Illustrative: a chain of blocks each linked by hash to the one before, with a Merkle tree under the newest

Risk Academy, led by the Nexus Consortium · Course catalogue · Governance, Policy and International Affairs

Law and Regulation

Compliance and regulatory change

Compliance and regulatory change, taught twice over: as the working methods of the field and as its frontier since 2024, with labs on the Academy's tools, open data and the Nexus Standards.

Core course Frontier course

The discipline

01Core course · L2 Intermediate

Compliance and regulatory change: foundations and practice

This area covers compliance risk management and how organisations track and respond to new and changing rules: compliance programmes, regulatory horizon scanning, data protection obligations, disclosure duties and the conformity of products and services with standards.

Level
L2 Intermediate
Study time
about 24 hours (planning estimate)
Status
In authoring
Prerequisites
An L1 course in the area, or an entry review

Why now

Regulatory change management needs to reset project timelines without discarding preparatory work that may still be required. Publications Office of the European Union (EUR-Lex), Directive (EU) 2025/794 amending Directives (EU) 2022/2464 and (EU) 2024/1760, 16 April 2025

Learning outcomes

  1. Define compliance risk and the other key terms of the discipline and use them correctly in a written case
  2. Explain compliance risk management and compliance programmes and controls with a worked example and its source
  3. Apply the discipline's method to a documented case and explain each result with its source
  4. Analyse a named case against regulatory horizon scanning, stating evidence, date and limits

Modules

  1. Compliance risk management
    • Compliance risk management
    • Compliance programmes and controls
    • Regulatory horizon scanning
  2. Regulatory change management
    • Regulatory change management
    • Data protection obligations
    • Disclosure obligations
  3. Standards and conformity
    • Standards and conformity
    • Enforcement and remediation
  4. Lab: the discipline's method
    • A new rule carries a fine ceiling as a share of turnover and a probability of detection; multiplied they give the expected penalty, and a compliance budget is justified when it costs less than the penalty it removes, which is Becker's rule applied to a firm's obligations register.
    • Work the method through a documented case and explain each result
    • Read the method's sources and stated values

Labs with Academy tools

Nexus Standards

Teaches

  • NRS-P9 Legal, compliance and regulatory risk
  • NRS-M12 Method fabric: Policy, regulation and governance

Relies on

  • NS-1 The UNI and the artefact catalogue
  • NS-16 UNI application profile (how articles, documents, code, data, APIs and interfaces carry the UNI)
  • NRS-C1 Risk vocabulary and ontology
  • NRS-C2 Risk assessment method
  • NRS-C8 Evidence, uncertainty and provenance
  • NRS-C9 Risk models, methods and validation
  • NRS-C10 Risk clauses and controls library
  • NRS-C16 Risk-informed decisions

Assessment

  • 40%Lab recordWork the discipline's method through a documented case and explain each result with its source and date
  • 40%Case memoApply the discipline's methods to a named place or organisation, stating evidence and limits
  • 20%Key terms checkShort answers on the key terms, marked against the definitions

Delivery

  • Self-paced online, with the labs in the browser
  • Cohort study over six to eight weeks, with a weekly lab review
  • Co-delivered with a partner institution, inside its own courses

Partner on this course

  • Co-teach a module and bring a current case from your work
  • Host a cohort for your learners, with your own schedule and review
  • Contribute a lab: a dataset your institution publishes openly, or a model
  • Review the course content and its references before it opens
  • Translate the course and adapt its cases to your region

How institutions and experts take part

In the Academy LMS

Course on the learning platform
Intermediate, 4 topics
Cohort group
A community group for each cohort of learners
Achievement
Recorded on completion of the assessed work

References

  1. Publications Office of the European Union (EUR-Lex), Directive (EU) 2025/794 amending Directives (EU) 2022/2464 and (EU) 2024/1760, 16 April 2025
  2. Becker, Crime and Punishment: An Economic Approach, 1968
  3. Ayres and Braithwaite, Responsive Regulation: Transcending the Deregulation Debate, 1992
  4. ISO 37301:2021, Compliance management systems, requirements with guidance for use, 2021
02Live map

People and hazards in the Horn of Africa

Where people live, night-time lights and the floods and fires public institutions answer to, over the Horn of Africa.

