Summary This source did not publish a separate summary. Review SKILL.md before using the skill.
Regulatory Compliance Audit
Overview
Executes a two-phase compliance analysis — detection scan followed by framework-by-framework
evaluation — across 7 regulatory frameworks. Produces a compliance scorecard with letter
grades (A-F) per framework, identifies specific gaps, and generates a prioritized
remediation roadmap with effort estimates and timelines.
This skill reads and analyzes existing assets. It does not generate legal documents or
modify any files. The output is an audit report documenting findings and recommendations.
Legal Disclaimer: This skill generates AI-assisted compliance analysis for
informational purposes only. It does not constitute legal advice, certification, or
attestation of compliance. Regulatory requirements are complex and jurisdiction-specific.
All findings should be reviewed by qualified legal counsel and/or certified compliance
professionals. No attorney-client relationship is created by using this tool.
Prerequisites
A live website URL or local codebase to analyze
Access to any existing privacy policy, terms of service, or compliance documentation
Knowledge of the business type, target audience, and geographic reach
Instructions
Phase 1: Detection Scan
Scan the website. Use WebFetch on the target URL to collect:
HTML source (meta tags, structured data, accessibility attributes)
Cookie and tracking behavior (Set-Cookie headers, JavaScript trackers)
Form elements (input types, required fields, consent checkboxes)
Payment indicators (payment form fields, processor scripts)
Third-party scripts and embeds (analytics, advertising, social)
SSL/TLS certificate presence
Content targeting indicators (age-related content, children's themes)
Scan the codebase (if available). Use Glob and Grep to find:
Privacy policy and terms of service files
Cookie consent implementation code
Authentication and access control patterns
Data encryption at rest and in transit
Logging and audit trail implementations
Age verification or gate mechanisms
Email sending code and unsubscribe handling
Payment processing integrations
Accessibility attributes (aria-*, alt text, semantic HTML)
Build the detection inventory. Create a structured map of findings:
Category Signals Found Frameworks Triggered Data Collection Forms, cookies, analytics GDPR, CCPA Payments Stripe, PayPal, card fields PCI-DSS Accessibility Missing alt text, no skip nav ADA/WCAG Email Marketing Newsletter signup, email sends CAN-SPAM User Demographics Age gates, child-oriented content COPPA Security Controls Auth, encryption, logging SOC 2
Phase 2: Framework-by-Framework Evaluation
Evaluate each applicable framework. Score against these criteria:
GDPR (General Data Protection Regulation)
CCPA/CPRA (California Consumer Privacy Act)
ADA/WCAG 2.1 (Accessibility)
PCI-DSS (Payment Card Industry)
CAN-SPAM (Commercial Email)
COPPA (Children's Online Privacy Protection)
SOC 2 (Trust Services Criteria)
Calculate compliance scores. For each framework:
Count the criteria met vs. total applicable criteria
Calculate a percentage score
Assign a letter grade:
Grade Score Meaning A 90-100% Substantially compliant B 75-89% Minor gaps, low risk C 60-74% Moderate gaps, action needed D 40-59% Significant gaps, priority remediation F 0-39% Non-compliant, immediate action required
Generate remediation roadmap. For each gap, provide:
Description of the gap
Regulatory risk (fine amounts, enforcement precedents)
Remediation action with specific steps
Effort estimate (hours: 1-4, 4-16, 16-40, 40+)
Priority tier: P0 (immediate), P1 (30 days), P2 (90 days), P3 (6 months)
Suggested responsible party (legal, engineering, marketing, ops)
Compile the audit report using the output format below.
