Regulatory Guard

Regulatory Guard

A standalone audit skill that verifies a website or web app strictly follows the legislation that applies to its users, content, and jurisdictions.

Use when:

• Preparing a public launch (B2C or B2B-with-consumer-touchpoints)
• Expanding to a new market (EU, UK, California, Brazil, etc.)
• Hardening before a regulator inquiry, DPIA review, or enterprise procurement
• Adding AI features that touch user-generated content
• Periodic compliance posture check (recommended quarterly)

Triggers: "compliance audit", "GDPR check", "is this site GDPR compliant", "WCAG audit", "accessibility audit", "ADA compliance", "EAA check", "CCPA compliance", "cookie banner audit", "AI Act compliance", "regulatory check", "legal audit", "audit website", "audit web app", "compliance posture".

Disclaimer. This skill produces a structured technical audit, not legal advice. High-severity findings should be reviewed by qualified counsel. Jurisdictional applicability is heuristic — when in doubt, mark as APPLIES? and escalate.

Agent Capabilities

This skill remains functional in a "static-only" mode (no browser) but loses the ability to verify cookie banners, runtime trackers, and rendered ARIA — flag those checks as UNVERIFIED in that case.

Table of Contents

1. Quick Start
2. Audit Scope Detection
3. Audit Domains
4. Severity Tiers
5. Execution Flow
6. Evidence Format
7. Output Format
8. References

Quick Start

# Audit a deployed site (live)
regulatory-guard audit https://example.com

# Audit local app (dev server)
regulatory-guard audit http://localhost:3000 --source ./

# Audit only one domain
regulatory-guard audit https://example.com --domain privacy
regulatory-guard audit https://example.com --domain accessibility
regulatory-guard audit https://example.com --domain consumer
regulatory-guard audit https://example.com --domain ai-content

# Restrict to specific jurisdictions
regulatory-guard audit https://example.com --jurisdictions EU,US-CA

Without a CLI router, agents invoke this skill by following the Execution Flow below using their native tools.

Audit Scope Detection

Before running checks, determine what applies. Skip irrelevant law — false positives erode trust.

┌──────────────────────────────────────────────────────────────┐
│              SCOPE DETECTION (run first)                     │
├──────────────────────────────────────────────────────────────┤
│ 1. Target users (geo)? ─────► EU? US? CA? UK? BR? Global?    │
│ 2. Data collected? ─────────► PII? sensitive? minors?        │
│ 3. Commerce? ───────────────► sales, ads, marketplace?       │
│ 4. AI features? ────────────► generation? recommendation?    │
│ 5. Service size? ───────────► VLOP/VLOSE? gatekeeper?        │
└──────────────────────────────────────────────────────────────┘
            │
            ▼
   Build APPLICABILITY MATRIX → only audit what applies

Heuristics for jurisdictional applicability:

If ambiguous → mark as APPLIES? with the signals you used, ask the user to confirm before running domain-specific checks.

Audit Domains

Each domain has its own deep checklist in references/. Load on-demand.

1. Privacy → references/privacy.md

Scope: GDPR, CCPA / CPRA, ePrivacy Directive (cookie law), PIPL, LGPD.

Top-level checks:

• Cookie consent — opt-in (EU), opt-out (US), no pre-checked boxes, banner blocks non-essential trackers until consent
• Privacy policy — completeness, clarity, last-updated date, lawful basis stated, retention periods, sub-processors, contact for DPO/privacy
• Data subject rights — discoverable mechanism for access, deletion, rectification, portability, objection, opt-out of sale
• DPIA triggers — high-risk processing identified
• Cross-border transfers — SCCs / adequacy decisions referenced
• Breach response — documented procedure, 72-hour notification capability
• Children — COPPA / age gate / parental consent if minors possible

2. Accessibility → references/accessibility.md

Scope: WCAG 2.2 Level AA, ADA Title III (US), European Accessibility Act (EAA, mandatory June 28, 2025), EN 301 549, Section 508.

Top-level checks:

• Perceivable: text alternatives, captions, color contrast (4.5:1 normal / 3:1 large), reflow, resize 200%
• Operable: keyboard accessible, no keyboard traps, focus visible (2.2 new), target size (2.2 new), no seizure-inducing flashes
• Understandable: language declared, predictable navigation, error identification + suggestion, labels/instructions, consistent help (2.2 new)
• Robust: parses, name/role/value, status messages
• Accessibility statement: published, conformance level, contact, enforcement
• Procurement (EAA scope): VPAT or equivalent for B2B

3. Consumer & E-commerce → references/consumer.md

Scope: DSA (Digital Services Act), DMA (Digital Markets Act), CCPA "sale" rules, CAN-SPAM, Consumer Rights Directive (EU), Omnibus Directive, Unfair Commercial Practices Directive, CPRA dark-patterns rules.

