Regulatory Compliance Check
The Prompt
The Logic
1. Ignorance of Regulations Is Not a Defense
The foundational principle of regulatory compliance is that "not knowing" offers zero legal protection. Courts and regulatory agencies uniformly reject ignorance as a defense—business owners are expected to know and comply with applicable regulations. This framework emphasizes comprehensive discovery of all applicable regulations because missing even one obscure requirement can result in severe penalties, business shutdown, or personal liability for owners. The challenge is that regulatory frameworks are Byzantine: federal regulations interact with state regulations which layer on top of local regulations, creating a complex web that varies by industry, business size, revenue, employee count, and activities. A food business might need 15+ different permits and licenses across city, county, state, and federal levels. This prompt systematically catalogs requirements across all layers to prevent the "we didn't know" trap that ensnares thousands of businesses annually. Proactive compliance discovery is dramatically cheaper than reactive compliance after violations—penalties can reach tens of thousands for issues that cost hundreds to prevent.
2. Risk-Based Prioritization Prevents Compliance Paralysis
Businesses face dozens or hundreds of compliance requirements, and attempting perfect compliance with everything simultaneously causes paralysis and bankruptcy. This framework prioritizes by risk severity and implementation urgency because not all compliance is equal. Operating without required business licenses is a critical risk—you can be shut down immediately. Missing trademark registration is a moderate risk—you lose brand protection but can continue operating. The prioritization matrix uses four dimensions: consequence severity (shutdown, fines, lawsuits, reputation damage), probability of detection (high-enforcement areas vs. rarely enforced), implementation complexity (quick vs. multi-month projects), and dependency chains (some requirements prerequisite others). This enables resource-constrained businesses to sequence compliance logically: address existential threats first (licenses to operate), then high-fine-risk items (payroll tax, data privacy), then competitive advantages (certifications), then aspirational best practices. Many businesses waste resources achieving perfect compliance in low-risk areas while remaining exposed in high-risk domains. The framework prevents this misallocation by explicitly ranking all requirements.
3. Multi-Jurisdiction Complexity Multiplies Exponentially
Operating in multiple states or countries doesn't just add compliance requirements—it multiplies them combinatorially because requirements interact. A business selling in all 50 states faces 50 different sales tax regimes, 50 employment law frameworks, 50 privacy law variations, 50 licensing systems, and 50 corporate registration requirements. Each jurisdiction has unique thresholds, filing frequencies, fee structures, and enforcement priorities. The framework explicitly maps jurisdictional compliance because this is where businesses most frequently fail—they understand their home state but miss requirements in expansion markets. California's CCPA privacy law, Virginia's consumer protection rules, and New York's labor regulations create a compliance patchwork requiring jurisdiction-specific expertise. International expansion adds entire additional layers (GDPR in EU, PIPEDA in Canada, tax treaties, export controls). E-commerce businesses particularly struggle because selling online creates nexus (substantial connection) in every state where customers exist, triggering registration and tax obligations. The framework forces systematic jurisdiction mapping to ensure no blind spots remain in multi-market operations.
4. Data Privacy Compliance Is Universal and Expanding
Data privacy regulations have become the universal compliance requirement affecting nearly every business regardless of size or industry. If you collect customer emails, store employee records, or process any personal information, you're subject to data privacy laws. The framework emphasizes privacy compliance because: (1) penalties are severe ($7,500 per violation under CCPA—multiply by thousands of customers), (2) enforcement is increasing dramatically (state attorneys general actively pursuing cases), (3) requirements are specific and detailed (requiring privacy policies, consent mechanisms, data deletion processes, breach notification procedures), and (4) customer expectations now include privacy protection (violations damage trust and brand). GDPR in Europe and CCPA in California have created de facto national standards—businesses find it easier to comply with strict standards everywhere than maintain different privacy regimes per jurisdiction. The framework specifies required documentation (privacy policies, terms of service, cookie consent), technical requirements (encryption, access controls, breach response), and operational procedures (data subject access requests, deletion rights) because privacy compliance is both legal and technical, requiring coordination between legal, engineering, and operations teams.
