Compliance checklist

Every rule in the compliance playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it.

Scope and ownership

• Required Keep a register of every duty that applies
• Required Derive scope from recorded facts
• Required Give every duty one named owner
• Required Keep every legal date in one calendar
• Required Decide whether you need a data protection officer
• Required Name a representative when you serve the EU from outside

Records and data map

• Required Map every store that holds personal data
• Required Keep the record of processing as data
• Required Mark special categories and children's data
• Required Screen every new feature for a DPIA
• Required Keep one retention schedule

Processors and transfers

• Required Keep one register of vendors
• Required Check each agreement covers Article 28
• Required Publish your subprocessors
• Required Record a legal basis for every transfer
• Required Check the Data Privacy Framework status of US vendors
• Required Rank vendors and check their evidence
• Required Record the data terms of every AI provider
• Recommended Confirm deletion when a vendor leaves

Breaches and reporting

• Required Start every reporting clock from one moment
• Required Log every breach with its decision
• Required Decide the risk with a fixed method
• Required Keep the notices ready
• Required Tell your customers when you are their processor

Audit logs and access

• Required Write an audit event for every sensitive action
• Required Make the audit log impossible to change
• Required Keep audit logs for a set time
• Required Review access every quarter
• Required Remove access within a day of leaving
• Required Grant admin rights only for a set time
• Recommended Keep roles as code

Controls and evidence

• Required Turn every policy line into a checked control
• Required Collect evidence automatically
• Required Keep evidence where nobody can change it
• Required Prove every production change was reviewed
• Required Keep every policy short and owned
• Required Keep a risk register with treatment dates
• Recommended Pick the framework your customers ask for

AI Act

• Required Register every AI feature with role and risk
• Required Rule out the banned uses
• Required Train everyone who uses AI at work
• Required Map each feature to its transparency duty
• Required Find out if a feature is high-risk
• Required Know when you become a model provider

Product and sector laws

• Required Decide whether NIS2 covers you
• Required Map the NIS2 measures to controls
• Required Decide whether the Cyber Resilience Act covers your product
• Required Report exploited vulnerabilities in your products
• Required Handle vulnerabilities for the whole support period
• Required Prepare the technical file and CE marking
• Required Meet the European Accessibility Act as a legal duty
• Required Let cloud customers leave under the Data Act

US state privacy laws

• Required Compute which state laws apply
• Required List every sale and every share
• Required Ask before using sensitive data
• Required Track request deadlines by law
• Required Assess risky processing for US laws too
• Required Keep the US breach notice laws as data