Top-level checks:

• Pricing transparency: total price upfront, no drip pricing, currency clear, taxes/fees disclosed before checkout
• Withdrawal / refund: 14-day right (EU), clear policy, withdrawal form provided
• Reviews & rankings: discloses if reviews verified, ranking parameters disclosed (Omnibus)
• Dark patterns: no forced action, no obstruction, no misdirection, opt-out as easy as opt-in
• DSA notice & action: working content-flagging, statement of reasons, transparency reports (if applicable)
• DMA: gatekeeper obligations (interop, sideloading, no self-preferencing) — only if designated
• Marketing email: unsubscribe in every email, accurate sender, accurate subject (CAN-SPAM); double opt-in (GDPR)
• Cookie / consent reuse for marketing: separate from analytics consent

4. AI & Content → references/ai-content.md

Scope: EU AI Act (phased applicability through 2026/2027), Copyright Directive (EU), DMCA (US), CDA Section 230 boundaries, state AI disclosure laws (e.g., CA, CO, IL).

Top-level checks:

• AI Act risk classification: unacceptable / high / limited / minimal — system identified and classified
• Transparency: users informed when interacting with AI (chatbots, deepfakes, generative content)
• Training-data disclosure for general-purpose AI (GPAI) per AI Act
• Copyright: TDM opt-out (Copyright Directive Art 4), training-data licensing posture
• DMCA: registered designated agent, takedown workflow, counter-notice flow, repeat-infringer policy
• User-generated content moderation: terms aligned with platform policy
• Watermarking / provenance: synthetic media labeled (AI Act + state laws)
• AI-generated decisions affecting users (employment, credit, housing, etc.) — explainability + appeal

Severity Tiers

Each finding receives one of four severity levels:

Plus two non-finding states:

• PASS — explicitly verified compliant
• UNVERIFIED — could not check (e.g., no live URL, gated behind auth) — list what's needed to verify

Execution Flow

Phase 0 — Scope

1. Confirm target: live URL, source path, or both.
2. Apply Audit Scope Detection → produce APPLICABILITY MATRIX.
3. Confirm with user if any domain is ambiguous.

Phase 1 — Gather (parallel where possible)

For each applicable domain, collect:

Phase 2 — Evaluate

For each check in the applicable domain reference, mark: PASS / BLOCKER / HIGH / MEDIUM / LOW / UNVERIFIED. Each non-PASS finding must include evidence (see Evidence Format).

Phase 3 — Report

Produce a single report following Output Format.

Phase 4 — Remediation Plan

For BLOCKER + HIGH findings, draft a concrete remediation:

• File path / page URL
• Suggested change (code, copy, configuration)
• Owner (engineering / legal / content)
• Estimated effort (XS / S / M / L)

Evidence Format

Every non-PASS finding must cite specific evidence so it can be verified:

[domain.check-id] <one-line summary>
  severity: BLOCKER
  evidence:
    - URL: https://example.com/checkout
    - request: GET https://google-analytics.com/collect?... (fired pre-consent)
    - source: app/layout.tsx:42 — <Script src="..." strategy="beforeInteractive" />
    - cookie: _ga=... (Set-Cookie before consent dialog dismissed)
  applicable_law: GDPR Art 6 + ePrivacy Art 5(3)
  remediation:
    - gate <Script> behind consent state
    - migrate to consent-aware loader (e.g., conditionally render after user accepts)
  effort: S

Never assert a finding without at least one of: URL + observed behavior, source path + line, network capture, header value, screenshot reference.

Output Format

# Regulatory Compliance Audit — <site / app name>

**Date:** 2026-MM-DD
**Auditor:** regulatory-guard skill (vllnt/skills)
**Target:** https://example.com (+ source: ./)
**Scope:** EU, US (CA), Global users

## Applicability Matrix
| Law | Applies | Reason |
|-----|---------|--------|
| GDPR | YES | Site available to EU users; collects email |
| CCPA / CPRA | YES | "California" mentioned; US users targeted |
| EAA | YES | B2C e-commerce, available in EU after 2025-06-28 |
| DSA | NO | <45M EU MAU and not a hosting provider for UGC at platform scale |
| EU AI Act | LIMITED | Chatbot present (limited-risk transparency obligations) |
| ... | ... | ... |

## Summary

| Severity | Count |
|----------|-------|
| BLOCKER  | 3 |
| HIGH     | 7 |
| MEDIUM   | 12 |
| LOW      | 5 |
| UNVERIFIED | 2 |
| PASS     | 41 |

**Verdict:** NOT READY FOR PUBLIC RELEASE — 3 blockers must be resolved.

## Findings — Privacy
... (one entry per non-PASS finding, in Evidence Format)

## Findings — Accessibility
...

## Findings — Consumer & E-commerce
...

## Findings — AI & Content
...

## Remediation Plan (BLOCKER + HIGH)
| ID | Severity | Owner | Effort | Description |
|----|----------|-------|--------|-------------|
| privacy.cookie-pre-consent | BLOCKER | eng | S | Gate GA behind consent... |
| ... | ... | ... | ... | ... |

## Out of Scope / Unverified
- "third-party-trackers": could not verify on /admin (auth required) — please re-run with admin session
- ...

## Limitations
This audit is a structured technical review, not legal advice. High-severity findings should be reviewed by qualified counsel for the relevant jurisdictions.

References

Each domain's deep checklist:

• Privacy: references/privacy.md
• Accessibility: references/accessibility.md
• Consumer & E-commerce: references/consumer.md
• AI & Content: references/ai-content.md

See also EXAMPLE.md for a full sample audit run.