---
title: "Compliance playbook · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance
updated: 2026-10-20
licence: "All rights reserved"
---

# Compliance and governance playbook

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

A compliance playbook for software companies and the apps they run. It covers the duties a company must meet and be able to prove. That means records of processing, processors, transfers, breach reporting, audit logs, access reviews and security controls. It also covers the EU AI Act, NIS2, the Cyber Resilience Act and the European Accessibility Act. It ends with how US state privacy laws differ from the GDPR.

This playbook is not legal advice. It turns common legal duties into registers, jobs and checks that engineers can run. A lawyer still decides which laws apply to you and what they mean for your case. Every date and article here was checked against the official texts in October 2026.

Each rule keeps its facts as data next to the code, such as a YAML file. A check fails when the data and the system disagree. Auditors then get evidence from the same runs that keep the system working. The [privacy chapter](https://agentwranglers.se/playbook/website/privacy) of the website playbook covers consent, the privacy policy and data requests. The [personal data chapter](https://agentwranglers.se/playbook/data/personal-data) of the data playbook covers columns, deletion and masking. This playbook links to both and does not repeat them.

Start with [Scope and ownership](https://agentwranglers.se/playbook/compliance/scope-and-ownership). It decides which laws apply, so you know which of the later chapters you need.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance`.

## Chapters

1. [Scope and ownership](https://agentwranglers.se/playbook/compliance/scope-and-ownership): Decide which laws and standards apply from recorded facts, give every duty one owner, and keep every legal date in one calendar that warns you. (6 required)
2. [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map): Keep the data map and the GDPR record of processing as data next to the code. Check them against the system and screen new features for a DPIA. (5 required)
3. [Processors and transfers](https://agentwranglers.se/playbook/compliance/processors-and-transfers): List every vendor that touches your data with its contract, region and transfer basis, publish your subprocessors, and check AI providers' terms on training. (7 required, 1 recommended)
4. [Breaches and reporting](https://agentwranglers.se/playbook/compliance/breaches-and-reporting): Start every legal reporting clock from one recorded moment, log every breach with its decision, and keep notices ready so a report takes minutes. (5 required)
5. [Audit logs and access](https://agentwranglers.se/playbook/compliance/audit-logs-and-access): Record who did what in a log nobody can change, and keep it for a set time. Prove every quarter that only the right people have access. (6 required, 1 recommended)
6. [Controls and evidence](https://agentwranglers.se/playbook/compliance/controls-and-evidence): Turn each policy into controls with an owner and an automated check. Map them to SOC 2 or ISO 27001 and collect dated evidence from CI and the cloud. (6 required, 1 recommended)
7. [AI Act](https://agentwranglers.se/playbook/compliance/ai-act): Register every AI feature with your role and its risk class under the EU AI Act. Rule out banned uses and track the dates that apply to you. (6 required)
8. [Product and sector laws](https://agentwranglers.se/playbook/compliance/product-and-sector-laws): Decide whether NIS2, the Cyber Resilience Act and the European Accessibility Act apply to you. Turn the ones that do into dates, controls and checks. (8 required)
9. [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws): About twenty US states have privacy laws that differ from the GDPR in scope, sales, sensitive data and deadlines. Keep the differences as data and checks. (6 required)

See all 58 rules on one page in the [checklist](https://agentwranglers.se/playbook/compliance/checklist).