5. Employment Law Creates Significant Personal Liability
Employment and labor compliance deserves special emphasis because violations create both corporate liability and personal liability for owners and managers. Misclassifying employees as contractors to avoid payroll taxes? The IRS can assess penalties against the business AND hold owners personally liable. Failing to pay overtime? Department of Labor can require back pay plus liquidated damages. Discriminatory hiring practices? EEOC lawsuits with uncapped damages. The framework thoroughly covers employment compliance because it's where small businesses most frequently create catastrophic liabilities through well-intentioned mistakes. The employee vs. contractor distinction has specific legal tests (IRS 20-factor test, ABC test in California) that trump intention—you can't simply agree with a worker to call them a contractor if the legal relationship is employment. Exempt vs. non-exempt classification for overtime requires meeting specific salary and duties tests. State-specific requirements layer on top of federal minimums—California, New York, Massachusetts have significantly more employee protections than federal law requires. The framework creates checklists for proper classification, required documentation (offer letters, handbooks, policies), and regulatory reporting (new hire reporting, tax withholding, workers' comp) to prevent the employment law pitfalls that generate most small business lawsuits.
6. Continuous Monitoring Prevents Compliance Drift
Compliance is not a one-time achievement but a continuous state requiring active maintenance because regulations change, business activities evolve, and thresholds trigger new requirements. This framework includes ongoing monitoring protocols because compliance drift—the gradual divergence between current obligations and actual practices—inevitably occurs without systematic oversight. New laws get passed (data privacy laws emerging in multiple states), revenue growth triggers new thresholds (FML A applies at 50 employees, certain tax rules at $100K revenue, securities regulations at investor counts), business activities expand into new domains (adding food service to a retail store triggers health permits), and regulatory agencies issue new guidance clarifying old rules. The framework specifies: (1) annual compliance audit procedures, (2) regulatory update monitoring (subscribing to industry association alerts, state business bureaus), (3) threshold tracking (employee count, revenue, customer count that trigger new obligations), (4) calendar management for recurring deadlines, and (5) relationship maintenance with professional advisors (annual attorney check-ins, quarterly CPA meetings). Organizations with strong compliance cultures treat it like financial reporting—regular reviews, documented procedures, clear ownership, and accountability. Those treating it as afterthought face predictable enforcement actions when drift creates violations.
Example Output Preview
Sample Output for HealthTrack Fitness App - SaaS Platform
EXECUTIVE COMPLIANCE SUMMARY
Overall Risk Level: MEDIUM-HIGH
Primary Concerns: Health data privacy (potential HIPAA trigger), multi-state sales tax nexus, international users (GDPR), app store compliance
Critical Gap: No privacy policy addressing health data collection—HIGH RISK
Timeline: 30 days for critical items, 90 days for full baseline compliance
Budget Estimate: $18,500-$28,000 (initial), $8,000-$12,000 annually (ongoing)
Professional Advisors Needed: Tech/privacy attorney ($5K-$8K), Multi-state tax CPA ($3K-$5K), HIPAA consultant (if handling PHI, $4K-$7K)
TOP 5 PRIORITY COMPLIANCE ACTIONS:
