legal-compliance

name	legal-compliance
description	Contract generation, terms of service, privacy policies, GDPR/CCPA compliance checks, regulatory monitoring, entity management. Use when working with legal compliance.
domain	operations
author	oyi77
license	Apache-2.0
subdomain	business-operations
tags	["business-ops","compliance","legal","management","monitoring","operations"]
version	1.0.0

Overview

Automate legal and compliance tasks that solo entrepreneurs spend disproportionate time on — or worse, skip entirely and face liability. Generate contracts from templates, monitor regulatory changes, ensure GDPR/CCPA compliance, and manage business entities. This skill does NOT replace legal counsel for complex matters but handles 80% of routine legal work.

Required Tools

• Document Generation: Pandoc, DOCX/PDF templating (Handlebars, Jinja2)
• Compliance: OneTrust API, Cookiebot, or custom compliance scanners
• Monitoring: RSS feeds for regulatory changes, Google Alerts for legal keywords
• Storage: Encrypted document storage (S3 with encryption, or local encrypted vault)
• E-Signature: DocuSign API, HelloSign API, or PandaDoc
• Entity Management: Stripe Atlas, Clerky, or custom tracking
• Python 3.10+ or Node.js 18+ for automation scripts

Capabilities

• Generate contracts, NDAs, ToS, and privacy policies from templates
• Run GDPR/CCPA compliance scans on websites and apps
• Monitor regulatory changes in relevant jurisdictions
• Manage business entities and annual filings
• Automate e-signature workflows
• Track compliance deadlines and renewals
• Generate data processing agreements (DPA)
• Audit cookie consent and data collection practices

When to Use

Trigger phrases:

• "legal compliance"

• "Contract generation, terms of service, privacy policies, GDPR/CCPA compliance ch"

• Starting a new business and need legal documents

• Launching a SaaS product requiring ToS and privacy policy

• Onboarding clients who need contracts signed

• Operating in EU/California and need GDPR/CCPA compliance

• Annual entity filings and compliance renewals

• Adding new data collection that requires privacy review

When NOT to Use

• You need legal advice (consult a lawyer, not an AI)
• Task requires jurisdiction-specific legal expertise
• Contract dispute or litigation (use legal counsel)
• You're unsure about legal requirements (get professional review)
• Task is about legal research, not document creation
• Compliance is for a regulated industry (finance, healthcare) with specific requirements

Pseudo Code

Implementation patterns for common use cases with this skill.

Entity Setup & Management

ENTITIES = {
  "main_llc": {
    "name": "My AI Company LLC",
    "state": "Wyoming",  # Privacy-friendly, no state income tax
    "formation_date": "2026-01-15",
    "ein": "XX-XXXXXXX",
    "registered_agent": "Northwest Registered Agent",
    "annual_report_due": "2027-01-15",
    "franchise_tax_due": "2027-04-15"
  }
}

# Track compliance deadlines
COMPLIANCE_CALENDAR = [
  {"entity": "main_llc", "task": "Annual Report", "due": "2027-01-15", "recurring": "yearly"},
  {"entity": "main_llc", "task": "Franchise Tax", "due": "2027-04-15", "recurring": "yearly"},
  {"entity": "main_llc", "task": "BOI Report Update", "due": "on_change", "recurring": "event"},
  {"entity": "main_llc", "task": "Operating Agreement Review", "due": "2026-07-15", "recurring": "yearly"}
]

def check_upcoming_deadlines():
    upcoming = []
     item  COMPLIANCE_CALENDAR:
         item[] != :
            due = datetime.strptime(item[], )
              < (due - datetime.now()).days <= days_ahead:
                upcoming.append(item)
     upcoming

Contract Generation

CONTRACT_TEMPLATES = {
  "nda_mutual": "templates/nda_mutual.md",
  "nda_one_way": "templates/nda_one_way.md",
  "service_agreement": "templates/service_agreement.md",
  "consulting_agreement": "templates/consulting_agreement.md",
  "independent_contractor": "templates/independent_contractor.md",
  "dpa": "templates/data_processing_agreement.md"
}

def generate_contract(template_name, variables):
    """
    Generate a contract from template with variables.
    Output: DOCX and PDF
    """
    template_path = CONTRACT_TEMPLATES[template_name]

