# Regulatory intelligence for AI: what changed, and by when. > Regulatory intelligence in ColossalX keeps AI governance current with the rules. It watches the regulator pages you choose, lists new circulars as candidates for a person to read, loads reporting duties for the jurisdictions you operate in, cross-maps controls across frameworks and puts dated milestones on one calendar. Watch regulators, load the duties that apply where you operate and keep one calendar, with India's DPDP, SEBI and IRDAI beside the EU AI Act. Canonical page: https://colossalx.tech/platform/regulatory-intelligence · Last reviewed: 7 Oct 2026 *Illustration:* Regulatory clock · dated: 2 Aug 2026 AI Act Article 50; 13 Nov 2026 DPDP consent managers; 13 May 2027 DPDP core obligations; 2 Dec 2027 AI Act Annex III. ## The threat and the control - **The threat:** A regulator publishes a circular, and nobody on your team has read it when the deadline arrives. - **The control:** ColossalX watches the pages you choose, lists new circulars for a person to read, and runs the clocks. ## How it works: From a regulator page to a deadline you can meet. One regulator update followed from a watched page to a person who reads it, a reporting clock that warns, and a date on the calendar. ### Workflow: a regulator update, read and tracked (illustrative) 1. **Page watched.** A regulator page is watched; the first check records a baseline. Regulator: SEBI, circulars page; Check: daily, and on demand; First check: baseline recorded | Watching 2. **Candidate listed.** A new listing arrives as a candidate, not yet read. Circular listing · Not yet read | A matched reference means it is worth reading, not that it is content. 3. **Person decides.** A named person reads it and decides what applies. Compliance lead: Read the circular, confirmed it applies | Confirmed by a person 4. **Clock and calendar.** Reporting duties run on clocks that warn, and land on the calendar. Duty: initial report to the regulator; Strictest: sets the operative target | Due within the hour · On the calendar | x, accounted for ## What you see: What is watched, what is due, what is dated. Watched pages with their candidates, a reporting clock with its stages, and the calendar of dates the workspace actually carries. 1. **Watch the regulators.** Watch regulator pages; new listings arrive as candidates, not as content. Add a regulator page, check now, or let the daily check run. The first check records a baseline and later checks list newly listed references. A page that cannot be read says so, and one built with scripting is reported not detectable, never unchanged. 2. **Say where you operate.** Countries, sector and entity type load the rulebook that applies. Jurisdiction packs cover global, India, EU and US duties. Where packs overlap, every regulator's duty is kept and the strictest sets the target. The rulebook is sealed and re-checked when it is read, and each change to the profile keeps its reason. 3. **Run the clocks.** A person starts a reporting clock; stages warn before they are missed. Start a clock from a rule in the rulebook against an incident, an issue or a manual event. Each stage shows its deadline, takes the regulator's reference when submitted, and raises an alert when due within the hour or missed. A person starts a clock; an incident does not. 4. **Map and schedule.** Controls cross-map across frameworks; deadlines land on one calendar. AI-governance controls carry clause references across the EU AI Act, NIST AI RMF, ISO/IEC 42001 and NIS2, so one piece of evidence serves several asks. The calendar lists real dates only: framework targets, audits, evidence expiry, clock stages, finding due dates and risk acceptance expiries. *Illustration:* An illustrative regulatory watch: three watched regulator pages, one with a new listing not yet read, one with a baseline recorded and one not detectable, beside a reporting clock with two stages and a calendar of milestones from the workspace's own records. Notes: 1. New listings arrive as candidates 2. Stages warn before they are missed 3. Dates from your own records only ## How we know - A new listing arrives as a candidate not yet read, never as compliance content. - A page that renders with scripting is reported not detectable, never unchanged, and a failed read says so. - Where jurisdiction packs overlap, every regulator's duty is kept and the strictest sets the target. - The calendar holds only dates from real records, and an empty calendar says why. ## Where a deadline goes next. A date or a duty is not the end: it feeds the audit plan, the calendar and the score. - **The audit plan.