- Implement Comprehensive Privacy Policy (7 days): Address CCPA, GDPR, health data collection—currently exposed to $7,500 per user penalties
- Determine HIPAA Applicability (14 days): If collecting Protected Health Information, must implement full HIPAA compliance ($15K-$25K project)—critical determination needed
- Register for Sales Tax (30 days): Economic nexus established in 8 states based on revenue, currently non-compliant—penalties $200-$10K per state
- Update Terms of Service (14 days): Current terms inadequate for subscription model, liability limitations missing—litigation exposure
- Implement Data Security Measures (30 days): Encryption, access controls, breach response plan—required for CCPA/GDPR, currently exposed
DATA PRIVACY & SECURITY COMPLIANCE - DETAILED:
FEDERAL PRIVACY REQUIREMENTS: FTC Act Section 5 (Unfair/Deceptive Practices): ✅ Applicability: YES - all businesses collecting consumer data 📋 Requirements: - Privacy policy accurately describing data practices - Honor stated privacy commitments - Implement reasonable data security 🚨 Current Status: PARTIAL - have basic privacy policy but missing health data disclosures ⚡ Action Needed: Update privacy policy within 7 days, add health data section 💰 Penalty: FTC fines up to $43,280 per violation ⏰ Timeline: IMMEDIATE COPPA (Children's Online Privacy Protection Act): ✅ Applicability: POTENTIAL - if users under 13 📋 Requirements: - Parental consent for data collection - Parental access to child's data - Age verification mechanisms 🚨 Current Status: NOT COMPLIANT - app allows 13+ but no age verification ⚡ Action Needed: Implement age verification, add parental consent flow if allowing <13 💰 Penalty: $46,517 per violation (per child affected) ⏰ Timeline: 30 days if allowing children, or implement 13+ age gate immediately STATE PRIVACY LAWS: California - CCPA/CPRA: ✅ Applicability: YES - revenue >$25M OR data on 100K+ CA consumers 📋 Requirements: - Notice at collection of personal information - Right to know what data is collected - Right to delete data - Right to opt-out of sale (if applicable) - Do Not Sell My Personal Information link - Updated privacy policy every 12 months 🚨 Current Status: NON-COMPLIANT - missing required disclosures ⚡ Action Needed: [Days 1-7] Update privacy policy with CCPA-compliant language [Days 8-14] Implement data subject request portal [Days 15-30] Create internal DSAR handling procedures [Days 31-60] Train team on CCPA compliance 💰 Penalty: $2,500 per violation (unintentional), $7,500 (intentional) ⏰ Timeline: 30 days critical, 60 days full implementation HEALTH DATA PRIVACY DETERMINATION: HIPAA Applicability Assessment: UNCERTAIN - REQUIRES LEGAL ANALYSIS Factors Suggesting HIPAA Applies: ❌ Collecting health information (weight, BMI, conditions, medications) ❌ Information used for health-related purposes ❌ Potential partnerships with healthcare providers Factors Suggesting HIPAA Does NOT Apply: ✅ Direct-to-consumer app (not healthcare provider) ✅ No treatment, payment, or healthcare operations ✅ Consumer wellness vs. medical treatment Determination Needed: Consult HIPAA attorney ($1,500-$2,500) If HIPAA Applies (Protected Health Information): 📋 Requirements: - HIPAA Privacy Rule compliance - HIPAA Security Rule (technical safeguards) - Business Associate Agreements with vendors - Breach notification procedures - HITECH Act provisions - Risk analysis and management 💰 Implementation Cost: $15,000-$25,000 ⏰ Timeline: 3-6 months full compliance 🚨 Penalty: $100-$50,000 per violation (up to $1.5M annually per violation type) If HIPAA Does NOT Apply (Consumer Health Data): 📋 Requirements: - General data privacy (CCPA, GDPR) - FTC Health Breach Notification Rule (if PHR) - State consumer health data laws (e.g., Washington My Health My Data Act) - Reasonable security measures 💰 Implementation Cost: $5,000-$10,000 ⏰ Timeline: 30-60 days RECOMMENDED ACTION: Obtain legal determination within 14 days
