# Regulatory Compliance Mapping

> Generic regulatory compliance mapping framework for franchise operations. Accepts any {regulatory_domain} and {territory_scope}, outputs a compliance checklist, gap analysis, and remediation roadmap. Covers data privacy, health/safety, food safety, financial services, education, professional licensing, and labor/employment regulations. Use when mapping compliance requirements for franchise expansion, assessing regulatory risk for new markets, designing compliance programs, or preparing for regulatory audits.

- Skill: `kaakati/regulatory-compliance-mapping` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kaakati/regulatory-compliance-mapping`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kaakati/regulatory-compliance-mapping/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: Kaakati (https://skillmd.com/u/kaakati)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kaakati/regulatory-compliance-mapping

---


# Regulatory Compliance Mapping

## Core Variables

| Variable | Examples | Impact on Analysis |
|---|---|---|
| `{regulatory_domain}` | data_privacy, food_safety, health_code, financial, education, professional_licensing, labor | Determines which regulatory frameworks to map |
| `{territory_scope}` | US-national, US-state-specific, EU, international | Determines jurisdictional depth |
| `{business_model}` | SaaS, physical_retail, service, hybrid | Determines which regulations apply |
| `{franchise_model}` | single-unit, multi-unit, area_development, master_franchise | Determines compliance delegation model |

## Required Inputs

- **Business Description**: What the franchise does and how it delivers value.
- **Data/Materials Handled**: What sensitive data, substances, or products are involved.
- **Target Markets**: Geographic scope with specific jurisdictions.
- **Franchise Structure**: How compliance responsibilities are split (franchisor vs. franchisee).

## Execution Steps

### 1. Regulatory Domain Identification

Map the business to all applicable regulatory domains:

| Domain | Triggers When | Examples |
|---|---|---|
| **Data Privacy** | Any business collecting personal data | GDPR, CCPA, FERPA, HIPAA, PIPEDA |
| **Food Safety** | Food handling, preparation, or service | FDA, local health codes, FSMA |
| **Health & Safety** | Physical premises with public access | OSHA, local building/fire codes |
| **Financial Services** | Payments, lending, insurance | PCI-DSS, state money transmitter, AML |
| **Education** | Schools, training, accreditation | FERPA, COPPA, accreditation bodies |
| **Healthcare** | Patient care, health data | HIPAA, state practice acts, CMS |
| **Professional Licensing** | Licensed professionals deliver service | State licensing boards, CE requirements |
| **Labor & Employment** | Franchise employs staff | FLSA, state employment laws, joint employer |
| **Consumer Protection** | Any B2C business | FTC Act, state UDAP laws |
| **Environmental** | Manufacturing, chemicals, waste | EPA, state environmental agencies |
| **Franchise-Specific** | The franchise relationship itself | FTC Rule 436, state franchise laws, international franchise regulations |

### 2. Jurisdiction-by-Jurisdiction Regulatory Map

For each target jurisdiction, map applicable regulations:

**Template: Regulatory Requirements Matrix**

| Jurisdiction | Regulation | Scope | Key Requirements | Registration / Permit | Renewal | Penalty for Non-Compliance |
|---|---|---|---|---|---|---|
| [Country/State] | [Law name] | [What it covers] | [Top 3-5 requirements] | [Yes/No + details] | [Frequency] | [Fine/license loss/criminal] |

**Franchise-Specific Regulations (Universal)**

| Jurisdiction | Franchise Regulation | Registration Required? | Relationship Law? | Key Provisions |
|---|---|---|---|---|
| US — Federal | FTC Rule 436 | No (disclosure only) | No | FDD delivery 14 days before signing |
| US — CA, IL, MD, MN, NY, etc. | State franchise laws | Yes (14+ states) | Yes (19+ states) | Registration, relationship protections |
| EU — varies by country | National franchise codes | Varies | Some countries | Pre-contractual disclosure |
| Canada — AB, ON, MB, NB, PEI, BC | Provincial franchise acts | Some require | Yes | Disclosure document, good faith |
| Australia | Franchising Code of Conduct | No | Yes | Disclosure, dispute resolution |
| India | No specific franchise law | No | General contract law | Contract Act, IP protection |
| UAE | Commercial Agency Law | Yes | Yes | Agency registration requirements |
| China | Commercial Franchise Admin Measures | Yes (MOFCOM) | Yes | Filing, disclosure, 2-unit rule |

