Regulatory Review

Regulatory Review

Overview

Regulatory review assesses the legal and compliance landscape affecting markets and products. This skill covers frameworks for understanding regulatory requirements, risks, and trends.

Required Frameworks

Trend Indicators: Load and apply the trend indicator definitions from protocols/TREND-INDICATORS.md.

Regulatory Dimensions

Direct Regulations

• Industry-specific rules (fintech, healthcare, etc.)
• Product safety requirements
• Licensing and certification
• Operational standards

Data & Privacy

• Data protection laws (GDPR, CCPA, etc.)
• Cross-border data transfer
• Consent requirements
• Breach notification

Consumer Protection

• Advertising standards
• Fair trading practices
• Warranty requirements
• Dispute resolution

Competition/Antitrust

• Market dominance rules
• M&A restrictions
• Pricing practices
• Distribution agreements

Major Regulatory Frameworks

Data Privacy

Financial Services

Healthcare

Children's Privacy

COPPA Parental Consent Methods (FTC-approved):

• Signed consent form (mail/fax/scan)
• Credit card transaction verification
• Government ID check
• Knowledge-based authentication
• Video conference verification
• FTC-approved verifiable parental consent method

Key COPPA Thresholds:

• Under 13: Full COPPA applies; verifiable parental consent required before collecting ANY personal information
• CCPA/CPRA: Under 16 requires opt-in for sale/sharing of personal data; under 13 requires parental opt-in

Consumer & Advertising

AI/Technology

AI/ML Bias Audit Requirements

When the product uses AI/ML in decisions affecting people (hiring, lending, insurance, housing), these specific requirements apply:

Industry-Framework Mapping

Use this table to quickly identify primary and secondary regulatory frameworks based on the user's industry:

Regulatory Risk Assessment

Risk Categories

Compliance Risk

• Failure to meet existing requirements
• Likelihood: Based on current gaps
• Impact: Fines, operational restrictions

Regulatory Change Risk

• New or changing regulations
• Likelihood: Based on legislative trends
• Impact: Cost of compliance, market access

Enforcement Risk

• Increased regulatory scrutiny
• Likelihood: Based on enforcement patterns
• Impact: Investigations, penalties

Reputational Risk

• Public perception of compliance
• Likelihood: Based on sensitivity of issues
• Impact: Customer trust, brand damage

Risk Matrix

Regulatory Trend Analysis

Trend Indicators

INC (Increasing regulation)

• New legislation proposed/passed
• Increased enforcement actions
• Growing public/political attention
• International coordination

DEC (Decreasing regulation)

• Deregulation initiatives
• Reduced enforcement
• Political shift toward less oversight

CONST (Stable regulation)

• Established framework
• Predictable enforcement
• No major changes pending

Current Global Trends

Compliance Assessment

Gap Analysis Framework

Compliance Cost Estimation

Jurisdiction Analysis

Market Entry Considerations

Cross-Border Considerations

• Data localization requirements
• Licensing reciprocity
• Contractual restrictions
• IP protection differences

Cross-Border Data Transfer Mechanisms

When operations span multiple jurisdictions, identify which transfer mechanism applies:

Output Rules

These rules are mandatory for every regulatory review output. They ensure consistency and completeness regardless of the specific industry or prompt:

1. Use exact section headings from the Output Structure below. Do not rename or skip sections.
2. Every Risk Matrix row MUST include a Trend column using exactly one of: INC, DEC, or CONST.
3. Every Trend Analysis bullet MUST use the format: Area: INC/DEC/CONST - [Evidence sentence].
4. Recommendations MUST include at least one of each: Immediate action, Medium-term action, and Monitoring action.
5. Compliance Assessment MUST use status symbols: ✓ (compliant), △ (partial), ✗ (non-compliant).
6. Never use the phrase "This is not legal advice" in the output. The skill disclaimer is in SKILL.md, not in outputs.
7. Always include a Monitoring Indicators section with at least 3 specific indicators (regulatory body names, legislative tracking sources).
8. Cross-border data transfer: When a prompt involves operations in multiple jurisdictions, always discuss data transfer mechanisms (SCCs, adequacy decisions, data localization).
9. Children's data: When the product involves users who may be minors, always address COPPA and parental consent requirements specifically.
10. Compliance costs: Always provide estimated ranges (not exact figures) broken down by Technology, Personnel, Legal/Consulting, Training, and Audit/Certification.

