Regulatory Obligations Register Template: How to Build One That Survives an Audit

A regulatory obligations register is a structured record of every discrete legal and regulatory obligation your organization must meet. Each row carries the source citation, the verbatim obligation text, your interpretation, a named owner, mapped controls, a compliance status and a review date. It is the customary way to produce the documented information about compliance obligations that ISO 37301:2021 clause 4.5 asks a compliance management system to maintain. Below is a free, ungated 28-field template, annotated field by field, with six populated rows from DORA.

The substance columns decide whether a register is useful, but the change-management columns (effective date, as-of date, last reviewed, next review, in-force status) decide whether it survives an audit. Registers tend to fail scrutiny on freshness and traceability, not on missing content, which is why those five fields sit in a group of their own.

Since 2025, regulators collect registers in prescribed formats, so "we have a spreadsheet" no longer clears the bar

The structural change is that regulators stopped taking documentation on faith and started collecting registers in prescribed formats. Under DORA Article 28(3), financial entities "shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers" (Regulation (EU) 2022/2554, applying since 17 January 2025). That register follows the 15 templates prescribed in Commission Implementing Regulation (EU) 2024/2956, entities report on it annually and must produce the full register on request, and national competent authorities passed the first industry-wide collection to the ESAs by 30 April 2025. The cycle repeats: for 2026 the reference date is 31 December 2025, with competent authorities reporting to the ESAs by 31 March.

In Australia, Prudential Standard CPS 230 commenced on 1 July 2025 and requires a register of material service providers. The first submission, on APRA's preferred template, was due on 1 October 2025, and transitional relief for pre-existing contracts ended on 1 July 2026 at the latest. APRA finalized targeted amendments to CPS 230 on 30 April 2026, and the register duty remains annual. GDPR Article 30 has required a record of processing activities with seven prescribed content categories since 2018 (Regulation (EU) 2016/679), and the Article 30(5) derogation for small organizations falls away when processing is not occasional or is likely to be risky, which in practice is almost always. A pending EU simplification package, Omnibus IV, would raise that threshold to 1,000 employees and limit the exceptions to high-risk processing and to core activities that require a data protection officer; the co-legislators provisionally agreed it in June 2026, and as of 1 October 2026 it has not been adopted.

Be precise about what these precedents are. The DORA register is a register of ICT contracts and the CPS 230 register is a register of service providers; neither is an obligations register. They do establish the direction of travel: regulators now think in structured, line-item, submittable registers, and they sample rows against source documents. The supervisory expectations were already in place. FCA SYSC 6.1.1R requires a firm to "establish, implement and maintain adequate policies and procedures sufficient to ensure compliance of the firm … with its obligations under the regulatory system" (FCA Handbook, current text as of 30 September 2026), and ASIC's Regulatory Guide 104 expects AFS licensees to document their compliance measures and review them regularly. Taken together, they make an instrument-level, undated and owner-free obligations register worthless as evidence.

The clock is also unforgiving. CUBE's Cost of Compliance Report 2025, a survey of more than 2,000 compliance, risk and legal leaders across 11 markets, found that 74% of firms need more than a year to implement a new regulation. That is slower than the pace at which regulators now expect a current register.

One clarification before the template, because the terms get conflated. A legal register is the environmental, health and safety tradition: the ISO 14001 and ISO 45001 management-system standards ask organizations to determine the legal and other requirements that apply to them and keep track of them, and EHS teams have kept instrument-organized registers for decades. (ISO published a new edition of ISO 14001 in April 2026, replacing the 2015 edition, so check the current clause numbering before you cite it.) An obligations register in the ISO 37301 sense is broader (all compliance sources, including industry codes and voluntary commitments) and more granular (obligation-level, not instrument-level). A risk register is a different object entirely: it records uncertainty. Obligations map to controls and risks map to mitigations, so link the two registers rather than merging them.

The template is 28 fields in five groups, and only group E survives an audit

The Excel file is free and needs no email address. It has five sheets: a READ ME with field definitions and usage rules, the Obligations Register itself (28 annotated fields with dropdown validation), a Worked Example with six populated DORA rows, a Reference Lists sheet that feeds the dropdowns, and a Changelog. One rule governs everything else in the file: one row is one obligation, not one law. More on why below.

This is the full field list:

Group E is the group that is easiest to skip and hardest to reconstruct later. In an audit, someone samples rows and asks two questions, "is this still what the law says?" and "how do you know?" Fields 24 to 28, plus the changelog sheet, are the only fields that answer the second question.

A worked DORA register turns one regulation into six independently testable rows

Populated rows teach more than abstract field lists. The example sheet carries six obligations from DORA (Regulation (EU) 2022/2554, applying since 17 January 2025) with all 28 fields filled. Here is the substance of those rows, with the verbatim text checked against the regulation as of 30 September 2026:

Three things this example teaches that a blank template can't.

The applicability-trigger field earns its place immediately. Rows OBL-DORA-021 and OBL-DORA-028 carve out microenterprises, and Art 28(2) additionally excludes entities under the simplified framework in Article 16(1). Copy the obligation without the trigger and a microenterprise (DORA Article 3(60): fewer than 10 people and no more than EUR 2 million in turnover or balance sheet total) "owes" duties it doesn't, while a group register misses that one subsidiary qualifies for the carve-out and another doesn't. Instrument-level registers erase that row-level nuance.

One regulation, six different kinds of work. Governance, an operational process, an event-driven report, a periodic testing program, a strategy review, a maintained register. Each needs different owners, frequencies, controls and evidence. That heterogeneity is the argument for obligation-level rows, made by the regulation itself.

