02 — Legal Issues Checklist#

Identify legal, licensing, contractual, privacy, and regulatory questions early. This is an issue-spotting tool, not legal advice or a certification of compliance.

Scope: Shared / cross-cutting. This file is one part of the 02_LegalIssues.md checklist. Apply the domain-wide release gate across all applicable scope files; each checklist ID remains unique.

Review details#

Project / product:
Release / version / environment:
Scope and applicable jurisdictions / markets:
Reviewer / owner:
Review date:
Decision: Pending / Approved / Approved with documented exceptions / Blocked

How to use#

Copy this template into each project's review records; keep the shared repository template unchecked.
Check [x] only after verifying the item with evidence. For any inapplicable item, record N/A and the reason in the project's own review notes or issue tracker using its checklist ID; do not mark it as passed.
Record evidence links or artifact references by checklist ID. Open an issue for every failed item, assign an owner and due date, and retest after remediation.
Apply the release gate below. These checklists guide review; they do not replace qualified specialist review when required.

Scope, ownership, and jurisdiction#

LEG-001 The legal entity, product owner, operating countries, target audiences, and distribution channels are identified.
LEG-002 Applicable laws, regulators, age restrictions, and industry-specific obligations are mapped with qualified counsel where needed.
LEG-003 Responsibilities for legal approvals, recordkeeping, and periodic re-review are assigned.
LEG-004 Material legal assumptions, unresolved questions, and launch-blocking risks are documented.
LEG-035 Identify which entity is controller, processor, service provider, publisher, or platform for each data flow, as applicable.
LEG-036 Maintain a jurisdiction-specific compliance register with the responsible reviewer and review trigger.
LEG-037 Assess whether access for minors, accessibility obligations, or industry regulation changes the launch path.

Intellectual property and licensing#

LEG-005 Ownership or permission exists for source code, designs, branding, text, images, video, audio, and datasets.
LEG-006 Employee, contractor, and contributor agreements address IP ownership and confidentiality where needed.
LEG-007 Third-party and open-source licenses are inventoried, reviewed for compatibility, and notices/attributions are included.
LEG-008 Use of trademarks, trade names, domain names, and third-party branding is reviewed for rights and confusion risks.
LEG-009 Restrictions on datasets, scraping, APIs, and model outputs are checked against contracts and applicable law.
LEG-038 Verify SDK, API, database, font, icon, and frontend package licenses including distribution and notice obligations.

LEG-011 Personal data categories, purposes, sources, recipients, storage locations, and retention periods are documented.
LEG-012 A lawful basis or other applicable justification is identified for each processing purpose.
LEG-013 Privacy notices accurately explain processing, sharing, user rights, contact channels, and material changes.
LEG-014 Cookie, tracking, analytics, advertising, and marketing-consent mechanisms meet applicable rules.
LEG-015 Data subject or consumer rights requests can be received, authenticated, fulfilled, and logged within required periods.
LEG-016 Processors and service providers have appropriate data-processing agreements and contractual controls where required.
LEG-017 International transfers, local hosting requirements, and cross-border safeguards are reviewed where applicable.
LEG-018 Data minimization, retention, deletion, and breach reporting obligations are assessed and operationalized.
LEG-019 Handling of children's or other sensitive personal data is approved under the applicable rules.
LEG-040 Map client-side identifiers, local storage, analytics pixels, server logs, API request bodies, and third-party transfers.
LEG-041 Assess whether a data protection impact assessment or equivalent risk review is required for high-risk processing.
LEG-042 Test that deletion and correction requests propagate to downstream processors and caches, subject to justified exceptions.

User-facing terms and commercial obligations#

LEG-020 Terms of service, acceptable-use rules, and any required disclaimers are accurate, accessible, and versioned.
LEG-021 Pricing, subscriptions, renewals, trials, taxes, refunds, cancellations, and required disclosures are legally reviewed.
LEG-022 Marketing claims, testimonials, comparisons, endorsements, and performance statements are supported and not misleading.
LEG-023 Consumer protection, accessibility, anti-spam, and platform-specific rules are reviewed for the intended markets.
LEG-024 Customer and vendor contracts cover liability, service levels, support, termination, confidentiality, and audit rights as appropriate.
LEG-025 Required policies and contact details are published and reachable at launch.
LEG-044 Confirm price, availability, and performance claims originate from current, approved data.
LEG-045 Verify that accessible versions of required contractual and privacy documents can be reached before consent or purchase.

