Geason Law Offices
AI Product Launch Compliance Checklist
Five documents, thirty-two checkpoints. For a first launch or a rebuild of an existing document set.
I. Personal Information Protection Impact Assessment
| # | Checkpoint | Standard |
|---|
| 1 | Trigger test | Sensitive information, automated decision-making, processing on instruction or disclosure, and cross-border transfer each addressed |
| 2 | Processing description | Systems, data flows, categories and volumes included |
| 3 | Lawful basis | One basis per purpose, with the consent mechanism stated |
| 4 | Necessity | Purpose specified, scope minimised, retention justified |
| 5 | Impact on rights | Affected groups and concrete consequences identified |
| 6 | Safeguards | Field-level measures, not general statements |
| 7 | Conclusion and remediation | Conclusion stated; remediation has owners and deadlines |
| 8 | Retention | Report and processing records kept for at least three years |
II. Privacy Policy
| # | Checkpoint | Standard |
|---|
| 9 | Controller identity | Operator and processors each identified |
| 10 | Purposes | Split into service, security, improvement and legal obligations |
| 11 | Categories | "User inputs" listed as its own category |
| 12 | Training use | Whether used, how de-identified, and whether users can opt out |
| 13 | Third-party sharing | Listed by category, with agreement and policy links |
| 14 | Automated decisions | Logic explained; appeal and human review available |
| 15 | Separate consent | Implemented separately for sensitive information, disclosure and cross-border transfer |
| 16 | Rights | An entry point for each of the seven rights |
III. User Agreement
| # | Checkpoint | Standard |
|---|
| 17 | Service description | Capabilities and excluded scenarios both stated |
| 18 | Variation clause | Material changes distinguished, with notice and termination rights |
| 19 | Content ownership | Consumer and business terms separated; training use addressed on its own |
| 20 | Input warranties | IP, personal information and confidentiality warranties given |
| 21 | Liability limits | Personal injury and wilful misconduct not excluded; limits highlighted |
| 22 | Termination | Triggers, notice, appeal and data export window all present |
| 23 | Dispute resolution | Governing law, jurisdiction and service of process specified |
| 24 | Version archive | Prior versions, effective dates and change summaries traceable |
IV. Filing Materials
| # | Checkpoint | Standard |
|---|
| 25 | Route selection | Algorithm filing, LLM filing or registration chosen and documented |
| 26 | Service description | Matches the version actually live |
| 27 | Security self-assessment | Consistent with PIA facts; no contradictory statements |
| 28 | Change filings | Changes to filed particulars already processed |
V. Content Labelling Scheme
| # | Checkpoint | Standard |
|---|
| 29 | Interface label | Generated content labelled in a prominent position |
| 30 | Metadata label | Metadata or implicit label readable by downstream systems |
| 31 | User terms | Duty to preserve labels and not remove or alter them written into the agreement |
| 32 | Cross-check | Facts consistent across the four texts, with a review record |
How to use this list
- Before ticking an item, confirm there is evidence that can be produced, not merely that the point was once written down.
- Items 2, 3, 12, 19 and 27 are the points regulators most often cross-check; review them first.
- When a new purpose, a new model provider, a new module or a change of labelling arises, update the documents under the trigger rules and keep the version.
This checklist is a general framework and does not constitute legal advice on any specific product. Where sensitive personal information, minors or cross-border transfer are involved, the assessment should be made against the actual processing activities.