Regulatory Review
Overview
Regulatory review assesses the legal and compliance landscape affecting markets and products. This skill covers frameworks for understanding regulatory requirements, risks, and trends.
Required Frameworks
| Framework | Output Section | Required | Condition | |-----------|---------------|----------|-----------| | Framework Identification | Applicable Frameworks | yes | — | | Industry-to-Framework Mapping | Regulatory Mapping | yes | — | | Penalty Ranges | Enforcement & Penalties | yes | — | | Risk Matrix | Risk Assessment | yes | — | | Cross-border Mechanisms | Cross-border Analysis | conditional | Multi-jurisdiction scope in elicitation |
Trend Indicators: Load and apply the trend indicator definitions from protocols/TREND-INDICATORS.md.
Regulatory Dimensions
Direct Regulations
- Industry-specific rules (fintech, healthcare, etc.)
- Product safety requirements
- Licensing and certification
- Operational standards
Data & Privacy
- Data protection laws (GDPR, CCPA, etc.)
- Cross-border data transfer
- Consent requirements
- Breach notification
Consumer Protection
- Advertising standards
- Fair trading practices
- Warranty requirements
- Dispute resolution
Competition/Antitrust
- Market dominance rules
- M&A restrictions
- Pricing practices
- Distribution agreements
Major Regulatory Frameworks
Data Privacy
| Framework | Jurisdiction | Key Requirements | |-----------|--------------|------------------| | GDPR | EU | Consent, data rights, DPO, breach notification | | CCPA/CPRA | California | Disclosure, opt-out, deletion rights | | LGPD | Brazil | Similar to GDPR, local DPO | | PIPL | China | Consent, localization, cross-border rules |
Financial Services
| Framework | Jurisdiction | Scope | |-----------|--------------|-------| | Dodd-Frank | US | Banking, consumer protection | | PSD2 | EU | Payment services, open banking | | MiCA | EU | Crypto assets | | SOX | US | Public company reporting |
Healthcare
| Framework | Jurisdiction | Scope | |-----------|--------------|-------| | HIPAA | US | Health information privacy | | FDA 21 CFR | US | Medical devices, pharma | | MDR | EU | Medical devices | | HITECH | US | Health IT security |
Children's Privacy
| Framework | Jurisdiction | Scope | |-----------|--------------|-------| | COPPA | US | Children under 13 online privacy, parental consent | | COPPA 2.0 (proposed) | US | Expanded age range, stricter consent | | Age-Appropriate Design Code | California/UK | Privacy-by-design for minors |
COPPA Parental Consent Methods (FTC-approved):
- Signed consent form (mail/fax/scan)
- Credit card transaction verification
- Government ID check
- Knowledge-based authentication
- Video conference verification
- FTC-approved verifiable parental consent method
Key COPPA Thresholds:
- Under 13: Full COPPA applies; verifiable parental consent required before collecting ANY personal information
- CCPA/CPRA: Under 16 requires opt-in for sale/sharing of personal data; under 13 requires parental opt-in
Consumer & Advertising
| Framework | Jurisdiction | Scope | |-----------|--------------|-------| | FTC Act Section 5 | US | Unfair/deceptive practices, advertising substantiation | | FCA (Financial Conduct Authority) | UK | Financial services authorization and conduct | | Proposition 65 | California | Chemical exposure warnings | | FDA DSHEA | US | Dietary supplement labeling and safety |
AI/Technology
| Framework | Jurisdiction | Scope | |-----------|--------------|-------| | EU AI Act | EU | AI risk classification, requirements | | NYC Local Law 144 | NYC | AI in employment decisions (bias audits required) | | State AI bills | Various US | Emerging requirements (IL, CO, MD) | | EEOC AI Guidance | US | Anti-discrimination for AI hiring tools |
AI/ML Bias Audit Requirements
When the product uses AI/ML in decisions affecting people (hiring, lending, insurance, housing), these specific requirements apply:
