{"playbook":"Compliance","url":"https://agentwranglers.se/playbook/compliance","updated":"2026-10-21","license":"https://creativecommons.org/licenses/by/4.0/","credit":"Required by the licence: credit Agent Wranglers with a link to the rule or playbook you used.","how":"Each rule's How text is on its own page: add .md to its url.","rules":[{"chapter":"Scope and ownership","name":"Keep a register of every duty that applies","level":"Recommended","rule":"Keep one register in the repository of every law, standard and contract duty you screened. Give each its decision, reason, owner and next review date.","check":"A script in the build fails when an entry lacks a decision, reason, owner, source link, reviewer or review date. It also fails when a review date has passed or lies more than 12 months ahead.","url":"https://agentwranglers.se/playbook/compliance/scope-and-ownership/obligations-register","related":["/playbook/payments/amounts-and-orders/marketplace-funds","/playbook/payments/tax/us-sales-tax-nexus","/playbook/engineering/rules-as-code/check-every-rule-in-code","/playbook/compliance/online-platforms/dsa-tier"],"sources":[]},{"chapter":"Scope and ownership","name":"Derive scope from recorded facts","level":"Recommended","rule":"Store the facts that decide which laws apply, such as headcount, turnover, countries served and product types, and compute each threshold in code.","check":"A unit test sets headcount to 50 for one year in a copy of the facts file, and the size stays small. With 50 for two years in a row, the size changes from small to medium. The register check then fails until the NIS2 entry is updated.","url":"https://agentwranglers.se/playbook/compliance/scope-and-ownership/scope-from-facts","related":["/playbook/website/accessibility/accessibility-law","/playbook/compliance/product-and-sector-laws/nis2-scope","/playbook/compliance/us-state-privacy-laws/us-state-scope","/playbook/compliance/online-platforms/dsa-tier"],"sources":[{"label":"Commission Recommendation 2003/361 on SME definition","url":"https://eur-lex.europa.eu/eli/reco/2003/361/oj"},{"label":"NIS2 Directive (EU) 2022/2555","url":"https://eur-lex.europa.eu/eli/dir/2022/2555/oj"}]},{"chapter":"Scope and ownership","name":"Give every duty one named owner","level":"Recommended","rule":"Give every duty, control and register one named person as owner and one as deputy. A team name is not an owner.","check":"A script compares every owner and deputy in the registers with the active users in the identity provider. It fails on any name that is missing or disabled.","url":"https://agentwranglers.se/playbook/compliance/scope-and-ownership/named-owners","related":["/playbook/engineering/documentation/doc-ownership","/playbook/compliance/audit-logs-and-access/offboarding-within-a-day"],"sources":[]},{"chapter":"Scope and ownership","name":"Keep every legal date in one calendar","level":"Recommended","rule":"Generate one calendar from the registers with every review date, contract renewal, legal start date and audit certificate expiry. Warn owners 30 days before each. Audit certificates include ISO 27001. TLS certificates follow [certificate renewal](https://agentwranglers.se/playbook/website/hosting-and-network/certificate-renewal) instead.","check":"The daily job exits with failure when any item is past its date. A test with a date 29 days ahead puts that item in the warning list.","url":"https://agentwranglers.se/playbook/compliance/scope-and-ownership/compliance-calendar","related":["/playbook/payments/checkout-and-card-data/pci-annual-attestation","/playbook/payments/invoices-and-records/e-invoicing","/playbook/website/hosting-and-network/certificate-renewal","/playbook/compliance/controls-and-evidence/control-register","/playbook/compliance/online-platforms/moderation-report"],"sources":[]},{"chapter":"Scope and ownership","name":"Decide whether you need a data protection officer","level":"Recommended","applies":["eu-users"],"rule":"Record whether GDPR Article 37 requires a data protection officer, with the reason. If it does, publish the contact and tell the supervisory authority.","check":"The register has a DPO entry with a decision. When it says yes, a test fetches the privacy policy and finds the DPO address. The register also holds the date the authority was told.","url":"https://agentwranglers.se/playbook/compliance/scope-and-ownership/dpo-decision","related":["/playbook/compliance/records-and-data-map/special-category-flags"],"sources":[{"label":"GDPR Article 37 on designating a data protection officer","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"}]},{"chapter":"Scope and ownership","name":"Name a representative when you serve the EU from outside","level":"Required","risk":"law","applies":["eu-users"],"rule":"If you have no EU office but offer goods or services to people in the EU, appoint an EU representative in writing. GDPR Article 27 requires it.","check":"The facts file lists no EU office and an EU market. Then the register check fails without an `eu_representative` entry with name and address. The privacy policy must contain that name.","url":"https://agentwranglers.se/playbook/compliance/scope-and-ownership/eu-representative","related":["/playbook/website/privacy/privacy-policy"],"sources":[{"label":"GDPR Article 27 on representatives outside the EU","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"},{"label":"AI Act Articles 22 and 54 on authorised representatives","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}]},{"chapter":"Records and data map","name":"Map every store that holds personal data","level":"Recommended","applies":["eu-users"],"rule":"Keep a data map in the repository of every place personal data is stored or sent. Give each its region, its owner and the kinds of data in it.","check":"The build compares the stores defined in infrastructure code and the external hostnames the app calls with the data map. It fails on any store or host missing from the map.","url":"https://agentwranglers.se/playbook/compliance/records-and-data-map/data-map","related":["/playbook/data/personal-data/retired-data-stores","/playbook/ai-features/logs-privacy-and-feedback/erase-from-ai-stores","/playbook/data/personal-data/minimal-columns"],"sources":[]},{"chapter":"Records and data map","name":"Keep the record of processing as data","level":"Required","risk":"law","applies":["eu-users"],"rule":"Keep the record of processing that GDPR Article 30 asks for as data in the repository. Build it on the data map and render it on demand.","check":"A script fails when an entry lacks an Article 30 field or a legal basis, or names a store missing from the data map. It also fails when a mapped store has no entry.","url":"https://agentwranglers.se/playbook/compliance/records-and-data-map/records-of-processing","related":["/playbook/website/privacy/privacy-policy"],"sources":[{"label":"GDPR Article 30 on records of processing","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"}]},{"chapter":"Records and data map","name":"Mark special categories and children's data","level":"Recommended","applies":["eu-users"],"rule":"Flag every store and column