Core
Identity, privacy, trackers, commercial flows, forms, third parties, accessibility, marketing, IP, security and AI use.
Magic / Legal Preflight
LEGAL PREFLIGHTFOR VIBE CODERS.
Before you ask an AI to “make the site compliant”, tell it what you are building, where it operates and whether it can affect someone's health, job, home, money or rights.
The model
LOAD ONLY WHAT APPLIES.
A restaurant website, a recruiting AI and a clinical decision-support product should not receive the same checklist. The preflight builds the applicable stack in four layers.
Jurisdiction
France, Germany, USA or multi-country triage. The tool loads the legal layer from where you are established and where you operate.
Sensitive use
Health, jobs, finance, insurance, housing, education, minors, biometrics, public services, justice or critical infrastructure.
AI decision role
Drafting is not ranking. Ranking is not an automatic decision. The tool asks how much the AI can actually affect a person.
Layer 02 · Where?
JURISDICTION PACKS.
“International compliance” is not one legal regime. The tool starts with establishment, customers and users, then combines only the relevant country layers.
LCEN · RGPD · CNIL · consumer
FRANCE
French website identity, privacy, tracking and consumer rules layered on top of EU law.
- Mentions légales and publisher / hosting information
- GDPR data map, lawful bases, retention and data-subject rights
- CNIL cookie / tracker consent and withdrawal mechanics
- B2C pre-contract information, withdrawal and consumer mediation where applicable
- Accessibility scope based on the actual service, not a simplistic company-size rule
DDG · DSGVO · TDDDG · BGB · BFSG
GERMANY
German digital-service, privacy, device-tracking, e-commerce and accessibility rules.
- Impressum / DDG §5 information duties
- DSGVO privacy information and processor / transfer mapping
- TDDDG §25 device storage and access
- BGB e-commerce flow, including the payment-button rule when relevant
- BFSG accessibility scope and microenterprise exemption for covered services
Federal baseline · state detector
UNITED STATES
A federal baseline plus state and local rules selected from the actual users, customers and use case.
- FTC privacy / advertising baseline and commercial-email rules
- State privacy-law threshold and rights analysis
- Accessibility and consumer-protection exposure
- Sector rules such as HIPAA, COPPA, FCRA, ECOA or medical-device regulation when triggered
- State / local automated-decision rules where the product makes high-consequence decisions
Jurisdiction triage
MULTI-COUNTRY
There is no single international checklist: determine establishment, target markets and regulated activities first.
- Country of establishment and contracting entity
- Where users and customers are located
- Cross-border transfers and processors
- Which country packs are actually triggered
- Conflicts, overlaps and specialist-review questions
Layer 03 · What can the product affect?
SENSITIVE USE-CASE PACKS.
The relevant question is often not your “industry”. It is what the software does: publishing health information is different from recommending treatment; listing apartments is different from ranking tenants.
Health data · clinical decisions
Health & medical
General health content, patient data and clinical decision support are three very different regulatory situations.
- Special-category / health-data handling
- HIPAA applicability in the US rather than assuming every health app is HIPAA-covered
- FTC Health Breach Notification Rule for applicable non-HIPAA health apps
- Medical-device / clinical-decision-support qualification
- Tracking technologies on health journeys
Candidates · workers · ranking
Jobs, HR & recruiting
CV screening, ranking, assessment and employee monitoring can become high-consequence decision systems.
- Recruitment / worker AI classification under the EU AI Act
- Discrimination and reasonable-accommodation risks
- Background-report / FCRA workflows in the US
- Notices, contestability and human oversight
- State / local automated-employment decision rules
Credit · affordability · investment
Finance & credit
Creditworthiness, lending and financial recommendations can trigger both sector regulation and explainability duties.
- EU AI Act high-risk creditworthiness analysis
- ECOA / Regulation B adverse-action explanations in the US
- FCRA and consumer-reporting dependencies
- Financial-services licensing / advice boundaries
- Payment, KYC / AML and security obligations where applicable
Underwriting · pricing · claims
Insurance
Life and health insurance risk assessment is explicitly sensitive under the EU AI Act and is heavily regulated elsewhere.
- EU AI Act classification for life / health risk assessment and pricing
- Health and special-category data
- Discrimination / proxy-feature analysis
- State insurance requirements in the US
- Human review and explanation paths
Tenant screening · eligibility
Housing & real estate
A property-listing site is not the same thing as software that scores applicants or recommends who gets a home.
- Tenant-screening and housing-discrimination rules
- Consumer-report / FCRA dependencies in the US
- Ad-targeting and protected-characteristic risks
- Ranking / scoring transparency and contestability
- Creditworthiness overlap for mortgage or affordability flows
Admissions · scoring · proctoring
Education
Admissions, exam scoring, placement and remote proctoring can create high-impact decisions and sensitive data flows.
- EU AI Act education high-risk analysis
- Student-record rules where applicable
- Accessibility and accommodation
- Remote-proctoring / biometric implications
- Appeal and human-review routes
Age · parental consent · design
Children & minors
Minor users change privacy, consent, advertising and product-design obligations.
- COPPA applicability in the US
- EU / national rules on children and consent
- Age-assurance and data-minimisation choices
- Profiling / advertising restrictions
- Parent / guardian rights where applicable
Face · voice · unique identification
Biometrics & identity
Face, voice, emotion and identity systems can trigger special-category data and specific AI / state-law restrictions.
