# Sentry Ip And Compliance > This skill explains common IP moves and the most-cited compliance regimes for early-stage product companies. It does not file your trademark, write your privacy policy, or interpret a regulator's order. Escalate to counsel any time you're in a regulated industry (health, finance, legal services, any - Skill: `ferroxlabs/sentry-ip-and-compliance` (Agent Skill) - Install (CLI): `npx skillmds@latest add ferroxlabs/sentry-ip-and-compliance` - Raw SKILL.md: https://api.skillmd.com/api/skills/ferroxlabs/sentry-ip-and-compliance/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: FerroxLabs (https://skillmd.com/u/ferroxlabs) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/ferroxlabs/sentry-ip-and-compliance --- # IP and compliance ## Not legal advice; escalate when This skill explains common IP moves and the most-cited compliance regimes for early-stage product companies. It does not file your trademark, write your privacy policy, or interpret a regulator's order. Escalate to counsel any time you're in a regulated industry (health, finance, legal services, anything touching minors), facing an active claim, expanding internationally, or processing personal data at meaningful scale. ## When to load this mode The user is naming a product and asking about trademark, has a copyright question, is launching to EU users and wondering about GDPR, is shipping AI and wondering about disclosure, or has been told they need a privacy policy. ## Procedure Four categories. For each, what to know and the first concrete step. **1. Trademark.** Protects a brand identifier (name, logo, slogan) used in commerce. (a) The U.S. and many jurisdictions confer common-law rights from first use, even unregistered. (b) Registration (USPTO, EUIPO) gives broader rights and is required for serious enforcement. (c) Before naming, run a clearance search — USPTO TESS, EUIPO, general web. Rebrand cost from infringement dwarfs the search fee. **2. Copyright.** Protects original works (code, copy, images, music, video) once fixed in a tangible medium. You own copyright in what you create unless: work-for-hire, assigned, or licensed. Practical: (i) written IP assignment from every contractor. (ii) Don't reuse images, code, or music without checking the license. (iii) Open-source carries terms; ignoring GPL/AGPL copyleft creates real exposure. AI-generated content has unsettled copyright treatment — treat outputs as potentially uncopyrightable until case law lands. **3. Privacy and data protection.** Several overlapping regimes: - **GDPR (EU/UK).** Applies whenever you process personal data of people in the EU/UK. Personal data is broad (emails, IPs, cookies, device IDs). Required: privacy policy, lawful basis, DPA with vendors, process for handling data-subject requests. Fines are large and enforcement is real. - **U.S. state privacy laws.** California (CCPA/CPRA) is most enforced; Colorado, Virginia, Connecticut, Utah, and others have similar regimes. - **Sectoral rules.** HIPAA (health), COPPA (under-13s), GLBA (financial), FERPA (education). Requirements go well beyond a generic policy. First step: map what data you collect, from whom, why, where it goes, how long. The privacy policy is the public summary of that map. Without the map, the policy is fiction. **4. AI compliance.** A moving target. As of 2026: - **EU AI Act.** Risk-tier framework; most consumer AI lands in "limited risk" with disclosure obligations. High-risk uses (employment, credit, education, biometrics) have heavier obligations. - **U.S. state disclosure laws.** California, Texas, and others require AI-content disclosure in certain contexts (political content, deepfakes, commercial chatbots). - **Sectoral application.** AI in hiring, lending, or healthcare gets the underlying sector's regime. First step: name where AI shows up, what decisions it influences, whose rules apply. Write the disclosure copy. If any high-risk use is in scope, get counsel. ## Decision rules - **Search before you name.** Clearance is cheap; rebrand is not. - **Written IP assignment from every contractor.** Default assumptions are not in your favor. - **Map data before writing the policy.** A mismatched policy is worse than no policy. - **GDPR-style discipline by default.** Cheaper to build for the strictest regime than retrofit later. - **Disclose AI use.** Disclosure cost is near zero; failure-to-disclose cost is rising. ## Anti-patterns - **Picking a name another company in your category uses.** Cheap to avoid, expensive to fix. - **Stock images, code, or music without checking the license.** Top copyright-claim trigger. - **Lifting a privacy policy from a competitor.** You inherit their disclosures; enforced on your reality. - **Treating GDPR as "an EU problem."** One EU user with one email puts you in scope. - **Open-source code in a commercial product without a license review.** GPL/AGPL can affect the whole product. - **Shipping AI with no disclosure.** Growing enforcement target. ## Before / after **Before:** *Solo founder launches a SaaS product, picks a name without searching, copies a competitor's privacy policy, uses AI images from an unclear license, ships a chatbot with no AI disclosure. Eighteen months in: a similarly named company sends a cease-and-desist (rebrand ~$40k). A user files a GDPR deletion request the policy promised but the founder never built a process for. An EU regulator opens an inquiry.* **After:** *Same founder, four moves on day one. (1) USPTO + EUIPO clearance before naming. (2) Maps data, writes a policy that matches; sets up a deletion mailbox. (3) Licensed image sources, keeps licenses.txt. (4) One-line "this chatbot uses AI" disclosure. Cost: ~$1,500 and a few hours. None of those problems happen.* **Disclaimer:** I am not your lawyer. This is a framework, not legal advice. For trademark filing, drafting your privacy policy on real data flows, AI compliance in any regulated sector, and any active dispute, you need actual counsel.