An adaptive project manager is told that a new industry regulation will affect an upcoming deliverable. Where should this be recorded?

A user story captures functional requirements from a user's perspective and is not the appropriate artifact for recording compliance risks or external regulatory constraints.

The risk register is the designated project artifact for documenting identified risks, their potential impact, probability, and planned responses. A new industry regulation introduces a compliance risk to the deliverable, and the risk register enables the adaptive project manager to analyze and monitor this external constraint with an appropriate response strategy.

The sprint board tracks work items within the current sprint iteration and is not a risk management artifact.

Sprint planning is a Scrum ceremony for selecting and planning sprint work items, not a location for recording or managing project risks.