Free Regulatory Change Tracker Spreadsheet, and When You'll Outgrow It

Below is a free regulatory change tracker spreadsheet: an ungated Excel workbook with five tabs, a 25-field change log, worked rows for the EU AI Act and DORA, a dedicated emerging-regulations tab, and no macros. Take it, no email required. But field audits since 1997 found errors in 91% of the 54 real-world spreadsheets examined (Panko's review of the evidence, presented at EuSpRIG in 2000), and 79% of compliance departments run on spreadsheets anyway (Regology, 2024).

A spreadsheet is the correct tool below roughly two jurisdictions, one regime and a weekly review cadence. Beyond that it fails for structural reasons: no audit trail, silent staleness, single-owner risk, no deduplication. The workbook is the best possible version of the spreadsheet, with a scored diagnostic for the day it stops being enough. You will find it in our trackers and templates hub next to our other templates.

Most compliance teams run on spreadsheets, and field audits find errors in most spreadsheets

Regology's 2024 State of Regulatory Compliance survey (a vendor survey of mid-to-senior professionals, 89% US-based) found that 82% of compliance departments rely on manual processes and 79% on spreadsheets. Wolters Kluwer's 2025 Regulatory and Risk Management Indicator (December 2025) found that 88% of US banking respondents use manual processes or spreadsheets "often" or "sometimes", and 63% plan investment in automating regulatory change management. The spreadsheet is the incumbent.

The problem is what audits find when they open the incumbent. Ray Panko's long-running research program on spreadsheet error, summarized in his paper for the European Spreadsheet Risks Interest Group, reports that field audits since 1997 found errors in 91% of the 54 real-world spreadsheets examined (the audits used different error criteria), with cell error rates between 0.4% and 2.5% in the audits that reported them, and at least 1% to 2% in experiments (arXiv:0802.3457). The finding I quote most, because nobody believes it applies to their tracker: in an experiment Panko describes, student developers estimated a median 10% chance that they had made an error, yet 86% had. At that base rate, your tracker is probably wrong somewhere, and you probably don't think it is.

When spreadsheets carry regulatory weight, the failures are documented. Public Health England left 15,841 positive COVID-19 cases out of its reported daily figures between 25 September and 2 October 2020, delaying contact tracing for them. Press reports traced it to legacy .XLS files capped at 65,536 rows, with multi-row case records meaning each sheet silently truncated at roughly 1,400 cases (The Register, 5 October 2020); officials at the time cited file size and a legacy system. JPMorgan's own task force found that the CIO's value-at-risk model ran through Excel spreadsheets "completed manually, by a process of copying and pasting" data between them, and that a formula divided by the sum instead of the average of two rates, muting volatility by a factor of two, ahead of losses that reached about $5.8 billion by 30 June 2012 (Task Force report, January 2013). Neither team was careless. The tool has no guardrails, so discipline is the only control, and discipline does not scale. So the template is the most disciplined spreadsheet you can run, built to tell you when discipline stops being enough.

The tracker has five tabs and 25 fields, with no macros and no email gate

The workbook is free and ungated. It works in Excel and Google Sheets; it uses dropdowns and conditional formatting only, and deliberately no macros, because compliance IT policies block them.

Each of the 25 columns exists because something specific goes wrong without it

A regulatory change log is a decision record, and every field earns its place by preventing a named failure.

Three of these deserve more than a table cell.

Published and effective dates are different facts, and conflating them is the most common tracking error

Regulators republish: corrections land, consolidated versions replace originals, page dates silently change. A consolidated text on EUR-Lex carries its own consolidation date, which is not the date the law was adopted or the date it applies. Article 64 of Regulation (EU) 2022/2554, for example, says DORA entered into force in January 2023 and applies from 17 January 2025 (EIOPA confirms); a tracker with one date column will hold whichever of those a person happened to copy. AI agents and experienced humans alike mis-date a change when the source shows the republication date. Two columns force the question "which date is this?" every time.

The applicability rationale is the column an auditor actually reads

"Out of scope" with no reasoning is indistinguishable, two years later, from "nobody looked." One sentence, such as "Out of scope: we are not a GPAI model provider; re-assess if we fine-tune and redistribute," turns a dismissal into evidence of a functioning process.

The obligation column is where a log becomes management

Tracking a change and acting on it are different disciplines, and that is the distinction between a change log and regulatory change management. Every in-scope row should produce an entry in an obligations register with an owner and a deadline, governed by your change management policy. A log where in-scope rows end at column 16 is a diary.

Three worked rows show what a finished entry looks like as of 30 September 2026

The workbook ships with filled-in rows so nobody has to guess what "good" looks like. They are condensed here (the file carries all 25 fields, plus a US Federal Register final-rule row):

The AI Act's moving timeline shows why the README tab has a changelog. Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk obligations to 2 December 2027 (stand-alone Annex III systems) and 2 August 2028 (systems embedded in Annex I products), while the GPAI obligations kept their 2 August 2025 date. A row for this regime needs an "as amended" note and a near-term next-review date. A static PDF template cannot tell you that; a dated, changelogged register can.

