If i am not mistaken, you are talking about the rules you make in the BPM project itself, right?
If that is the case, then yes, you have to do it manually every time a change is required.
That is the reason why, it is not used widely.
For certain rules specific to the project, it is okay.
But when it involves critical data related subject to frequent change, separate BRM project exposed as web-service and then integrated into the BPM is widely suggested.
So that the web-service will always point to the updated rules and values.