Regulatory change does not arrive at once. It keeps on arriving.

One of the assumptions that still appears in a lot of compliance programmes is that regulatory change has a beginning and an end. A regulation is published. A project is launched. Policies are updated. Controls are reviewed. The programme closes.

On paper, it's a logical way to work. The difficulty is that regulation rarely behaves like that anymore. Publication has become one milestone in a much longer conversation. That conversation might continue for months, sometimes years.

Anyone involved in a major regulatory programme over the past few years will probably recognise the pattern. The regulation arrives. Then come the questions. Industry bodies begin asking for clarification. Regulators publish additional guidance. Conference speeches add context. The first supervisory reviews reveal where attention is really being focused. Eventually, enforcement activity starts to define the practical expectations more clearly than the original publication ever could. Nothing about that process feels like a single project.

CPS 230 is a useful example. Most institutions understandably concentrated on the publication of the standard and the implementation deadline. But that wasn't really the end of the story. It was the point where the conversation began to gather pace. As firms worked through implementation, APRA continued engaging with industry. Questions emerged. Clarifications followed. Expectations became clearer as practical issues surfaced.

That's not unusual. Increasingly, it's how significant regulation evolves. The regulation establishes the framework. Everything that follows explains how the framework is expected to operate in practice. Perhaps that's why the phrase "regulatory change" is starting to feel slightly misleading.

The regulation may not change again for years. The expectations often do. That's an important distinction. One creates a legal obligation. The other shapes supervisory judgement. Compliance teams have always monitored regulations. Increasingly, they're also monitoring how regulators communicate after publication. That creates a different challenge.

Access to regulatory information isn't really the problem anymore. Deciding what matters is. Most organisations receive the same publications at roughly the same time. The difficult part is deciding what deserves attention. Which developments genuinely alter expectations? Which simply provide additional context? Which require action? Those decisions rarely come from reading a regulation in isolation. They're formed gradually as the regulatory conversation develops.

There's another consequence that receives less attention. Treating regulatory change as a project encourages organisations to think in terms of completion.

Projects finish.
Conversations don't.

When regulatory expectations continue to evolve, declaring a programme "complete" becomes increasingly difficult. Implementation may end. Interpretation rarely does.

None of this makes project management less important. Far from it. Major regulatory programmes still need structure, governance, and clear accountability. What's changing is everything around them. The period after publication is becoming just as important as the publication itself. In some cases, more important. Perhaps that's the real shift.

For years, the challenge was implementing regulation. Increasingly, it's keeping pace with the conversation that follows. Organisations that recognise that shift will be better prepared for whatever comes next.

The regulation may be published once.
The change keeps arriving.