{"id":"1860b81e-e543-4c98-aa9a-f2be81c2bc26","entityType":"agent","slug":"clawhub-skills-1kalin-afrexai-regulatory-compliance","name":"afrexai-regulatory-compliance","canonicalUrl":"https://www.xpersona.co/agent/clawhub-skills-1kalin-afrexai-regulatory-compliance","canonicalPath":"/agent/clawhub-skills-1kalin-afrexai-regulatory-compliance","generatedAt":"2026-10-10T07:29:05.629Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"description":"Regulatory Compliance Audit Regulatory Compliance Audit Run a full regulatory compliance audit for any business. Covers US, UK, and EU frameworks across 8 compliance domains with gap analysis, risk scoring, and remediation timelines. When to Use - Annual or quarterly compliance reviews - Pre-audit preparation (SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS) - New market entry requiring regulatory assessment - Board or investor due diligence on complian","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. Last updated 4/15/2026.","installCommand":"clawhub skill install skills:1kalin:afrexai-regulatory-compliance","sourceUrl":"https://github.com/openclaw/skills/tree/main/skills/1kalin/afrexai-regulatory-compliance","homepage":null,"primaryLinks":[{"label":"View on ClawHub","url":"https://github.com/openclaw/skills/tree/main/skills/1kalin/afrexai-regulatory-compliance","kind":"source"}],"safetyScore":84,"overallRank":62,"popularityScore":50,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Regulatory Compliance Audit Regulatory Compliance Audit Run a full regulatory compliance audit for any business. Covers US, UK, and EU frameworks across 8 compl"},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[{"label":"frequency","status":"self-declared"},{"label":"be","status":"self-declared"}],"verifiedCount":0,"selfDeclaredCount":3,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"},{"key":"frequency","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"},{"key":"be","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile capability:frequency|supported|profile capability:be|supported|profile"}},"adoption":{"evidence":{"source":"no-adoption-signals","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"No source adoption metrics were available."},"stars":null,"forks":null,"downloads":null,"packageName":null,"latestVersion":null,"tractionLabel":null},"release":{"evidence":{"source":"agent-index","verified":false,"confidence":"medium","updatedAt":"2026-02-25T06:18:01.034Z","emptyReason":null},"lastUpdatedAt":"2026-04-15T00:45:39.800Z","lastCrawledAt":"2026-02-25T06:18:01.034Z","lastIndexedAt":null,"nextCrawlAt":"2026-02-26T06:18:01.034Z","lastVerifiedAt":null,"highlights":[]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install skills:1kalin:afrexai-regulatory-compliance","setupComplexity":"low","setupSteps":["Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-regulatory-compliance/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-regulatory-compliance/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-regulatory-compliance/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-regulatory-compliance/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-regulatory-compliance/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-regulatory-compliance/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-10T07:29:05.629Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-regulatory-compliance/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-regulatory-compliance/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-regulatory-compliance/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-1kalin-afrexai-regulatory-compliance/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"high","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"readme":"# Regulatory Compliance Audit\n\nRun a full regulatory compliance audit for any business. Covers US, UK, and EU frameworks across 8 compliance domains with gap analysis, risk scoring, and remediation timelines.\n\n## When to Use\n- Annual or quarterly compliance reviews\n- Pre-audit preparation (SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS)\n- New market entry requiring regulatory assessment\n- Board or investor due diligence on compliance posture\n- Post-incident compliance gap analysis\n\n## How It Works\n\n### Step 1: Identify Applicable Frameworks\nBased on the business profile (industry, geography, data types, revenue), determine which frameworks apply:\n\n| Framework | Triggers |\n|-----------|----------|\n| SOC 2 Type II | B2B SaaS, handles customer data |\n| GDPR | Any EU customer data, EU employees |\n| HIPAA | Any PHI (healthcare, benefits, wellness) |\n| PCI DSS | Processes, stores, or transmits card data |\n| ISO 27001 | Enterprise clients requesting certification |\n| SOX | Public company or preparing for IPO |\n| CCPA/CPRA | >$25M revenue OR >50K CA consumers |\n| NIST AI RMF | Deploying