that holds special categories of data, criminal records or children's data, because stricter rules apply to them.","check":"A script searches the schema for column names such as `health`, `diagnosis`, `religion`, `ethnicity`, `biometric` and `date_of_birth`. It fails when a match sits in a store without the matching flag.","url":"https://agentwranglers.se/playbook/compliance/records-and-data-map/special-category-flags","related":["/playbook/compliance/scope-and-ownership/dpo-decision","/playbook/data/personal-data/field-encryption"],"sources":[{"label":"GDPR Articles 8, 9 and 10 on sensitive data","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"}]},{"chapter":"Records and data map","name":"Screen every new feature for a DPIA","level":"Required","risk":"law","applies":["eu-users"],"rule":"Before a feature that touches personal data starts, answer a fixed screening list. When the result says high risk, finish a data protection impact assessment first.","check":"Every pull request that adds a processing activity or a flagged column carries a screening file. The build fails when it scores two or more criteria, or marks an automated decision with legal effect, and no DPIA link is filled in.","url":"https://agentwranglers.se/playbook/compliance/records-and-data-map/dpia-screening","related":["/playbook/adversarial-testing/supply-chain-and-setup/threat-model","/playbook/compliance/records-and-data-map/legitimate-interests-assessment","/playbook/compliance/us-state-privacy-laws/us-risk-assessments"],"sources":[{"label":"GDPR Article 35 on data protection impact assessment","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"},{"label":"Article 29 Working Party WP248 DPIA guidelines","url":"https://ec.europa.eu/newsroom/article29/items/611236"}]},{"chapter":"Records and data map","name":"Keep one retention schedule","level":"Recommended","rule":"Keep one retention schedule that gives every kind of personal data a period, the reason for it and the job that enforces it.","check":"Every record entry names a schedule entry, and every schedule entry names a job. Monitoring fails when a job has not succeeded in 48 hours. A daily query fails when the oldest row in a table is older than its period plus one day.","url":"https://agentwranglers.se/playbook/compliance/records-and-data-map/retention-schedule","related":["/playbook/website/privacy/data-minimization","/playbook/api-design/files-and-uploads/storage-lifecycle","/playbook/data/personal-data/retention-jobs","/playbook/data/product-analytics/analytics-retention","/playbook/operations/disaster-recovery/backup-retention","/playbook/operations/logs/log-retention"],"sources":[{"label":"GDPR Article 5(1)(e) on storage limitation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"}]},{"chapter":"Records and data map","name":"Weigh every legitimate interest in writing","level":"Recommended","applies":["eu-users"],"rule":"Before a purpose relies on legitimate interests, write an assessment with the purpose, necessity and balancing tests. Stop the processing for anyone who objects, unless the assessment shows compelling grounds.","check":"Every record of processing entry with the basis `legitimate_interests` links an assessment with the three tests filled in and a review date within 12 months. An end-to-end test sends an objection to direct marketing, and the next marketing job skips that person.","url":"https://agentwranglers.se/playbook/compliance/records-and-data-map/legitimate-interests-assessment","related":["/playbook/compliance/records-and-data-map/dpia-screening","/playbook/email/unsubscribe-and-bounces/one-click-unsubscribe"],"sources":[{"label":"GDPR Articles 6 and 21","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"},{"label":"EDPB Guidelines 1/2024 on legitimate interest","url":"https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2024/guidelines-12024-processing-personal-data-based_en"},{"label":"ICO guidance on applying legitimate interests","url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/how-do-we-apply-legitimate-interests-in-practice/"}]},{"chapter":"Processors and transfers","name":"Keep one register of vendors","level":"Recommended","rule":"Keep one register of every vendor that handles personal data or reaches production. Fail the build when the code uses a vendor not in it.","check":"A build script reads the dependency manifests and the outbound hostnames in configuration. It fails on any vendor package or host that has no register entry with a signed agreement date.","url":"https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-register","related":["/playbook/website/privacy/processor-agreements","/playbook/compliance/processors-and-transfers/vendor-exit","/playbook/compliance/ai-act/ai-register"],"sources":[]},{"chapter":"Processors and transfers","name":"Check each agreement covers Article 28","level":"Required","risk":"law","applies":["eu-users"],"rule":"Check every data processing agreement against the list in GDPR Article 28(3), and record the result and the breach notice deadline in the vendor register.","check":"A script fails when a processor entry lacks any of the eight items marked true, or has no `breach_notice_hours`, or has a value above 72.","url":"https://agentwranglers.se/playbook/compliance/processors-and-transfers/dpa-article-28","related":["/playbook/website/privacy/processor-agreements"],"sources":[{"label":"GDPR Article 28 on processors","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"}]},{"chapter":"Processors and transfers","name":"Publish your subprocessors","level":"Recommended","applies":["eu-users"],"rule":"If you process personal data for business customers, publish your subprocessor list at a stable address and tell customers before you add one.","check":"A test compares the published page with the register and fails on any difference. For each subprocessor, its start date is at least the promised number of days after its change notice date.","url":"https://agentwranglers.se/playbook/compliance/processors-and-transfers/subprocessor-list","related":["/playbook/website/privacy/processor-agreements"],"sources":[{"label":"GDPR Article 28(2) on approving subprocessors","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"}]},{"chapter":"Processors and transfers","name":"Record a legal basis for every transfer","level":"Required","risk":"law","applies":["eu-users"],"rule":"For every store or vendor outside the European Economic Area, record the transfer basis under GDPR Chapter V. Contract clauses also need a transfer impact assessment.","check":"A script reads the country of every vendor and store. It fails when a country outside the EEA and the adequacy list has no basis, or when a clauses basis has no assessment link.","url":"https://agentwranglers.se/playbook/compliance/processors-and-transfers/transfer-basis","related":["/playbook/website/privacy/processor-agreements","/playbook/compliance/processors-and-transfers/dpf-status"],"sources":[{"label":"GDPR Chapter V on transfers outside the EU","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"},{"label":"European Commission list of adequacy