Legal, IP & Compliance Risk Checklist for Discovery — Interactive Intake & Decision Guide

title": "Legal, IP & Compliance Risk Checklist — Discovery Intake", "introductionHtml": "

Purpose: Use this intake checklist to surface likely legal, IP, privacy, security and regulatory issues early in discovery, prototyping, and pilot work. The form captures key facts, highlights common risks, and suggests minimal next steps so teams can iterate without creating surprising legal or compliance stop-gaps.

How to use: Complete the fields below for a project or experiment. If you answer "yes" to certain risk flags or select "Unclear" for IP ownership, route the submission to legal, privacy, or compliance. This is not legal advice — it’s an early-warning and routing tool.

Quick decision guide: Green: Low-risk answers and no sensitive data — proceed with standard controls. Yellow: Some data sensitivity, third-party code, or unclear ownership — get a focused review. Red: Health/financial data, children, export controls, regulated devices, or contractual obligations — stop and engage counsel before scaling.

", "submitLabel": "Submit Intake", "successMessage": "Thank you. Your intake has been recorded and will be routed per your selections. If legal or compliance is requested, they will contact you with next steps.", "dataType": "LegalIPComplianceChecklistSubmission", "schemaVersion": "1.0", "fields": [ { "key": "projectName", "label": "Project or Experiment Name", "fieldType": "text", "required": true, "helpText": "Short name used for tracking and routing." }, { "key": "projectLead", "label": "Project Lead / Primary Contact", "fieldType": "text", "required": true }, { "key": "submitterEmail", "label": "Submitter Email", "fieldType": "text", "required": true, "helpText": "Used to follow up on routing and questions." }, { "key": "briefDescription", "label": "Brief Description of Project and Planned Activities", "fieldType": "textarea", "helpText": "Explain what you’re building, the main user interactions, and the planned scope of experiments or pilot." }, { "key": "stage", "label": "Current Stage", "fieldType": "select", "required": true, "options": [ {"value": "discovery","label": "Discovery / Research"}, {"value": "prototype","label": "Prototype / Lab"}, {"value": "pilot","label": "Pilot / Field Trial"}, {"value": "scale","label": "Preparing to Scale"} ], "helpText": "Choose the option that best describes where the work is now." }, { "key": "jurisdictions", "label": "Primary Jurisdictions / Markets", "fieldType": "text", "helpText": "Country or region list (e.g., US, EU, UK, CN). Regulatory triggers depend on location." }, { "key": "collectsUserData", "label": "Will this project collect user or customer data?", "fieldType": "yesno", "helpText": "Includes telemetry tied to individuals, registration details, surveys, device identifiers, etc." }, { "key": "dataTypes", "label": "Types of Data Collected (check all that apply)", "fieldType": "checkbox", "options": [ {"value": "pii","label": "Personal Identifiable Information (name, email)"}, {"value": "health","label": "Health / Medical Data"}, {"value": "financial","label": "Financial / Payment Data"}, {"value": "children","label": "Data about Children / Minors"}, {"value": "biometric","label": "Biometric Data"}, {"value": "location","label": "Location Data"}, {"value": "device","label": "Device / Telemetry IDs"}, {"value": "sensitive","label": "Other Sensitive Categories"}, {"value": "none","label": "None / Anonymous only"}, {"value": "other","label": "Other"} ], "helpText": "Selecting health, financial, children, biometric or sensitive flags typically raises the need for stronger review." }, { "key": "consentApproach", "label": "Planned Consent / Notices", "fieldType": "radio", "options": [ {"value": "explicit","label": "Explicit informed consent (opt-in)"}, {"value": "notice","label": "Notice with opt-out"}, {"value": "none","label": "No consent / not applicable"}, {"value": "unclear","label": "Unclear / TBD"} ], "helpText": "Note how you will inform users and collect permissions; unclear or no-consent situations require privacy review." }, { "key": "dataRetention", "label": "Planned Data Retention Period", "fieldType": "text", "helpText": "How long will data be kept? (e.g., 30 days, indefinite, until user request)." }, { "key": "transfersCrossBorder", "label": "Will data be transferred cross-border or stored in other regions?", "fieldType": "yesno" }, { "key": "deidentification", "label": "Is data de-identification or anonymization planned?", "fieldType": "yesno", "helpText": "De-identification reduces some privacy risk but does not eliminate all regulatory considerations." }, { "key": "securityControls", "label": "Planned Security Controls", "fieldType": "textarea", "helpText": "List measures such as encryption at rest/in transit, authentication, access controls, logging." }, { "key": "ip_components", "label": "IP and Code Components