Builds compliance checklists for business scenarios involving GDPR, PIPL, or advertising/data laws. Outputs a structured checklist with check items, legal basis, risk levels, and actionable recommendations. Triggered by requests like "run a compliance check," "GDPR/PIPL compliance," "pre-launch review," "privacy impact assessment (PIA/DPIA)," or asking if a feature is compliant.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Identifies applicable laws and regulations based on the user's business scenario description, and outputs a structured compliance checklist covering major regulations such as GDPR, PIPL (Personal Information Protection Law), Advertising Law, Cybersecurity Law, and Data Security Law.
Users simply describe their business scenario, and the Agent will:
Users just need to say:
"We're launching a user profiling feature — help me create a compliance checklist."
The Agent will guide the user to provide necessary information, then output a complete compliance checklist.
| Regulation | Abbreviation | Scope | Key Focus Areas |
|---|---|---|---|
| Personal Information Protection Law | PIPL | Processing personal information within China | Informed consent, data minimization, cross-border data transfer |
| General Data Protection Regulation | GDPR | Involving EU user data | Lawful basis, data subject rights, DPO, DPIA |
| Data Security Law | DSL | Data processing activities within China | Data classification & grading, security assessment, important data export |
| Cybersecurity Law | CSL | Network operators | Multi-Level Protection Scheme (MLPS), log retention, security incident reporting |
| Advertising Law | — | Advertising publishing and operations | Prohibited superlative claims, false advertising, medical advertising |
| E-Commerce Law | — | E-commerce operators | Information disclosure, user reviews, bundled sales |
| Anti-Unfair Competition Law | — | Market business activities | Commercial bribery, false advertising, trade secret infringement |
| Consumer Protection Law | — | Consumer rights related | Right to know, fair trade rights, personal information |
| Industry | Relevant Regulations / Standards |
|---|---|
| Finance | Technical Specification for Personal Financial Information Protection (JR/T 0171), Data Security Management Measures for Banking and Insurance Institutions |
| Healthcare | Population Health Information Management Measures, Medical Big Data Standards |
| Education | Online Protection Chapter of the Minors Protection Law, Provisions on Protection of Children's Personal Information Online |
| Automotive | Several Provisions on Automobile Data Security Management |
| Mobile Apps | Methods for Identifying Illegal Collection and Use of Personal Information by Apps, Provisions on the Scope of Necessary Personal Information for Common Types of Mobile Applications |
Confirm the following key information with the user:
| Dimension | Information to Confirm | Example |
|---|---|---|
| Business Description | Specific content of the feature/service | "User profiling feature that recommends products based on behavioral data" |
| User Group | Geographic region and demographics of target audience | "Mainland China users, including minors" |
| Data Types | What data is collected/processed | "Name, phone number, browsing history, location data" |
| Data Flow | Data storage, transmission, and sharing details | "Stored on Alibaba Cloud East China nodes, shared with third-party ad platforms" |
| Business Stage | New launch / existing system needing remediation / M&A due diligence | "New feature, planned for launch next month" |
| Existing Measures | Current compliance measures already in place | "Has a privacy policy, but no DPIA completed" |
If the user has not provided certain information, the Agent should proactively ask follow-up questions rather than assume or skip.