decisions","url":"https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en"}]},{"chapter":"Processors and transfers","name":"Check the Data Privacy Framework status of US vendors","level":"Recommended","applies":["eu-users"],"rule":"Rely on the EU-US Data Privacy Framework only for US vendors on its active list. Check the list monthly and keep signed contract clauses as a fallback.","check":"A monthly job looks up each vendor with basis `dpf` on the published list and fails when it is not active. It also fails on a `checked` date older than 31 days or no `fallback` entry.","url":"https://agentwranglers.se/playbook/compliance/processors-and-transfers/dpf-status","related":["/playbook/compliance/processors-and-transfers/transfer-basis"],"sources":[{"label":"Commission Implementing Decision (EU) 2023/1795 on the EU-US DPF","url":"https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj"},{"label":"Data Privacy Framework List","url":"https://www.dataprivacyframework.gov/list"}]},{"chapter":"Processors and transfers","name":"Rank vendors and check their evidence","level":"Recommended","applies":["audit"],"rule":"Rank every vendor by the data and access it has, and require current security evidence for the top tier.","check":"A script fails when a vendor that touches a data map store is not tier 1. It fails when a tier 1 vendor has no report or certificate, its report period ended over 12 months ago, or its certificate has expired. It also fails when its last review is older than 12 months.","url":"https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-tiers","related":["/playbook/operations/disaster-recovery/provider-failure"],"sources":[{"label":"AICPA Trust Services Criteria","url":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022"}]},{"chapter":"Processors and transfers","name":"Record the data terms of every AI provider","level":"Recommended","applies":["ai-features"],"rule":"Give every AI model provider a vendor register entry with its plan, its training setting, its retention and its region. Allow only plans that do not train on your data.","check":"Every AI provider entry has `trains_on_inputs: false`, a retention in days, a region, a plan, a signed agreement date and a review date within 12 months. The outbound proxy refuses AI hosts that are not in the register.","url":"https://agentwranglers.se/playbook/compliance/processors-and-transfers/ai-provider-terms","related":["/playbook/ai-assisted-development/safety-and-permissions/tool-data-terms","/playbook/adversarial-testing/ai-agents-and-models/private-data-to-models"],"sources":[]},{"chapter":"Processors and transfers","name":"Confirm deletion when a vendor leaves","level":"Recommended","rule":"When you stop using a vendor, get written confirmation that it deleted or returned your data, before you remove it from the register.","check":"A script fails on any vendor ended over 30 days ago without a `deletion_confirmed` date. It also fails when its API key is still active.","url":"https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-exit","related":["/playbook/compliance/processors-and-transfers/vendor-register"],"sources":[{"label":"GDPR Article 28(3)(g) on deletion or return of data","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"}]},{"chapter":"Breaches and reporting","name":"Start every reporting clock from one moment","level":"Recommended","rule":"Record the moment you became aware of an incident, and compute every legal and contract deadline from it in code, the moment the incident opens.","check":"A unit test opens an incident with awareness at `2026-10-20T09:00Z` and the GDPR and NIS2 flags set. The tool shows the NIS2 early warning due at `2026-10-21T09:00Z` and the GDPR report due at `2026-10-23T09:00Z`.","url":"https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks","related":["/playbook/website/privacy/breach-plan","/playbook/operations/incidents/declare-incidents","/playbook/compliance/us-state-privacy-laws/us-breach-notice-laws","/playbook/operations/incidents/security-incidents","/playbook/compliance/product-and-sector-laws/nis2-measures","/playbook/compliance/product-and-sector-laws/cra-vulnerability-reporting"],"sources":[{"label":"GDPR Article 33 on notifying the supervisory authority","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"},{"label":"NIS2 Article 23 on reporting obligations","url":"https://eur-lex.europa.eu/eli/dir/2022/2555/oj"},{"label":"Cyber Resilience Act Article 14 on reporting","url":"https://eur-lex.europa.eu/eli/reg/2024/2847/oj"}]},{"chapter":"Breaches and reporting","name":"Log every breach with its decision","level":"Required","risk":"law","applies":["eu-users"],"rule":"Record every personal data breach in a register, including the ones you did not report. Give the facts, the effects, the actions and each decision's reason.","check":"A script fails when an incident tagged as a personal data breach has no register entry. It also fails when an entry lacks a decision after 72 hours.","url":"https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-register","related":["/playbook/website/privacy/breach-plan","/playbook/operations/incidents/incident-severity","/playbook/compliance/audit-logs-and-access/audit-log-immutable"],"sources":[{"label":"GDPR Article 33(5) on documenting breaches","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"}]},{"chapter":"Breaches and reporting","name":"Decide the risk with a fixed method","level":"Recommended","applies":["eu-users"],"rule":"Decide whether a breach must be reported with one written scoring method, and store the score next to the decision.","check":"Every register entry has a method name, a score and a decision. A script fails when a score at or above the reporting threshold has `reported_to_authority: false`. It also fails when a score at or above the high-risk threshold has `people_told: false`.","url":"https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-risk-method","related":["/playbook/operations/incidents/incident-severity"],"sources":[{"label":"EDPB Guidelines 01/2021 on personal data breach examples","url":"https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-012021-examples-regarding-personal-data-breach_en"},{"label":"ENISA methodology for personal data breach severity","url":"https://www.enisa.europa.eu/publications/dbn-severity"},{"label":"GDPR Articles 33 and 34 on breach notification","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"}]},{"chapter":"Breaches and reporting","name":"Keep the notices ready","level":"Recommended","rule":"Keep notices ready for the authority, business customers and the people affected, with every field the law asks for. Know where to file each one.","check":"A test fills each template from a sample breach entry and fails when any required field stays empty. The register holds a lead authority and a form address that answers 200.","url":"https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-notice-templates","related":["/playbook/email/deliverability/mandated-notices","/playbook/website/privacy/breach-plan"],"sources":[{"label":"GDPR Articles 33 and 34 on breach