The interactive map needs JavaScript; the layer list and sources are below.

Layers 2

People and hazards

Latest available

NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth

Loading the latest NASA imagery.

Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.

People and hazards, framed on the Horn of Africa.Satellite and model products as NASA publishes them, each with its own date. They are indicators, not assessments of any place.

Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural Earth · NASA EONETSources and licences

  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
  • VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • NASA Fire Information for Resource Management System (FIRMS), VIIRS 375 m active fire product, NASA LANCE; vector tiles via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
  • Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
  • © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). ODbL
  • Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
  • Globe: MapLibre GL JS 6.9.1, BSD-3-Clause, © MapLibre contributors.
  • Live events: NASA Earth Observatory Natural Event Tracker (EONET); events are indicative and keep their original source links.
  • Live: NASA EONET Events are indicative, not authority warnings.
  • NASA GIBS: We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
  • Optional layers (3 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.

Layers and dates

  • Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
  • Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
  • Flood water, 3-day composite: VIIRS Global Flood Product, NASA LANCE · 14 Oct 2026
  • Active fires and thermal anomalies: VIIRS NOAA-20 375 m (FIRMS), NASA LANCE FIRMS · 13 Oct 2026
  • True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026

03How learning runs

How learning runs, as a process you can run

Select a scenario and press Play: course, pathway, practice, faculty, cells and record.

04What is changing

Frontier course · L3 advanced, programme courses and standards

Compliance and regulatory change: frontier methods

The methods, data, tools and studies that changed compliance and regulatory change between 2024 and 2026, taught by reproducing them on open data.

Level
L3 Advanced
Study time
about 28 hours (planning estimate)
Status
Planned
Prerequisites
Compliance and regulatory change: foundations and practice; Working knowledge of a scripting language (Python or R) for the labs

Why now

Regulatory change management needs to reset project timelines without discarding preparatory work that may still be required. Publications Office of the European Union (EUR-Lex), Directive (EU) 2025/794 amending Directives (EU) 2022/2464 and (EU) 2024/1760, 16 April 2025

Learning outcomes

  1. Explain what changed in compliance and regulatory change since 2024 and cite the studies, data or rules behind each change
  2. Reproduce EU 'stop-the-clock' directive postponed CSRD and CSDDD dates on open data and state the uncertainty of the result
  3. Evaluate a 2024 to 2026 study: its question, data, method, limits and what it changes for practice
  4. Design an analysis that combines a frontier method with the faculty's instruments, and justify each choice

Modules

  1. EU 'stop-the-clock' directive postponed CSRD and CSDDD dates
    • Directive (EU) 2025/794 delays sustainability reporting for the second and third waves of companies by two years and pushes due diligence transposition to July 2027 and first application to July 2028.
    • Regulatory change management needs to reset project timelines without discarding preparatory work that may still be required.
    • Publications Office of the European Union (EUR-Lex), 16 April 2025
  2. SEC stopped defending its climate disclosure rules
    • The US Securities and Exchange Commission voted to end its defence of the 2024 climate disclosure rules in the Eighth Circuit litigation; the rules had already been stayed.
    • Firms facing several disclosure regimes must track which obligations remain live in each jurisdiction.
    • US Securities and Exchange Commission, 27 March 2025
  3. EU Omnibus I proposed simplifying sustainability reporting and due diligence
    • The Commission published the Omnibus I package of proposals to simplify corporate sustainability reporting and due diligence rules, as part of its simplification agenda.
    • A pending overhaul of disclosure duties means compliance teams must manage uncertainty about scope and timing rather than a fixed rulebook.
    • European Commission, 26 February 2025
  4. UK guidance prepared firms for the failure to prevent fraud offence
    • Government guidance explains the new corporate offence of failure to prevent fraud under the Economic Crime and Corporate Transparency Act, which applies to large incorporated bodies, partnerships and incorporated public bodies and came into force on 1 September 2025.
    • In-scope organisations need fraud prevention procedures in place, making this a direct change for compliance programmes and controls.
    • Home Office (UK), 6 November 2024
  5. Reproduction lab
    • Extend the discipline's method with one frontier method and compare its results
    • State the uncertainty and the limits of the result
    • Peer review against a shared checklist
  6. Technology that helps and the risks it carries
    • Foresight tools and regulatory sandboxes.
    • Threats to information integrity, and AI in public decisions.

