---
title: "Compliance checklist: all 58 rules · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/checklist
updated: 2026-10-20
licence: "All rights reserved"
---

# Compliance checklist

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

Every rule in the compliance playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/checklist`.

## Scope and ownership

- [ ] **Required** [Keep a register of every duty that applies](https://agentwranglers.se/playbook/compliance/scope-and-ownership/obligations-register): Keep one register in the repository of every law, standard and contract duty you screened. Give each its decision, reason, owner and next review date.
- [ ] **Required** [Derive scope from recorded facts](https://agentwranglers.se/playbook/compliance/scope-and-ownership/scope-from-facts): Store the facts that decide which laws apply, such as headcount, turnover, countries served and product types, and compute each threshold in code.
- [ ] **Required** [Give every duty one named owner](https://agentwranglers.se/playbook/compliance/scope-and-ownership/named-owners): Give every duty, control and register one named person as owner and one as deputy. A team name is not an owner.
- [ ] **Required** [Keep every legal date in one calendar](https://agentwranglers.se/playbook/compliance/scope-and-ownership/compliance-calendar): Generate one calendar from the registers with every review date, contract renewal, legal start date and audit certificate expiry. Warn owners 30 days before each. Audit certificates include ISO 27001. TLS certificates follow [certificate renewal](https://agentwranglers.se/playbook/website/hosting-and-network/certificate-renewal) instead.
- [ ] **Required** [Decide whether you need a data protection officer](https://agentwranglers.se/playbook/compliance/scope-and-ownership/dpo-decision): Record whether GDPR Article 37 requires a data protection officer, with the reason. If it does, publish the contact and tell the supervisory authority.
- [ ] **Required** [Name a representative when you serve the EU from outside](https://agentwranglers.se/playbook/compliance/scope-and-ownership/eu-representative): If you have no EU office but offer goods or services to people in the EU, appoint an EU representative in writing. GDPR Article 27 requires it.

## Records and data map

- [ ] **Required** [Map every store that holds personal data](https://agentwranglers.se/playbook/compliance/records-and-data-map/data-map): Keep a data map in the repository of every place personal data is stored or sent. Give each its region, its owner and the kinds of data in it.
- [ ] **Required** [Keep the record of processing as data](https://agentwranglers.se/playbook/compliance/records-and-data-map/records-of-processing): Keep the record of processing that GDPR Article 30 asks for as data in the repository. Build it on the data map and render it on demand.
- [ ] **Required** [Mark special categories and children's data](https://agentwranglers.se/playbook/compliance/records-and-data-map/special-category-flags): Flag every store and column that holds special categories of data, criminal records or children's data, because stricter rules apply to them.
- [ ] **Required** [Screen every new feature for a DPIA](https://agentwranglers.se/playbook/compliance/records-and-data-map/dpia-screening): Before a feature that touches personal data starts, answer a fixed screening list. When the result says high risk, finish a data protection impact assessment first.
- [ ] **Required** [Keep one retention schedule](https://agentwranglers.se/playbook/compliance/records-and-data-map/retention-schedule): Keep one retention schedule that gives every kind of personal data a period, the reason for it and the job that enforces it.

## Processors and transfers

- [ ] **Required** [Keep one register of vendors](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-register): Keep one register of every vendor that handles personal data or reaches production. Fail the build when the code uses a vendor not in it.
- [ ] **Required** [Check each agreement covers Article 28](https://agentwranglers.se/playbook/compliance/processors-and-transfers/dpa-article-28): Check every data processing agreement against the list in GDPR Article 28(3), and record the result and the breach notice deadline in the vendor register.
- [ ] **Required** [Publish your subprocessors](https://agentwranglers.se/playbook/compliance/processors-and-transfers/subprocessor-list): If you process personal data for business customers, publish your subprocessor list at a stable address and tell customers before you add one.
- [ ] **Required** [Record a legal basis for every transfer](https://agentwranglers.se/playbook/compliance/processors-and-transfers/transfer-basis): For every store or vendor outside the European Economic Area, record the transfer basis under GDPR Chapter V. Contract clauses also need a transfer impact assessment.
- [ ] **Required** [Check the Data Privacy Framework status of US vendors](https://agentwranglers.se/playbook/compliance/processors-and-transfers/dpf-status): Rely on the EU-US Data Privacy Framework only for US vendors on its active list. Check the list monthly and keep signed contract clauses as a fallback.
- [ ] **Required** [Rank vendors and check their evidence](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-tiers): Rank every vendor by the data and access it has, and require current security evidence for the top tier.
- [ ] **Required** [Record the data terms of every AI provider](https://agentwranglers.se/playbook/compliance/processors-and-transfers/ai-provider-terms): Give every AI model provider a vendor register entry with its plan, its training setting, its retention and its region. Allow only plans that do not train on your data.
- [ ] **Recommended** [Confirm deletion when a vendor leaves](https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-exit): When you stop using a vendor, get written confirmation that it deleted or returned your data, before you remove it from the register.

