# Compliance Legal

> Determine which legal, regulatory, contractual, accessibility, platform, and open-source obligations apply to a product. Use when entering a market, processing regulated data, adding payments, children, healthcare, AI, new vendors, or a distribution platform. Produce an evidence-based applicability and gap record; flag interpretation that needs qualified counsel.

- Skill: `ashermahonin/compliance-legal` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add ashermahonin/compliance-legal`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ashermahonin/compliance-legal/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: ashermahonin (https://skillmd.com/u/ashermahonin)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/ashermahonin/compliance-legal

---


# Compliance / Legal

## Purpose

Identify the laws, standards, contracts, and platform policies that apply. For each one, record the obligation, current evidence, gap, owner, and effect on release. Mark legal interpretation that still requires qualified counsel.

## Scope and evidence

1. Read `references/compliance-frameworks.md`.
2. Pull platform matrix from `platform-detector`, data flow from `data-ml-pipeline`, security posture from `security-owasp-*` and `security-secrets`.
3. Identify scope: regions/markets, data subjects (consumer, employee, child, patient, EU resident, California resident, etc.), data categories (PII, health, financial, biometric, location, kids), AI capabilities, payment processing, content moderation, advertising.
4. Use Context7 MCP for current text and guidance on each framework. Regulatory law changes often; do not rely on training data.

## Assessment

1. **Applicability matrix.** Per framework: applies (yes/no) + why. Anchor each "yes" to a specific user/data/region/feature.
2. **Per-framework gap analysis.** For each "yes", walk the required controls (lawful basis, consent, retention, access, deletion, breach notification, audit trail, vendor management). Mark Pass / Concern / Fail / Out-of-scope with evidence.
3. **Data Processing Register / RoPA.** For GDPR-like regimes, list processing activities: purpose, lawful basis, data categories, subjects, retention, recipients, transfers, safeguards.
4. **DPIA / AIPIA.** Run a Data Protection Impact Assessment (or AI Impact Assessment) when triggered: large-scale sensitive data, automated decisions, biometric, kids, public-space monitoring, AI Act high-risk categories.
5. **Vendor / sub-processor register.** List every third party that touches user data; verify contracts (DPA, SCCs where needed), security posture, breach SLAs.
6. **Open-source license check.** Coordinate with `cve-zero-day-scanner` SBOM. Flag copyleft (AGPL/GPL) in proprietary distributions; flag attribution requirements.
7. **Accessibility law.** If selling into the EU (EAA), US public sector (Section 508), Canada (AODA), require `accessibility-audit` verdict before release.
8. **Store-platform legal.** Validate against current App Store / Play / Steam / console legal terms (paid content, IAP, subscriptions, cancellation flow, refunds).
9. **Release-gate verdict.** Per framework: Go / Conditional / Hold. Conditional requires named approver and expiry.

## Safety rules

- Use Context7 MCP for current legal text and guidance; do not paraphrase from memory.
- Keep a decision trace: applicable frameworks, why included or excluded, jurisdictional choices, accepted-risk register.
- Refuse to mark a framework Pass without named evidence (contract, policy, control, audit record).
- Refuse to ship into a new region/market without an applicability check.
- This skill is not legal counsel. Escalate binding interpretations to qualified counsel before release.

## Security record

- Applicability matrix per framework
- Per-framework gap analysis with evidence
- Data Processing Register / RoPA (when applicable)
- DPIA / AIPIA (when triggered)
- Vendor / sub-processor register with DPA / SCC status
- Open-source license report
- Accessibility-law verdict link
- Store-platform legal verdict
- Release-gate verdict with named approver and conditions

## Release criteria

- No "we comply" without a per-control evidence link.
- No new region launched without an applicability check for that region.
- No AI feature deployed in EU without an AI Act risk classification.
- No vendor processing user data without a DPA on file.
- No open-source dependency under restrictive license shipped in a proprietary product without review.

## Handoff

Hand off to `service-implementation` per control gap, to `documentation-graph-curator` to store register/DPIA in the project vault, and to `release-management` to integrate the verdict into the go/no-go report.

## References

- `references/compliance-frameworks.md`: per-framework one-pager (scope, triggers, controls, evidence, common pitfalls).