Many facilities and compliance teams operating today treat “regulatory risk” and “compliance risk” as if they were interchangeable. This is a concern given that, while regulatory risk and compliance risk are closely connected, they are not the same thing.
Confusion as to the distinctions between the two terms can lead to a given organisation’s personnel either over-reacting to every legislative headline or presuming that treating day-to-day checks as routine admin will keep the organisation safe.
So, let’s make clear the distinction. Regulatory risk is the danger that the rules themselves will change. Compliance risk is the danger of failing to comply with the rules as they presently stand. Grasping this difference is vital for all manner of teams operating across such sectors as social housing, healthcare, education, and more.
This article will define both types of risk with examples. It will set out the key differences between the two, in addition to explaining why the difference matters, and the practical steps that organisations can take to manage both.
What is regulatory risk?
Regulatory risk is the possibility that changes to laws, regulations, guidance, or enforcement approach will affect how an organisation is required to operate, even if it is fully compliant today.
This refers to the proverbial situation of the “goalposts moving”. New statutory timescales may be set out, secondary legislation might fill in the detail of primary Acts, or regulators may shift their interpretation and inspection focus.
A current example in the UK is the phased rollout of the Hazards in Social Housing (Prescribed Requirements) (England) Regulations 2025, commonly referred to as Awaab’s Law.
Phase 1 of this legislation came into force in October 2025, imposing strict investigation and remediation timescales for damp, mould, and emergency hazards in social housing. Phase 2 is due to take effect from November 2026, making further hazard categories (such as fire and explosion risks, electrical hazards, and excess cold and heat) subject to the same timescales.
What is compliance risk?
Compliance risk is the possibility of failing to meet laws, regulations, approved codes of practice, or internal policies that already apply. It is the gap between what the organisation is required to do right now and what it is actually doing or can evidence.
In contrast to regulatory risk, which relates to potential changes in an organisation’s obligations, compliance risk exists even when the rules stay the same. In the latter case, an organisation may simply fail to comply with the existing requirements.
Typical examples of compliance risk that can affect facilities in the UK include lapsed legionella checks under ACoP L8 and HSG274, or an out-of-date fire risk assessment under the Regulatory Reform (Fire Safety) Order 2005 (RRFSO).
Regulatory risk vs compliance risk: key differences
The easiest way to understand the distinction between these two risk categories is to compare them directly:
| Aspect | Regulatory Risk | Compliance Risk |
|---|---|---|
| Source | External: legislators, regulators, new guidance or enforcement priorities | Internal: the gap between current obligations and actual practice or records |
| Time horizon | Forward-looking: rules that may change | Present-state: rules that apply today |
| Ownership | Typically leadership, legal, or risk functions (in smaller organisations, the same person may hold several of these roles) | Organisational and compliance teams with responsibility for day-to-day compliance |
| Monitoring | Horizon-scanning for upcoming legislation, consultations, and guidance | Audit trails, scheduled checks, evidence of completion, and remedial actions |
One reason why these two risks are so often conflated is the ownership overlap in smaller teams. In a smaller organisation, the same person may be responsible for regulatory monitoring as well as operational compliance.
The important distinction is ultimately between monitoring change (regulatory risk) and demonstrating adherence (compliance risk). The monitoring difference points to the different systems needed; one is about keeping a lookout for change on the horizon, while the other is concerned with using reliable records to prove current status.
Why the distinction matters for facilities and compliance teams
There is a real cost to conflating these two distinct risks. Teams tracking only today’s obligations put themselves in danger of being blindsided by future rule changes.
One concrete example scenario that will likely be currently unfolding for some organisations in the UK, is a housing provider being in full compliance with existing damp-and-mould processes, yet unprepared for the expanded statutory timescales and hazard categories that Awaab’s Law Phase 2 will bring.
This same broad pattern of minimal compliance risk, but potentially high regulatory risk appears across all the core sectors for Vision Pro Software, including social housing, healthcare, education, facilities management, and retail.
To manage both compliance risk and regulatory risk effectively, organisations must have visibility across two questions at once: “is this current?” and “is this about to change?” Treating them as essentially a single problem tends to result in one of the two risks being neglected.
Examples of regulatory risk and compliance risk in UK facilities management
Regulatory risk might manifest in such examples as:
- Fire safety reform that requires organisations to review existing processes
- Awaab’s Law, such as the planned expansion of requirements in 2026
- Building Safety Act secondary legislation, which can create new obligations for organisations and dutyholders
- Evolving asbestos guidance, which may affect how asbestos risks need to be assessed, recorded, and managed.
In the case of compliance risk, meanwhile, real-life examples may encompass:
- A missed fire risk assessment, or a completed assessment not properly recorded
- Lapsed legionella checks like scheduled monitoring or other control activities
- An incomplete asbestos register, with information about asbestos-containing materials being missing, inaccurate, or out of date
- Expired ISO evidence including required certification, inspections, reviews, or supporting evidence.
These examples also help draw attention to how the two categories of risk can interact.
A regulatory change might bring about a new compliance obligation. Once the new requirement applies, failure to meet it becomes a compliance risk.
How to manage both regulatory and compliance risk
These risks should be treated as two distinct disciplines:
- Regulatory risk needs systematic horizon-scanning, tracking such events as consultations, secondary legislation, regulator guidance, and the release of new sector guidance. This allows for the advance planning of suitable process and resource changes within the organisation.
- Compliance risk needs disciplined audit and recordkeeping. This can encompass such vital elements as clear schedules, assigned ownership, evidence of completion, and the prompt closure of remedial actions.
The cloud-based Vision Pro Software provides direct support for the compliance side. It centralises records for fire, asbestos, legionella, and wider statutory obligations. Alongside this, the platform schedules checks and inspections, issues alerts for upcoming or overdue tasks, and maintains a full audit trail.
The reliable present-state view that Vision Pro Software helps provide for many organisations frees capacity for the separate work of scanning the regulatory horizon. Teams adopting this solution, then, can be better prepared to avoid having to constantly scramble for basic evidence whenever the rules change.
Final thoughts: take steps today to better handle both these major risks
Regulatory risk is the risk that the rules will change. Compliance risk is the risk of not meeting the rules as they stand today.
When facilities and compliance teams conflate these two risks, they can be left either chasing every legislative headline or assuming that the checks they complete today will be equally valid for compliance over the years to come.
Organisations can put themselves in a stronger position by taking a number of practical steps. These can include assigning clear ownership for horizon-scanning, making sure every current obligation has a scheduled check and auditable record, and using a single platform that provides live visibility of status as well as gaps.
To learn more about how organisations across such sectors as social housing, healthcare, and education can benefit from the adoption of the right cloud-based platform incorporating such elements as centralised compliance records, scheduled checks, and alerts, please feel free to request a demo of Vision Pro Software today.
