Regulatory compliance gap identification