A UK compliance team rarely answers to a single regulator. Obligations from the FCA, PRA, MHRA, HSE and ICO stack rather than replace each other, and each one needs an owner, a deadline and evidence that it was closed.

What is regulatory mapping?

Regulatory mapping is the process of linking each regulatory requirement to the internal policy, control or team it affects. Regulatory mapping software continuously monitors regulatory sources, converts each change into a discrete obligation and links it to the internal policy or control it affects.

For a UK compliance team, that replaces a manual cycle of reading bulletins and updating documents by hand with a structured, auditable record of what applies, to whom and since when.

How mapping differs from monitoring

Monitoring flags that a regulator has published something. Mapping shows what it means for a specific organization: which business unit is affected, which control needs to change and who owns the response. The related practices of horizon scanning, regulatory intelligence and regulatory change management are covered in a separate post on how they connect.

Why UK obligations stack rather than substitute

  • A manufacturer selling into the UK and EU tracks UKCA marking alongside CE marking, which diverged after Brexit and now carry separate technical documentation routes.
  • A financial services firm answers to the FCA and PRA on operational resilience while separately meeting ICO requirements on data handling.
  • A life sciences company reconciles MHRA guidance with EMA positions where the two bodies have not stayed aligned.

None of these obligations cancel each other out. They stack, and each one needs its own owner and deadline.

Compliance workload is rising across UK businesses

The Department for Business and Trade's Business Perceptions Survey 2024 found that UK private sector businesses spent an average of 8.0 staff days a month on compliance activity, up from 6.6 days in 2022, rising to 25.8 days a month at businesses with 250 or more staff. Over half (52%) expect the regulatory burden to increase over the following 12 months. That trajectory is what turns mapping from a nice-to-have into a structural requirement.

Four functions of regulatory mapping software

Regulatory mapping software performs four connected functions:

  • Continuous source monitoring: tracking regulatory bodies and government publications for new or amended requirements, rather than relying on staff to check individually
  • Obligation extraction and mapping: converting a regulatory change into a discrete obligation and mapping it against existing policies and controls
  • Impact assessment: flagging which teams, sites or product lines an obligation affects
  • Regulatory obligation tracking: assigning an owner to each obligation and maintaining an auditable trail of the action taken and when

The fourth function often decides whether a compliance program survives an audit intact. Regulators want to see how an obligation was identified, assessed and closed, not just confirmation that it eventually was.

Operational resilience deadlines from the FCA and PRA

The FCA and PRA's operational resilience rules show what mapping obligations look like with real dates attached.

Self-assessment from March 31, 2022

In-scope firms had to identify their important business services and set impact tolerances under FCA policy statement PS21/3 and the equivalent PRA supervisory statement.

Full compliance by March 31, 2025

Firms had to evidence that they could remain within those impact tolerances during severe but plausible disruption.

Each phase is a set of interlocking obligations, not a single deadline. A firm tracking this manually is relying on someone remembering to revisit each item as the date approaches. Regulatory mapping software keeps every obligation live and visible until it is closed.

Mapping UK regulatory sources to compliance actions

A compliance mapping tool that works well does not just flag a change, it shows the specific action it demands. The table below sets out how UK and EU sources typically translate into obligations and actions.

Regulatory source Typical obligation type Compliance action
FCA / PRA (operational resilience) Impact tolerance setting, scenario testing Map important business services, test against severe disruption scenarios, evidence remediation
MHRA Product safety, clinical evidence, post-market surveillance Update technical files, align labeling, log adverse event reporting
HSE Workplace safety, RIDDOR reporting Update risk assessments, log and report notifiable incidents within statutory timeframes
ICO Data protection, breach notification Update data processing records, assess breach notification obligations within 72 hours
UKCA / CE marking bodies Product conformity, technical documentation Maintain parallel UK and EU technical files, track divergence in conformity assessment routes

Cost of manual mapping for UK financial services firms

A 2025 PwC UK and TheCityUK report estimated that regulatory compliance costs for UK financial services firms exceed £33.9 billion a year, over 13% of average operating costs, and 84% of surveyed firms reported costs rising over the past five years.

Spreadsheet-based obligation registers are the usual manual substitute, and they fail predictably:

  • Version control breaks down once more than one person edits the register
  • There is no automatic link between a regulatory change and the control it affects
  • The audit trail depends on someone remembering to log who did what and when

None of this is visible until an auditor asks to see the evidence. Strong regulatory change management closes that gap before it is tested.

Five checks for choosing regulatory mapping software

Not all UK compliance software handles mapping the same way, and the gaps matter once a team is relying on it for audit evidence rather than general awareness. Assess:

  • Regulatory coverage: does it track the specific bodies relevant to the organization (FCA, PRA, HSE, MHRA, ICO) rather than a generic global feed
  • UK/EU divergence handling: can it track parallel obligations such as UKCA and CE marking without merging them into one requirement
  • Obligation-to-control linkage: does it map each obligation to a specific policy or control, or just flag the change
  • Audit trail and evidence management: does it document ownership, action and closure date for every obligation
  • Integration with existing QMS or GRC workflows: can obligations flow into tools the team already uses

From eight staff days a month to an audit-ready trail

A UK compliance program built on structured mapping can show a regulator exactly when an obligation was identified, assigned and closed, rather than simply confirming that it eventually was. That distinction is what closes the gap between the eight days a month UK businesses spend on compliance and the audit-ready trail regulators expect.