Policy
Legal and Regulatory Compliance Policy
This policy establishes the framework for identifying, interpreting, tracking, implementing, and reporting compliance with legal and regulatory obligations across all jurisdictions where the organization operates.
- Type
- Policy
- Version
- 1.0.38
- Date
- 2026-11-06
- Owner
- Chief Compliance Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Compliance Management
- Review frequency
- Annual and upon material legal, regulatory, or framework change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Governance and accountability
- 4. Compliance management system
- 5. Regulatory horizon scanning and change management
- 6. Risk assessment and treatment
- 7. Control design and evidence management
- 8. Reporting and notification obligations
- 9. Supplier and trade compliance
- 10. Monitoring, metrics, and review
- 11. Continuous improvement
- 12. Framework alignment
Frameworks it maps to
- ISO 37301:2021
- COBIT 2019
- CSA CCM v4.1
- ISO/IEC 27001:2022
- ISO 28000:2022
- BASC v6 (2022)
- WCO SAFE Framework (2025 edition)
- EU GDPR
- EU NIS 2 Directive (Directive (EU) 2022/2555)
- EU AI Act (2024)
- Canada PIPEDA
- Treasury Board Directive on Automated Decision-Making / Voluntary Code of Conduct on Generative AI (AIDA lapsed)
- NIST AI RMF 1.0
- ISO/IEC 42001:2023
Related documents
- Compliance, Audit, and CAPA Management Policycompliance
- Enterprise Governance and Risk Management Policyrisk
- Information Security Policysecurity
- Supplier and Cloud Governance Frameworksupply-chain
- Supplier Audit Proceduresupply-chain
- Security Incident Reporting and Escalation Procedureresilience
Next
All Documents