The Horizon tab is your emerging-regulations tracker

Most of what will hurt you in 2027 is visible in 2026, in consultations, work programs and the regulators' own forward pipelines. The Horizon tab tracks items before adoption: Item, Jurisdiction, Stage, Expected next milestone and date, Pipeline source, Likely impact (H/M/L), Watch trigger ("promote to Change Log when...") and Watch owner.

The watch trigger keeps the tab from becoming a graveyard of interesting links: "promote when the final rule publishes in the Federal Register" is an instruction; a bookmark is not. Feed it from free regulator pipelines: the Unified Agenda (semiannual in principle; the edition after Spring 2025 was the 2026 Regulatory Plan and Unified Agenda, published in July 2026, and no edition was labeled Fall 2025) for planned US federal rules, and the FCA-hosted Regulatory Initiatives Grid, whose 10th edition (19 May 2026) tracks 135 live initiatives over a two-year pipeline. This tab is deliberately minimal regulatory horizon scanning; when the pipeline becomes its own workstream, graduate to the full horizon-scanning template.

The Sources tab is the free detection layer, because regulators already run the alerts

Regulators operate free alert infrastructure themselves, and that is what makes a $0 tracker workable. The Sources tab (Source, URL, Channel, Check frequency, Owner, Last checked) ships pre-filled with:

• Federal Register email subscriptions: per-agency and per-topic alerts on every proposed and final rule. For scale, 2024 set an all-time record at 106,109 pages and 3,248 final rules (OFR data via CEI), and 2025 fell to 60,917 pages and 2,441 final rules (CEI, 2026), so volume moves in both directions.
• Regulations.gov and the reginfo.gov Unified Agenda for the US pipeline.
• EUR-Lex saved searches, plus EBA and ESMA update pages.
• FCA Regulatory Initiatives Grid dashboard for the UK pipeline.

Add a free-tier page-change monitor for regulator pages with no feed (Visualping's free plan covers 5 pages and Changeflow's 3 sources, as of 30 September 2026), and detection is solved for $0. What is not solved for $0 is triage, deduplication and follow-through, which is exactly where the scorecard starts scoring against you. For the full range of methods, see how compliance teams track regulatory changes.

Five mistakes quietly corrupt a regulatory change log

1. One date column. Covered above; the republication trap. Two columns, always.
2. Logging the commentary instead of the instrument. If column 3 holds a law firm's client alert, your log inherits their scope decisions and errors. Link the regulator; cite the blog in Notes.
3. Decisions without rationale. "Out of scope" with an empty column 14 fails the only audit question that matters: how do you know?
4. No master copy. The moment "RC_tracker_v3_FINAL_amended.xlsx" is emailed, you have forked your compliance record. Keep one file in one location, with one changelog.
5. Conditional formatting as a substitute for cadence. Red cells only work if someone opens the file. A tracker with no fixed weekly review and named backup goes stale silently, which is worse than none, because people trust it. This is the failure Panko's 86% figure predicts, because the file feels current.

Ten questions tell you whether you have outgrown the spreadsheet

Tab 5, rendered in full. Score each question 0 (no or never), 1 (sometimes) or 2 (yes or routinely); the workbook auto-sums.

0 to 6: Keep the spreadsheet. It is the correct tool at your scale. Adopt the controls above (two date columns, rationale on every dismissal, a reviewer, a weekly cadence) and re-score quarterly.

7 to 12: Your tracker is now a risk register of its own. Either enforce discipline hard (a single master copy, a mandatory reviewer, a changelog entry on every edit) or go hybrid: automate detection so humans only do triage and follow-through.

13 or more: You have outgrown it. These thresholds are my rules of thumb, not a standard, but the logic is arithmetic. At more than 20 changes a month across more than 3 jurisdictions with more than 3 editors, the missing structural features (audit trail, deduplication, staleness alarms, access control) cannot be disciplined into existence.

The bands are positions; if you think your team beats the 86% base rate at 13 or more, I would like to see the file.

The spreadsheet is the manual version of what our agents populate

Full disclosure: RegWatch sells the software side of this conversion path. I am comfortable shipping a free spreadsheet because its columns map one to one onto the objects our platform maintains. Columns 3 and 4 are a Source, tracked with a health status. A hit from your weekly check is a Finding, with its URL, dates and a verbatim excerpt. Columns 12 to 15 are an Alert, except that our triage writes "Why this matters" in plain language for every item it accepts, and dismissing an alert requires a written reason, because a decision without inspectable reasoning fails the same audit test your column 14 exists for. Column 17 is an Obligation with an owner and an effective date; column 23 is Evidence; and the changelog tab is the audit log, which in the product is a tamper-evident, append-only record.

That is also where the crossover sits. A spreadsheet has no way to notice a new instrument across a dozen regulators, deduplicate it against the three law-firm alerts that mention it, and tell you why it does or does not apply to you. Someone has to do that reading, and the scorecard measures when that someone runs out of hours.

At 13 or more, buy against these criteria, in order: coverage of your source list, not the vendor's; recorded, inspectable reasoning for every accept and dismissal; deduplication across sources; a native change, obligation and evidence loop; and an audit trail you didn't build yourself. Our tools comparison applies those criteria across the market, ours included.

At 0 to 6: take the workbook, subscribe to the four free regulator channels this week, and run the weekly review. That is a real, defensible program at your scale, costing nothing but discipline.

This article is general information, not legal advice.