Output Structure

## Regulatory Review Summary

### Regulatory Landscape
[Overview of applicable regulations]

### Key Frameworks
| Framework | Applicability | Status |
|-----------|---------------|--------|
| [Name] | Direct/Indirect | Applicable/Monitor |

### Compliance Assessment
| Area | Status | Gap | Priority |
|------|--------|-----|----------|
| Data Privacy | ✓/△/✗ | [Gap] | H/M/L |
| [Other] | ✓/△/✗ | [Gap] | H/M/L |

### Regulatory Risk Matrix
| Risk | Likelihood | Impact | Trend |
|------|------------|--------|-------|
| [Risk] | H/M/L | H/M/L | INC/DEC/CONST |

### Trend Analysis
- Data Privacy: INC/DEC/CONST - [Evidence]
- Industry-Specific: INC/DEC/CONST - [Evidence]
- Enforcement: INC/DEC/CONST - [Evidence]

### Estimated Compliance Costs
[Cost breakdown]

### Recommendations
1. [Immediate action]
2. [Medium-term action]
3. [Monitoring action]

### Monitoring Indicators
- [Regulatory body announcements]
- [Legislative calendars]
- [Enforcement actions]

Emerging Regulations to Monitor

These proposed or recently enacted regulations are not yet fully in force but will affect multiple industries. Reference them in Trend Analysis and Monitoring Indicators when relevant:

Penalty Reference Ranges

Use these ranges to calibrate risk impact assessments. Cite specific enforcement examples when relevant to the user's industry:

Pre-Output Checklist

Before finalizing output, verify every item. This prevents common omissions that weaken the analysis:

1. Regulatory Landscape section opens the output with a narrative overview (not just a table)
2. Key Frameworks table lists at least 3 frameworks with Applicability and Status columns
3. Compliance Assessment uses ✓/△/✗ symbols and includes Priority column (H/M/L)
4. Risk Matrix has Likelihood, Impact, AND Trend columns; every row has INC/DEC/CONST
5. Trend Analysis has at least 3 bullet points, each using INC/DEC/CONST - [Evidence] format
6. Recommendations include at least one Immediate, one Medium-term, and one Monitoring action
7. Monitoring Indicators lists at least 3 specific sources (named regulatory bodies, legislative trackers)
8. Compliance Costs table is present with Technology, Personnel, Legal/Consulting, Training, and Audit rows
9. No forbidden phrases appear: "This is not legal advice", "I cannot provide legal advice", "consult a lawyer" (the disclaimer in SKILL.md handles this)
10. Cross-border transfers are addressed when multiple jurisdictions are involved (SCCs, adequacy, data localization)

Best Practices

• Findings are research-grade, not compliance-grade — flag regulatory dependencies for qualified review
• Monitor regulatory developments continuously
• Consider both current and proposed regulations
• Assess both direct and indirect impacts
• Factor compliance costs into business planning

Disclaimer

This skill provides research frameworks only. Consult qualified legal counsel for compliance decisions.

Additional Resources

For detailed frameworks, see:

• references/privacy-frameworks.md - Data privacy details
• references/compliance-checklist.md - Compliance templates
• examples/regulatory-analysis.md - Sample analysis

Orchestration Hints

Confidence tiers (universal scale):

• High: 3+ independent, recent (<12mo) sources that converge
• Medium: 2 sources OR sources >12mo old OR indirect evidence
• Low: Single source, inference, or extrapolation

Dimension-specific confidence criteria below REFINE (not replace) these universal definitions.

• Cross-reference dimensions: trends (regulatory trends and policy direction), competitive (compliance status of competitors)
• Alert triggers:
  • New regulation with <12 months to compliance deadline
  • Regulatory action against a major competitor
  • Policy shift that could enable or block market entry
• Confidence rules:
  • High: Published regulation or official government announcement
  • Medium: Proposed regulation in comment period or credible policy analysis
  • Low: Speculative based on political signals or advocacy positions
• Conflict detection:
  • Compliance timeline vs trend dimension's market entry projections
  • Regulatory burden cost vs financial dimension's unit economics
  • Compliance requirements vs tech dimension's feasibility assessment

Converted and distributed by TomeVault — claim your Tome and manage your conversions.