TAX COMPLIANCE - MULTI-STATE NEXUS:
SALES TAX ECONOMIC NEXUS ANALYSIS: States Where HealthTrack Has Established Nexus: California: Nexus Threshold: $500,000 revenue Your Revenue: $847,000 (exceeds threshold) 🚨 Status: NEXUS ESTABLISHED - must collect sales tax Action Required: 1. Register with CA Dept. Tax & Fee Admin (7-10 days) 2. Obtain seller's permit 3. Configure tax collection in Stripe/payment processor 4. Begin collecting on new sales immediately 5. File returns monthly (if >$17K tax/quarter) or quarterly Registration Cost: $0 (CA) CPA Setup: $500-$800 New York: Nexus Threshold: $500,000 revenue AND 100+ transactions Your Stats: $312,000 revenue, 2,847 transactions (exceeds both) 🚨 Status: NEXUS ESTABLISHED Action Required: Similar to CA, register with NY Dept. of Taxation Registration Cost: $0 (NY) Filing Frequency: Quarterly Texas: Nexus Threshold: $500,000 revenue Your Revenue: $298,000 (below threshold currently) ✅ Status: NO NEXUS YET - monitor Action Required: Track monthly; register when exceeding threshold [Similar analysis for all states where revenue/transactions exist] TOTAL STATES REQUIRING REGISTRATION: 8 States: CA, NY, FL, TX (approaching), IL, PA, OH, WA Implementation Plan: Week 1: Register in CA, NY (highest revenue states) Week 2: Register in FL, IL, PA Week 3: Register in OH, WA, NC Week 4: Configure tax collection and test Week 5: Begin charging sales tax to customers Costs: - Registration fees: $0-$50 per state (most are free) - CPA assistance: $2,500-$4,000 for multi-state setup - Sales tax software (TaxJar, Avalara): $99-$199/month - Ongoing filing: $200-$400 per state annually RETROACTIVE LIABILITY RISK: You should have been collecting in CA, NY, FL since Q2 2024 Potential exposure: $18,400-$24,700 in uncollected taxes Penalty: 10-25% on unpaid tax + interest Recommendation: Voluntary disclosure agreements in CA/NY/FL to reduce penalties Cost: $8,000-$12,000 (back taxes + penalties + legal fees)
EMPLOYMENT COMPLIANCE CHECKLIST:
Current Team: 12 employees, 8 contractors EMPLOYEE vs. CONTRACTOR CLASSIFICATION REVIEW: HIGH RISK: 3 of your "contractors" may be misclassified Red Flags Identified: ❌ Work full-time hours (35-40 hrs/week) ❌ Work exclusively for HealthTrack ❌ Use company-provided equipment ❌ Integrated into company operations ❌ No independent business operations IRS 20-Factor Test Applied: 14 of 20 factors indicate employment California ABC Test Applied: Fails Part A and Part B 🚨 Misclassification Consequences: - Back payroll taxes (7.65% of compensation) - Penalties ($50-$250 per W-2 not filed) - Interest on unpaid taxes - Potential unemployment insurance retroactive - Workers' comp insurance retroactive premiums - Potential employee lawsuits for benefits 💰 Estimated Exposure: $47,000-$68,000 (3 workers, 18 months) Recommended Action: 1. Consult employment attorney for classification review ($2,000-$3,500) 2. If misclassified: Reclassify as W-2 employees immediately 3. File corrected tax returns (2-3 years back) 4. Consider IRS Voluntary Classification Settlement Program (VCSP) - Reduced penalties (10% vs. 100% of tax liability) 5. Document independent contractor relationships properly for remaining 5 REQUIRED EMPLOYMENT DOCUMENTATION: ✅ Have: Offer letters, I-9 forms, W-4 forms ❌ Missing: Employee handbook (REQUIRED - 12 employees) ❌ Missing: Anti-harassment policy (REQUIRED - CA law for 5+ employees) ❌ Missing: Meal/rest break policy (CA requirement) ❌ Missing: FMLA policy (not yet applicable - <50 employees) ❌ Missing: Expense reimbursement policy (CA requirement) Action Required: - Develop employee handbook: $2,500-$5,000 (attorney-drafted) - OR use compliant template: $500-$1,000 + attorney review $800-$1,200 - Distribute to all employees with signed acknowledgment Timeline: 30 days