## Breaches and reporting

- [ ] **Required** [Start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks): Record the moment you became aware of an incident, and compute every legal and contract deadline from it in code, the moment the incident opens.
- [ ] **Required** [Log every breach with its decision](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-register): Record every personal data breach in a register, including the ones you did not report. Give the facts, the effects, the actions and each decision's reason.
- [ ] **Required** [Decide the risk with a fixed method](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-risk-method): Decide whether a breach must be reported with one written scoring method, and store the score next to the decision.
- [ ] **Required** [Keep the notices ready](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-notice-templates): Keep notices ready for the authority, business customers and the people affected, with every field the law asks for. Know where to file each one.
- [ ] **Required** [Tell your customers when you are their processor](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/processor-breach-notice): When you process data for business customers, tell each affected customer about a breach without undue delay and within the hours your agreement promises.

## Audit logs and access

- [ ] **Required** [Write an audit event for every sensitive action](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-events): Write one audit event for each action on a fixed list, with who, what, which record, when, from where and the result.
- [ ] **Required** [Make the audit log impossible to change](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-immutable): Store audit events where the app can only add and nobody can edit or delete. Chain each event to the one before with a hash.
- [ ] **Required** [Keep audit logs for a set time](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-retention): Keep audit logs for a stated period, longer than debug logs, then delete them on schedule.
- [ ] **Required** [Review access every quarter](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/access-reviews): Every quarter, export every account and role from each system with production or customer data. Compare it with the staff list and remove extras within five working days.
- [ ] **Required** [Remove access within a day of leaving](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day): Disable every account of a person who leaves within 24 hours of their last day, and rotate any shared secret they knew.
- [ ] **Required** [Grant admin rights only for a set time](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/just-in-time-admin): Give nobody standing admin rights to production. Grant them on request, with a reason, for at most 8 hours, and log every grant.
- [ ] **Recommended** [Keep roles as code](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/roles-as-code): Define which job gets which role in a file in the repository, apply it from there, and change access only through a reviewed pull request.

## Controls and evidence

- [ ] **Required** [Turn every policy line into a checked control](https://agentwranglers.se/playbook/compliance/controls-and-evidence/control-register): Keep a register of controls in the repository. Each control has an ID, one testable statement, an owner, a frequency and the command that checks it.
- [ ] **Required** [Collect evidence automatically](https://agentwranglers.se/playbook/compliance/controls-and-evidence/automated-evidence): Let scheduled jobs collect evidence for each automated control from CI, the code host and the cloud. Save each result with a date and a hash.
- [ ] **Required** [Keep evidence where nobody can change it](https://agentwranglers.se/playbook/compliance/controls-and-evidence/evidence-store): Store evidence in write-once storage, in folders by date, and keep it for the audit period plus at least one year.
- [ ] **Required** [Prove every production change was reviewed](https://agentwranglers.se/playbook/compliance/controls-and-evidence/change-evidence): For every production deploy, keep a link to the commit, the pull request, an approval by someone other than the author, and the passing checks.
- [ ] **Required** [Keep every policy short and owned](https://agentwranglers.se/playbook/compliance/controls-and-evidence/policies-owned): Give every written policy an owner, a version, an approval date and a review date within 12 months. Track that every person has read the current version.
- [ ] **Required** [Keep a risk register with treatment dates](https://agentwranglers.se/playbook/compliance/controls-and-evidence/risk-register): Keep a register of security and privacy risks as data. Give each risk a likelihood, an impact, an owner, a treatment and a review date within 12 months.
- [ ] **Recommended** [Pick the framework your customers ask for](https://agentwranglers.se/playbook/compliance/controls-and-evidence/framework-choice): Choose SOC 2 or ISO/IEC 27001 from what your customers ask for in contracts and questionnaires, and record the auditor and the next audit date.

