A regulatory page is not a fixed object. It is a URL, and what sits behind it on the day you read it is not necessarily what sat behind it when you built a control around it. Most compliance teams know this in the abstract. Very few can prove it happened, because proving it requires having kept the earlier copy.
We keep the earlier copy. Every page nimmy fetches is stored as the bytes that came back, hashed, and compared against the last time we fetched the same address. When the hash differs we keep both and record what moved between them. That is a versioning system for other people’s websites, and it produces a number nobody else is in a position to produce.
What we found
Between 4 November 2025 and 17 September 2026 we stored 1,419 redlines: occasions where a page we already held came back different. Of those, 802 differed in wording — text added, removed or rewritten. The remaining 617 differed only in whitespace or punctuation, and we count them separately because calling a re-indentation an amendment would be the same overstatement we are complaining about.
The median substantive revision touched seven paragraphs. The busiest single document has been revised thirty times. The oldest document we have watched change was published on 1 July 2003.
The clearest example is a media release from 2023
On 17 September 2026 a 2023 ASIC media release about charges against an insurance broking director came back with a new paragraph at the end:
Editor’s note 18: On 17 September 2026, the final directions hearing was held at the Melbourne County Court. The matter was adjourned to 8 December 2026 for a further final directions hearing and Mr De Maria’s bail was extended on the same terms and conditions. The court has now listed the first trial to commence on 1 March 2027.
— Added to ASIC media release 23-079MR, first published in 2023, as fetched on 17 September 2026
Note the number. This is the eighteenth such note appended to that page. The matter has been running for three years and the public record of it is a single URL that has been rewritten at least eighteen times. There is no feed of editor’s notes. Nothing is re-issued. If you read that page in 2024 and filed it, your copy is out of date and nothing told you.
This is not a criticism of ASIC. Appending a note to the original release is a reasonable way to keep a public record current, and the alternative — a new release for every procedural step — would be worse for everybody. The problem is on the reading side. A regime that updates in place assumes its readers come back, and compliance teams do not come back to a page they have already assessed.
Why it matters more than it sounds
- An assessment is evidence of what you decided and when. If the underlying text has moved since, the assessment is evidence of a decision about a document that no longer exists in that form.
- A control mapped to a clause is mapped to a clause number. Renumbering is one of the commonest substantive edits we see, and a renumbered clause breaks a mapping silently — the reference still resolves, to different words.
- Guidance is edited far more often than rules. The instrument is stable; the page explaining how the regulator will apply it is not, and that page is usually what the operating procedure was written from.
- Closing dates move, and they move by the page being edited rather than by anything being re-announced — which is why how long a consultation actually runs is a question about revisions as much as about policy.
What to do about it
The practical answer is to stop treating a link as a record. Whatever tool you use, the test is whether you can answer two questions about any obligation you carry: what did this page say on the day we assessed it, and has it changed since. If answering either one means opening the regulator’s website and reading it again, the answer is no. Our own upcoming deadlines are published from the same stored copies, and each row links to the version of the page we actually read.
Figures measured on 17 September 2026 across documents nimmy fetched directly, excluding anything reconstructed or seeded. The window opens on 4 November 2025, the earliest stored version we still hold.