The journey from the legal register to the early warning system: What used to be the responsibility of international law firms and large internal teams can now be partially automated. Dr. Thomas Altenbach and Kevin Rodler look at the topic from two perspectives: the technological development of the AI-based legal register and the practical implementation at Thomann. At the Federal Compliance Congress (BCM), they will present these experiences in a joint presentation.
From seven-figure office costs to AI
Thomas Altenbach: My first encounter with a cadastral survey was in 2008 – and I was rather disappointed.
At the time, I was in a leadership role in the legal department at Daimler. What I encountered was a huge Excel-based collection of laws, regulations, and technical standards. The information was plentiful. As a lawyer, however, I did not find that manageable.
About eight years later, the topic came up again at Deutsche Bank. After a complaint from the BaFin, we had to organize a legal registry for 59 countries. An international law firm provided quarterly evaluations. In Frankfurt alone, according to my recollection, six people were involved in the management. The legal costs amounted to a high seven-figure sum per year – in addition to the internal manpower.
If someone had shown me what is technically possible today back then, I probably would have considered it quite unrealistic.
Today, AI can monitor regulatory sources, capture new regulations, structure and review content, and assess which requirements could be relevant for a specific company. This raises a new question for me: How do we use these opportunities without giving up control over the evaluation?
We had rather too much information
Kevin Rodler: At Thomann, I came across the topic from a different direction.
When I started 23 years ago, Thomann had around 200 employees. Today, it has about 1,800 employees. From a music store, it has become an internationally active company with subsidiaries, e-commerce, a wide product portfolio, own brands, and its own production activities.
Our legal and compliance management has grown alongside us. In various areas, we developed our own solutions: Excel lists, server repositories, information sources, and individual tools. Product compliance had different requirements than occupational safety, finance, or the supply chain. The result was a fragmented knowledge management system.
Finding information was rarely the biggest problem. Other questions were more difficult: Which version is on the server? Who maintains it currently? Who gets to make changes? And which of the many new regulations does Thomann actually affect?
Once a new regulation has been found, the actual work begins: What obligations follow from it? Which sites are affected? Are we acting as traders, importers, or manufacturers? Who needs to take care of implementation? Who bears responsibility and how is the implementation monitored and documented?
The challenge in regulatory management today lies primarily in identifying the requirements relevant to the specific company from a large amount of information.
Regulating developments look different earlier
Thomas Altenbach: AI also changes the moment at which we can deal with new requirements.
Official or official regulatory sources can be continuously monitored and reviewed daily for new or modified regulations. Subsequently, the characteristics that trigger their applicability are analyzed. The review can extend to individual obligations within a law.
The AI-based legal registry is currently available in 120 jurisdictions. For global companies, this primarily involves connecting regulatory requirements with activities, locations, products, markets, and regulatory roles.
Kevin Rodler: At Thomann, we are also interested in what regulatory requirements we face. If we find out just before a deadline for implementation that a new regulation will trigger major changes, we have a problem. Therefore, we are already dealing with the legislative process and its possible effects today. This observation is quite time-consuming by hand.
AI can play a role here. It can monitor current law, capture future requirements that have already been adopted, and examine the potential relevance of ongoing legislative processes. The result is not a prediction. For compliance planning, the information that something is developing that could be relevant to the company is already valuable.
Thus, the classic legal register is increasingly becoming a regulatory early warning system.
„How do I know if I can trust the AI?“
Thomas Altenbach: I hear this question over and over again in conversations with compliance officers. The answer „Because our AI is very good“ wouldn’t satisfy me.
Any AI can make mistakes. Anyone who uses it in regulatory management must be able to assess when additional testing is warranted.
For that we use a Confidence Score. It shows how clearly the system considers a regulation for the specific company to be relevant – illustrated as high, medium or low.
Even a high value does not mean legal certainty. The score helps the compliance manager to categorize the AI assessment and to focus his or her attention specifically on unsafe cases.
The Confidence Score makes uncertainty visible.
Many data only help if the connection is correct.
Kevin Rodler: One of our most important experiences came from an evaluation in which we and the AI initially disagreed.