** A regulatory trigger can open an audit, and its plan dates and finding due dates reach the calendar. - **Compliance and AI governance.** Frameworks, controls and policies read the same dates and the same cross-mapped clauses. - **Consent at runtime.** Withdrawn consent is enforced on the next AI request carrying that person's data, not only recorded. - **The trust score.** The compliance pillar of the score reads the same position. Where an x ends up: x, accounted for. ## Specs: delivery and data - **Delivery:** SaaS, from one login. - **Isolation:** Each customer runs in an isolated workspace with its own database. - **Certifications:** None held. Frameworks are mapped to and assessed against. ## Frameworks - Mapped to EU AI Act: Controls cross-mapped, with dated obligations. - Mapped to India DPDP: Mapped, with consent enforced at runtime. - Mapped to SEBI cyber circulars: Circulars mapped; regulator page watched. - Mapped to IRDAI cyber circulars: Cyber circulars mapped; page watched. - Cross-mapped to NIS2: AI controls cross-mapped to it. ## What it does not do - Jurisdiction packs are starting content for your counsel to review, not legal advice. - Only Indian circular references are recognised so far, and confirming a candidate has no screen yet. - A clock is started by a person; an incident does not start one by itself. - The watch spots new listings; it does not read or summarise the circular. *Illustration:* Jurisdiction pack · stated plainly: Pack content Starting content; Counsel review Yours to do; Overlaps Strictest wins, others kept; Status Shown on screen. Not legal advice. ## Questions ### How does ColossalX track regulatory change? You choose the regulator pages to watch. The first check records a baseline and later checks list newly listed references, which arrive as candidates for a person to read, never as unverified compliance content. It does not read or summarise the circular, and it says so when a page cannot be read. ### Which AI regulation dates should we plan around? According to the sources on our clock, the EU AI Act Article 50 transparency obligations apply from 2 Aug 2026 and Annex III high-risk obligations from 2 Dec 2027. India's DPDP consent manager rules start on 13 Nov 2026 and the core obligations on 13 May 2027. EU decisions can move these dates, so confirm with counsel. ### Does ColossalX map to SEBI and IRDAI circulars? Yes. The SEBI and IRDAI cyber circulars are mapped frameworks beside India's DPDP, the EU AI Act, ISO/IEC 42001 and NIST AI RMF, and their regulator pages can be watched. The mapped content is starting content for your counsel to review, not legal advice, and mapping is not a statement of conformity. ### What is a regulatory reporting clock? A regulatory reporting clock counts down the stages of an incident-reporting duty, such as an initial notice and a fuller report, from the moment you became aware. In ColossalX a person starts a clock from a rule in the rulebook for your jurisdictions, each stage shows its deadline, and an alert is raised when one is due within the hour or missed. ### What does cross-mapping mean for AI governance? Cross-mapping links one control to the clauses it supports in several frameworks, so one piece of evidence can answer more than one ask. ColossalX carries clause references across the EU AI Act, NIST AI RMF, ISO/IEC 42001 and NIS2 for its AI-governance controls. Framework control sets are baselines, not clause-by-clause mappings. ## Related - [Compliance and AI governance](https://colossalx.tech/platform/compliance) - [Audit](https://colossalx.tech/platform/audit) - [Frameworks](https://colossalx.tech/frameworks) ## Sources - Jones Walker, AI law blog: EU AI Act Article 50 transparency obligations apply, 2 Aug 2026: https://www.joneswalker.com/en/insights/blogs/ai-law-blog/yes-august-2-still-matters-the-eu-approved-a-high-risk-ai-delay-but-most-trans.html?id=102nbon - PIB, DPDP Rules 2025: India DPDP consent manager rules start, 13 Nov 2026: https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf - PIB, DPDP Rules 2025: India DPDP core obligations start, 13 May 2027: https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf - Gibson Dunn: EU AI Act Annex III high-risk obligations apply, 2 Dec 2027: https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/ --- ColossalX is an AI security and governance platform from Quantexra Labs LLP, delivered as SaaS. Book a walkthrough: https://colossalx.tech/demo · client.success@quantexra.tech