## AI Act

- [ ] **Required** [Register every AI feature with role and risk](https://agentwranglers.se/playbook/compliance/ai-act/ai-register): Keep a register of every AI system you build, sell or use. Record your role, its risk class, the model and provider, its purpose and who it affects.
- [ ] **Required** [Rule out the banned uses](https://agentwranglers.se/playbook/compliance/ai-act/prohibited-ai-practices): Screen every AI feature against the practices banned by AI Act Article 5 before it is built, and record the answer per practice.
- [ ] **Required** [Train everyone who uses AI at work](https://agentwranglers.se/playbook/compliance/ai-act/ai-literacy): Give every person who builds, runs or uses AI systems for you training that fits their role, and keep a dated record per person.
- [ ] **Required** [Map each feature to its transparency duty](https://agentwranglers.se/playbook/compliance/ai-act/ai-transparency-map): For every AI feature, record which paragraph of AI Act Article 50 applies. Link an automated test that proves the notice or mark is there.
- [ ] **Required** [Find out if a feature is high-risk](https://agentwranglers.se/playbook/compliance/ai-act/ai-high-risk-check): Check every AI feature against the high-risk areas in AI Act Annex III and the products in Annex I. Plan the duties before their start dates.
- [ ] **Required** [Know when you become a model provider](https://agentwranglers.se/playbook/compliance/ai-act/gpai-provider-duties): Record whether you provide a general-purpose AI model, including by changing someone else's model substantially, and meet the Article 53 duties if you do.

## Product and sector laws

- [ ] **Required** [Decide whether NIS2 covers you](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/nis2-scope): Decide whether the NIS2 Directive covers you from your sector and size, record the decision, and register with the national authority when it does.
- [ ] **Required** [Map the NIS2 measures to controls](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/nis2-measures): If NIS2 covers you, map each of the ten measures in Article 21(2) to checked controls. Management approves them and takes training on them.
- [ ] **Required** [Decide whether the Cyber Resilience Act covers your product](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-scope): List every product with digital elements you place on the EU market, record whether the Cyber Resilience Act applies to each, and record its class.
- [ ] **Required** [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-vulnerability-reporting): Since 11 September 2026, report every actively exploited vulnerability and severe incident in a CRA product. Use the ENISA single reporting platform.
- [ ] **Required** [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-support-period): State a support period of at least five years for each covered product, unless its use is shorter. Ship free security fixes until it ends.
- [ ] **Required** [Prepare the technical file and CE marking](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-technical-file): From 11 December 2027, each covered product needs a technical file, an EU declaration of conformity and a CE marking. Keep them for ten years or the support period, whichever is longer.
- [ ] **Required** [Meet the European Accessibility Act as a legal duty](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/accessibility-act-duty): Record whether the European Accessibility Act covers your products or services. If it does, meet EN 301 549, publish how you meet it, and test it in every build.
- [ ] **Required** [Let cloud customers leave under the Data Act](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/data-act-switching): If you sell a cloud or software service to EU customers, offer a tested full export and the switching terms of the Data Act. Charge nothing for switching from 12 January 2027.

## US state privacy laws

- [ ] **Required** [Compute which state laws apply](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-state-scope): Keep a table of the US state privacy laws with their thresholds and start dates. Compute from your facts file which ones apply to you.
- [ ] **Required** [List every sale and every share](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/sales-and-sharing-inventory): List every flow of personal data to another company that could count as a sale or targeted advertising. Offer an opt-out that stops each one.
- [ ] **Required** [Ask before using sensitive data](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-sensitive-data-consent): Process sensitive data only after an opt-in where any applying state requires it, and record each consent with its time and wording.
- [ ] **Required** [Track request deadlines by law](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/request-deadlines-by-law): Compute the due date of every privacy request from the law that applies to the person. Offer the appeal step that US state laws require.
- [ ] **Required** [Assess risky processing for US laws too](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-risk-assessments): Write a data protection assessment before targeted advertising, selling data, profiling with large effects or using sensitive data, in every state that asks for one.
- [ ] **Required** [Keep the US breach notice laws as data](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-breach-notice-laws): Keep a table of the breach notice law of every US state where affected people live. Compute each deadline and each notice to a regulator from it.