PRIORITIZED IMPLEMENTATION ROADMAP:
IMMEDIATE (Days 1-7) - CRITICAL:
- ✅ Update privacy policy (CCPA/GDPR compliant) - $1,500 attorney or $200 template
- ✅ Add health data disclosures to privacy policy
- ✅ Post updated Terms of Service with liability limitations
- ✅ Implement age verification (13+ gate) to avoid COPPA
- ✅ Engage HIPAA attorney for determination consultation - $1,500-$2,500
SHORT-TERM (Days 8-30) - HIGH PRIORITY:
- ✅ Register for sales tax in CA, NY, FL, IL, PA, OH, WA, NC - $2,500-$4,000 CPA
- ✅ Configure automated sales tax collection
- ✅ Implement data security measures (encryption, access controls) - $3,000-$6,000
- ✅ Create data breach response plan
- ✅ Review contractor classification, reclassify if needed - $2,000-$3,500 attorney
- ✅ Develop employee handbook - $2,500-$5,000
- ✅ Implement DSAR (data subject access request) portal - $800-$1,500
MEDIUM-TERM (Days 31-90) - MODERATE PRIORITY:
- ✅ If HIPAA applies: Full compliance implementation - $15K-$25K
- ✅ Obtain cyber liability insurance - $2,500-$4,000 annually
- ✅ Trademark registration for "HealthTrack" - $1,500-$2,500
- ✅ Voluntary tax disclosure agreements (back taxes) - $8K-$12K
- ✅ SOC 2 Type I audit preparation (if pursuing enterprise) - $15K-$25K
- ✅ Implement vendor security assessment program
ONGOING - CONTINUOUS:
- 📅 Monthly: Sales tax filings (8 states)
- 📅 Quarterly: Payroll tax returns (941), sales tax review
- 📅 Quarterly: Privacy policy review and updates
- 📅 Semi-annually: Security audit and penetration testing
- 📅 Annually: Corporate good standing filings, insurance renewals
- 📅 Annually: Compliance audit with attorney - $3,000-$5,000
TOTAL COMPLIANCE BUDGET:
Initial Compliance (Days 1-90): Legal fees (privacy, employment, tax): $8,000-$12,000 Tax registration and back taxes: $10,500-$16,000 Security implementation: $3,000-$6,000 Insurance (cyber liability): $2,500-$4,000 Documentation and policies: $3,500-$6,000 Contingency (HIPAA if applicable): $0-$25,000 TOTAL INITIAL: $27,500-$69,000 (Realistic estimate without HIPAA: $27,500-$44,000) Ongoing Annual Compliance: Legal/CPA retainer: $5,000-$8,000 Sales tax software: $1,200-$2,400 Insurance renewals: $2,500-$4,000 Security audits: $4,000-$8,000 Filing fees and licenses: $800-$1,200 TOTAL ANNUAL: $13,500-$23,600
Prompt Chain Strategy
Step 1: Business Activity Classification & Risk Screening
Expected Output: Business activity classification, risk-ranked regulatory domains, preliminary risk assessment, and focus areas for deep-dive analysis. This prevents wasting time on irrelevant regulations while ensuring high-risk areas get appropriate attention.
Step 2: Comprehensive Regulatory Compliance Assessment
Expected Output: Complete compliance assessment with industry-specific regulations, data privacy requirements, employment compliance, tax obligations, licensing needs, IP protection, contracts, insurance, prioritized roadmap, and budget estimates.
Step 3: Professional Advisor Engagement Strategy
Expected Output: Detailed advisor engagement strategy with specific types needed, engagement scopes, cost estimates, prioritization, evaluation criteria, and relationship management guidance. This ensures you spend compliance budget efficiently on the right experts at the right time.
