The Compliance Audit

Install It (No Terminal Needed)

The easiest way is to let Claude install it for you. Open a new chat, in Claude Code or on the web at claude.ai, and paste this in. Claude grabs the file straight off GitHub and drops it in the right place.

Once it's installed, run it in any repo by saying run compliance-audit.

Prefer to grab the file yourself? Copy or download it and drop it into your project's .claude/skills/compliance-audit/ folder, or ~/.claude/skills/ to use it on every project. It works on whatever you've built, Next.js, Rails, a static site, an API.

The Idea

Your vibe-coded product is probably illegal. Not on purpose, but if anyone in the EU can use it, GDPR applies to you, and since 2 August 2026 the EU AI Act does too. If you heard the AI Act was delayed, that was the high-risk tier, hiring and credit and medical. The duty to tell people they are talking to an AI was not delayed, and it applies to a side project.

The trouble is the gaps are invisible from the outside. You pasted in a privacy-policy template, wired up an AI API, dropped in analytics, and shipped. Nothing looks broken, but the policy doesn't match what you collect, there's no real way to delete an account, and nobody's been told the AI provider is reading every message.

So this skill asks you what you meant to build, reads what you actually built, and checks both against what the law requires. It comes back with a short, ranked list of what's wrong and what to do about it, then offers to fix it for you. It won't make you a lawyer. It'll get you most of the way there.

The Four Things Most Products Are Missing

These are the four the audit leads with, the ones nearly every vibe-coded product fails. It checks plenty more underneath (consent, cookies, retention, data transfers, security basics), but if you only fix these, you've closed most of your exposure.

1. 1

   A privacy policy that matches what you actually collect

   Not the template you pasted in

   It reads your forms, database schema and API routes to see what you really collect, then diffs that against your policy. A template that says name and email while you store phone numbers, uploads and chat history is a transparency failure.

2. 2

   A real way for users to delete their data

   "I'd do it manually" doesn't count

   The right to erasure means a user-triggered way to actually remove their data. The audit looks for a real deletion path in your code, a route, a setting, a handler. If there isn't one, that's a finding.

3. 3

   Whether you're telling users they're talking to an AI

   Since 2 August 2026, that's the law

   If you've got a chatbot or AI-generated content, the EU AI Act says you have to tell people. It detects your AI features, then checks whether the interface actually discloses them.

4. 4

   Whether you've named every third party that touches their data

   Your AI provider sees every message

   It lists every processor from your dependencies and API keys, AI, analytics, email, payments, hosting, and checks each one is named in your policy. Your AI provider processes every message your users send. They should know.

How It Works

1. 1Asks you ten questions first

   Who is behind it, who uses it, what people give you, which outside services it relies on, whether anyone reads users' data, how long you keep it. The code can't answer any of those, and a policy written without them is a template with the blanks guessed. "Don't know" is a fine answer.

2. 2Reads your repo, not a template

   Forms, API routes, dependencies, env vars, database schema, policy pages. It works out what your product actually does with personal data, and who it sends it to, from the code itself. Where your answers and the code disagree, it asks.

3. 3Checks both against GDPR and the EU AI Act

   What you collect versus what the law requires. Privacy notice, consent, deletion, cookies, third-party disclosure, AI transparency, data transfers, the gaps most vibe-coded products ship with.

4. 4Ranks what it finds

   Critical, medium, low, ordered by legal risk rather than by how easy it is to fix. Every finding names what's wrong, where in your code it is, the law behind it, and the fix.

5. 5Offers to fix it

   Say the word and it generates a privacy policy that matches your real data, scaffolds a delete-my-account flow, adds an AI-disclosure notice, or gates your cookies behind consent. Before it writes a policy it checks it has your legal name, contact and retention periods, so what it writes is yours.

Run It If

• You shipped a product and pasted in a privacy policy template.
• Anyone in the EU or UK can sign up, so GDPR already applies to you.
• You wired up an AI API and never added a notice that it's AI.
• You've got Google Analytics or a Meta Pixel firing with no consent banner.
• You genuinely don't know which third parties end up with your users' data.

One Honest Caveat

This is indicative guidance, not legal advice. It's an automated read of your code, not a lawyer, and it doesn't replace one for anything high-stakes. What it does is catch the obvious, expensive gaps fast, so the conversation you eventually have with a professional is a much shorter one.

Inspired by Flagged, a compliance scanner for UK and EU websites. This is the skill version, packaged to run inside Claude, right where you build.