Obligations register

An obligations register is a structured record of every discrete legal and regulatory obligation an organization must meet, one row per obligation. Each row carries the source citation at clause level, the obligation text, the organization's interpretation, a named owner, mapped controls, a compliance status and review dates. It is the usual way to hold the documented information about compliance obligations that ISO 37301:2021 clause 4.5 asks a compliance management system to maintain and keep current.

A row per law ("GDPR: compliant") cannot be tested; a row per obligation ("Article 30: maintain a record of processing activities") can be sampled against evidence. Registers built at instrument level tend to fail the first audit sample.

Three neighbors are often confused with it:

• A legal register, from the environmental, health and safety tradition, lists applicable legal requirements by instrument.
• A risk register records uncertainties and their mitigations. Obligations map to controls; risks map to mitigations.
• Prescribed supervisory registers, such as the DORA register of information on ICT third-party arrangements required by Article 28(3) of Regulation (EU) 2022/2554, record contracts rather than obligations. They do show the direction of travel: supervisors increasingly expect structured, line-item registers they can sample.

A register stays useful only if it changes when the law does. Fields for effective date, last reviewed and next review make staleness visible, and a link from each row to the regulatory change log entry that created or amended it keeps the history traceable. The mapped-controls field is where regulatory mapping is recorded, and an empty one is likely to end up as an audit finding.

A free 28-field template with worked DORA rows is in our regulatory obligations register template.

This entry is general information, not legal advice.