Human-in-the-Loop Refinements
1. Jurisdiction-Specific Deep Dive
After receiving the general compliance assessment, request jurisdiction-specific analysis for your primary locations: "I'm located in [CITY, STATE]. Provide a detailed analysis of city, county, and state-specific requirements beyond federal regulations. Include: (1) Local business license requirements and costs, (2) State-specific employment laws that exceed federal requirements, (3) State tax registrations and obligations, (4) Industry-specific state regulations, (5) Zoning and land use requirements, (6) State-specific contract law considerations. Research my specific city and county—don't provide generic advice." Local regulations vary enormously and generic compliance guidance misses city-specific requirements that can shut down businesses. Request specific municipal code references and local agency contact information.
2. Compliance Gap vs. Current Practice Audit
Map the AI's compliance recommendations against your current practices: "Here's what we currently do: [list your current policies, documentation, procedures]. Compare this to the compliance requirements you identified. Create a gap analysis showing: (1) Requirements we already meet, (2) Requirements partially met (what's missing?), (3) Requirements not met at all, (4) Documentation we have but may be insufficient, (5) Practices we do but haven't documented. For each gap, categorize as critical/high/medium/low priority." This focuses effort on actual gaps rather than redoing compliant areas and quantifies exactly how much work is needed. Many businesses discover they're 60-70% compliant already but lack documentation proving it.
3. Compliance Cost-Benefit Analysis
For expensive compliance requirements, request ROI analysis: "The compliance assessment recommends SOC 2 certification ($25K-$40K). Analyze: (1) Is this required legally or optional for competitive advantage? (2) What revenue opportunities does SOC 2 enable (enterprise sales typically require it)? (3) What's the cost if we DON'T obtain certification? (4) Can we defer this 12-18 months or must we do it now? (5) What's the minimum viable compliance (lighter alternative)?" Not all compliance is mandatory immediately—some is competitive positioning. Separating "must have" from "nice to have" prevents compliance overspending. Request breakeven analysis: at what annual revenue does expensive certification pay for itself?
4. Compliance Calendar Creation
Request a comprehensive compliance calendar: "Create a 12-month compliance calendar including: (1) All recurring filing deadlines (monthly, quarterly, annual), (2) License and permit renewal dates, (3) Insurance policy renewals, (4) Scheduled compliance audits or reviews, (5) Training completion deadlines, (6) Policy review and update schedules. For each item: list responsible party, deadline, filing location/method, estimated time required, cost (if any), and consequences of missing deadline. Format as a spreadsheet I can import to Google Calendar with automated reminders 60, 30, and 7 days before deadlines." Deadline management is 80% of ongoing compliance. A systematic calendar prevents the missed deadline penalties that account for most compliance failures.
5. Materiality Threshold Analysis
For each compliance requirement, understand enforcement realities: "For the top 20 compliance requirements you identified, research: (1) How actively is this enforced in [YOUR STATE]? (2) What triggers enforcement (complaint-based, random audit, industry sweep)? (3) What are typical penalties for first-time violations vs. repeat violations? (4) Any safe harbor provisions or cure period? (5) Examples of recent enforcement actions in this area. (6) Can penalties be reduced through voluntary disclosure or compliance programs?" Not all regulations are enforced equally—understanding enforcement patterns helps prioritize limited resources. Some requirements have near-zero enforcement (technically required but ignored), others have active enforcement with steep penalties. Focus compliance spending on high-enforcement areas.
6. Compliance Insurance vs. Compliance Cost Analysis
Request risk transfer evaluation: "For the compliance risks identified, analyze: (1) What risks can be transferred to insurance vs. must be mitigated directly? (2) Compare cost of insurance coverage vs. cost of full compliance. (3) What compliance is required for insurance coverage (e.g., must have privacy policy for cyber insurance)? (4) What compliance work reduces insurance premiums (e.g., security audits reduce cyber premium 15-30%)? (5) What's not insurable and requires direct compliance? Create a matrix showing each major risk: mitigation cost, insurance cost, combined approach, recommendation." Some compliance costs can be partially replaced by insurance at lower cost. Cyber insurance ($2,500/yr) might be more cost-effective than full security infrastructure ($20K+), though some baseline security is required for coverage. Request specific insurance policy recommendations with coverage limits and cost ranges.