Involved (check all that apply)", "fieldType": "checkbox", "options": [ {"value": "internalCode","label": "Internal code / in-house prototypes"}, {"value": "partnerCode","label": "Partner or contractor code"}, {"value": "thirdPartyLibs","label": "Third-party libraries / SDKs"}, {"value": "openSource","label": "Open-source components"}, {"value": "modelsData","label": "ML models or training data"}, {"value": "designsBrand","label": "Designs, UI, branding"}, {"value": "tradeSecret","label": "Trade secrets / proprietary algorithms"}, {"value": "other","label": "Other"} ], "helpText": "Identify where IP complexity might appear. Partner code and open-source licensing often need review." }, { "key": "ipOwnershipClear", "label": "Is IP ownership and assignment clear for code, designs and models?", "fieldType": "radio", "options": [ {"value": "yes","label": "Yes — covered by agreements"}, {"value": "no","label": "No — unclear or disputed"}, {"value": "partial","label": "Partially — some components unclear"} ], "helpText": "Unclear ownership is a common source of late stops." }, { "key": "openSourceLicenses", "label": "Open-source licenses present", "fieldType": "checkbox", "options": [ {"value": "mit","label": "MIT"}, {"value": "apache2","label": "Apache 2.0"}, {"value": "gpl","label": "GPL"}, {"value": "bsd","label": "BSD"}, {"value": "proprietary","label": "Proprietary / vendor"}, {"value": "unknown","label": "Unknown"} ], "helpText": "Certain licenses (e.g., GPL) can affect how prototypes can be distributed." }, { "key": "vendorThirdParty", "label": "Does the project rely on vendors, partners or third-party services?", "fieldType": "yesno" }, { "key": "vendorRiskNotes", "label": "Vendor / Third-party Risk Notes", "fieldType": "textarea", "helpText": "List vendors, hosting providers, data processors, and any contractual constraints you know." }, { "key": "regulatoryDomains", "label": "Potential Regulatory Domains (check all that apply)", "fieldType": "checkbox", "options": [ {"value": "healthcare","label": "Healthcare / Medical (HIPAA, MDR)"}, {"value": "finance","label": "Finance / Payments / KYC"}, {"value": "education","label": "Education / Student Data"}, {"value": "telecom","label": "Telecommunications"}, {"value": "transport","label": "Transportation / Safety-critical"}, {"value": "energy","label": "Energy / Utilities"}, {"value": "consumer","label": "Consumer protection / product safety"}, {"value": "medicaldevice","label": "Medical device regulations"}, {"value": "other","label": "Other"} ], "helpText": "Selecting one of these typically increases compliance needs." }, { "key": "exportControls", "label": "Are export controls or trade restrictions likely relevant (e.g., encryption, defense, restricted tech)?", "fieldType": "yesno" }, { "key": "accessibility", "label": "Is accessibility (a11y) a requirement for this project?", "fieldType": "yesno", "helpText": "Public-facing products often require basic accessibility compliance." }, { "key": "consumerRisk", "label": "Are there consumer protection, safety or product liability risks?", "fieldType": "yesno" }, { "key": "estimatedTimeline", "label": "Planned timeline for pilot or public release", "fieldType": "text", "helpText": "Short timeline (e.g., 3 months, Q4)." }, { "key": "minimalDocs", "label": "Minimum recommended documentation to attach or prepare", "fieldType": "checkbox", "options": [ {"value": "projectBrief","label": "Project brief / scope"}, {"value": "dataMap","label": "Data map / flow diagram"}, {"value": "dpia","label": "DPIA / privacy impact assessment"}, {"value": "ipMemo","label": "IP ownership/assignment memo"}, {"value": "vendorList","label": "Vendor / subcontractor list"}, {"value": "consentTemplates","label": "Consent / notice templates"}, {"value": "other","label": "Other"} ], "helpText": "Collect these documents to speed review." }, { "key": "routeToLegal", "label": "Do you want this routed to Legal / Privacy / Compliance now?", "fieldType": "radio", "options": [ {"value": "no","label": "No — only record this intake"}, {"value": "yes_privacy","label": "Yes — Privacy review"}, {"value": "yes_ip","label": "Yes — IP / Ownership review"}, {"value": "yes_compliance","label": "Yes — Regulatory / Compliance review"} ], "helpText": "Selecting a review type helps route to the right owner and speeds response." }, { "key": "immediateRisks", "label": "Immediate or Showstopper Risks (describe briefly)", "fieldType": "textarea", "helpText": "Call out anything that would prevent the pilot from running (e.g., explicit contractual prohibition, regulated data, safety hazard)." }, { "key": "suggestedNextSteps", "label": "Suggested Next Steps (team's recommendation)", "fieldType": "textarea", "helpText": "Examples: proceed with controls, gather DPIA and consent, engage IP counsel, pause public trials." }, { "key": "submitterNotes", "label": "Additional notes or links (e.g., design docs, repo links)", "fieldType": "textarea" } ] }