notification","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"}]},{"chapter":"Breaches and reporting","name":"Tell your customers when you are their processor","level":"Required","risk":"law","applies":["eu-users"],"rule":"When you process data for business customers, tell each affected customer about a breach without undue delay and within the hours your agreement promises.","check":"Every customer account has a security contact. In a yearly drill, a test notice reaches every contact within the promised hours, measured from the drill's awareness time.","url":"https://agentwranglers.se/playbook/compliance/breaches-and-reporting/processor-breach-notice","related":["/playbook/operations/incidents/status-updates"],"sources":[{"label":"GDPR Article 33(2) on processors notifying controllers","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"}]},{"chapter":"Audit logs and access","name":"Write an audit event for every sensitive action","level":"Recommended","applies":["audit"],"rule":"Write one audit event for each action on a fixed list, with who, what, which record, when, from where and the result.","check":"An end-to-end test performs every action on the list. For each, the audit store holds exactly one event with every field filled.","url":"https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-events","related":["/playbook/accounts/sessions-and-security-activity/owner-ends-sessions","/playbook/accounts/organisations-and-teams/admin-set-passwords","/playbook/accounts/support-and-staff-access/support-identity-check","/playbook/accounts/support-and-staff-access/support-access-consent","/playbook/data/personal-data/access-logging","/playbook/payments/invoices-and-records/money-audit-log","/playbook/payments/payment-events-and-reconciliation/payment-ledger","/playbook/website/privacy/data-minimization","/playbook/compliance/online-platforms/notice-and-action"],"sources":[]},{"chapter":"Audit logs and access","name":"Make the audit log impossible to change","level":"Recommended","applies":["audit"],"rule":"Store audit events where the app can only add and nobody can edit or delete. Chain each event to the one before with a hash.","check":"An `UPDATE` or `DELETE` on the audit table as the app role fails. A test changes one stored event in a copy, and the chain verifier reports the exact event.","url":"https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-immutable","related":["/playbook/data/personal-data/access-logging","/playbook/operations/logs/off-host-logs","/playbook/compliance/breaches-and-reporting/breach-register","/playbook/compliance/audit-logs-and-access/audit-log-retention","/playbook/compliance/controls-and-evidence/evidence-store"],"sources":[]},{"chapter":"Audit logs and access","name":"Keep audit logs for a set time","level":"Recommended","applies":["audit"],"rule":"Keep audit logs for a stated period, longer than debug logs, then delete them on schedule.","check":"A daily query fails when the oldest audit event is older than the stated period plus one day. It also fails when the log has run longer than the period but its oldest event is younger. The storage lock period equals the stated period.","url":"https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-retention","related":["/playbook/operations/logs/log-retention","/playbook/compliance/audit-logs-and-access/audit-log-immutable"],"sources":[{"label":"PCI DSS document library","url":"https://www.pcisecuritystandards.org/document_library/"}]},{"chapter":"Audit logs and access","name":"Review access every quarter","level":"Recommended","applies":["audit"],"rule":"Every quarter, export every account and role from each system with production or customer data. Compare it with the staff list and remove extras within five working days.","check":"The latest review in the evidence store is less than 92 days old. The script finds no account that is missing from the staff list or that holds a role its job does not grant.","url":"https://agentwranglers.se/playbook/compliance/audit-logs-and-access/access-reviews","related":["/playbook/payments/payment-events-and-reconciliation/provider-dashboard-access","/playbook/accounts/roles-and-permissions/access-review"],"sources":[{"label":"AICPA Trust Services Criteria","url":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022"}]},{"chapter":"Audit logs and access","name":"Remove access within a day of leaving","level":"Required","risk":"takeover","rule":"Disable every account of a person who leaves within 24 hours of their last day, and rotate any shared secret they knew.","check":"A script compares leaving dates from the HR system with the deactivation times in the identity provider and in each tool outside single sign-on. It fails when any gap passes 24 hours.","url":"https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day","related":["/playbook/engineering/version-control-and-review/code-host-accounts","/playbook/infrastructure/servers/ssh-keys-only","/playbook/accounts/organisations-and-teams/member-removal","/playbook/compliance/scope-and-ownership/named-owners","/playbook/infrastructure/identity-and-access/single-sign-on-for-people"],"sources":[]},{"chapter":"Audit logs and access","name":"Grant admin rights only for a set time","level":"Recommended","rule":"Give nobody standing admin rights to production. Grant them on request, with a reason and an end time, and log every grant.","check":"A query of the cloud and database roles finds no person with a permanent admin role, except the emergency accounts. Every grant in the last quarter has a reason, an approver and an end time within the limit that rule sets.","url":"https://agentwranglers.se/playbook/compliance/audit-logs-and-access/just-in-time-admin","related":["/playbook/infrastructure/identity-and-access/just-in-time-access","/playbook/infrastructure/identity-and-access/break-glass-access"],"sources":[]},{"chapter":"Audit logs and access","name":"Keep roles as code","level":"Recommended","rule":"Define which job gets which role in a file in the repository, apply it from there, and change access only through a reviewed pull request.","check":"A daily job compares the live roles in each system with the matrix and fails on any difference.","url":"https://agentwranglers.se/playbook/compliance/audit-logs-and-access/roles-as-code","related":["/playbook/accounts/business-sign-on-and-provisioning/group-role-mapping","/playbook/accounts/roles-and-permissions/permission-matrix-test"],"sources":[]},{"chapter":"Controls and evidence","name":"Turn every policy line into a checked control","level":"Recommended","applies":["audit"],"rule":"Keep a register of controls in the repository. Each control has an ID, one testable statement, an owner, a frequency and the command that checks it.","check":"A script fails when a control lacks an owner, a frequency or a framework mapping. It also fails without a check command or a dated manual evidence task.","url":"https://agentwranglers.se/playbook/compliance/controls-and-evidence/control-register","related":["/playbook/compliance/scope-and-ownership/compliance-calendar","/playbook/engineering/rules-as-code/check-every-rule-in-code","/playbook/compliance/controls-and-evidence/framework-choice"],"sources":[{"label":"AICPA