Labs with Academy tools

Nexus Standards

Teaches

  • NRS-P9 Legal, compliance and regulatory risk
  • NRS-M12 Method fabric: Policy, regulation and governance

Relies on

  • NS-1 The UNI and the artefact catalogue
  • NS-16 UNI application profile (how articles, documents, code, data, APIs and interfaces carry the UNI)
  • NRS-C1 Risk vocabulary and ontology
  • NRS-C2 Risk assessment method
  • NRS-C8 Evidence, uncertainty and provenance
  • NRS-C9 Risk models, methods and validation
  • NRS-C10 Risk clauses and controls library
  • NRS-C16 Risk-informed decisions

Assessment

  • 50%Method reproductionReproduce one frontier method on open data and state the uncertainty of the result
  • 30%Study reviewA critical review of a 2024 to 2026 study: question, data, method, limits, what it changes
  • 20%Peer reviewReview two other learners' reproductions against a shared checklist

Delivery

  • Self-paced online, with the labs in the browser
  • Cohort study over six to eight weeks, with a weekly lab review
  • Co-delivered with a partner institution, inside its own courses

Partner on this course

  • Co-teach a module and bring a current case from your work
  • Host a cohort for your learners, with your own schedule and review
  • Contribute a lab: a dataset your institution publishes openly, or a model
  • Review the course content and its references before it opens
  • Translate the course and adapt its cases to your region

How institutions and experts take part

In the Academy LMS

Course on the learning platform
Expert, 6 topics
Cohort group
A community group for each cohort of learners
Achievement
Recorded on completion of the assessed work

References

  1. Publications Office of the European Union (EUR-Lex), Directive (EU) 2025/794 amending Directives (EU) 2022/2464 and (EU) 2024/1760, 16 April 2025
  2. US Securities and Exchange Commission, SEC Votes to End Defense of Climate Disclosure Rules, 27 March 2025
  3. European Commission, Omnibus I, 26 February 2025
  4. Home Office (UK), Offence of 'failure to prevent fraud' introduced by ECCTA, 6 November 2024
  5. Becker, Crime and Punishment: An Economic Approach, 1968
  6. Ayres and Braithwaite, Responsive Regulation: Transcending the Deregulation Debate, 1992
  7. ISO 37301:2021, Compliance management systems, requirements with guidance for use, 2021
05Take part

Take part in the work

Start from who you are.

06Questions

Questions, answers and key terms

Is the course free?
Yes. Every course and learning material of Risk Academy, led by the Nexus Consortium, is free to study, self-paced or with a cohort. Ordinary participation has no fee; paid work, internships and fellowships are separate arrangements.
What does completing a course give me?
A completion record: the course, its version, the date and what was assessed, private by default and shared by you. It stacks into discipline, department and programme achievements. A record states what was studied and assessed and does not certify competence; it is not a licence, a professional title or an employment status.
Where do the data and the places come from?
Every faculty teaches on a twin of a real place built from open data; each layer carries its provider, licence and date, and every result on the Academy states its source. Maps and figures are indicators for teaching, never an assessment of a place.
How do I take part beyond the course?
Form a competence cell of three to seven people, study a shared pathway, take a supervised assignment in the National Working Groups, or bring a cohort from your institution. For organisations.

Key terms

Term

Compliance risk

The risk of legal or regulatory sanctions, loss or damage from failing to comply with rules.

Term

Regulatory change management

The process of finding new or changed rules, assessing their effect and putting the changes in place.

Term

Conformity assessment

Checking that a product, service or system meets the requirements of a standard or regulation.

Term

Data protection impact assessment

An assessment of the risks to people of processing their personal data, and how they are reduced.

ReportsContribute

Contribute evidence from this page.

Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

Risk Academy
Related

Around Compliance and regulatory change: courses

Risk Academy

Study compliance and regulatory change with us, or teach it

Every course is free and open. Institutions and experts can co-teach, host a cohort, contribute a lab or review a course before it opens.

Browse the course catalogue Partner with the Academy
Risk Academy

Courses · practice · credentials

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Support our work

Who funds us

Risk Academy is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices