# How should US regulatory change influence the roadmap?

**Use configurable obligation management rather than coding assumptions about unfinished proposals into the platform.** The proposed interagency third-party guidance emphasises proportionate risk management; the OCC says it would not create enforceable standards. HHS’s Security Rule proposal page likewise does not establish a new final-rule compliance deadline. Neither source supports assuming a compulsory Q1 2027 GRC-platform replacement. ([occ.gov](https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-46.html?utm_source=openai))

For existing requirements, the September NYDFS guidance offers a more immediate evaluation question: can the organisation preserve a repeatable assessment methodology and show the reasoning behind its conclusions? The guidance expressly says it creates no new obligations. ([dfs.ny.gov](https://www.dfs.ny.gov/industry_guidance/industry_letters/il20260910-cyber-risk-assessment))

**Recommended obligation-register fields:** source, legal entity, applicability owner, status, effective date where established, review date, linked controls and approved interpretation. Keep “proposed”, “final”, “guidance” and “internal policy” distinct.