Trust Services Criteria","url":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022"}]},{"chapter":"Controls and evidence","name":"Collect evidence automatically","level":"Recommended","applies":["audit"],"rule":"Let scheduled jobs collect evidence for each automated control from CI, the code host and the cloud. Save each result with a date and a hash.","check":"For every automated control, the evidence store holds a result newer than its frequency, with a date and a hash that matches the saved body. Each failed result in the last quarter links to a ticket.","url":"https://agentwranglers.se/playbook/compliance/controls-and-evidence/automated-evidence","related":["/playbook/engineering/version-control-and-review/continuous-integration","/playbook/compliance/online-platforms/moderation-report"],"sources":[]},{"chapter":"Controls and evidence","name":"Keep evidence where nobody can change it","level":"Recommended","applies":["audit"],"rule":"Store evidence in write-once storage, in folders by date, and keep it for the audit period plus at least one year.","check":"A test tries to delete and to overwrite an evidence file and both fail. The bucket's lock period is at least the audit period plus 365 days.","url":"https://agentwranglers.se/playbook/compliance/controls-and-evidence/evidence-store","related":["/playbook/compliance/audit-logs-and-access/audit-log-immutable","/playbook/compliance/product-and-sector-laws/product-liability"],"sources":[]},{"chapter":"Controls and evidence","name":"Prove every production change was reviewed","level":"Recommended","applies":["audit"],"rule":"For every production deploy, keep a link to the commit, the pull request, an approval by someone other than the author, and the passing checks.","check":"The quarterly script fails on any deploy without a merged pull request or a passing check run. It also fails without approval from someone other than the author.","url":"https://agentwranglers.se/playbook/compliance/controls-and-evidence/change-evidence","related":["/playbook/ai-assisted-development/measuring-and-improving/human-sign-off","/playbook/data/migrations/data-fixes","/playbook/engineering/version-control-and-review/protect-the-main-branch"],"sources":[]},{"chapter":"Controls and evidence","name":"Keep every policy short and owned","level":"Recommended","applies":["audit"],"rule":"Give every written policy an owner, a version, an approval date and a review date within 12 months. Track that every person has read the current version.","check":"A script fails when a policy lacks an owner, version or approval date, or its review date has passed. It also fails when an active person has not confirmed every current policy by the due date.","url":"https://agentwranglers.se/playbook/compliance/controls-and-evidence/policies-owned","related":["/playbook/engineering/documentation/doc-ownership"],"sources":[]},{"chapter":"Controls and evidence","name":"Pick the framework your customers ask for","level":"Recommended","applies":["audit"],"rule":"Choose SOC 2 or ISO/IEC 27001 from what your customers ask for in contracts and questionnaires, and record the auditor and the next audit date.","check":"The obligations register names the framework, the auditor and the next audit date, and the date appears in the compliance calendar.","url":"https://agentwranglers.se/playbook/compliance/controls-and-evidence/framework-choice","related":["/playbook/compliance/controls-and-evidence/control-register"],"sources":[{"label":"AICPA Trust Services Criteria","url":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022"}]},{"chapter":"Controls and evidence","name":"Keep a risk register with treatment dates","level":"Recommended","applies":["audit"],"rule":"Keep a register of security and privacy risks as data. Give each risk a likelihood, an impact, an owner, a treatment and a review date within 12 months.","check":"A script fails when a risk lacks a score, an owner or a review date, or when a review date has passed. It also fails when a risk at or above the limit has neither controls nor an accepted-by entry.","url":"https://agentwranglers.se/playbook/compliance/controls-and-evidence/risk-register","related":["/playbook/adversarial-testing/rules-of-engagement/rank-findings","/playbook/adversarial-testing/supply-chain-and-setup/threat-model"],"sources":[{"label":"NIS2 Article 21 on risk management measures","url":"https://eur-lex.europa.eu/eli/dir/2022/2555/oj"}]},{"chapter":"AI Act","name":"Register every AI feature with role and risk","level":"Recommended","applies":["ai-features","eu-users"],"rule":"Keep a register of every AI system you build, sell or use. Record your role, its risk class, the model and provider, its purpose and who it affects.","check":"A build script fails when the code uses an AI SDK or model host without a register entry. It also fails when an entry lacks a role, risk class or screening.","url":"https://agentwranglers.se/playbook/compliance/ai-act/ai-register","related":["/playbook/ai-features/evals-and-quality/counterfactual-evals","/playbook/compliance/processors-and-transfers/vendor-register","/playbook/ai-features/deciding-to-use-a-model/model-or-code","/playbook/compliance/ai-act/prohibited-ai-practices","/playbook/compliance/ai-act/gpai-provider-duties"],"sources":[{"label":"AI Act, Regulation (EU) 2024/1689","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}]},{"chapter":"AI Act","name":"Rule out the banned uses","level":"Required","risk":"law","applies":["ai-features","eu-users"],"rule":"Screen every AI feature against the practices banned by AI Act Article 5 before it is built, and record the answer per practice.","check":"Every register entry has a screening with one answer per banned practice and a date. An image or video feature has an automated test with a set of banned prompts, and every one is refused.","url":"https://agentwranglers.se/playbook/compliance/ai-act/prohibited-ai-practices","related":["/playbook/compliance/ai-act/ai-register"],"sources":[{"label":"AI Act Article 5 on prohibited AI practices","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj"},{"label":"Regulation (EU) 2026/1744, the Digital Omnibus on AI","url":"https://eur-lex.europa.eu/eli/reg/2026/1744/oj"},{"label":"Commission guidelines on prohibited AI practices","url":"https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act"}]},{"chapter":"AI Act","name":"Train everyone who uses AI at work","level":"Required","risk":"law","applies":["ai-features","eu-users"],"rule":"Give every person who builds, runs or uses AI systems for you training that fits their role, and keep a dated record per person.","check":"A script compares the people with access to AI tools in the identity provider with the training records. It fails on anyone without a record from the last 12 months.","url":"https://agentwranglers.se/playbook/compliance/ai-act/ai-literacy","related":[],"sources":[{"label":"AI Act Article 4 on AI literacy","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj"},{"label":"Regulation (EU) 2026/1744, the Digital Omnibus on