Domain 1 · Objective reference 1A2 · Chapter 2 of 35
Legal, regulatory and contractual requirements
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: A requirement matters when it applies to this entity and activity.
Explore the anchors
Find authoritative legal or contractual obligations.
Concept matching activity
Match this task or description to its concept:
Confirm entity data and activity applicability.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Keep the requirement record current
Management concept and decision mechanism
Build an applicability register that identifies the entity, activity, instrument, version, effective date, accountable specialist and evidence needed. A voluntary framework, contract and regulatory direction can inform one control but have different authority. Resolve conflicts with authorized legal or compliance support, not a convenient technical assumption. Translate obligations into owned controls and preserve the interpretation and its review trigger. A supplier agreement cannot automatically transfer every customer obligation. Regulatory changes, new locations and new processing purposes can invalidate an earlier assessment even when the application itself has not changed.
Keep the requirement record current
For each applicable obligation, retain its source, scope, accountable interpreter, mapped requirement, implementation owner, evidence, and review trigger. Use qualified legal or compliance input for interpretation. Track conflicts and unresolved gaps through authorized decisions; changing a security policy cannot waive an external obligation.
Maintain controlled document versions, approval, communication, review, and retirement. Check that staff can find the current procedure and that material changes reach affected suppliers and teams. Review exceptions alongside the requirement they depart from.
Worked example
A financial group checks the specific regulated entity and applicable circular before setting its reporting process, rather than copying a deadline from another group company.
Check your understanding
Why is a familiar framework name insufficient to establish compliance?
Show explanation
Applicability and the actual requirement, implementation, evidence and assurance scope still need evaluation.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.