We provided extensive company information, item lists, and customs tariff numbers. Despite this, the AI initially classified a regulation that we considered relevant as not relevant.
The analysis showed that there was not necessarily a lack of data. The connection was not clear enough for the AI system.
Thomann is a retailer and e-commerce company. We import goods and have our own brands, which means that in certain regulatory contexts we take on a manufacturer role. The AI initially viewed us primarily from the perspective of the e-commerce retailer. When we described the different roles more precisely and, for example, clearly linked customs tariff numbers to our import activities, the relevance assessment improved significantly.
Many data only help if the AI understands the context.
Therefore, the company’s regulatory profile is central when building an AI-based legal disaster management system: its activities, products, markets, locations, and the roles in which it operates.
How we organize control
Thomas Altenbach: As AI takes on more of the groundwork, the controls must also grow with it.
Within the system, multiple AI models perform different tasks. Results are controlled and verified – a checks-and-balances principle, as we know from risk management. The Confidence Score complements this technical control. In the end, human review remains an essential component of the process.
Kevin Rodler: At Thomann, we have a clear division of roles for this. The AI searches, sorts, structures, and evaluates relevance. The responsibility for the final regulatory classification remains with us. How intensively we manually review individual evaluations depends on the risk, complexity, and uncertainty of the evaluation. Where we need additional expertise, we involve the relevant departments.
We are also interested in regulations that are classified as not relevant. A regulation that is deemed unnecessary as relevant will initially lead to additional testing effort. On the other hand, if an actually relevant obligation is excluded, it may fall out of the further testing and implementation process.
For us, Human in the Loop does not mean repeating every evaluation completely manually, but rather using human review in a targeted and risk-oriented manner. Complex regulatory roles, uncertain evaluations, or potential significant impacts deserve special attention.
And what if the AI is still wrong?
Thomas Altenbach: Theoretically, there remains a residual risk. It encompasses both error directions: The AI evaluates a requirement as relevant even though it does not actually apply to the company, or it classifies a requirement that is actually relevant as not applicable.
Therefore, we have a control concept with multiple levels. Technical checks, confidence score, human review, and a clean corporate context reduce the risk of a misclassification. Furthermore, we provide a performance guarantee for the accuracy, completeness, and timeliness of the results.
What changes for the compliance manager
Kevin Rodler: Looking back on our introduction today, some of the work was surprisingly classic.
We first had to capture our existing sources and tools and describe our business model, product portfolio, our markets, and regulatory roles in such a way that a robust corporate context could be created.
The real added value for me lies not only in the fact that AI is taking away our jobs. It rather shifts the focus of our work. Less time is spent on acquiring and maintaining regulatory information, more time on evaluating and implementing it. It is precisely here that the true value of a compliance function lies: not in collecting regulations, but in translating regulatory requirements into business practices.
The time horizon is also changing. Already approved future requirements and ongoing legislative processes can be factored into the planning process earlier. This creates a head start when regulatory developments become relevant to us.
The essence of both perspectives
We come from very different experiences with legal systems. Thomas still remembers the enormous effort that was required to systematically capture regulatory developments in 59 countries. Kevin experiences today at Thomann how AI can take on a significant part of this work – and where its limits lie in practical application.
It is precisely these two perspectives that lead to the questions we address when using AI in regulatory management: How well must the AI know a company? How does the compliance manager recognize which evaluations they should pay closer attention to? How can you organize Human in the Loop without undoing the efficiency gains? And how do you deal with the remaining risk of a misjudgment?
We will answer these questions at the Federal Congress on Compliance (BCM) deepen together. Kevin Rodler brings his experience from the introduction and use at Thomann. Thomas Altenbach adds the perspective on what is now technologically possible and how control and security can be organized.
At its core, it comes down to a very practical question: Which tasks can AI be used to perform effectively – and which decisions must remain with the compliance manager?
Our previous experience can be summarized in one sentence:
AI takes the lead; the human decides
This article originally appeared in the specialist magazine on October 26, 2026. The Compliance Manager as part of the Federal Compliance Congress under the title „From the Legal Register to the Early Warning System: How AI Changes Regulatory Management“.
