Financial institutions today operate in an environment where regulation changes constantly. New frameworks like DORA, NIS2, the EU AI Act, and evolving guidance from regulators such as the EBA, ECB, and national supervisory authorities continue to reshape how organizations manage governance, risk, and compliance.

Yet many organizations still manage regulatory change through disconnected processes, spreadsheets, emails, and manual assessments. That approach is no longer sustainable.

At CERRIX, we believe the future of Governance, Risk & Compliance (GRC) lies in connecting regulatory change management directly to risks, controls, incidents, actions, and assurance activities in one integrated platform. That vision is exactly why CERRIX acquired Ruler.

In this short video, CERRIX CEO, Niels van Weereld explains the vision behind the acquisition of Ruler and why connecting regulatory change management with risk and controls is critical for the future of GRC.

The problem with traditional GRC software

Most GRC platforms today still function primarily as registration systems.

Risks are documented.
Controls are logged.
Incidents are tracked.
Audit findings are stored.

But the processes surrounding those activities often remain highly manual.

Compliance teams monitor regulatory websites separately.
Risk teams assess impacts in another process.
Control owners update frameworks later.
Internal audit validates everything afterwards.

The result:

• fragmented governance processes,  

• duplicated work,  

• delayed implementation,  

• compliance gaps,  

• and limited real-time visibility.  

As Niels van Weereld explains: “Most GRC tools today are, at their core, spreadsheets on steroids. A fancy interface to register things.”

This creates a major challenge for financial institutions trying to stay continuously compliant in a rapidly changing regulatory landscape.

Why regulatory change management matters

Regulatory change management has become one of the most critical capabilities for financial institutions. New regulations increasingly affect:

• operational resilience,  

• cybersecurity,  

• AI governance,  

• outsourcing,  

• third-party risk,  

• internal controls,  

• and reporting obligations.  

Take DORA as an example. A single regulatory update may require organizations to:

• reassess operational risks,  

• update policies,  

• implement additional controls,  

• adjust incident management procedures,  

• collect new evidence,  

• and demonstrate compliance to supervisors.  

When these activities happen in disconnected systems, organizations struggle to maintain oversight and traceability. This is why regulatory intelligence can no longer operate separately from the GRC process itself.

From static GRC to an Intelligent Operating System for Risk & Compliance

CERRIX’s vision is to become the Intelligent Operating System for Risk & Compliance. That means moving beyond static compliance administration toward a connected platform where:

• regulatory developments,  

• risks,  

• controls,  

• incidents,  

• measures of improvement,  

• and assurance activities  

all work together as part of one continuous governance process.

Instead of manually translating regulations into operational actions, organizations need a system that helps connect the entire chain automatically.

According to Niels van Weereld: “Risk and compliance professionals should be strategic levers for their organization, not data entry clerks.” The goal is not simply to document governance activities. The goal is to help organizations make faster, smarter, and more proactive decisions about risk and compliance.

Why CERRIX acquired Ruler

Ruler is a regulatory change management platform specialized in monitoring regulatory developments for financial institutions. The platform continuously monitors regulatory sources, identifies new or changing requirements, and helps compliance teams assess the impact on their organization. This makes Ruler a natural extension of the CERRIX platform.

CERRIX helps organizations manage:

• risks,  

• controls,  

• incidents,  

• audits,  

• and assurance activities across the entire GRC process.  

Ruler helps organizations understand:

• what regulations are changing,  

• what obligations are affected,  

• and where action is required.  

Together, they create a complete regulatory-to-control chain. As Niels describes it: “CERRIX tells you where you stand. Ruler tells you what’s coming.”

By combining regulatory intelligence with operational GRC processes, organizations can move from reactive compliance toward continuous governance.

The benefits of an integrated GRC and regulatory change platform

Connecting regulatory change management directly to governance, risk, and compliance processes creates several important advantages for financial institutions.

Faster impact assessments

When new regulations emerge, organizations can immediately understand:

• which risks are affected,  

• which controls require updates,  

• and which business processes need attention.  

Reduced manual work

Instead of relying on spreadsheets, emails, and fragmented workflows, teams can centralize governance activities in one integrated platform.

Improved audit readiness

By connecting regulations directly to controls and evidence, organizations strengthen traceability and demonstrate compliance more efficiently during audits and supervisory reviews.

Stronger operational resilience

Continuous visibility into regulatory obligations helps organizations respond faster to regulatory change and reduce compliance gaps.

Better collaboration across the three lines of defense

Risk, compliance, internal audit, and operational teams can work from the same source of truth instead of maintaining separate interpretations and tracking files.

Building the intelligent operating system for risk and compliance

The GRC market is evolving rapidly. Organizations no longer need static systems that only document governance activities after the fact. They need intelligent platforms that help them anticipate change, coordinate action, and maintain continuous oversight.

That means:

• connecting regulatory intelligence with operational execution,  

• automating governance workflows,  

• reducing manual compliance work,  

• and embedding risk and compliance into daily operations.  

This is the direction CERRIX is building toward: an Intelligent Operating System for Risk & Compliance.

By combining regulatory change management, risk management, controls, incidents, audits, and assurance activities in one connected platform, organizations gain a continuous view of both their current compliance position and the regulatory changes ahead.

The acquisition of Ruler is an important step in that journey.

A step toward a future where:

• regulatory change automatically flows into governance processes,
• risks and controls continuously evolve alongside new obligations,
• and risk and compliance professionals can focus less on administration and more on strategic decision-making.

Or as Niels van Weereld summarizes it:

“Together, regulatory change flows directly into your risk and compliance framework. No more spreadsheets, no more gaps, no more surprises.”

‍

FAQ

What is regulatory change management?

Regulatory change management is the process of monitoring new or changing regulations, assessing their impact on the organization, and implementing the required governance, risk, and compliance updates.

Why is regulatory change management important for financial institutions?

Financial institutions operate in highly regulated environments where frameworks such as DORA, NIS2, GDPR, and the EU AI Act continuously evolve. Effective regulatory change management helps organizations remain compliant, reduce operational risk, and improve audit readiness.

What is an integrated GRC platform?

An integrated GRC platform connects governance, risk management, compliance, controls, incidents, audits, and regulatory obligations in one centralized environment.

How does regulatory intelligence improve compliance?

Regulatory intelligence helps organizations identify new or changing regulatory requirements early, assess their impact faster, and connect them directly to operational risk and compliance processes.

Why did CERRIX acquire Ruler?

CERRIX acquired Ruler to connect regulatory change management directly with risk and control management, helping financial institutions create a complete end-to-end GRC process in one platform.

‍