Compliance Check (Pre-Launch)

Compliance Check (Pre-Launch)

Pre-launch regulatory go/no-go check on a proposed initiative.

When to use vs. adjacent compliance/legal skills

Defining characteristic of this skill: PRE-launch + proposed thing + forward-looking go/no-go.

Common invocations

• "Can we launch the new AI risk-scoring feature next month?"
• "Pre-launch check on a free-trial auto-convert flow for PR + 50 states"
• "Is it OK to add Anthropic as a sub-processor next week?"
• "We want to expand to EU customers in Q3 — go/no-go from a compliance angle?"
• "Marketing wants to run a 99% accuracy claim on the landing page — safe?"
• "Partnering with a health-data startup — what regulatory issues should we know?"

What gets checked

1. Applicable regulations (by jurisdiction)

• Privacy: GDPR (EU/UK), CCPA/CPRA (CA), CO/VA/CT/UT/TX/OR state privacy laws, HIPAA, COPPA, PIPEDA, LGPD, DPDP (India), PDPA (Singapore), CSL (China)
• Puerto Rico–specific: Ley Núm. 111-2005 (citizen identity-data breach notification), DACO consumer protection rules, PR Department of State filing requirements (if entity-level), bilingual disclosure expectations
• Marketing: CAN-SPAM, TCPA (SMS/calls), FTC endorsement guides + substantiation, state-level deceptive practice laws, state auto-renewal disclosure laws (CA, NY, OR, etc.)
• AI/algorithmic: EU AI Act risk classification (prohibited/high-risk/limited-risk/minimal), CO AI Act (effective Feb 2026), NYC Local Law 144 (employment ADM), state-level deepfake/biometric laws
• Industry-specific: HIPAA (health), GLBA (finance), FERPA (education), FedRAMP (federal customers), PCI-DSS (card data), SEC marketing rule (financial advice), FDA SaMD (medical software)
• Cybersec-specific: SEC cyber disclosure rule (4-day material incident), state breach notification laws, NYDFS Part 500 (NY financial counterparties)

2. Internal approvals required

• Legal review
• Privacy / DPO sign-off
• Security review (threat-model + data-flow)
• Finance (if revenue or pricing impact)
• Brand / marketing (if external comms)
• Executive (if material risk, strategic shift, or PR-sensitive)

3. External approvals / notifications required

• Regulatory filings (DPA notification of high-risk processing where required, FTC/state AG)
• Customer notice (DPA-required terms updates, material privacy policy change)
• Sub-processor notice — typically 30-day per DPA (verify your DPA's exact term)
• Auditor notification (if mid-cycle and material)
• Cyber insurance disclosure (material new exposure)
• Cross-border transfer mechanism updated (SCCs, UK IDTA, adequacy)

4. Required pre-launch artifacts

• DPIA / TIA (Data Protection / Transfer Impact Assessment) if high-risk personal data
• Vendor DPAs in place if data shared with new processor
• Updated privacy policy / disclosures
• Updated cookie banner + consent flows
• Data retention schedule updated
• Incident response runbook updated for new data type/system
• AI Act conformity assessment (if high-risk AI)

Output structure

1. Initiative summary — what is being proposed, in 2-3 sentences
2. Jurisdictional scope — where will this operate, where will users be (PR? US states? EU? UK?)
3. Applicable regulations table — regulation | requirement | applies (Y/N) | why
4. Required approvals table — approver | what they need to see | target date
5. Required artifacts checklist — done / in progress / missing
6. Risk areas — specific clauses, claims, or assumptions needing attention
7. DECISION — single-line GO / NO-GO / GO-WITH-CONDITIONS at the top of the report
8. Conditions (if conditional) — each condition must be verifiable and assigned: [Owner] must [action] by [date], evidenced by [artifact]
9. Re-check trigger — what change would invalidate the decision (e.g., "if we add EU users, re-run with GDPR scope")

Common pre-launch gotchas (cybersec/PR-founder context)

• Launching a feature that processes personal data without updating the privacy policy first
• Marketing claims that exceed FTC substantiation ("99% of customers...", "military-grade encryption")
• AI/algorithmic features without EU AI Act risk classification
• New data collection without consent capture flow update
• Cross-border data transfer without SCCs / UK IDTA / adequacy
• New sub-processor without 30-day customer notification per DPA
• Children-adjacent feature without COPPA verifiable parental consent
• Health-adjacent feature triggering HIPAA covered-entity / business-associate status
• Free trial auto-converting without state-by-state auto-renewal disclosure (CA Bus & Prof §17602, NY GBL §527-a, etc.)
• PR consumer rollout missing bilingual (Spanish) disclosures or DACO-required terms
• PR-resident PII processing without aligning to PR Ley 111-2005 breach-notification timing
• SaaS launching into NY-DFS-regulated counterparties without Part 500 attestation prep
• Cybersec product making detection-rate claims without substantiation file
• Partnership data-sharing without joint-controller analysis under GDPR Art. 26

Output format

Markdown report with the structure above. Top line is GO / NO-GO / GO-WITH-CONDITIONS, followed by conditions list (each verifiable, owned, dated). Defer recommendation always cites the appropriate sister skill if the user's actual ask is misclassified.