AI/ML in production |\n| UK DPA 2018 | UK operations or UK customer data |\n| FCA/PRA | UK financial services |\n\n### Step 2: 8-Domain Compliance Assessment\n\nScore each domain 1-5 (1=non-existent, 5=mature):\n\n**Domain 1: Data Governance**\n- [ ] Data classification policy (public/internal/confidential/restricted)\n- [ ] Data retention schedule with legal hold procedures\n- [ ] Data processing agreements with all vendors\n- [ ] Cross-border transfer mechanisms (SCCs, adequacy decisions)\n- [ ] Data subject rights workflow (access, deletion, portability)\n- [ ] Data breach notification procedure (<72hr GDPR, state-specific US)\n\n**Domain 2: Access Control & Identity**\n- [ ] Role-based access control (RBAC) implemented\n- [ ] Multi-factor authentication on all critical systems\n- [ ] Privileged access management (PAM) for admin accounts\n- [ ] Quarterly access reviews with evidence retention\n- [ ] Automated provisioning/deprovisioning tied to HR\n- [ ] Service account inventory with rotation schedule\n\n**Domain 3: Security Operations**\n- [ ] Vulnerability management program (scan frequency, SLA by severity)\n- [ ] Penetration testing (annual minimum, after major changes)\n- [ ] Security incident response plan (tested within 12 months)\n- [ ] Log retention meeting regulatory minimums (1yr SOC 2, 6yr SOX)\n- [ ] Endpoint detection and response (EDR) on all endpoints\n- [ ] Network segmentation between environments\n\n**Domain 4: Business Continuity**\n- [ ] Business impact analysis (BIA) current within 12 months\n- [ ] Disaster recovery plan with defined RTO/RPO by system tier\n- [ ] Backup testing (restore verified quarterly minimum)\n- [ ] Pandemic/remote work continuity procedures\n- [ ] Third-party dependency mapping for critical services\n- [ ] Communication plan (internal + external + regulatory)\n\n**Domain 5: Vendor & Third-Party Risk**\n- [ ] Vendor risk assessment questionnaire (SIG Lite or equivalent)\n- [ ] Tiered vendor classification (critical/high/medium/low)\n- [ ] Annual vendor reviews for critical and high-tier vendors\n- [ ] Right-to-audit clauses in critical vendor contracts\n- [ ] Fourth-party risk assessment for critical vendors\n- [ ] Vendor offboarding procedure with data return/destruction\n\n**Domain 6: HR & Personnel Security**\n- [ ] Background check policy (scope appropriate to role)\n- [ ] Security awareness training (annual + phishing simulations)\n- [ ] Acceptable use policy signed by all employees\n- [ ] Code of conduct with reporting mechanisms\n- [ ] Termination checklist (access removal, device collection, NDA reminder)\n- [ ] Contractor/temp worker security requirements\n\n**Domain 7: AI & Automation Governance**\n- [ ] AI model inventory with risk classification\n- [ ] Bias testing and fairness metrics for decision-making models\n- [ ] Human-in-the-loop requirements defined per use case\n- [ ] AI incident response procedures\n- [ ] Transparency documentation (model cards, impact assessments)\n- [ ] Training data governance and lineage tracking\n\n**Domain 8: Financial & Reporting Controls**\n- [ ] Segregation of duties in financial processes\n- [ ] Change management procedures for financial systems\n- [ ] Audit trail for all financial transactions\n- [ ] Revenue recognition controls (ASC 606 / IFRS 15)\n- [ ] Tax compliance calendar (federal, state, international)\n- [ ] Internal audit schedule and findings tracking\n\n### Step 3: Risk Scoring Matrix\n\nFor each gap identified:\n\n| Likelihood | Impact | Risk Score | Action Timeline |\n|-----------|--------|------------|-----------------|\n| High | High | Critical | Fix within 30 days |\n| High | Medium | High | Fix within 60 days |\n| Medium | High | High | Fix within 60 days |\n| Medium | Medium | Medium | Fix within 90 days |\n| Low | High | Medium | Fix within 90 days |\n| Low | Medium | Low | Next quarterly review |\n| Low | Low | Informational | Annual review |\n\n### Step 4: Remediation Roadmap\n\nBuild a 90-day plan:\n\n**Days 1-30: Critical Gaps**\n- Address any gaps with Critical or High risk scores\n- Implement quick wins (policy updates, access reviews)\n- Engage external counsel for regulatory interpretation if needed\n\n**Days 31-60: Systematic Improvements**\n- Deploy technical controls (MFA, EDR, log aggregation)\n- Complete vendor risk assessments for critical vendors\n- Update employee training program\n\n**Days 61-90: Evidence & Documentation**\n- Build evidence collection system for ongoing compliance\n- Conduct internal audit of remediated areas\n- Prepare board-ready compliance dashboard\n\n### Step 5: Compliance Cost Benchmarks (2026)\n\n| Company Size | Annual Compliance Budget | Key Cost Drivers |\n|-------------|------------------------|-----------------|\n| 10-50 employees | $30K-$80K | SOC 2 audit ($15-30K), tools ($10-20K), training ($5-10K) |\n| 50-200 employees | $80K-$250K | + DPO/compliance hire ($80-120K), pen testing ($15-40K) |\n| 200-1000 employees | $250K-$800K | + GRC platform ($50-150K), multiple audits, legal counsel |\n| 1000+ employees | $800K-$3M+ | + Dedicated compliance team, continuous monitoring, regulatory filings |\n\n**Cost of non-compliance (real examples):**\n- GDPR fines: up to 4% global annual revenue (Meta: €1.2B, 2023)\n- HIPAA: $100-$50K per violation, $1.5M annual cap per category\n- PCI DSS: $5K-$100K/month until compliant + liability for breaches\n- SOX: Criminal penalties, officer personal liability\n- Average data breach cost: $4.88M (IBM 2024)\n\n### Step 6: Output Format\n\nGenerate a compliance report with:\n1. **Executive Summary** — Overall maturity score (1-5), top 3 risks, recommended budget\n2. **Framework Applicability Matrix** — Which frameworks apply and current certification status\n3. **Domain Scores** — 8 domains with gap counts and risk distribution\n4. **Critical Findings** — Top 10 gaps ranked by risk score with remediation steps\n5. **90-Day Roadmap** — Week-by-week action plan with owners and milestones\n6. **Budget Estimate** — Compliance cost projection for next 12 months\n7. **Board Dashboard** — One-page visual for board/investor reporting\n\n## Industry-Specific Requirements\n\n| Industry | Primary Frameworks | Special Considerations |\n|----------|-------------------|----------------------|\n| **SaaS/Technology** | SOC 2, GDPR, CCPA | AI governance, open source licensing |\n| **Healthcare** | HIPAA, HITRUST, FDA (if devices) | PHI everywhere, BAAs required |\n| **Financial Services** | SOX, PCI DSS, GLBA, FCA/PRA | Transaction monitoring, AML/KYC |\n| **Legal** | ABA ethics, GDPR, privilege rules | Client confidentiality, conflict checks |\n| **Construction** | OSHA, environmental, bonding | Safety records, subcontractor compliance |\n| **E-commerce** | PCI DSS, CCPA/GDPR, FTC | Payment data, consumer protection, returns |\n| **Manufacturing** | ISO 9001, OSHA, EPA, export controls | Supply chain compliance, ITAR/EAR |\n| **Real Estate** | Fair Housing, AML, state licensing | Property data, transaction compliance |\n| **Recruitment** | EEOC, GDPR (candidate data), ban-the-box | AI hiring bias (NYC Local 144), background checks |\n| **Professional Services** | Industry-specific licensing, SOC 2 | Client data handling, engagement letters |\n\n## 7 Compliance Audit Mistakes That Cost Companies Millions\n\n1. **Treating compliance as annual** — It's continuous. Point-in-time audits miss 60% of gaps that develop mid-year.\n2. **Ignoring AI governance** — NIST AI RMF and EU AI Act are here. Every production model needs documentation.\n3. **Vendor risk as checkbox** — Your vendor's breach is your breach. Fourth-party risk is real.\n4. **No evidence retention system** — If you can't prove compliance, you're not compliant. Automate evidence collection.\n5. **Security ≠ compliance** — You can be secure and non-compliant, or compliant and insecure. Address both.\n6. **Underbudgeting remediation** — Plan for 2x the estimated remediation cost. Surprises are the norm.\n7. **Board reporting as afterthought** — Boards that see compliance dashboards quarterly make better risk decisions.\n\n---\n\nGet the full compliance implementation toolkit for your industry:\n- **Browse all 10 industry context packs** → https://afrexai-cto.github.io/context-packs/\n- **Calculate your AI automation ROI** → https://afrexai-cto.github.io/ai-revenue-calculator/\n- **Set up your AI agent stack** → https://afrexai-cto.github.io/agent-setup/\n\nBundles: Playbook $27 | Pick 3 $97 | All 10 $197 | Everything $247\n","readmeExcerpt":"Regulatory Compliance Audit Run a full regulatory compliance audit for any business. Covers US, UK, and EU frameworks across 8 compliance domains with gap analysis, risk scoring, and remediation timelines. When to Use - Annual or quarterly compliance reviews - Pre-audit preparation (SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS) - New market entry requiring regulatory assessment - Board or investor due diligence on complian","codeSnippets":[],"executableExamples":[],"parameters":{},"dependencies":[],"permissions":[],"extractedFiles":[],"languages":["typescript"],"docsSourceLabel":"CLAWHUB","editorialOverview":"Regulatory Compliance Audit Regulatory Compliance Audit Run a full regulatory compliance audit for any business. Covers US, UK, and EU frameworks across 8 compliance domains with gap analysis, risk scoring, and remediation timelines. When to Use - Annual or quarterly compliance reviews - Pre-audit preparation (SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS) - New market entry requiring regulatory assessment - Board or investor due diligence on complian","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":374,"uniquenessScore":67,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-10T07:29:05.629Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}