AI, content, and specialized risks (if applicable)#

LEG-029 Any regulated activity (for example health, finance, employment, education, or payments) receives specialist legal/compliance review.
LEG-030 Accessibility or consumer-facing statements do not promise compliance beyond what has been verified.
LEG-046 Evaluate automated decision-making and profiling transparency or review rights under relevant local law.
LEG-048 Require review of any claim implying government, regulator, or professional endorsement.

Approvals and ongoing governance#

LEG-031 Required licenses, registrations, filings, permits, and notices are in place before operating.
LEG-032 Regulatory, litigation, complaint, and contract escalation contacts are documented.
LEG-033 Legal review is completed for material product, data-flow, geographic, and vendor changes.
LEG-034 Open legal issues have owners, counsel input where appropriate, and approved remediation plans.
LEG-049 Record accountable legal owners for new APIs, vendors, cookies, marketing channels, countries, and AI features.

Release gate#

All applicable high-priority checks above pass, or an authorized decision-maker has explicitly accepted and documented each residual risk.
Failed items have tracked remediation, owners, and deadlines; material blockers remain blocked until resolved.
Evidence links and the reviewer, review date, and final decision are recorded.

Domain-specific approval rule: Block release for missing mandatory licenses, unlawful personal-data practices, unlicensed critical assets, or unresolved material regulatory obligations. Require qualified legal sign-off when appropriate.

Trusted references and scope#

The checks above are adapted into practical verification questions from these authoritative publications (not copied as standards text). Verify current versions and the project's scope before sign-off.

These examples are issue-spotting checks. EU and UK sources do not automatically govern other markets; determine actual applicability and seek local legal counsel. Cookie and consumer-protection obligations can vary and guidance changes.

Source review date: 2026-11-12.

Suggested testing tools#

Choose tools appropriate to the project's stack and risks; automation supports evidence but does not approve the checklist.

Test focus: consent, retention, access, export, deletion, and policy-enforcement behavior (legal interpretation remains manual); include shared/cross-team controls where applicable.
Cross-stack: Playwright + Open Policy Agent.
Python: pytest; for pytest-based suites, run python -m pytest -q.
TypeScript: Playwright + Vitest; for Vitest-based suites, run npx vitest run (or npx playwright test for E2E).
JavaScript: Playwright + Jest; for Jest-based suites, run npx jest --ci (or npx playwright test for E2E).
Evidence: Save tool versions, configuration, test environment, fixtures, results, and links in project-specific review records using the existing checklist IDs. Expert review remains necessary where relevant.

Suggested AI skills for verification#

These are optional agent review aids, not automated passes or release approval. Each linked repository had at least 1,000 GitHub stars when checked on 2026-11-12; counts are per repository, not per skill, and do not indicate security or correctness.

gdpr-data-handling — Review GDPR-related data flows when applicable (wshobson/agents, 42,437 repo stars).
audit-integrity — Inspect integrity of audit trails and approvals (github/awesome-copilot, 41,073 repo stars).
spec-to-code-compliance — Compare documented privacy/security rules with implementation (trailofbits/skills, 8,150 repo stars).

How to check: In a project-specific copy, have the agent audit the shared / cross-cutting scope and map findings to this file's existing checklist IDs, with code/configuration references, reproducible test results, failed or inapplicable cases, and uncertainties. Independently verify findings; keep shared template boxes unchecked and retain human approval requirements.

Before use: Read the skill's SKILL.md, referenced scripts, license, and requested tool permissions. Only execute vetted skills with appropriate access in a controlled environment.

Important warning: reference only#

⚠️ Reference only — not a definitive or exhaustive checklist. This template is a starting point for review, not the ultimate authority or a guarantee of project safety, quality, regulatory compliance, accessibility, security, or launch readiness.

Use project-specific judgment and independent verification. Requirements and risks evolve and differ by project, technology, and jurisdiction. Adapt the checks, consult current authoritative sources, perform relevant tests, and obtain qualified specialist review or approval when appropriate. Checking every box does not replace these steps.