Regulatory Compliance Agent Skill

Regulatory compliance

Compliance failures are rarely defiance. They are almost always an obligation nobody knew applied,

in a jurisdiction nobody was watching, discovered by someone external.

**This structures the work and names what to ask. Which regulations apply, and what they require,

are legal determinations that vary by jurisdiction and change — they belong with qualified counsel.

Nothing here substitutes for that.**

Start with an obligation map, not a framework

The first question is not "are we SOC 2 compliant" but "what are we actually obliged to do, by

whom, and what happens if we do not." Build the map from facts about the business:

• What you sell, and to whom. Selling to regulated customers pulls their obligations onto you

through contract even when the regulation does not reach you directly.

• What data you hold. Personal data, health data, payment data and children's data each carry

distinct regimes — see legal-risk:privacy-and-data-protection.

• Where you operate and where your customers are. Obligations follow the customer more often

than companies expect.

• How you are funded and structured. Public, regulated, or government-adjacent adds regimes.

Distinguish three things that get conflated: law you must follow, certifications you choose

to obtain commercially, and contractual commitments you signed. Only the first carries state

enforcement; all three carry consequences.

Certifications are evidence, not compliance

SOC 2, ISO 27001 and their equivalents demonstrate that controls exist and operate. They do not

establish that you meet any legal obligation, and a clean report is not a defense to a regulator.

Where they earn their cost is commercially — unblocking deals, as in the SOC 2 situation in

docs/USE-CASES.md. Scope them to what the market asks for rather than to everything, since scope

drives cost more than any other decision.

The program is monitoring, not documentation

A compliance program that produces policies and stops is a shelf. What makes it real:

• An owner per obligation — a named person, not a department.
• Controls that produce evidence as a by-product of the work, rather than evidence assembled

before an audit. See finance:internal-controls-and-audit for the control design pattern.

• Monitoring that would detect failure before an external party does, with the frequency matched

to how fast the obligation can be breached.

• Horizon scanning. Regulation changes; a map built once is wrong within a year.

When a regulator arrives

Respond promptly, accurately, and narrowly — answer what was asked. Route everything through counsel

before it goes out, preserve records from the moment you are aware, and never let an informal

conversation become an undocumented commitment.

Findings get root-caused like any other failure. A remediation that consists of retraining people on

a process that made the failure easy will produce the same finding next cycle.

Never

• Treat a certification as evidence of legal compliance.
• Build a compliance program without a named owner per obligation.
• Assemble control evidence retrospectively for an audit.
• Answer a regulator without counsel reviewing the response.