Compliance - Regulatory Compliance & Standards
Overview
Compliance validates regulatory compliance for PromptForge AI. While Integrity handles ethics, Compliance handles the law—ensuring all prompts and AI systems meet legal requirements across applicable jurisdictions.
When to Use
- Before deploying prompts in regulated industries (healthcare, finance, legal, education)
- When entering a new jurisdiction with different AI regulations
- When validating compliance with specific regulations (EU AI Act, GDPR, CCPA, HIPAA)
- When creating compliance documentation for audits
- When assessing legal risk of a prompt or AI capability
- Don't use when: Evaluating ethical concerns (use integrity-promptforge-ethical-ai)
Core Procedures
Step 1: Identify Applicable Regulations
Determine which regulations apply:
- Geographic: Where will the prompt be used? (EU, US, UK, etc.)
- Industry: What industry? (healthcare → HIPAA, finance → SOX, etc.)
- Data Type: What data is processed? (personal data → GDPR/CCPA, health data → HIPAA)
- Use Case: What is the prompt used for? (employment, credit, healthcare → additional rules)
Step 2: Map Requirements to Prompt
For each applicable regulation:
COMPLIANCE MAPPING
==================
Regulation: [name and section]
Requirement: [what the regulation requires]
Applies To: [which part of the prompt/system]
Evidence Needed: [what proves compliance]
Status: [compliant/partial/non-compliant]
Gap: [what's missing for compliance]
Step 3: Conduct Compliance Check
For each requirement:
Step 4: Document Compliance Status
COMPLIANCE REPORT
=================
System/Prompt: [name and version]
Regulations Assessed: [list]
Overall Status: [compliant/partial/non-compliant]
Gaps: [list of non-compliant items with remediation plan]
Evidence: [documentation proving compliance]
Next Review: [when to reassess]
Sign-off: [compliance officer approval]
Step 5: Monitor Regulatory Changes
- Track new and updated AI regulations
- Assess impact of regulatory changes on existing prompts
- Update compliance mappings when regulations change
- Alert affected teams when compliance status changes
Success Metrics
- Compliance coverage: 100% of deployed prompts have compliance assessment
- Regulatory violations: 0 in production
- Compliance assessment time: <4 hours for standard assessments
- Regulatory change response time: <1 week from regulation update to impact assessment
Error Handling
- Error: Prompt is non-compliant with a regulation
Response: Do NOT deploy, design remediation plan, re-assess after changes
- Error: Regulation is ambiguous (multiple valid interpretations)
Response: Document interpretation chosen, note alternative interpretations, consult legal counsel
- Error: Conflicting regulations (compliance with one violates another)
Response: Document the conflict, escalate to legal counsel, implement most restrictive requirement
Cross-Team Integration
Related Skills: integrity-promptforge-ethical-ai, specialist-promptforge-domain-adaptation, predictor-promptforge-outcome-prediction, data-privacy-check, license-compliance
Used By: Integrity, Specialist, Predictor, Sage, ALL agents deploying in regulated contexts
1---2name: compliance-promptforge-regulatory-compliance3description: Use when validating prompts and AI systems against regulatory requirements, industry standards, and legal obligations. This skill provides systematic compliance checking procedures for AI regulations across jurisdictions.4---56# Compliance - Regulatory Compliance & Standards78## Overview9Compliance validates regulatory compliance for PromptForge AI. While Integrity handles ethics, Compliance handles the law—ensuring all prompts and AI systems meet legal requirements across applicable jurisdictions.1011## When to Use12- Before deploying prompts in regulated industries (healthcare, finance, legal, education)13- When entering a new jurisdiction with different AI regulations14- When validating compliance with specific regulations (EU AI Act, GDPR, CCPA, HIPAA)15- When creating compliance documentation for audits16- When assessing legal risk of a prompt or AI capability17- **Don't use when:** Evaluating ethical concerns (use integrity-promptforge-ethical-ai)1819## Core Procedures2021### Step 1: Identify Applicable Regulations22Determine which regulations apply:23- **Geographic:** Where will the prompt be used? (EU, US, UK, etc.)24- **Industry:** What industry? (healthcare → HIPAA, finance → SOX, etc.)25- **Data Type:** What data is processed? (personal data → GDPR/CCPA, health data → HIPAA)26- **Use Case:** What is the prompt used for? (employment, credit, healthcare → additional rules)2728### Step 2: Map Requirements to Prompt29For each applicable regulation:30```31COMPLIANCE MAPPING32==================33Regulation: [name and section]34Requirement: [what the regulation requires]35Applies To: [which part of the prompt/system]36Evidence Needed: [what proves compliance]37Status: [compliant/partial/non-compliant]38Gap: [what's missing for compliance]39```4041### Step 3: Conduct Compliance Check42For each requirement:43- [ ] **Transparency:** Does the prompt disclose AI involvement where required?44- [ ] **Consent:** Is user consent obtained where required?45- [ ] **Data Minimization:** Does the prompt collect only necessary data?46- [ ] **Purpose Limitation:** Is the prompt used only for stated purposes?47- [ ] **Right to Explanation:** Can the prompt's output be explained to affected individuals?48- [ ] **Human Oversight:** Is human review available where required?49- [ ] **Data Retention:** Are outputs stored only as long as permitted?50- [ ] **Cross-Border Transfer:** Does data transfer comply with localization requirements?5152### Step 4: Document Compliance Status53```54COMPLIANCE REPORT55=================56System/Prompt: [name and version]57Regulations Assessed: [list]58Overall Status: [compliant/partial/non-compliant]59Gaps: [list of non-compliant items with remediation plan]60Evidence: [documentation proving compliance]61Next Review: [when to reassess]62Sign-off: [compliance officer approval]63```6465### Step 5: Monitor Regulatory Changes66- Track new and updated AI regulations67- Assess impact of regulatory changes on existing prompts68- Update compliance mappings when regulations change69- Alert affected teams when compliance status changes7071## Success Metrics72- Compliance coverage: 100% of deployed prompts have compliance assessment73- Regulatory violations: 0 in production74- Compliance assessment time: <4 hours for standard assessments75- Regulatory change response time: <1 week from regulation update to impact assessment7677## Error Handling78- **Error:** Prompt is non-compliant with a regulation79 **Response:** Do NOT deploy, design remediation plan, re-assess after changes80- **Error:** Regulation is ambiguous (multiple valid interpretations)81 **Response:** Document interpretation chosen, note alternative interpretations, consult legal counsel82- **Error:** Conflicting regulations (compliance with one violates another)83 **Response:** Document the conflict, escalate to legal counsel, implement most restrictive requirement8485## Cross-Team Integration86**Related Skills:** integrity-promptforge-ethical-ai, specialist-promptforge-domain-adaptation, predictor-promptforge-outcome-prediction, data-privacy-check, license-compliance87**Used By:** Integrity, Specialist, Predictor, Sage, ALL agents deploying in regulated contexts
Construct-AI-primary