| Requirement | Source | Detail | |-------------|--------|--------| | Annual bias audit by independent auditor | NYC Local Law 144 | Must test for disparate impact across race/ethnicity and gender; publish summary results | | 10-day candidate notice | NYC Local Law 144 | Notify candidates that AEDT is used; describe data collected and data retention policy | | High-risk AI conformity assessment | EU AI Act | Employment, education, law enforcement AI classified as high-risk; requires risk management system, data governance, human oversight | | Adverse impact analysis | EEOC/Title VII | Four-fifths rule for selection rates across protected categories; document validation studies | | Algorithmic fairness assessment | Colorado SB 21-169 | Developers and deployers of high-risk AI must provide impact assessments |
Industry-Framework Mapping
Use this table to quickly identify primary and secondary regulatory frameworks based on the user's industry:
| Industry | Primary Frameworks | Secondary Frameworks | |----------|-------------------|----------------------| | Healthcare/Telehealth | HIPAA, HITECH, FDA 21 CFR | GDPR (EU), State telehealth laws | | Fintech/Crypto | Dodd-Frank, SEC, FCA (UK) | MiCA (EU), State MSB licensing, BSA/FinCEN | | AI/ML in Employment | NYC Local Law 144, EEOC, EU AI Act | State AI bills, CCPA/CPRA | | Children's Apps/Games | COPPA, FTC Act | CCPA minors provisions, App store policies | | Medical Devices | FDA 21 CFR, EU MDR | TGA (AU), PMDA (JP), ISO 13485 | | E-commerce/Supplements | FDA DSHEA, FTC Act, Prop 65 | CCPA/CPRA, cGMP (21 CFR 111) | | SaaS/Data Processing | GDPR, CCPA/CPRA | ePrivacy, Sector-specific (HIPAA, PCI DSS) |
Regulatory Risk Assessment
Risk Categories
Compliance Risk
- Failure to meet existing requirements
- Likelihood: Based on current gaps
- Impact: Fines, operational restrictions
Regulatory Change Risk
- New or changing regulations
- Likelihood: Based on legislative trends
- Impact: Cost of compliance, market access
Enforcement Risk
- Increased regulatory scrutiny
- Likelihood: Based on enforcement patterns
- Impact: Investigations, penalties
Reputational Risk
- Public perception of compliance
- Likelihood: Based on sensitivity of issues
- Impact: Customer trust, brand damage
Risk Matrix
| Risk | Likelihood | Impact | Trend | Mitigation | |------|------------|--------|-------|------------| | [Risk] | H/M/L | H/M/L | INC/DEC/CONST | [Action] |
Regulatory Trend Analysis
Trend Indicators
INC (Increasing regulation)
- New legislation proposed/passed
- Increased enforcement actions
- Growing public/political attention
- International coordination
DEC (Decreasing regulation)
- Deregulation initiatives
- Reduced enforcement
- Political shift toward less oversight
CONST (Stable regulation)
- Established framework
- Predictable enforcement
- No major changes pending
Current Global Trends
| Area | Direction | Key Developments | |------|-----------|------------------| | Data Privacy | INC | More countries adopting GDPR-style laws | | AI/ML | INC | EU AI Act, emerging US frameworks | | Crypto/Fintech | INC | Global frameworks emerging | | Competition/Big Tech | INC | Antitrust scrutiny increasing | | ESG/Sustainability | INC | Disclosure requirements expanding | | Cybersecurity | INC | Mandatory breach reporting | | Children's Privacy | INC | COPPA 2.0, Kids Online Safety Act, state children's codes | | Supplement/Consumer Products | INC | FDA mandatory listing, FTC enforcement of health claims |
Compliance Assessment
Gap Analysis Framework
| Requirement | Current State | Gap | Priority | Remediation | |-------------|---------------|-----|----------|-------------| | [Req 1] | Compliant/Partial/Non | Description | H/M/L | Action needed |
Compliance Cost Estimation
| Component | One-Time | Ongoing Annual | |-----------|----------|----------------| | Technology | $X | $X | | Personnel | $X | $X |