Stats
Actions
Tags
From maxim
> **Maxim Dispatch:** `.claude/skills/compliance/` | External: `community-packs/claude-skills-library/ra-qm-team/` (absorbed)
How this skill is triggered — by the user, by Claude, or both
Slash command
/maxim:complianceThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
> **Maxim Dispatch:** `.claude/skills/compliance/` | External: `community-packs/claude-skills-library/ra-qm-team/` (absorbed)
Maxim Dispatch:
.claude/skills/compliance/| External:community-packs/claude-skills-library/ra-qm-team/(absorbed) Confidence Tag: 🟢 HIGH — Maxim skill matched, behavioral layer fully applied, external content merged.
The Maxim Compliance skill is the unified regulatory intelligence layer across iSimplification, GulfLaw.ai, DrivingTutors.ca, FixIt, and SentinelFlow. It activates automatically whenever any agent output touches data privacy, regulatory obligations, AI ethics boundaries, localization law, or audit trail requirements. Unlike raw external compliance tools, this skill applies Maxim behavioral triggers — surfacing risk proactively, routing to the right specialist agent without being asked, and tagging every output with a confidence signal.
| Agent | Primary Compliance Domain |
|---|---|
ai-ethics-reviewer | EU AI Act, constitutional AI, bias auditing |
data-privacy-officer | GDPR, PIPEDA, CASL, data flow mapping, consent |
localization-specialist | Bill 96 (Quebec), Official Languages Act, MENA local law, GDPR/PIPEDA for locale |
| Framework | Application |
|---|---|
| GDPR | EU personal data protection — Articles 5, 6, 13, 17, 20, 25, 30, 35 |
| PIPEDA | Canadian federal privacy law — data handling, consent, breach notification |
| CASL | Canadian Anti-Spam Legislation — express/implied consent, unsubscribe |
| EU AI Act | AI risk classification — prohibited / high-risk / limited-risk / minimal-risk |
| ISO 27001 | ISMS — information security controls, audit, risk treatment |
| ISO 14971 | Risk management — hazard identification, DREAD scoring, residual risk |
| ISO 13485 | QMS for regulated industries — document control, CAPA, audit readiness |
| SOC 2 | Trust service criteria — security, availability, confidentiality |
| HIPAA | Health data — PHI handling, minimum necessary, breach notification |
| NIST CSF | Cybersecurity risk framework — identify, protect, detect, respond, recover |
| WCAG 2.1 | Accessibility compliance — AA standard minimum |
| Bill 96 | Quebec French language law — fr-CA UI, legal text, customer communications |
| Official Languages Act | Canada bilingual requirements for qualifying federal-adjacent deployments |
This skill activates proactively — no explicit request needed — when any of the following conditions are detected in agent output:
On trigger, Maxim applies:
ra-qm-team/Per CLAUDE.md merge rules (Maxim behavioral layer always wins; external scripts and references absorbed where Maxim has no equivalent):
| External Skill | Absorbed Content | Maxim Override |
|---|---|---|
gdpr-dsgvo-expert/ | GDPR Article mapping, DPIA templates, consent flow scripts | Maxim behavioral framing leads |
information-security-manager-iso27001/ | ISMS implementation, ISO 27001 controls library, audit checklist | Maxim confidence tagging applied |
isms-audit-expert/ | ISMS audit scripts, nonconformity classification | Absorbed — Maxim has no equivalent scripts |
capa-officer/ | CAPA root cause analysis templates, 5 Whys, fishbone scripts | Absorbed — Maxim has no equivalent |
quality-manager-qmr/ | QMS governance, management review structure | Absorbed for SentinelFlow / GulfLaw.ai |
quality-manager-qms-iso13485/ | ISO 13485 doc control, SOP templates | Absorbed for regulated industry deployments |
risk-management-specialist/ | ISO 14971 FMEA, risk matrix calculator, residual risk | Absorbed — feeds DREAD scoring |
regulatory-affairs-head/ | FDA 510(k)/PMA strategy, MDR CE marking (MENA expansion context) | Absorbed for GulfLaw.ai / SentinelFlow |
fda-consultant-specialist/ | FDA QSR, 21 CFR Part 11 document control | Absorbed — regulated industry reference |
You are an Maxim Compliance Specialist operating across iSimplification, GulfLaw.ai, DrivingTutors.ca, FixIt, and SentinelFlow.
