FerroxLabs IP and compliance
Not legal advice; escalate when
This skill explains common IP moves and the most-cited compliance regimes for early-stage product companies. It does not file your trademark, write your privacy policy, or interpret a regulator's order. Escalate to counsel any time you're in a regulated industry (health, finance, legal services, anything touching minors), facing an active claim, expanding internationally, or processing personal data at meaningful scale.
When to load this mode
The user is naming a product and asking about trademark, has a copyright question, is launching to EU users and wondering about GDPR, is shipping AI and wondering about disclosure, or has been told they need a privacy policy.
Procedure
Four categories. For each, what to know and the first concrete step.
1. Trademark. Protects a brand identifier (name, logo, slogan) used in commerce. (a) The U.S. and many jurisdictions confer common-law rights from first use, even unregistered. (b) Registration (USPTO, EUIPO) gives broader rights and is required for serious enforcement. (c) Before naming, run a clearance search — USPTO TESS, EUIPO, general web. Rebrand cost from infringement dwarfs the search fee.
2. Copyright. Protects original works (code, copy, images, music, video) once fixed in a tangible medium. You own copyright in what you create unless: work-for-hire, assigned, or licensed. Practical: (i) written IP assignment from every contractor. (ii) Don't reuse images, code, or music without checking the license. (iii) Open-source carries terms; ignoring GPL/AGPL copyleft creates real exposure. AI-generated content has unsettled copyright treatment — treat outputs as potentially uncopyrightable until case law lands.
3. Privacy and data protection. Several overlapping regimes:
- GDPR (EU/UK). Applies whenever you process personal data of people in the EU/UK. Personal data is broad (emails, IPs, cookies, device IDs). Required: privacy policy, lawful basis, DPA with vendors, process for handling data-subject requests. Fines are large and enforcement is real.
- U.S. state privacy laws. California (CCPA/CPRA) is most enforced; Colorado, Virginia, Connecticut, Utah, and others have similar regimes.
- Sectoral rules. HIPAA (health), COPPA (under-13s), GLBA (financial), FERPA (education). Requirements go well beyond a generic policy.
First step: map what data you collect, from whom, why, where it goes, how long. The privacy policy is the public summary of that map. Without the map, the policy is fiction.
4. AI compliance. A moving target. As of 2026:
- EU AI Act. Risk-tier framework; most consumer AI lands in "limited risk" with disclosure obligations. High-risk uses (employment, credit, education, biometrics) have heavier obligations.
- U.S. state disclosure laws. California, Texas, and others require AI-content disclosure in certain contexts (political content, deepfakes, commercial chatbots).
- Sectoral application. AI in hiring, lending, or healthcare gets the underlying sector's regime.
First step: name where AI shows up, what decisions it influences, whose rules apply. Write the disclosure copy. If any high-risk use is in scope, get counsel.
Decision rules
- Search before you name. Clearance is cheap; rebrand is not.
- Written IP assignment from every contractor. Default assumptions are not in your favor.
- Map data before writing the policy. A mismatched policy is worse than no policy.
- GDPR-style discipline by default. Cheaper to build for the strictest regime than retrofit later.
- Disclose AI use. Disclosure cost is near zero; failure-to-disclose cost is rising.
Anti-patterns
- Picking a name another company in your category uses. Cheap to avoid, expensive to fix.
- Stock images, code, or music without checking the license. Top copyright-claim trigger.
- Lifting a privacy policy from a competitor. You inherit their disclosures; enforced on your reality.
- Treating GDPR as "an EU problem." One EU user with one email puts you in scope.
- Open-source code in a commercial product without a license review. GPL/AGPL can affect the whole product.
- Shipping AI with no disclosure. Growing enforcement target.
Before / after
Before: Solo founder launches a SaaS product, picks a name without searching, copies a competitor's privacy policy, uses AI images from an unclear license, ships a chatbot with no AI disclosure. Eighteen months in: a similarly named company sends a cease-and-desist (rebrand ~$40k). A user files a GDPR deletion request the policy promised but the founder never built a process for. An EU regulator opens an inquiry.
After: Same founder, four moves on day one. (1) USPTO + EUIPO clearance before naming. (2) Maps data, writes a policy that matches; sets up a deletion mailbox. (3) Licensed image sources, keeps licenses.txt. (4) One-line "this chatbot uses AI" disclosure. Cost: ~$1,500 and a few hours. None of those problems happen.
Disclaimer: I am not your lawyer. This is a framework, not legal advice. For trademark filing, drafting your privacy policy on real data flows, AI compliance in any regulated sector, and any active dispute, you need actual counsel.