AI","url":"https://eur-lex.europa.eu/eli/reg/2026/1744/oj"}]},{"chapter":"AI Act","name":"Map each feature to its transparency duty","level":"Required","risk":"law","applies":["ai-features","eu-users"],"rule":"For every AI feature, record which paragraph of AI Act Article 50 applies. Link an automated test that proves the notice or mark is there.","check":"Every register entry with an Article 50 paragraph names a test ID, and that test exists and passes in the build. An entry with risk `transparency` and no paragraph fails.","url":"https://agentwranglers.se/playbook/compliance/ai-act/ai-transparency-map","related":["/playbook/website/privacy/disclose-ai","/playbook/ai-features/guardrails-and-human-review/label-ai-output"],"sources":[{"label":"AI Act Article 50 on transparency obligations","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj"},{"label":"Regulation (EU) 2026/1744, the Digital Omnibus on AI","url":"https://eur-lex.europa.eu/eli/reg/2026/1744/oj"}]},{"chapter":"AI Act","name":"Find out if a feature is high-risk","level":"Recommended","applies":["ai-features","eu-users"],"rule":"Check every AI feature against the high-risk areas in AI Act Annex III and the products in Annex I. Plan the duties before their start dates.","check":"Every register entry has an `annex_iii_area` answer. An entry with an area has either a dated Article 6(3) assessment or a plan whose start date appears in the compliance calendar.","url":"https://agentwranglers.se/playbook/compliance/ai-act/ai-high-risk-check","related":["/playbook/ai-features/evals-and-quality/counterfactual-evals","/playbook/ai-features/guardrails-and-human-review/human-decides"],"sources":[{"label":"AI Act Article 6 and Annex III on high-risk systems","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj"},{"label":"Regulation (EU) 2026/1744, the Digital Omnibus on AI","url":"https://eur-lex.europa.eu/eli/reg/2026/1744/oj"}]},{"chapter":"AI Act","name":"Know when you become a model provider","level":"Recommended","applies":["ai-features","eu-users"],"rule":"Record whether you provide a general-purpose AI model, including by changing someone else's model substantially, and meet the Article 53 duties if you do.","check":"The register holds a `gpai_provider` decision with a date for every model you train or fine-tune. Each one with a yes links its technical documentation, copyright policy and published training summary.","url":"https://agentwranglers.se/playbook/compliance/ai-act/gpai-provider-duties","related":["/playbook/compliance/ai-act/ai-register"],"sources":[{"label":"AI Act Article 53 on general-purpose model providers","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj"},{"label":"Commission guidelines for general-purpose AI model providers","url":"https://digital-strategy.ec.europa.eu/en/library/guidelines-scope-obligations-providers-general-purpose-ai-models-under-ai-act"}]},{"chapter":"Product and sector laws","name":"Decide whether NIS2 covers you","level":"Recommended","applies":["eu-users"],"rule":"Decide whether the NIS2 Directive covers you from your sector and size, record the decision, and register with the national authority when it does.","check":"The obligations register has a NIS2 entry computed from the facts file. When it applies, the entry holds the authority's registration reference and date.","url":"https://agentwranglers.se/playbook/compliance/product-and-sector-laws/nis2-scope","related":["/playbook/compliance/scope-and-ownership/scope-from-facts"],"sources":[{"label":"NIS2 Directive (EU) 2022/2555","url":"https://eur-lex.europa.eu/eli/dir/2022/2555/oj"},{"label":"Commission Recommendation 2003/361 on SME definition","url":"https://eur-lex.europa.eu/eli/reco/2003/361/oj"}]},{"chapter":"Product and sector laws","name":"Map the NIS2 measures to controls","level":"Recommended","applies":["eu-users"],"rule":"If NIS2 covers you, map each of the ten measures in Article 21(2) to checked controls. Management approves them and takes training on them.","check":"A script fails when any of the ten measures has no control in the control register, or when a mapped control's latest result failed. The management approval date is less than 12 months old.","url":"https://agentwranglers.se/playbook/compliance/product-and-sector-laws/nis2-measures","related":["/playbook/compliance/breaches-and-reporting/reporting-clocks"],"sources":[{"label":"NIS2 Article 21 on risk management measures","url":"https://eur-lex.europa.eu/eli/dir/2022/2555/oj"},{"label":"Commission Implementing Regulation (EU) 2024/2690","url":"https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj"}]},{"chapter":"Product and sector laws","name":"Decide whether the Cyber Resilience Act covers your product","level":"Recommended","applies":["eu-users"],"rule":"List every product with digital elements you place on the EU market, record whether the Cyber Resilience Act applies to each, and record its class.","check":"The obligations register lists every shipped product with a CRA decision and, when it applies, its class. A product released by the build pipeline but missing from the list fails the build.","url":"https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-scope","related":["/playbook/compliance/product-and-sector-laws/cra-vulnerability-reporting"],"sources":[{"label":"Cyber Resilience Act, Regulation (EU) 2024/2847","url":"https://eur-lex.europa.eu/eli/reg/2024/2847/oj"}]},{"chapter":"Product and sector laws","name":"Report exploited vulnerabilities in your products","level":"Required","risk":"law","applies":["eu-users"],"rule":"Since 11 September 2026, report every actively exploited vulnerability and severe incident in a CRA product. Use the ENISA single reporting platform.","check":"The obligations register names at least two people with active accounts on the reporting platform. A test of the incident tool with the `cra` flag shows the 24-hour and 72-hour deadlines.","url":"https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-vulnerability-reporting","related":["/playbook/compliance/product-and-sector-laws/cra-scope","/playbook/compliance/breaches-and-reporting/reporting-clocks","/playbook/website/security/security-txt"],"sources":[{"label":"Cyber Resilience Act Article 14 on reporting","url":"https://eur-lex.europa.eu/eli/reg/2024/2847/oj"}]},{"chapter":"Product and sector laws","name":"Handle vulnerabilities for the whole support period","level":"Recommended","applies":["eu-users"],"rule":"State a support period of at least five years for each covered product, unless its use is shorter. Ship free security fixes until it ends.","check":"Every release of a covered product has a bill of materials. Its published support end date is at least five years after the market date. The release job fails when a scanner finds a known exploited vulnerability, such as one in the CISA KEV list.","url":"https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-support-period","related":["/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance","/playbook/website/security/security-txt","/playbook/compliance/product-and-sector-laws/product-liability"],"sources":[{"label":"Cyber Resilience Act Article 13 