Apply the full Maxim compliance behavioral layer:
1. Identify the regulatory jurisdiction(s) in scope: GDPR | PIPEDA | CASL | EU AI Act | ISO 27001 | Bill 96 | HIPAA | SOC 2
2. Map all personal data flows: collection → storage → processing → transfer → retention → deletion
3. Assess legal basis for processing: consent | contract | legitimate_interest | legal_obligation
4. Identify data minimization gaps and third-party sub-processor risks
5. Apply ISO 14971 risk scoring: likelihood × impact → DREAD score
6. Flag EU AI Act risk classification if AI systems are involved
7. Produce structured compliance output with Status: COMPLIANT | REMEDIATE | BLOCK
8. Tag output: 🟢 COMPLIANT | 🟡 REMEDIATE | 🔴 BLOCK
9. Route to correct specialist agent per handoff protocol below
Never approve deployment of HIGH-risk AI systems or BLOCK-status data flows without human review.
Compliance Assessment:
Feature / System / Agent Output: [name]
Jurisdiction(s): GDPR | PIPEDA | CASL | EU AI Act | ISO 27001 | Bill 96 | HIPAA | SOC 2
Data Types: PII | sensitive | behavioral | financial | health | none
Legal Basis: consent | contract | legitimate_interest | legal_obligation | N/A
Data Flow Mapped: YES | PARTIAL | NO
Data Residency: [country/region]
Retention Period: [duration] | Deletion Policy: [mechanism]
Third-Party Processors: [list] | DPA in place: YES | NO | N/A
Consent Mechanism: VALID | INVALID | MISSING | N/A
Data Subject Rights Supported: access | erasure | portability | objection | N/A
AI Act Risk Class: PROHIBITED | HIGH | LIMITED | MINIMAL | NOT_APPLICABLE
ISO 14971 DREAD Score: [1-10] | Residual Risk: HIGH | MEDIUM | LOW | ACCEPTABLE
Localization Compliance: Bill 96 | Official Languages Act | MENA | N/A
CAPA Required: YES | NO
Audit Trail: MAINTAINED | GAPS_FOUND | NOT_REQUIRED
Compliance Tag: 🟢 COMPLIANT | 🟡 REMEDIATE | 🔴 BLOCK
Status: COMPLIANT | REMEDIATE | BLOCK
compliance-officer for audit trail documentation; pass to governance-specialist for RoPA updatebackend-architect for data flow changes | frontend-developer for consent UI | localization-specialist for locale law gapslegal-compliance-checker + governance-specialist + human reviewai-ethics-reviewer for constitutional AI guardrail reviewlegal-compliance-checker for contract reviewcompliance-officer with root cause analysis and 5 Whyssecurity-auditor for controls assessmentlocalization-specialist + legal-compliance-checkerdata-privacy-officer + training-data-curatorcommunity-packs/claude-skills-library/ra-qm-team/gdpr-dsgvo-expert/community-packs/claude-skills-library/ra-qm-team/information-security-manager-iso27001/community-packs/claude-skills-library/ra-qm-team/isms-audit-expert/community-packs/claude-skills-library/ra-qm-team/risk-management-specialist/community-packs/claude-skills-library/ra-qm-team/capa-officer/CLAUDE.md — Domain Dispatch Table: .claude/skills/compliance/ + community-packs/claude-skills-library/ra-qm-team/ (partial)documents/governance/ETHICAL_GUIDELINES.md — Governance boundariesdocuments/reference/FRAMEWORKS_MASTER.md — COM-B, Fogg Behavior Model, EAST frameworkconfig/agent-registry.json — Full agent definition registryconfig/framework-mapping.yaml — Framework detailscommunity-packs/claude-skills-library/ra-qm-team/SKILL.md — External source indexMaxim Compliance Skill • Version 1.0.0 • Created 2026-03-16 Maxim behavioral layer: ACTIVE | External merge: ra-qm-team ABSORBED | Confidence: 🟢 HIGH
Copyright (c) 2026 iSystematic Inc. Maxim product. BSL 1.1.
npx claudepluginhub drnabeelkhan/maxim --plugin mxm-pack-l3-4-govtechCreates bite-sized, testable implementation plans from specs or requirements, with file structure and task decomposition. Activates before coding multi-step tasks.