### 3. Compliance Responsibility Matrix (Franchise-Specific)

Define who is responsible for what in the franchise structure:

| Compliance Area | Franchisor Responsibility | Franchisee Responsibility | Shared |
|---|---|---|---|
| Franchise law compliance (FDD, registration) | Full | None | — |
| Brand and trademark protection | Full | Report violations | — |
| Platform/product regulatory compliance | Full | Local permits | — |
| Local business licensing | Guidance | Full | — |
| Employment law | Own employees | Own employees | Joint employer risk |
| Data privacy (if applicable) | Policy, platform controls | Local implementation | Data processing agreements |
| Health/safety (if applicable) | Standards and audits | Daily compliance | Audit process |
| Insurance | Minimum requirements | Procurement and maintenance | Verification |
| Tax compliance | System-level | Unit-level filing | Royalty reporting |
| Training and certification | Program design | Completion and currency | Tracking |

### 4. Compliance Readiness Assessment

Score current posture per regulatory domain:

| Requirement Category | Current State | Gap | Priority | Remediation Cost |
|---|---|---|---|---|
| Registrations and permits | In place / Partial / Missing | Description | Critical/High/Med/Low | $X |
| Policies and procedures | Documented / Draft / None | | | |
| Technical controls | Implemented / Partial / None | | | |
| Training program | Active / Planned / None | | | |
| Monitoring and audit | Systematic / Ad hoc / None | | | |
| Incident response | Tested / Documented / None | | | |
| Record keeping | Compliant / Partial / None | | | |
| Third-party management | Managed / Partial / None | | | |

### 5. Compliance Program Design

For identified `{regulatory_domain}` requirements, design the compliance program:

**Program Components**

| Component | Description | Owner | Frequency |
|---|---|---|---|
| Policy framework | Written policies covering each regulatory area | Franchisor | Annual review |
| Training curriculum | Role-based training for franchisee staff | Franchisor designs, franchisee delivers | Initial + annual |
| Self-assessment | Franchisee self-audit against compliance checklist | Franchisee | Quarterly |
| Franchisor audit | Independent compliance audit of franchise units | Franchisor | Annual |
| Incident reporting | Process for reporting compliance failures | Both | As needed |
| Remediation tracking | Corrective action management | Both | Ongoing |
| Regulatory monitoring | Track regulatory changes in target jurisdictions | Franchisor | Continuous |

### 6. Remediation Roadmap

Phase remediation by risk and timeline:

- **Phase 1 (0-30 days)**: Critical — active non-compliance in current markets
  with enforcement risk.
- **Phase 2 (30-90 days)**: High — requirements for next expansion markets or
  upcoming regulatory deadlines.
- **Phase 3 (90-180 days)**: Medium — best practices, certifications (SOC 2,
  ISO 27001, HACCP), and proactive compliance positioning.
- **Phase 4 (Ongoing)**: Monitoring — regulatory change tracking and program
  maintenance.

## Output Template

```markdown
## Regulatory Compliance Map: [Business Name]

### Engagement Parameters
| Variable | Value |
|---|---|
| Regulatory Domain(s) | {regulatory_domain} |
| Territory Scope | {territory_scope} |
| Business Model | {business_model} |
| Franchise Model | {franchise_model} |

### Executive Summary
[Overall compliance posture, critical gaps, recommendation]

### Regulatory Requirements Matrix
[Jurisdiction × regulation map with key requirements]

### Franchise Compliance Responsibilities
[Franchisor vs. franchisee responsibility matrix]

### Compliance Readiness Scorecard
[Assessment scores per domain with gap analysis]

### Remediation Roadmap
[Phased plan with owner, timeline, and cost]

### Critical Disclaimers
> This analysis provides a regulatory mapping framework. It does not constitute
> legal advice. Implementation requires review by qualified counsel in each
> jurisdiction. Regulations change frequently; all analysis reflects the
> regulatory landscape as of the date provided.
```

## Quality Checks

- All applicable `{regulatory_domain}` areas identified (not just the obvious ones).
- Franchise-specific regulations mapped (FTC Rule 436, state laws, international).
- Jurisdiction analysis is specific (not "check local laws").
- Franchisor vs. franchisee responsibilities clearly delineated.
- Joint employer risk addressed for labor/employment domain.
- Remediation roadmap is phased with priorities.