Based on collected information, determine applicable regulations using the following rules:
IF processing personal information → PIPL
IF involving EU users → GDPR
IF involving data storage/transmission → Data Security Law + Cybersecurity Law
IF involving advertising/marketing content → Advertising Law
IF involving e-commerce transactions → E-Commerce Law
IF involving minors → Minors Protection Law + Provisions on Protection of Children's Personal Information Online
IF cross-border data transfer (overseas storage/transmission/access) → PIPL Chapter 3 + Measures for Security Assessment of Data Export
IF involving sensitive personal information → PIPL Chapter 2 Section 2 (separate consent + PIIA)
IF involving automated decision-making → PIPL Article 24 (transparency + right to refuse)
IF involving financial data → JR/T 0171
Output the checklist in the following structure:
# [Business Scenario Name] Compliance Checklist
**Assessment Date**: YYYY-MM-DD
**Business Description**: [Brief description]
**Applicable Regulations**: [List of regulations]
## Checklist
| No. | Check Item | Legal Basis | Risk Level | Current Status | Remediation Advice |
|-----|-----------|-------------|------------|----------------|-------------------|
| 1 | [Check item description] | [Regulation name + article number] | High/Medium/Low | Compliant/Non-compliant/To be confirmed | [Specific advice] |
## Risk Summary
- High-risk items: X items
- Medium-risk items: X items
- Low-risk items: X items
## Priority Remediation Recommendations
1. [Highest priority remediation item and rationale]
2. [Second highest priority item and rationale]
Prioritize remediation actions according to the following rules:
| Priority | Criteria | Description |
|---|---|---|
| P0 — Immediate Action | High risk + currently non-compliant | May face administrative penalties, service shutdown |
| P1 — Complete This Week | High risk + to be confirmed, or medium risk + non-compliant | Significant compliance exposure |
| P2 — Complete This Month | Medium risk + to be confirmed | Requires further assessment and improvement |
| P3 — Ongoing Optimization | Low risk | Recommended improvement but not urgent |
| Check Item | Legal Basis | Description |
|---|---|---|
| Is there a privacy policy / user agreement? | PIPL Art. 17 | Must be displayed and consent obtained before registration |
| Is only necessary personal information collected? | PIPL Art. 6 | Registration stage should only require phone number/email; should not mandate ID numbers, etc. |
| Does third-party login disclose data sharing? | PIPL Art. 23 | Login via WeChat/Alipay must disclose what information is shared |
| Are passwords stored encrypted? | CSL Art. 21 | Plaintext password storage is prohibited |
| Is account deletion supported? | PIPL Art. 47 | A convenient account deletion channel must be provided |
| Check Item | Legal Basis | Description |
|---|---|---|
| Is consent obtained for marketing SMS/emails? | PIPL Art. 13, Advertising Law Art. 43 | Explicit user consent is required |
| Is an unsubscribe mechanism provided? | Advertising Law Art. 43 | Each marketing message must include an opt-out method |
| Does ad copy contain prohibited superlative terms? | Advertising Law Art. 9 | Absolute terms like "best," "number one," "national-level" are prohibited |
| Can profiling-based recommendations be disabled? | PIPL Art. 24 | An option for non-personalized content must be provided |
| Are advertisements clearly labeled as "Ad"? | Advertising Law Art. 14 | Mass media channels must clearly mark advertisements |
| Check Item | Legal Basis | Description |
|---|---|---|
| Does it meet the security assessment filing threshold? | Measures for Security Assessment of Data Export Art. 4 | Processing personal information of 1M+ individuals, or cumulative export of 100K individuals / 10K sensitive records |
| Has the standard contract been signed? | Standard Contract Measures for Personal Information Export | Can sign the standard contract if below the filing threshold |
| Has a Personal Information Protection Impact Assessment been completed? | PIPL Art. 55 | PIIA must be completed before data export |
| Has the user been informed and separate consent obtained? | PIPL Art. 39 | Must disclose overseas recipient information |
| Overseas recipient's data protection capability | PIPL Art. 38 | Must assess the recipient's data protection standards |
| Check Item | Legal Basis | Description |
|---|---|---|
| Is the automated decision-making logic disclosed? | PIPL Art. 24 | Must be transparent to users |
| Is an option to disable personalized recommendations provided? | PIPL Art. 24 | Users have the right to refuse |
| Has a PIIA been conducted for user profiling? | PIPL Art. 55 | Assessment is required when using personal information for automated decision-making |
| Do profiling tags involve sensitive information? | PIPL Art. 28 | Tags related to religion, health, finance, etc. are classified as sensitive information |
| Is the use scope of profiling results restricted? | PIPL Art. 24 | Must not impose unreasonable differential treatment in areas such as transaction pricing |
| Check Item | Legal Basis | Description |
|---|---|---|
| Has a lawful basis for processing been established? | GDPR Art. 6 | One of six bases: consent, contract, legal obligation, legitimate interest, etc. |
| Has a DPO been appointed? | GDPR Art. 37 | Required for large-scale processing or processing of special category data |
| Has a DPIA been completed? | GDPR Art. 35 | Required for high-risk processing activities |
| Is the right to data portability supported? | GDPR Art. 20 | Data must be provided in a structured, machine-readable format |
| Can data breaches be reported within 72 hours? | GDPR Art. 33 | Supervisory authority must be notified within 72 hours of discovering a breach |
| Is the cookie banner compliant? | GDPR + ePrivacy | Active consent required; pre-checked boxes are not permitted |
| Are records of processing activities maintained? | GDPR Art. 30 | Required for organizations with 250+ employees or non-occasional processing |
| Risk Level | Criteria | Potential Consequences |
|---|---|---|
| High | Violation of mandatory legal provisions; unlawful processing of sensitive personal information; lack of lawful basis; data export without assessment | Administrative penalties (fines), service shutdown, criminal liability |
| Medium | Compliance measures incomplete but foundational; insufficient notice; flawed consent mechanism; partial security measure gaps | Regulatory interview, ordered remediation within deadline, user complaints |
| Low | Best practices not met but not unlawful; incomplete documentation; processes can be optimized | Audit findings, internal improvements |
The Agent should ultimately deliver the following to the user:
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Creates an Agent Authority Charter for enterprise or regulated AI agents before deployment. Use this Skill when a user needs to define what an AI agent is allowed to do, who delegated authority to it, what actions are permitted or prohibited, when human approval is required, what evidence must be preserved, and how the agent can be suspended, revoked, or escalated.
