Regulatory Agencies Inventory and Attributes

Description — The enterprise’s assessed priority for compliance with this agency’s requirements — reflecting the consequence severity of non-compliance.

Benefit(s) — Drives governance investment proportional to compliance consequence. Critical agencies warrant immediate response to new requirements, dedicated legal counsel, and executive-level accountability. Low priority agencies can be managed through periodic self-assessment.

Source — Manual.

Examples — Critical (non-compliance threatens enterprise viability, operations, or market access), High (material financial penalties or significant operational impact), Medium (significant but manageable consequences), Low (minor or remote consequences)

Notes — Valid values: Critical, High, Medium, Low. Compliance Priority is a strategic designation set by the Enterprise Compliance Owner and reviewed annually. Distinct from Assessed Risk — Priority is the strategic designation; Risk is the operational probability-weighted assessment.

Description — The broader strategic significance of this agency relationship beyond immediate compliance obligations — for example, an agency whose regulatory posture directly shapes the enterprise’s product roadmap, market entry strategy, or technology architecture.

Benefit(s) — Identifies agencies whose requirements have strategic implications beyond compliance cost. A data protection authority whose guidance on AI processing shapes what products the enterprise can offer in a jurisdiction is strategically more important than its compliance priority rating alone suggests.

Source — Manual.

Examples — Very High, High, Medium, Low, Very Low

Notes — Valid values: Very High | High | Medium | Low | Very Low. Assessed annually by the Enterprise Compliance Owner in consultation with business leadership.