and Annex I","url":"https://eur-lex.europa.eu/eli/reg/2024/2847/oj"},{"label":"CISA Known Exploited Vulnerabilities Catalog","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}]},{"chapter":"Product and sector laws","name":"Prepare the technical file and CE marking","level":"Recommended","applies":["eu-users"],"rule":"From 11 December 2027, each covered product needs a technical file, an EU declaration of conformity and a CE marking. Keep them for ten years or the support period, whichever is longer.","check":"The release pipeline fails for a covered product when its technical file, declaration of conformity or CE marking file is missing. The storage lock on those files is at least ten years and at least the support period.","url":"https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-technical-file","related":["/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance"],"sources":[{"label":"Cyber Resilience Act Articles 28 to 31 and Annex VII","url":"https://eur-lex.europa.eu/eli/reg/2024/2847/oj"}]},{"chapter":"Product and sector laws","name":"Meet the European Accessibility Act as a legal duty","level":"Required","risk":"law","applies":["eu-users"],"rule":"Record whether the European Accessibility Act covers your products or services. If it does, meet EN 301 549, publish how you meet it, and test it in every build.","check":"The obligations register has an EAA decision. When it applies, the build runs accessibility tests on every page. The accessibility information page answers 200 and has a date from the last 12 months.","url":"https://agentwranglers.se/playbook/compliance/product-and-sector-laws/accessibility-act-duty","related":["/playbook/website/accessibility/accessibility-law","/playbook/website/accessibility/accessibility-overlays","/playbook/testing/non-functional-tests/accessibility-in-ci"],"sources":[{"label":"European Accessibility Act, Directive (EU) 2019/882","url":"https://eur-lex.europa.eu/eli/dir/2019/882/oj"}]},{"chapter":"Product and sector laws","name":"Let cloud customers leave under the Data Act","level":"Required","risk":"law","applies":["eu-users"],"rule":"If you sell a cloud or software service to EU customers, offer a tested full export and the switching terms of the Data Act. Charge nothing for switching from 12 January 2027.","check":"An end-to-end test exports every kind of customer data in the listed formats and imports it into an empty account. The contract template holds both periods, and the price list shows no switching charge after 12 January 2027.","url":"https://agentwranglers.se/playbook/compliance/product-and-sector-laws/data-act-switching","related":["/playbook/accounts/profile-and-account-lifecycle/self-service-export"],"sources":[{"label":"Data Act Chapter VI on switching between services","url":"https://eur-lex.europa.eu/eli/reg/2023/2854/oj"}]},{"chapter":"Product and sector laws","name":"Give users the data from connected products","level":"Recommended","applies":["eu-users"],"rule":"If you make a connected device or the app or service it needs, let users get its data free and machine-readable. Tell them what data it creates before they buy.","check":"An end-to-end test requests a test device's data and gets every listed data type as JSON or CSV, at no charge. Every product model has a published pre-contract page with data types, continuous generation, storage place and access method.","url":"https://agentwranglers.se/playbook/compliance/product-and-sector-laws/data-act-connected-products","related":["/playbook/accounts/profile-and-account-lifecycle/self-service-export"],"sources":[{"label":"Data Act Articles 3, 4, 7 and 50","url":"https://eur-lex.europa.eu/eli/reg/2023/2854/oj"}]},{"chapter":"Product and sector laws","name":"Keep the evidence to answer a product liability claim","level":"Recommended","applies":["eu-users"],"rule":"For software placed on the EU market after 9 December 2026, keep a record of every release for ten years. Ship the updates needed to keep it safe while you control it.","check":"Every release of a product sold in the EU has a stored record. It holds the version, date, bill of materials, test results and security fixes. The storage lock on each record ends at least ten years after the release date.","url":"https://agentwranglers.se/playbook/compliance/product-and-sector-laws/product-liability","related":["/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance","/playbook/compliance/product-and-sector-laws/cra-support-period","/playbook/compliance/controls-and-evidence/evidence-store"],"sources":[{"label":"Product Liability Directive (EU) 2024/2853","url":"https://eur-lex.europa.eu/eli/dir/2024/2853/oj"}]},{"chapter":"US state privacy laws","name":"Compute which state laws apply","level":"Recommended","rule":"Keep a table of the US state privacy laws with their thresholds and start dates. Compute from your facts file which ones apply to you.","check":"A unit test computes the applying states from the facts file. The build fails when the result differs from the US entries in the obligations register.","url":"https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-state-scope","related":["/playbook/compliance/scope-and-ownership/scope-from-facts"],"sources":[]},{"chapter":"US state privacy laws","name":"List every sale and every share","level":"Required","risk":"law","rule":"List every flow of personal data to another company that could count as a sale or targeted advertising. Offer an opt-out that stops each one.","check":"A browser test loads the main pages and lists every third-party host. It fails on a host without an inventory entry. With the `Sec-GPC: 1` header, no host labelled sale or sharing is called. The same holds without the header after a click on the opt-out link.","url":"https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/sales-and-sharing-inventory","related":["/playbook/website/standard-addresses/gpc-json","/playbook/website/privacy/global-privacy-control"],"sources":[{"label":"California Consumer Privacy Act, Attorney General","url":"https://oag.ca.gov/privacy/ccpa"},{"label":"W3C Global Privacy Control","url":"https://www.w3.org/TR/gpc/"}]},{"chapter":"US state privacy laws","name":"Ask before using sensitive data","level":"Required","risk":"law","rule":"Process sensitive data only after an opt-in where any applying state requires it, and record each consent with its time and wording.","check":"An integration test stores each sensitive field without a consent record, and the call is refused. With a consent record, it succeeds and the record holds a time and a wording version.","url":"https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-sensitive-data-consent","related":["/playbook/email/email-privacy/consent-records"],"sources":[{"label":"COPPA Rule, 16 CFR Part 312","url":"https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312"}]},{"chapter":"US state privacy laws","name":"Track request deadlines by law","level":"Recommended","rule":"Compute the due date of every privacy request from the law that applies to the person. Offer the appeal step that US state laws require.","check":"A unit test opens a GDPR