Compliance and governance playbook

A compliance playbook for software companies and the apps they run. It covers the duties a company must meet and be able to prove. That means records of processing, processors, transfers, breach reporting, audit logs, access reviews and security controls. It also covers the EU AI Act, NIS2, the Cyber Resilience Act and the European Accessibility Act. It ends with how US state privacy laws differ from the GDPR.

This playbook is not legal advice. It turns common legal duties into registers, jobs and checks that engineers can run. A lawyer still decides which laws apply to you and what they mean for your case. Every date and article here was checked against the official texts in October 2026.

Each rule keeps its facts as data next to the code, such as a YAML file. A check fails when the data and the system disagree. Auditors then get evidence from the same runs that keep the system working. The privacy chapter of the website playbook covers consent, the privacy policy and data requests. The personal data chapter of the data playbook covers columns, deletion and masking. This playbook links to both and does not repeat them.

Start with Scope and ownership. It decides which laws apply, so you know which of the later chapters you need.

Chapters

1. Scope and ownership

   Decide which laws and standards apply from recorded facts, give every duty one owner, and keep every legal date in one calendar that warns you.

   • Required 6

2. Records and data map

   Keep the data map and the GDPR record of processing as data next to the code. Check them against the system and screen new features for a DPIA.

   • Required 5

3. Processors and transfers

   List every vendor that touches your data with its contract, region and transfer basis, publish your subprocessors, and check AI providers' terms on training.

   • Required 7
   • Recommended 1

4. Breaches and reporting

   Start every legal reporting clock from one recorded moment, log every breach with its decision, and keep notices ready so a report takes minutes.

   • Required 5

5. Audit logs and access

   Record who did what in a log nobody can change, and keep it for a set time. Prove every quarter that only the right people have access.

   • Required 6
   • Recommended 1

6. Controls and evidence

   Turn each policy into controls with an owner and an automated check. Map them to SOC 2 or ISO 27001 and collect dated evidence from CI and the cloud.

   • Required 6
   • Recommended 1

7. AI Act

   Register every AI feature with your role and its risk class under the EU AI Act. Rule out banned uses and track the dates that apply to you.

   • Required 6

8. Product and sector laws

   Decide whether NIS2, the Cyber Resilience Act and the European Accessibility Act apply to you. Turn the ones that do into dates, controls and checks.

   • Required 8

9. US state privacy laws

   About twenty US states have privacy laws that differ from the GDPR in scope, sales, sensitive data and deadlines. Keep the differences as data and checks.

   • Required 6

All 58 rules on one page