- GDPR biometric special-category analysis when used for unique identification
- EU AI Act prohibited / restricted biometric or emotion-recognition uses
- State biometric laws in the US
- Retention, deletion and consent mechanics
- Vendor model-training and secondary-use controls
Eligibility · benefits · triage
Public services & benefits
Systems that influence access to public assistance, healthcare benefits or emergency services deserve specialist review.
- EU AI Act high-risk classification
- Fundamental-rights and impact-assessment questions
- Reason-giving and appeal
- Human oversight
- Public-sector procurement / transparency requirements
Rights · disputes · justice
Legal & justice
Tools influencing legal rights, courts, law enforcement or dispute outcomes require a much higher review threshold.
- EU AI Act classification where applicable
- Confidentiality / professional-secrecy questions
- Human oversight and contestability
- Evidence provenance and audit logs
- Jurisdiction-specific professional rules
Energy · water · transport · telecom
Critical infrastructure
Safety-relevant infrastructure can add cybersecurity, resilience and regulated-AI obligations.
- EU AI Act safety / high-risk analysis
- NIS2 or national cybersecurity scope where relevant
- Operational resilience and incident handling
- Supplier / processor security
- Human fallback and fail-safe behaviour
Layer 04 · Decision intensity
HIGH-CONSEQUENCE USE DETECTED.
If AI ranks people, recommends a consequential outcome or executes one automatically, the prompt stops treating compliance like a footer exercise. It asks who is affected, what evidence drives the decision, who can override it, how someone can contest it, and which specialist must review it.
Examples that trigger extra review
Who gets interviewed or hired
Who gets housing
Who receives credit or insurance
A diagnosis, treatment or clinical decision
Admission, grading or educational access
Public benefits, legal rights or emergency triage
What you will not get:
A fake “73% legally compliant” score. The output is an applicability matrix with evidence, uncertainties, engineering actions and explicit specialist-review flags.
Build the audit
TELL IT WHAT YOU BUILT.
Answer once here. The generated prompt carries your context into Claude Code, Codex, Cursor or another coding agent, tells it to inspect the repository and asks it to challenge your answers when the code says something different.
Magic Form / Legal Preflight
LEGAL PREFLIGHT FOR VIBE CODERS
Build a repository-audit prompt from jurisdiction, business model, data, AI decision intensity and sensitive use cases. The generated prompt tells the coding agent what to inspect, what not to assume and where specialist review is mandatory.
Generated prompt
The form composes your case-specific inputs with the reusable master prompt. Copy it into ChatGPT or another AI workflow.
Optional bonus · not legal compliance
AI & SEARCH DISCOVERABILITY.
Semantic HTML, metadata, sitemap, robots controls, structured data and an optionalllms.txt can help machines understand a site. The preflight labels these separately so an emerging discoverability convention never masquerades as a legal obligation.
LEGAL ≠ SEO ≠ AI DISCOVERABILITY
They can be audited in the same repository, but they answer different questions. Keeping the layers separate makes the final report much easier to trust.
Source discipline
CHECKED, DATED, LINKED.
Legal rules change. The prompt tells the coding agent to prefer legislation, regulators and government guidance, and to record what it checked rather than relying on an undated template.
Pack verification: 20 September 2026
Service Public EntreprendreFrench website legal noticesOfficial guidance on mandatory identification and hosting information for professional websites.CNILCookies and trackersFrench guidance on refusal, consent and tracker controls.French Ministry of EconomyConsumer mediationProfessional obligations to identify the competent consumer mediator.EUR-LexEU AI ActCurrent consolidated text used for high-risk / prohibited-use triage.European Data Protection BoardSpecial-category personal dataEU data-protection guidance; health and biometric use requires extra care.German federal lawImpressum / information dutiesDDG §5 general information duties.German federal lawDevice storage / accessTDDDG §25 consent and strict-necessity exceptions.German federal lawConsumer checkout buttonBGB §312j electronic-commerce duties for consumer payments.German federal lawAccessibilityBFSG accessibility requirement and microenterprise service exemption.U.S. HHSHIPAA applicabilityHIPAA applies to covered entities and business associates, not automatically to every health app.U.S. FTCHealth Breach Notification RuleBreach-notification rules for applicable health apps and related entities outside HIPAA.U.S. FDAClinical decision support softwareJanuary 2026 final guidance on non-device and device CDS software functions.U.S. FTCChildren's privacyCOPPA guidance, including the 2025 amended rule.U.S. FTCCommercial emailCAN-SPAM requirements for commercial email.U.S. EEOCAI and disability in employmentExamples of accommodation and algorithmic-screening issues.U.S. HUDTenant screeningFair Housing Act guidance for rental applicant screening, including complex models.U.S. CFPBAI credit adverse actionCreditors must still provide specific reasons when complex algorithms are used.California Attorney GeneralCalifornia Global Privacy ControlCovered businesses must honor applicable opt-out signals.
Credit & evolution
Starting point: 0xloucash's French “Legal — la checklist pour vibe coder sans amende”. This version restructures the idea into a reusable engine, separates legal compliance from AI discoverability, adds Germany / USA / multi-country triage and introduces sensitive-use and AI-decision layers.