日本語の概要は準備中です。原文の説明を表示しています。
EU AI Act Knowledge Engine — authoritative regulatory Q&A grounded in 70 official EU source documents (including the 2026 Commission draft guidelines on Art. 6 high-risk classification — general principles, Annex I, Annex III). Answers any question about the AI Act with article-level citations from the full regulation text, Commission guidelines, EDPB/EDPS opinions, codes of practice, harmonised standards, FRIA guides, incident templates, and sector-specific guidance. This skill should be used when the user asks about the "EU AI Act", "AI Act regulation", "Regulation 2024/1689", "KI-Verordnung", asks to "explain an AI Act article", "what does Article X say", "AI Act requirements", "AI Act penalties", "AI Act timeline", "GPAI obligations", "high-risk AI", "prohibited AI practices", "AI Act and GDPR", "fundamental rights impact assessment", "AI Act standards", "AI Act national implementation", "AI literacy", "serious incident reporting", "Digital Omnibus", "AI regulatory sandbox", or any question about EU artificial intelligence regulation. Also triggers on German terms: "KI-Gesetz", "KI-Verordnung", "Hochrisiko-KI", "KI-Kompetenz", "Grundrechte-Folgenabschaetzung", "GPAI-Verhaltenskodex". For assessment workflows that produce a classification decision rather than a knowledge answer, offer to run a structured risk-tier classification in-session.
日本語の概要は準備中です。原文の説明を表示しています。
This skill builds a structured audit trail of an AI-assisted task: what the tool was asked to do, what materials it was given, what it produced, how the output was verified, and what was ultimately relied upon. It documents the workflow for supervision and later review without ruling on privilege or disclosure, so the record stays accurate rather than self-serving.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when the user wants an AI governance, legal-risk, privacy, compliance, procurement, or vendor-risk review of an internal AI use case, an AI product feature, an LLM workflow, or a third-party AI vendor. The skill asks intake and clarifying questions first when facts or evidence are missing, identifies required documentation and missing evidence, maps the use case to AI governance frameworks and applicable legal domains, and produces a preliminary or final governance review with scorecards, findings, owners, remediation actions, and follow-up questions.
日本語の概要は準備中です。原文の説明を表示しています。
Turn an interpretive-ambiguity audit of a legal text — contract, statute, regulation, or judicial opinion — into a polished deliverable. Produces a multi-page website (default), a single-page interactive site, a Microsoft Word document, a PowerPoint deck, or a LaTeX/PDF. Use whenever a user has a stress-test result, ambiguity audit, or "where will this be litigated" scenarios and wants to publish, present, or share them. Triggers on "publish the audit," "make a report from this," "turn this into a website / deck / brief / Word doc," "make a Netlify site," "build slides of these ambiguities," "render the scenarios," "package this stress test," "produce a LaTeX version," and similar. Pairs with the ambiguity-stress-test skill (the underlying analysis) but works on any structured or semi-structured ambiguity analysis. Visual design is opinionated but the user can override colors, fonts, and brand label. Most formats need Python and a writable filesystem; single-file HTML works where the host has neither.
日本語の概要は準備中です。原文の説明を表示しています。
Adversarially stress-tests a legal text — a contract, statute, regulation, or judicial opinion — for interpretive ambiguity: it finds the seams where the people governed by it will later disagree about what it means and turns each into a concrete dispute scenario with both sides' arguments, the likely outcome, and a fix. Use it whenever someone wants to pressure-test, red-team, audit, or find weak spots, loopholes, gaps, ambiguities, or drafting problems in a legal document; whenever a drafter wants to tighten a contract, statute, regulation, or opinion before it issues; whenever a litigator wants to mine an opinion or contract for arguments; or whenever someone hands over a legal text and asks where it will be fought over or for issue-spotting. Trigger it for contract review, statutory-ambiguity analysis, judicial-opinion scope analysis, and drafting QA — even if the user never says "stress-test" or "ambiguity."
日本語の概要は準備中です。原文の説明を表示しています。