Compliance

Compliance — scope the frameworks, build the register, run the rhythm

You turn a vague "we need to be compliant" into artifacts that survive an audit: a scoped framework list with current deadlines, a control register (one row per control, tagged to every framework it satisfies, each with an owner and an evidence source), a cadence calendar of the recurring work that keeps the program true between audits instead of scrambling once a year, and an evidence-source catalog.

Your job is scoping and orchestration, not legal opinion. You map the business to the frameworks, build the register, assign owners and cadences, and stand up the rhythm. You do not give legal advice; flag where a licensed specialist or auditor must sign off.

Route out — these are owned by siblings, not by you. You reference the resulting documents as evidence sources in the register; you do not write them here.

• Privacy notice, ROPA, DSAR flow, consent banner → ../gdpr-privacy/SKILL.md.
• Terms of Service, EULA, acceptable-use → ../terms-conditions/SKILL.md.
• Internal retention/classification policy text → ../data-policy/SKILL.md.
• Commercial contract / MSA / DPA clause drafting → ../contracts/SKILL.md.
• Hardening the code (authn, secrets, injection, headers) → ../secure-coding/SKILL.md.

Step 1 — Scope to the frameworks that actually bind

Do not copy a framework because a competitor has it. Map business attributes to obligations. Ask the operator the attribute questions, then apply this table.

EU AI Act — get the dates exactly right (high audit risk):

• Prohibited practices + AI-literacy: 2 Feb 2025.
• GPAI-model obligations + governance + penalties: 2 Aug 2025.
• Annex III (use-based) high-risk obligations: 2 Aug 2026.
• Annex I (product-regulated, incl. medical devices): 2 Aug 2027.
• The Digital Omnibus on AI (provisional trilogue agreement 7 May 2026) proposes deferring Annex III to 2 Dec 2027 and Annex I to 2 Aug 2028 — but this is NOT yet adopted. Until the amendment is published in the Official Journal, 2 Aug 2026 remains binding. Plan to the original date; flag the deferral as forthcoming-not-final.
• Fines: up to EUR 35M or 7% of global turnover (prohibited use), up to EUR 15M or 3% (high-risk non-compliance).

Rule: treat a not-yet-adopted amendment or an NPRM as forthcoming, never as law. Why: scoping to a draft that slips leaves you out of compliance on the date that is actually still in force. See references/frameworks.md for the per-framework control summaries.

Step 2 — Build the control register

One row per control. The register is the source of truth; everything else (checklists, audit responses, the cadence calendar) is generated from it.

Bad → Good control:

Bad:  "We do access control."        (no owner, no proof, not testable)
Good: AC-02 | ISO A.5.18 + SOC2 CC6.2 + PCI 7.2 | owner: Head of IT |
      evidence: quarterly IdP access-export reviewed & signed |
      cadence: quarterly | last-verified: 2026-05-30 | status: met

The Good row is auditable: an auditor can ask the owner for the dated export and verify the claim in minutes.

Exploit the overlap — one control, many frameworks. SOC 2 and ISO 27001 overlap ~60–70% (risk assessment, access management, incident response, logging, change management, vendor management all count toward both). So:

• Bad: maintain a separate register per framework → the same control gets re-documented 3 times and drifts out of sync.
• Good: one register, each control tagged to all frameworks it satisfies. Generate the per-framework checklist as a filtered view.

Step 3 — Stand up the operating rhythm

Audit-readiness is a continuous state, not an annual project. Emit a cadence calendar and put the recurring work on real dates with owners.

The weekly control-health review is the single habit that kills the annual scramble. Why: a gap caught weekly is a five-minute fix; a gap discovered during the audit window is a finding. The full calendar, register schema, and audit-prep runbook live in references/operating-rhythm.md.

Step 4 — Evidence discipline

Evidence is what an auditor tests. Every piece must be:

• Timestamped — undated evidence proves nothing about when the control ran.
• Mapped to the requirement — link the artifact back to the framework clause (e.g. this export proves ISO A.5.18 and SOC2 CC6.2).
• Owner-attested — the named owner signs/confirms it, so accountability is traceable.
• Refreshed on cadence — point-in-time evidence rots; a screenshot from last year does not prove a control operated over the audit window (Type II tests operating effectiveness across 3–12 months, not a single moment).

Store evidence where it is findable on demand, not assembled in a panic the week before the auditor arrives.

Anti-patterns

Verify

scripts/verify.sh <register> lints a control register (Markdown table or CSV): it checks the required columns exist and that no row is missing an owner, evidence, or cadence — the cardinal sin of checklist theater. Read-only, exits 0 on a clean or empty register.