request and a Virginia request on 1 March 2026. They are due on 1 April 2026 and 15 April 2026. An appeal of a Virginia refusal is due 60 days after it arrives. A daily job fails on any request past its due date.","url":"https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/request-deadlines-by-law","related":["/playbook/website/privacy/data-requests"],"sources":[{"label":"GDPR Article 12(3) on the one-month deadline","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"},{"label":"Virginia Consumer Data Protection Act","url":"https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/"}]},{"chapter":"US state privacy laws","name":"Assess risky processing for US laws too","level":"Recommended","rule":"Write a data protection assessment before targeted advertising, selling data, profiling with large effects or using sensitive data, in every state that asks for one.","check":"The screening file has fields for targeted ads, sale, profiling and sensitive data. The build fails when any is true and no assessment link is filled in.","url":"https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-risk-assessments","related":["/playbook/compliance/records-and-data-map/dpia-screening"],"sources":[{"label":"California Privacy Protection Agency regulations","url":"https://cppa.ca.gov/regulations/"}]},{"chapter":"US state privacy laws","name":"Keep the US breach notice laws as data","level":"Recommended","rule":"Keep a table of the breach notice law of every US state where affected people live. Compute each deadline and each notice to a regulator from it.","check":"A unit test feeds a breach with people in Colorado and California into the tool. It shows the 30-day Colorado deadline. It adds the California attorney general step, due 15 days after the notice to people, once California residents pass 500.","url":"https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-breach-notice-laws","related":["/playbook/compliance/breaches-and-reporting/reporting-clocks","/playbook/website/privacy/breach-plan"],"sources":[{"label":"California Attorney General on data breach reporting","url":"https://oag.ca.gov/privacy/databreach/reporting"},{"label":"California Civil Code section 1798.82","url":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82"}]},{"chapter":"Online platforms","name":"Decide which Digital Services Act tier you are in","level":"Recommended","applies":["eu-users"],"rule":"Record whether your service is an intermediary, a hosting service, an online platform or a marketplace under the Digital Services Act. Record whether the small enterprise exclusions apply.","check":"The obligations register has a `dsa` entry with a size computed from the facts file. Its tier is intermediary, hosting, platform or marketplace. A test fetches the published contact page and the terms, and both answer 200. The contact page names both points of contact, and the terms hold a content moderation section.","url":"https://agentwranglers.se/playbook/compliance/online-platforms/dsa-tier","related":["/playbook/compliance/scope-and-ownership/scope-from-facts","/playbook/compliance/scope-and-ownership/obligations-register","/playbook/compliance/online-platforms/trader-traceability"],"sources":[{"label":"Digital Services Act, Regulation (EU) 2022/2065","url":"https://eur-lex.europa.eu/eli/reg/2022/2065/oj"},{"label":"Commission questions and answers on the Digital Services Act","url":"https://digital-strategy.ec.europa.eu/en/faqs/digital-services-act-questions-and-answers"}]},{"chapter":"Online platforms","name":"Take notices about illegal content and answer each one","level":"Required","risk":"law","applies":["eu-users"],"rule":"If you host content for users, offer an electronic form to report illegal content. Confirm each report, decide on it, and give the affected user a statement of reasons.","check":"An end-to-end test files a notice with all four fields and gets a receipt by email. A unit test fails every restriction record that lacks one of the six fields of Article 17(3).","url":"https://agentwranglers.se/playbook/compliance/online-platforms/notice-and-action","related":["/playbook/compliance/audit-logs-and-access/audit-log-events"],"sources":[{"label":"Digital Services Act Articles 16 to 18","url":"https://eur-lex.europa.eu/eli/reg/2022/2065/oj"}]},{"chapter":"Online platforms","name":"Handle appeals and send decisions to the EU database","level":"Recommended","applies":["eu-users"],"rule":"If you run an online platform and are not a micro or small enterprise, let users appeal moderation decisions for at least six months. Send every statement of reasons to the Commission's database.","check":"A test files an appeal 180 days after a decision, and it is accepted. Every closed appeal names a staff reviewer. A daily job fails when a statement of reasons older than 24 hours has no database submission ID.","url":"https://agentwranglers.se/playbook/compliance/online-platforms/platform-complaints","related":["/playbook/ai-features/guardrails-and-human-review/human-decides"],"sources":[{"label":"Digital Services Act Articles 20 to 28","url":"https://eur-lex.europa.eu/eli/reg/2022/2065/oj"},{"label":"DSA Transparency Database API documentation","url":"https://transparency.dsa.ec.europa.eu/page/api-documentation"}]},{"chapter":"Online platforms","name":"Publish a yearly moderation report","level":"Recommended","applies":["eu-users"],"rule":"Unless you are a micro or small enterprise, publish a content moderation report for each calendar year by the end of February. Build it from your moderation records.","check":"The report for the last full year is public as CSV by 28 February. Its total of notices equals the count in the moderation database for that year. The compliance calendar holds the next due date.","url":"https://agentwranglers.se/playbook/compliance/online-platforms/moderation-report","related":["/playbook/compliance/controls-and-evidence/automated-evidence","/playbook/compliance/scope-and-ownership/compliance-calendar"],"sources":[{"label":"Digital Services Act Articles 15 and 24","url":"https://eur-lex.europa.eu/eli/reg/2022/2065/oj"},{"label":"Commission Implementing Regulation (EU) 2024/2835","url":"https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj"}]},{"chapter":"Online platforms","name":"Check traders before they sell on your marketplace","level":"Required","risk":"law","applies":["eu-users"],"rule":"If consumers buy from traders on your platform, collect and check five items about each trader before they can sell. Show the trader's contact details on every offer.","check":"An end-to-end test registers a trader without a payment account, and publishing an offer fails. A retention test runs one day past the six months after a contract ends, and the trader's data is gone.","url":"https://agentwranglers.se/playbook/compliance/online-platforms/trader-traceability","related":["/playbook/compliance/online-platforms/dsa-tier","/playbook/data/personal-data/retention-jobs","/playbook/payments/amounts-and-orders/marketplace-funds"],"sources":[{"label":"Digital Services Act Articles 29 to 31","url":"https://eur-lex.europa.eu/eli/reg/2022/2065/oj"}]}]}