Regulatory Scanner — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Regulatory Scanner (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Produce a clear map of which regulations apply to a product and where the gaps are - research and triage, not legal advice. The costly failure this prevents is discovering an obligation from the enforcement letter: teams routinely learn that a checkout flow triggered a state privacy law, or a health-adjacent feature crossed into HIPAA territory, only after the exposure exists.
Jurisdiction drives everything, so scoping comes first; a scan that assumes US-only while the product sells into the EU is worse than no scan, because it creates false confidence.
Collect from the user:
Label anything assumed as a guess and confirm before Step 2, because a wrong jurisdiction list invalidates the whole map.
Work through the domains systematically and mark each apply / not apply / unclear, with a one-line reason:
"Unclear" is a legitimate status - it becomes a question for counsel, which is more useful than a guess.
For each applicable regulation, list the concrete obligations it imposes - consent mechanisms, breach notification timelines, record-keeping, audits, disclosures, data-subject rights. Cite the specific article or section so every requirement is traceable and checkable. Precision matters because obligations carry real deadlines: GDPR breach notification to the supervisory authority is 72 hours from awareness (Art. 33); GDPR data-subject access requests must be answered within one month (Art. 12).
For each requirement, mark status: Met / Partial / Not met / Unknown. "Unknown" is a gap, not a pass. Prioritize gaps by three factors:
High exposure + high likelihood + low effort is the top of the list.
Fill one row per requirement:
Regulation | Jurisdiction | Requirement (with citation) | Status | Gap | Priority | Owner
Example row:
GDPR | EU | Notify supervisory authority of a personal-data breach
within 72h of awareness (Art. 33) | Not met | No incident-response
playbook with notification step | HIGH | [FILL]
[FILL] | [FILL] | [FILL] | [FILL] | [FILL] | [FILL] | [FILL]Add a narrative summary of the top 3 risks in plain language an executive can act on, and note the date the scan was performed - regulations change, and an undated scan misleads.
For each high-priority gap, suggest a concrete remediation action and an owner. Explicitly flag every item that needs qualified legal counsel before action - binding interpretation, filings, regulator contact, anything ambiguous in Step 2.
Produce: the jurisdiction and data inventory, the domain applicability checklist with reasons, the compliance map table (Regulation | Jurisdiction | Requirement + citation | Status | Gap | Priority | Owner), a top-3 risk narrative, a remediation list, and an explicit "requires counsel" list.
This is a research scan, NOT legal advice - no output from it should be treated as a binding interpretation, and nothing here creates an attorney-client relationship. Bring in qualified counsel for: any binding interpretation, all filings and regulator communications, anything marked "unclear" in Step 2, and any regime with criminal liability or where enforcement is active in the user's sector. For drafting policies and terms, route to terms-of-service; for audit-evidence assembly, route to soc2-evidence-helper.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.