    # Load template
    with open(template_path) as f:
        template = f.read()

    # Fill variables
    for key, value in variables.items():
        template = template.replace(f"{{{{{key}}}}}", str(value))

    # Add legal boilerplate
    template = add_governing_law(template, variables.get("jurisdiction", "Delaware"))
    template = add_dispute_resolution(template, variables.get("dispute_method", "arbitration"))

    # Generate documents
    docx_path = f"output/{template_name}_{date.today()}.docx"
    pdf_path = f"output/{template_name}_{date.today()}.pdf"

    # Markdown → DOCX → PDF
    pandoc_convert(template, docx_path)
    docx_to_pdf(docx_path, pdf_path)

    return {"docx": docx_path, : pdf_path}


contract = generate_contract(, {
    : ,
    : ,
    : ,
    : ,
    : ,
    : ,
    : 
})

Website Compliance Scan

def scan_website_compliance(url):
    """
    Scan website for GDPR/CCPA compliance issues.
    """
    issues = []

    # 1. Cookie consent check
    cookies = scan_cookies(url)
    if not cookies.has_consent_banner:
        issues.append({
            "severity": "critical",
            "category": "cookies",
            "issue": "No cookie consent banner detected",
            "fix": "Add cookie consent banner (Cookiebot, OneTrust, or custom)"
        })

    # 2. Privacy policy check
    privacy = check_privacy_policy(url)
    if not privacy.exists:
        issues.append({
            "severity": "critical",
            "category": "privacy",
            "issue": "No privacy policy page found",
            "fix": "Create privacy policy covering data collection, usage, and rights"
        })
    elif privacy.last_updated_days_ago > 365:
        issues.append({
            "severity": "warning",
            "category": "privacy",
            "issue": f"Privacy policy not updated in {privacy.last_updated_days_ago} days",
            "fix": "Review and update privacy policy annually"
        })

    # 3. Data collection audit
    forms = scan_forms(url)
    for form in forms:
        if form.collects_pii   form.has_consent_checkbox:
            issues.append({
                : ,
                : ,
                : ,
                : 
            })

    
    scripts = scan_third_party(url)
     script  scripts:
         script.tracks_users   script.in_consent_manager:
            issues.append({
                : ,
                : ,
                : ,
                : 
            })

    
     targets_eu(url):
          has_data_deletion_process(url):
            issues.append({
                : ,
                : ,
                : ,
                : 
            })
          has_data_export_process(url):
            issues.append({
                : ,
                : ,
                : ,
                : 
            })

     {
        : url,
        : datetime.now().isoformat(),
        : issues,
        : calculate_compliance_score(issues),
        :   ([i  i  issues  i[] == ]) ==   
    }

Regulatory Monitoring

REGULATORY_SOURCES = [
    # GDPR
    {"name": "EDPB", "url": "https://edpb.europa.eu/news/news_en", "region": "EU"},
    {"name": "ICO", "url": "https://ico.org.uk/action-and-policy/", "region": "UK"},

    # CCPA/US Privacy
    {"name": "CPPA", "url": "https://cppa.ca.gov/announcements/", "region": "US-CA"},
    {"name": "FTC", "url": "https://www.ftc.gov/news-events", "region": "US"},

    # Industry-specific
    {"name": "SEC", "url": "https://www.sec.gov/news", "region": "US", "industry": "finance"},
    {"name": "HIPAA", "url": "https://www.hhs.gov/hipaa/", "region": "US", "industry": "health"}
]

def monitor_regulatory_changes():
    """
    Check regulatory sources for new announcements.
    Alert on changes relevant to business operations.
    """
    for source in REGULATORY_SOURCES:
        updates = fetch_rss(source["url"])

         update  updates:
            relevance = assess_relevance(update, business_profile)

             relevance.score > :
                alert = {
                    : source[],
                    : update.title,
                    : update.summary,
                    : relevance.reason,
                    : relevance.action,
                    : relevance.deadline,
                    : update.link
                }

