisdiction you assessed.
• Supporting facts: what evidence you used and who confirmed it.
• Conclusion and rationale: which conditions are met, which aren’t, which are still open.
• Reviewer and next action: who signed off and what’s still outstanding.
• Reassessment trigger: the change that would send it back for another review.

For the hospital questionnaire, an open record might read:

• Status: Needs review.
• Scope: Proposed Healthcare service operated by entity A.
• Missing fact: Whether the service will handle protected health information on behalf of the customer.
• Next step: Product and privacy teams to confirm the data flow before launch.

That’s a usable record. Anyone reading it knows what’s unresolved, who’s on it, and when it has to be settled.

If the requirement does apply, the record has to connect to implementation: owners, policies, and controls. Bloomberg Regology’s article on why regulatory change management often breaks after the alert  picks up from there.

WHEN SHOULD REGULATORY APPLICABILITY BE REASSESSED?

Whenever the fact behind a decision changes, whether that change comes from the law or the business. Periodic reviews are a backstop for the changes that slip through.

Typical triggers include:

• a new product or a meaningful change to the existing one
• a new jurisdiction or customer group
• an acquisition or work moving from one entity to another
• a change in how data is collected, processed, or shared
• getting close to a revenue, headcount, or customer threshold

The easiest place to catch these is in approvals you already run. Add a question to the product launch form: does the feature change our role, our data practices, or where we operate? If the answer is yes, route it to the right reviewer before the launch.

The same profile should drive monitoring. If it still reflects last year’s business, your team ends up reviewing alerts against operations you’ve wound down. Bloomberg Regology’s article on regulatory alerts that don’t apply covers that problem.

 HOW DOES BLOOMBERG REGOLOGY SUPPORT REGULATORY APPLICABILITY WORK?

Regology starts from your business profile, which it calls your legal DNA.

The Regulatory Change Agent uses that profile to build a custom Smart Law Library and generate relevant alerts across legislative and executive sources, covering both proposed and final changes. Reggi scores each alert for relevance to your business profile and gives the reason for the score, so reviewers can see why an update surfaced. Reggi also flags laws or regulations missing from your library, recommends adding them, and explains why they’re relevant.

Once a requirement applies, the Compliance Agent drafts requirements, controls, and policies aligned to the legal source. It also groups and harmonizes requirements across documents and jurisdictions.

People still make the call. Your legal and compliance reviewers confirm the business facts and settle the hard interpretations. If you’re evaluating any tool for this, check that reviewers can open the source, see why an update surfaced, and tell what still needs investigating.

WHERE SHOULD YOUR TEAM START?

Pick one thing: a product, a legal entity, or a change coming up next quarter. See whether your team can connect its operating facts to the relevant requirements and write the assessment down.

Or start with a decision you’ve already made. Try to find the source provision, the facts behind it, the reviewer, and what would trigger a second look. The gaps will be obvious.

To see how your business profile can shape regulatory monitoring, request a Bloomberg Regology Demo.

FREQUENTLY ASKED QUESTIONS.

Is there a single list of regulations that apply to every company in an industry?

No. An industry list is a reasonable place to start work, but two companies in the same sector can have very different obligations depending on their entities, activities, and footprint.

What is the difference between regulatory applicability and relevance?

A relevant update is worth reviewing. An applicable requirement is one you’ve reviewed and confirmed covers a specific entity, activity, or jurisdiction. Plenty of relevant alerts turn out not to apply.

What should trigger a new applicability review?

Look again when a fact behind the earlier decision changes. Common triggers include a new product or service, a new jurisdiction or customer group, an acquisition, a change in how data is collected or shared, or getting close to a threshold. Scheduled reviews catch changes that weren’t flagged.

Does holding a license determine which regulations apply?

It helps, but it isn’t the whole picture. Look at the activity itself and the requirement’s scope including whether the activity needs authorization you don’t have yet.

Who should determine regulatory applicability?

Legal and compliance teams run the assessment, and business owners confirm the operating facts. Send complex interpretations to a qualified legal reviewer. Give one person ownership of the open questions and the record.

Can AI determine which regulations apply to a business?

AI can speed up research and initial analysis. A reviewer still needs to check the source text, the business assumptions, and the reasoning before anyone relies on the result.

‍