Two meanings of “regulatory impact assessment”
Before the method, a note on terms. “Regulatory impact assessment” (RIA) means two different things.
- For governments, it is the analysis an agency does of the costs and benefits of a proposed rule. In the US, Executive Order 12866 requires it for significant rules, with a more rigorous analysis for rules with “an annual effect on the economy of $100 million or more.” According to a June 2026 Congressional Research Service summary, the 2023 revision of OMB Circular A-4 (the guidance for these analyses) has been repealed and the original 2003 version reinstated.
- For companies, it is the assessment of how a new or changed regulation affects their products, processes and documents. This article is about that meaning.
The company version always contains a gap analysis: comparing what the new requirement says with what you do today.
What a regulatory gap analysis is
A regulatory gap analysis compares a defined set of requirements against your current documents and practice, and records where you comply, where you partly comply and where you do not. It is used when:
- A new regulation or guidance takes effect (for example the QMSR in February 2026)
- You enter a new market or add a product type
- You prepare for an inspection, certification or partner audit
- You acquire a company or site
- A draft regulation signals future requirements (for example the 2025 drafts of EU GMP Annex 11 and Annex 22)
The method, step by step
1. Define the requirement set
List the specific requirements, not the document title. A gap analysis against “the QMSR” is too vague. A gap analysis against each clause of ISO 13485:2016 plus each added FDA requirement in 21 CFR 820 is usable.
2. Define the scope
Which sites, products, processes and systems? Which version of each requirement?
3. Map requirements to your documents
For each requirement, find the procedures, records and system controls that address it. This is a regulatory document review: reading your SOPs, work instructions, templates and records against the requirement text.
4. Rate compliance
Use a simple scale and record the evidence for each rating.
| Rating | Meaning | Evidence needed |
|---|---|---|
| Compliant | Requirement fully met in procedure and practice | Procedure reference and a sample record |
| Partial | Met in procedure but not in practice, or only some elements met | What is missing |
| Gap | Not addressed | Statement of what is required |
| Not applicable | Does not apply, with justification | Reason |
5. Assess risk and prioritize
Not all gaps are equal. Prioritize by impact on patient safety, product quality, data integrity and regulatory exposure, and by the effective date of the requirement.
6. Plan and track remediation
Each gap becomes an action with an owner and due date, normally through change control or CAPA. The gap analysis itself should be approved and kept as a record.
Worked examples from 2025–2026
| Trigger | Gap analysis focus |
|---|---|
| QMSR effective February 2, 2026 | ISO 13485:2016 clauses and FDA additions; NAMSA notes management review, quality audit and supplier audit reports are no longer exempt from FDA inspection, so check that these documents are inspection-ready |
| EU GMP Annex 11 draft (consultation closed October 7, 2025) | Audit trail review timing and tools, periodic review, supplier oversight for cloud systems |
| EU GMP Annex 22 draft (AI) | Inventory of AI tools; which are used in critical applications; static vs dynamic models; human-in-the-loop for non-critical uses |
| EU pharmaceutical reform (provisional agreement December 2025) | Shortage notification processes; regulatory data protection strategy; product information digitalization |
| EMA PMS structured data deadlines (2026–2027) | Completeness of structured manufacturer and pack size data |
Common gap analysis mistakes
- Assessing procedures, not practice. An SOP can be compliant while the records show it is not followed. The most cited drug GMP provision in FY2025, 21 CFR 211.22(d), covers exactly this: procedures not in writing or not followed (243 observations, per GMP Insiders).
- Requirement lists that are too coarse. One line per regulation hides most of the gaps.
- No evidence for “compliant”. A rating without a document reference cannot be verified.
- Gap analysis as a one-off. It goes stale as soon as the requirement or your processes change.
- No link to remediation. Gaps are listed but never become actions.
Regulatory gap analysis checklist
- Requirement set broken down to individual requirements, with version
- Scope (sites, products, processes, systems) defined
- Each requirement mapped to procedures and records
- Practice sampled, not only procedures
- Ratings recorded with evidence
- Gaps prioritized by risk and effective date
- Remediation actions in change control or CAPA
- Gap analysis approved and kept as a record
- Review date set
Run gap analyses faster with AskDona
The slowest part of a gap analysis is reading every procedure against every requirement. AskDona reads the requirement text and your SOPs, records and templates together, rates each requirement as compliant, partial or gap, and links every rating to the source page so your team can verify it quickly. Run a sample gap analysis against a regulation your team is working on now. AskDona shows the evidence; your quality and regulatory teams decide.
FAQ
What is a regulatory gap analysis? A structured comparison of specific regulatory requirements against a company’s current documents and practice, identifying where it complies and where it does not.
What is a regulatory impact assessment? For companies, the assessment of how a new or changed regulation affects products, processes and documents. For governments, the cost-benefit analysis of a proposed rule.
What is regulatory document review? Reading procedures, records and other documents against specific regulatory requirements. It is the core activity of a gap analysis.
How long does a gap analysis take? It depends on the requirement set and scope. Breaking requirements into individual items and assigning document owners shortens it.
Should gap analyses cover draft regulations? Yes, for planning. Drafts such as the EU Annex 11 and Annex 22 consultations signal future requirements early.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| Congressional Research Service, Cost-Benefit Analysis in Federal Agency Rulemaking (June 2026) | Government research report | EO 12866 and Circular A-4 status |
| NAMSA, Industry Update: QMSR | CRO / consultancy article | QMSR effective date; inspectable reports |
| EC consultation on Chapter 4, Annex 11 and Annex 22 | EU consultation page | Draft annexes |
| Draft Annex 22 (2025 consultation) | EU draft guideline | AI scope |
| Cooley, EU pharma reform: we have a deal | Law firm analysis | EU reform |
| EMA, Substance and product data management services | EMA web page | PMS deadlines |
| GMP Insiders, FY2025 FDA inspection observations | Industry analysis of FDA data | 211.22(d) |