Group regulatory expectations into a small set of stable control families and types, then run your program around those, not around clauses, articles and acronyms.