                
                send_slack_alert(alert)
                send_email_alert(alert)

                
                log_regulatory_alert(alert)

E-Signature Workflow

async function sendForSignature(document, recipients) {
  // DocuSign integration
  const envelope = await docusign.createEnvelope({
    emailSubject: `Please sign: ${document.name}`,
    documents: [{
      documentId: "1",
      name: document.name,
      documentBase64: document.base64
    }],
    recipients: {
      signers: recipients.map((r, i) => ({
        email: r.email,
        name: r.name,
        recipientId: String(i + 1),
        routingOrder: String(i + 1),
        tabs: {
          signHereTabs: [{
            documentId: "1",
            pageNumber: document.signaturePage,
            xPosition: "200",
            yPosition: "400"
          }]
        }
      }))
    },
    status: "sent"
  });

  
   (envelope., {
    : .,
    : recipients.( r.),
    :  ()
  });

   envelope.;
}

Error Handling

Error	Cause	Recovery
TEMPLATE_NOT_FOUND	Contract template missing	Use fallback generic template, flag for review
COMPLIANCE_SCAN_FAIL	Website blocked scanner	Use headless browser, retry with different user-agent
ENVELOPE_DECLINED	Recipient declined to sign	Log reason, contact recipient, modify terms if needed
REGULATORY_ALERT_FALSE	Irrelevant alert triggered	Update relevance model, add to ignore list
ENTITY_OVERDUE	Missed filing deadline	File immediately, pay late fees, set better reminders
PDF_GENERATION_FAIL	Pandoc conversion error	Fall back to DOCX only, alert for manual PDF creation

Common Patterns

Reusable patterns that appear frequently when applying this skill.

Privacy Policy Auto-Generation

privacy_policy = generate_privacy_policy({
    "company": "My AI Company LLC",
    "website": "https://mysite.com",
    "data_collected": ["email", "name", "usage_analytics", "cookies"],
    "third_parties": ["Stripe (payments)", "Google Analytics", "Intercom (support)"],
    "retention_period": "2 years or until account deletion",
    "user_rights": ["access", "delete", "export", "opt-out"],
    "jurisdiction": ["GDPR (EU)", "CCPA (California)"],
    "contact_email": "[e-mail]",
    "dpo_required": false
})

Compliance Checklist per Jurisdiction

Requirement	GDPR (EU)	CCPA (CA)	PIPEDA (CA)
Consent before collection	Explicit opt-in	Opt-out only	Implied consent OK
Right to delete	Yes (30 days)	Yes (45 days)	Yes
Right to export	Yes	Yes	Yes
Data breach notification	72 hours	"Without unreasonable delay"	"As soon as feasible"
DPO required	Sometimes	No	No
Cookie consent	Required	Not required	Implied OK

Annual Compliance Calendar

• January: Annual report filing, privacy policy review
• April: Tax filings, DPA renewals
• July: Mid-year compliance audit, cookie scan
• October: Pre-year-end entity review, regulatory update check
• December: Year-end compliance report, renew expiring agreements

Red Flags

• Ignoring jurisdiction-specific requirements
• Not keeping up with regulatory changes
• Missing required disclosures
• Not protecting sensitive data
• Ignoring compliance deadlines

Verification

• Jurisdiction requirements are met
• Regulatory changes are tracked
• Required disclosures are included
• Sensitive data is protected
• Compliance deadlines are met

Process

1. Analyze the task requirements
2. Apply domain expertise
3. Verify output quality

Anti-Rationalization Table

Rationalization	Reality
"We do not need SOPs"	Without SOPs, quality depends on memory. Document everything.
"Manual processes work fine"	Manual processes do not scale and are error-prone. Automate.
"Compliance is optional"	Compliance protects you legally. Build it in from the start.