Row OBL-DORA-029 is a register entry mandating a register. The obligation to maintain DORA's register of information belongs in your obligations register, with an owner and an evidence location like any other row. The circularity shows that "maintain a structured record" is now itself a supervised obligation, not back-office hygiene.

Assessing what a change like DORA actually costs you, row by row, is its own discipline. The companion piece with a worked DORA impact assessment is the regulatory change impact assessment template.

One row per obligation, not per law: instrument-level rows are how registers fail

The most common failing register has a row that says "GDPR," a row that says "DORA," an owner column that says "Legal," and a status column that says "Compliant." That register cannot be tested.

The reasoning is mechanical. ASIC's RG 104 expects licensees to document measures showing how they meet their general obligations, implement and monitor those measures, and review them regularly, which presupposes measures that address specific requirements, not a green checkmark on an Act. Certification audits under ISO 37301 work the same way: the auditor picks an obligation and follows it to a control and to evidence. And where regulators collect registers directly, they prescribe line-item granularity; the ESAs' implementing standards for DORA's register of information template it down to individual contractual arrangements.

To test whether your granularity is right, ask whether each row can be assigned to one named owner, mapped to identifiable controls, and marked compliant or not independently of its neighbors. "DORA: compliant" fails all three. The six rows above pass.

The cost of getting this right is real. DORA decomposes into dozens of rows, not six, and the example sheet is deliberately a starter, not a full regulatory mapping of the regulation. That cost is also the honest argument for automation.

Five more ways a register dies in the first sample test

Granularity is failure mode number one. The next five, in the order auditors tend to find them:

2. No verbatim text. A register of paraphrases is a register of opinions. The auditor opens the official link (field 8), reads the clause, and compares it to what you wrote. When your paraphrase says "report incidents promptly" and Art 19 says "in accordance with paragraph 4," the gap between those is a finding. Verbatim text plus a separate interpretation field gives you both fidelity and usability.

3. A team as owner. "Compliance" as owner means the interview question "who is responsible for this obligation?" gets answered with silence or with three people pointing at each other. Use named individuals, with the second-line contact recorded separately so ownership and oversight don't collapse into one cell.

4. No as-of dates. This failure kills registers that were good when built. CUBE's report (published 4 November 2025) found that 74% of firms need more than a year to implement new regulations, so a register reviewed annually is structurally behind the change it exists to track. The fix is two cadences: a scheduled review (every row, at least annually, recorded in fields 26 and 27) and change-driven updates the moment a source is amended, which requires a monitoring process feeding the register, not a calendar reminder. How teams wire that feed is covered in how compliance teams track regulatory changes, and catching obligations before they're in force is the job of horizon scanning.

5. Merging it into the risk register or the controls library. The three objects answer different questions (what must we do, what could go wrong, what do we operate), and merging them always subordinates obligations to whichever function owns the merged document. Keep the register sovereign and link by ID.

6. N/A without justification. "Not applicable" is a legal conclusion, and auditors treat it as the highest-risk value in the status column because it is the one nobody re-tests. Every N/A needs the applicability trigger it fails and the date someone last checked; without them, it's an untested assumption with a green light on it.

The changelog sheet (date, what changed, source, who changed it) is the sixth defense rolled into one artifact: it converts "trust us, we maintain this" into a regulatory change log an examiner can read.

A spreadsheet register is a snapshot; the update loop is the product

To be plain about the incentive: RegWatch sells software for exactly the update loop this section is about. The spreadsheet above is still free and sufficient for a register of a few hundred rows in a handful of jurisdictions. Start there, and see the regulatory change tracker spreadsheet for the upstream tracking companion.

A spreadsheet cannot keep field 25 honest as the footprint grows. Every alert about a change is a potential edit to somebody's register: a new row, an amended verbatim text, an in-force status flip. Keeping those edits current by hand gets harder with every jurisdiction added, and a register that goes quietly stale keeps looking authoritative.

The loop we build works like this. A Watchlist defines what you monitor and how often. Scheduled runs pick up new items inside strict date windows and save each as a Finding with its source URL, dates and a verbatim excerpt. Triage then decides, finding by finding and against your company profile, which ones become alerts; accepted items carry a plain-language "Why this matters," and suppressed ones are kept on record. An accepted Alert converts to an Obligation in one step, with an owner, an effective date, an evidence area, a history and a discussion thread, and the calendar shows the dates. The human stays on the judgment calls: interpretation (field 10), status (field 22), and whether the agent's reasoning holds. Those decisions go to a tamper-evident, append-only audit log, because a register updated by a process you can't explain is no more audit-proof than one updated by an intern you didn't supervise.

Populate one regime end to end, with named owners, before you go broad

To stand up a register from zero, work in this order:

1. Download the template and read the READ ME sheet with your second line in the room. Agree on the dropdown values in the reference sheet before populating anything; retrofitting taxonomy onto 400 rows is misery.
2. Populate one regime end to end before going broad. Pick the regime with your nearest deadline and decompose it to obligation level, the way the DORA sheet does. One complete regime teaches your team the granularity standard.
3. Assign named owners at populate time, not after. A row without an owner at creation stays ownerless. If no name fits, that absence is itself a gap; record it in field 23, not a blank cell.
4. Date every row and start the changelog the same day. The register's audit value begins the day field 25 starts being true, and a register is never finished.
5. Decide the feed before the register outgrows the review cycle. Whether it's a weekly manual scan or an agent, something has to push amendments into group E faster than annually. The CUBE numbers say the firms that skip this step run more than a year behind.

Everything in this template works with the spreadsheet alone. The change-management columns are just a lot easier to keep honest when something is watching the sources for you.

Its impact-assessment and tracker companions are filed with it in our trackers and templates library.

This article is general information, not legal advice.