A control you tested once and never checked again is not a control. It is a memory. Regulators know this, which is why almost every framework is built around cadence rather than one-time proof. Access reviews, policy attestations, vendor reassessments, and evidence refreshes all have to happen again, and
The regulatory grey zone for crypto in the United States is closing. In its 2026 Unified Regulatory Agenda, the SEC placed three crypto-focused rulemakings at the Proposed Rule Stage, each carrying a target date of July 2026. If your firm issues, custodies, or trades digital assets, these proposals will
GDPR
An auditor-grade GDPR compliance checklist for SaaS companies and startups: who is in scope, lawful bases, data subject rights, international transfers, breach rules, and a 10-step plan.
A fractional compliance officer's problem is not knowledge. It is surface area. One person now carries the regulatory obligations of six, eight, sometimes ten organisations at once — each with a different framework, a different maturity level, a different regulator asking different questions on a different timeline. The skill
Compliance
Email was never designed to be a system of record. Here's why evidence-by-email fails under audit pressure — and what a control-to-evidence register looks like instead.
Ninety-three controls. Four themes. Ten management clauses. That is what ISO/IEC 27001:2022 actually asks of you — and none of it is optional if certification is the goal. Most organizations that fail their Stage 1 audit don't fail because their security is weak. They fail because
A freelance compliance consultant juggling five clients is, in practice, running five parallel control environments out of one laptop. Each client has its own framework, its own evidence folder, its own version of "the tracker," and its own habit of emailing you a renamed copy of last quarter&
The Digital Operational Resilience Act — DORA — entered into force across the EU on 17 January 2025. For banks, investment firms, insurance companies, payment institutions, crypto-asset service providers, and their critical ICT third-party providers, this is not a regulation to prepare for. It is a regulation to be compliant
The EU's Markets in Crypto-Assets Regulation — MiCA — is no longer on the horizon. It is here. For crypto-asset service providers (CASPs), issuers of asset-referenced tokens (ARTs), and e-money token (EMT) issuers operating in or serving European markets, the compliance clock is running. The firms
News
This is regentcomply.ai, a brand new site by Kevin that's just getting started. Things will be up and running here shortly, but you can subscribe in the meantime if you'd like to stay up to date and receive emails when new content is published!