Output Generate a single Markdown file named COMPLIANCE-AUDIT-{company}-{YYYY-MM-DD}.md:
# Regulatory Compliance Audit
**{Company Name}** — {URL or codebase path}
**Audit Date:** {date}
**Auditor:** AI Compliance Scan (Legal Assistant Plugin)
**Scope:** {frameworks evaluated}
---
## Executive Summary
{3-5 sentence overview of compliance posture, highest-risk areas, and top recommendation}
## Compliance Scorecard
| Framework | Score | Grade | Status |
|-----------|-------|-------|--------|
| GDPR | {%} | {A-F} | {Compliant / Gaps Found / Non-Compliant} |
| CCPA/CPRA | {%} | {A-F} | {status} |
| ADA/WCAG 2.1 | {%} | {A-F} | {status} |
| PCI-DSS | {%} | {A-F} | {status} |
| CAN-SPAM | {%} | {A-F} | {status} |
| COPPA | {%} | {A-F} | {status} |
| SOC 2 | {%} | {A-F} | {status} |
| **Overall** | **{%}** | **{grade}** | |
## Detection Inventory
{table of all signals detected during Phase 1}
## Detailed Findings
### GDPR
{criteria-by-criteria evaluation with PASS/FAIL/N-A}
### CCPA/CPRA
{criteria-by-criteria evaluation}
{... remaining frameworks ...}
## Remediation Roadmap
### P0 — Immediate (This Week)
| # | Gap | Framework | Action | Effort | Owner |
|---|-----|-----------|--------|--------|-------|
{high-risk items}
### P1 — Short-Term (30 Days)
{moderate-risk items}
### P2 — Medium-Term (90 Days)
{lower-risk items}
### P3 — Long-Term (6 Months)
{enhancement items}
## Risk Exposure Summary
{estimated fine exposure per framework based on published enforcement ranges}
---
**Frameworks Not Applicable:** {list with reason}
**Limitations:** AI scan cannot detect server-side controls, review organizational policies,
or assess physical security. This audit supplements but does not replace professional
compliance assessment.
**Generated by:** Legal Assistant Plugin — Not a substitute for legal counsel.
Error Handling Error Cause Solution Website unreachable URL down, behind auth, or blocked Ask for codebase path or manual description of features Framework not applicable Business does not trigger certain regulations Mark as N/A with explanation, exclude from overall score Cannot assess server-side No codebase access, only URL Note limitation, recommend server-side review separately Mixed signals on COPPA Cannot determine if audience includes children Flag for manual review, apply COPPA criteria conservatively Payment processing unclear Redirects to external checkout Note processor, limit PCI-DSS scope to integration points Existing policies not found No privacy policy or ToS published Score as F for policy-dependent criteria, flag as P0
Examples Example 1: E-Commerce Website
Request: "Audit for compliance"
Result: COMPLIANCE-AUDIT-ExampleShop-2026-04-02.md with:
GDPR: C (68%) — privacy policy exists but missing granular consent, no DPA with Shopify
CCPA: D (45%) — no "Do Not Sell" link, no consumer request mechanism
ADA/WCAG: B (82%) — good semantic HTML, missing alt text on 12 product images
PCI-DSS: A (95%) — Stripe checkout handles card data, HTTPS enforced
CAN-SPAM: B (78%) — unsubscribe works, missing physical address
COPPA: N/A — adult products only
SOC 2: N/A — not pursuing certification
Remediation: 14 items across P0-P2, estimated 120 hours total
Example 2: SaaS Application Codebase
Request: "Run a compliance audit on our codebase at ./src"
Result: COMPLIANCE-AUDIT-SaaSApp-2026-04-02.md with:
GDPR: D (52%) — no data processing records, no breach notification procedure
CCPA: C (65%) — basic privacy controls exist, missing sensitive data handling
ADA/WCAG: F (35%) — minimal ARIA attributes, no keyboard navigation, poor contrast
PCI-DSS: B (80%) — Stripe integration clean, but card-related strings in logs
CAN-SPAM: A (92%) — proper unsubscribe, physical address, clear headers
COPPA: N/A
SOC 2: D (48%) — no incident response plan, minimal access controls
Remediation: 23 items, accessibility overhaul as top P0
Resources 