Maintenance
Part of Recording the right date type keeps a policy news timeline useful for years
How to scope a policy news watch before you drown in sources
Policy news and timelines: how to scope a watch to your real exposure, pick source tiers, name an owner, and decide when you have watched enough.
Most organizations either watch nothing or try to watch everything. The first produces a nasty surprise every few years. The second produces a folder of unread alerts and the same nasty surprise, because volume is not attention.
This page is about scoping a policy news watch. Not what the rungs of a rule's progress are, which is the ladder from proposal to enforcement, but how to decide how much of that ladder is yours to climb.
What to take away
- Watch by exposure, not by interest. The subjects that would cost you money are usually duller than the ones that make headlines.
- One named owner and two hours a month beats a distribution list and a feed reader nobody opens.
- Source tiers matter more than source count. A secondary source tells you something happened; only a primary one tells you what it says.
Start from what would actually hurt
Write down, in plain sentences, the things that would be expensive to change on short notice. Not risks in the abstract. Actual mechanics of how you operate.
Typical entries: how you collect information from people who sign up, and whether any of those people are minors, which brings in a separate set of overlapping rules. What you do with a person's contact details after they stop being a customer.
Exposure list: what to write down
- How you collect signup information
- Whether any signups are minors
- What happens to contact details after churn
- Whether you show advertising
- Whether you take payment directly
- Countries where staff are employed
- Third-party service you cannot lose for a week
Each of those is a search term and an owner. Anything not on the list is background reading, and background reading does not need a process.
Scope by three questions, in order
Which kind of body could reach you?
Where?
At what threshold?
Three source tiers
| Tier | What it is | What it is good for |
|---|---|---|
| Primary | The official register or journal, the regulator's own decisions and guidance pages, the platform's own policy and changelog pages | The only thing worth quoting or acting on |
| Institutional secondary | A public body's plain-language explainer of its own process | Understanding how the machinery works |
| Commentary | Law firm briefings, trade press, newsletters | Noticing that something happened, and interpretation |
Commentary earns its place by being fast and by flagging things you would not have searched for. It does not earn a place in your record. Use it to find the primary document, then cite the primary document, and note which tier each entry came from so a later reader can see how much weight it carries.
Three source tiers and their uses
Primary
- What it is
- Official register, regulator pages
- Good for
- Quoting and acting on
- In your record
- Yes, cite it
- Speed
- Slowest, authoritative
Institutional secondary
- What it is
- Public body explainer
- Good for
- Understanding the machinery
- In your record
- Context only
- Speed
- Medium
Commentary
- What it is
- Law firm briefings, trade press
- Good for
- Noticing and interpreting
- In your record
- No, find the primary
- Speed
- Fastest, unverified
For federal rulemaking in the United States, the government's own explanation of the docket and comment system at regulations.gov describes what a comment period is and what happens to submissions.
When you need to identify which body owns a subject before you start looking for its rules, the USA.gov pages on doing business with the federal government are one place to start. Equivalent explainers exist for other systems: the European Commission publishes its own account of how EU law is made. Find the equivalent for every place you operate, once, and keep the link.
The address book, subject by subject
Naming the tiers does not help until the actual addresses are written down. For the subject this publication covers, the list is short.
- United States.Proposed and final agency rules appear in the Federal Register, and the current text of a rule is consolidated in the eCFR; comments are filed through regulations.gov. The FTC writes and enforces much of the consumer-protection and children's privacy material that reaches apps, including the Children's Online Privacy Protection Act, the FCC covers anything touching communications, and state attorneys general bring their own enforcement actions.
- European Union.The Digital Services Act is the platform rulebook; the European Commission publishes it and explains how it is made and enforced.
- United Kingdom.The Online Safety Act, applied by Ofcom.
At the platform tier, the binding documents are the ones you already agreed to: Apple's App Store Review Guidelines and Google Play's Developer Program Policies decide whether your app stays listed, and Meta, TikTok and X each maintain their own terms and policy pages. Those pages move faster than any statute.
On the workplace side, the EEOC and the NLRB are the two US bodies most likely to have a view on how an employer uses social media and app data, in hiring screening and in managing staff.
What a scoped watch looks like
Take a US consumer app that signs up teenagers and has customers in the EU. The three questions turn into a short list:
- Which body.At home, the FTC and the state attorneys general; abroad, the European Commission under the Digital Services Act, alongside national data protection authorities.
- Where.Where you are established, where your users are, and where your staff are - in this example the US and the EU.
- At what threshold.A carve-out for small operators is unlikely to cover you, so the pass is weekly rather than quarterly.
- Platforms.Apple's App Store Review Guidelines, Google Play's Developer Program Policies, and the Meta, TikTok and X policy pages, because a delisting or an account ban can arrive before any regulator acts.
- Workplace.The EEOC and the NLRB for anything touching staff use and screening.
That is a short address book and one named owner, not a folder of unread alerts.
Name one person
A watch owned by a committee is owned by nobody. Name one person, give them a fixed slot, and give them permission to say that nothing happened. The last part matters more than it sounds: an owner who feels obliged to produce findings will produce findings, and most months there genuinely are none.
What a monthly watch costs
- 1named owner, not a committee
- 2 hoursrealistic monthly time for a small org
- 1 linenote that the pass happened, with date
Two hours a month is realistic for a small organization with a scoped list. What that buys is a pass over the primary sources for your named subjects, an update to any entry that moved, and a one-line note saying the pass happened and the date it happened.
The first sitting
The first pass is slower because you are building the address book rather than reading the news. Do it in one sitting and it takes an afternoon:
- For each item on your exposure list, identify the body that could impose something on you and find its own publication page.
- Save the primary source URL. Not a search result, not a summary.
- Record today's state of anything already in force that you rely on, with the date you looked.
- Write down what would make you look again before the next scheduled pass.
That last line is the one that converts a research afternoon into a maintained record. Where a change arrives through a service's own rules rather than through a regulator, the mechanics are different again, and the asymmetries of that relationship are set out in what you agreed to on a platform.
Common questions
How do I know my scope is right rather than just comfortable?
Test it backwards. Take the two or three things in the last few years that forced an unplanned change on you, and ask whether this scope would have caught them at any rung before the deadline. If it would not, the scope is wrong in a way you can name and fix.
Is a paid alerting service worth it for a small team?
Usually not at the start, because the constraint is reading time rather than discovery. Get the scope and the owner right first. If the owner is consistently finding out late from commentary, that is the moment a paid feed starts earning its cost.
We operate in one country only. Do I still need to watch anything foreign?
Sometimes, and not for the reason people expect. Foreign rules can reach you through a supplier's contract or through a global service applying one standard everywhere, which is why a rule you are not subject to can still change your product.
What do I do when the answer to a question is genuinely unclear?
Record it as unresolved, with the date and what you checked, and set a trigger to look again. An honest gap in a record is usable. A guess that later reads as a finding is not, and nobody will remember which one it was.
