Regulatory Compliance Software: Six Categories and Their Rule Text

"Regulatory compliance software" is one label on six kinds of product. Some track rule changes. Some collect proof for security audits. Some manage a company's duties and risks. Some screen people and payments. Some prepare filings. Some supply the text of the rules. Pick by the job first. Then ask each vendor where its rule text comes from and when it was last checked. RegTech, short for regulatory technology, is the finance world's name for tech that helps firms meet rules.

Written and checked on 12 October 2026. This is general information, not legal advice; check the cited statute or opinion before relying on it.

Official text, as of 12 October 2026

• Citation: 45 CFR 164.308(a)(1)(ii)(A), part of the HIPAA Security Rule. HIPAA is the US health privacy law.
• Quote: "Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate."
• Source: the eCFR page for 45 CFR 164.308. The eCFR listed Title 45 as up to date as of 8 October 2026.
• What changed in 2025 and 2026: HHS proposed changes to the Security Rule on 6 January 2025 (90 FR 898, comments closed 7 March 2025). A search of the Federal Register on 12 October 2026 found no final rule and no withdrawal for that proposal. The Unified Agenda entry on reginfo.gov (RIN 0945-AA22, labelled 2026) lists the rule under "Long-Term Actions" with a final action date of July 2027. Check HHS before relying on the text.

TL;DR

• Six categories, six jobs. Name your job before you shop.
• "Compliance automation" can mean audit evidence for security standards such as SOC 2. That is a different job from legal research.
• Only one category supplies the rule text. The other five use it.
• One question sorts demos: where does the rule text come from, and when was it last checked?

What RegTech means and who uses the word

The word is used by financial regulators. The Financial Stability Board is a group that coordinates the work of national financial authorities. On 9 October 2020 it published a report on supervisory and regulatory technology. Its glossary defines RegTech as "any range of applications of FinTech for regulatory and compliance requirements and reporting by regulated institutions." The report says that for those institutions, RegTech "could improve compliance outcomes, enhance risk management capabilities and generate new insights into the business." The UK Financial Conduct Authority says it in one line: "RegTech applies to new technologies developed to help overcome regulatory challenges in financial services." That is on its RegTech page.

So RegTech is a label used by financial regulators. It names a use, and many kinds of product fit it.

Six categories at a glance

GRC means governance, risk and compliance. XBRL is a format that lets computers read reports. A vendor appears here only for a fact read on its own page. The table is a map. It ranks nothing.

What each category means in practice

Change tracking watches sources for new or changed rules. Our guide to regulatory change management walks through the five steps. Our post on monitoring covers the first step.

Compliance automation is where the phrase gets slippery. The Vanta page we read says its software helps "achieve and maintain alignment with the laws" and "translates requirements into easy-to-follow controls." The frameworks it names, such as SOC 2 and ISO 27001, are security standards that auditors check. That job differs from reading a statute.

GRC platforms are the filing cabinet for duties. The Archer page we read says its product can "turn dense regulatory text into structured, traceable obligations." In a GRC setup, each duty usually has an owner and a review date. Our post on regulatory mapping shows how a rule becomes a row.

Screening and monitoring tools check people and payments. ComplyAdvantage describes checks on customers, companies and payments. It also lists transaction monitoring. They work from lists and risk data.

Reporting tools help a company file what the law requires. CoreFiling says it helps "regulators, auditors and enterprises." The rule sets the format. The tool makes the file.

Rule content and data is the layer that holds the text. Everything above it uses this layer. The vendor may own the text, license it or read it from a government site.

One sentence, four tools

Take the sentence quoted at the top. It says a covered entity or business associate must run a risk analysis. Those are the rule's own words for the groups it binds. Whether it applies to your company is a question for your adviser.

• A change tracker watches the text. It would flag the January 2025 proposal, and any final rule if one appears.
• A compliance automation tool turns the sentence into a control, such as "annual risk assessment complete," and collects proof.
• A GRC platform stores it as an obligation with an owner and a review date.
• A content provider delivers the sentence itself, with the date it was last checked.

Three of the four use the sentence. Only one has to get it right at the source. The other three inherit any error. Our guide to the data sources behind compliance products compares the options.

Where the rule text comes from

There are six places a product can read from.

1. The Federal Register. The daily publication where US agencies announce rules, proposals and notices.
2. The eCFR. The current text of federal regulations, updated daily. Its own page calls it "an editorial compilation of CFR material and amendments published in the daily Federal Register." It calls itself an informational resource and says the aim is for it to be "officially recognized" in time. Ask any vendor how it treats that.
3. State registers and codes. Each state publishes its own rules and statutes, on its own schedule. Our state law update guide covers how.
4. Agency guidance pages. Agency explainers that help you read a rule. They are not the rule itself.
5. Court orders. A court can vacate a rule. Ask a vendor whether its text reflects the order.
6. Licensed feeds. Companies that collect and sort the above, then sell the result.

We read two vendor guides for this post, from Resolver and Vanta. They name categories and frameworks, and Resolver mentions content libraries and automated updates. The parts we read do not name the sources that supply the text underneath. Vaquill AI serves US federal and state primary law by citation through an API. That is the layer the change, GRC and content categories sit on. For the abbreviations, see USC vs CFR. The wider picture is in US Law Data: The Complete Guide.

Questions to ask any vendor

1. Which sources supply your rule text for US federal and state law, and how often is each one updated?
2. When a rule changes, can I see the old and new text side by side?
3. Does every requirement show its citation and the date it was read?
4. Is the text yours, licensed from someone, or taken from a government site? If licensed, from whom?
5. Which of the six jobs do you skip, so I can plan for it?
6. How do you handle a rule that a court vacated?

What goes wrong

• Buying audit software and expecting legal research. The two jobs differ.
• Buying a change tracker with no list of duties. Alerts land on nobody.
• Hearing "covers 40 frameworks" and assuming it covers your state's rules. Frameworks and state laws are separate things.
• Taking a vendor's summary as the rule. Read the sentence that binds you.
• No refresh date on the text you rely on.

FAQ

What is regulatory compliance software? Software that helps a business meet its legal duties. The job depends on the category. It may track rule changes, collect audit proof or file reports.

What is RegTech? Tech that helps firms follow the rules. The term is used by financial regulators such as the FCA and the Financial Stability Board.

How do compliance automation and rule-change tracking differ? Compliance automation tools often turn a framework into controls and collects proof for auditors. Change tracking watches for new rules and records the response.

Where does compliance software get its rules? From government sources such as the Federal Register and eCFR, from state sites, or from licensed providers. Ask the vendor which one, and how fresh it is.

Do I need an API for rule data? Only if you are building a product that has to apply rules. If you are buying a finished tool, the vendor handles the data layer.

Is compliance monitoring software the same as rule monitoring? Not always. The words also name tools that watch security and payments.

How do I compare vendors fairly? Use the six questions above and describe your job in your own words first.

For the US statutes, regulations and court rules these laws sit in, see the US primary law API.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill AI: the pipelines that pull statutes, regulations and court rules from every US jurisdiction's official publisher, and the REST API, MCP server and open dataset that serve them.