> A phased implementation plan for Acme Inc. Go from zero to fully compliant in 8 weeks. Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Generated on 2026-03-19 | 8 services detected

## Overview

This roadmap breaks compliance implementation into four phases, prioritized by legal risk and regulatory deadlines. Each phase builds on the previous one.

Phase | Timeline | Focus | Priority
--- | --- | --- | ---
Phase 1 | Week 1 | Essential Legal Documents | Critical
Phase 2 | Weeks 2-4 | Security & Incident Response | High
Phase 3 | Month 2 | Advanced Compliance & Audit | Medium
Phase 4 | Ongoing | Monitoring, Updates & Reviews | Continuous

## Phase 1: Essential Documents (Week 1)

> Goal: Get the minimum viable legal documents published on your website.

These documents carry the highest legal risk if missing. Without them, you are exposed to regulatory fines and user complaints.

### Week 1, Days 1-2: Privacy & Terms

- Review and publish Privacy Policy (`PRIVACY_POLICY.md`)
- Replace all placeholder values (`[Your Company Name]`, `[your-email@example.com]`)
- Verify all 8 detected services are correctly listed
- Add to website footer
- GDPR Art. 13 requires this to be accessible before data collection

- Review and publish Terms of Service (`TERMSOFSERVICE.md`)
- Customize limitation of liability amounts
- Review arbitration clause (modify for your jurisdiction)
- Add to website footer alongside Privacy Policy

### Week 1, Day 3: Cookie Compliance

- Publish Cookie Policy (`COOKIE_POLICY.md`)
- Verify all detected cookies are listed
- Cross-reference with `COOKIE_INVENTORY.md`
- ePrivacy Directive requires consent before non-essential cookies

- Deploy cookie consent banner
- Import `COOKIECONSENTCONFIG.json` into your CMP
- Test consent flow: banner appears, preferences saved, cookies blocked until consent
- Verify banner appears on first visit in EU/UK

### Week 1, Day 4: AI Compliance

- Publish AI Disclosure (`AI_DISCLOSURE.md`)
- EU AI Act Art. 50 — must disclose AI system usage to users
- Deadline: August 2, 2026 (but implement early)
- Link from main product page, not just buried in legal docs

- Review AI Model Card (`AIMODELCARD.md`)
- Document model capabilities, limitations, and intended use
- Required for high-risk AI systems under EU AI Act Art. 53

### Week 1, Day 5: Payment Compliance

- Publish Refund Policy (`REFUND_POLICY.md`)
- Required in EU (14-day cooling-off period for digital services)
- Customize refund window and process for your business model

### Week 1 Checklist

Document | Status | Published | URL
--- | --- | --- | ---
Privacy Policy | ☐ Reviewed | ☐ Published | `/privacy`
Terms of Service | ☐ Reviewed | ☐ Published | `/terms`
Cookie Policy | ☐ Reviewed | ☐ Published | `/cookies`
Cookie Consent Banner | ☐ Configured | ☐ Deployed | —
AI Disclosure | ☐ Reviewed | ☐ Published | `/ai-disclosure`

## Phase 2: Security & Incident Response (Weeks 2-4)

> Goal: Establish security documentation and breach response procedures.

If a data breach occurs without these documents, response time increases dramatically and regulatory penalties are higher.

### Week 2: Security Foundations

- Finalize Security Policy (`SECURITY.md`)
- Publish as `SECURITY.md` in your repository root
- This is the first document security researchers look for
- Include responsible disclosure contact

- Establish Incident Response Plan (`INCIDENTRESPONSEPLAN.md`)
- Assign incident response team roles
- Set up communication channels (on-call, Slack channel, etc.)
- GDPR requires 72-hour breach notification to supervisory authority
- Run a tabletop exercise within 30 days

- Review Responsible Disclosure Policy (`RESPONSIBLEDISCLOSUREPOLICY.md`)
- Set up security@https://acme-saas.com email
- Consider a bug bounty program (HackerOne, Bugcrowd)

### Week 3: Access & Change Control

- Implement Access Control Policy (`ACCESSCONTROLPOLICY.md`)
- Enforce MFA for all team members
- Review service account permissions
- Document role-based access matrix

- Formalize Change Management (`CHANGEMANAGEMENTPOLICY.md`)
- Require code review for all changes
- Document deployment procedures
- Establish rollback procedures

### Week 4: Data Protection

- Set up Data Subject Request process (`DSARHANDLINGGUIDE.md`)
- Create internal DSAR handling workflow
- GDPR requires response within 30 days
- Document data export and deletion procedures

- Review Data Retention Policy (`DATARETENTIONPOLICY.md`)
- Define retention periods for each data category
- Implement automated deletion where possible
- Document exceptions and legal holds

## Phase 3: Advanced Compliance & Audit Readiness (Month 2)

> Goal: Prepare for investor due diligence, SOC 2 audit, and advanced regulatory requirements.

### SOC 2 Preparation

- Complete SOC 2 Readiness Checklist (`SOC2READINESSCHECKLIST.md`)
- Map controls to Trust Service Criteria
- Identify gaps in current implementation
- Begin evidence collection

- Review ISO 27001 Checklist (`ISO27001CHECKLIST.md`)
- Align with Annex A controls
- Document existing controls
- Plan gap remediation

### Data Processing & Transfers

- Finalize Data Processing Agreements (`DATAPROCESSINGAGREEMENT.md`)
- Send DPA to all 8 detected sub-processors
- Collect signed copies
- Review `VENDOR_CONTACTS.md` for DPA contact details

- Complete Privacy Impact Assessment (`PRIVACYIMPACTASSESSMENT.md`)
- Required for AI-based processing under GDPR Art. 35
- Document risks and mitigations
- Review with DPO or legal counsel

- Review Transfer Impact Assessment (`TRANSFERIMPACTASSESSMENT.md`)
- Map all international data transfers
- Ensure Standard Contractual Clauses are in place
- Document supplementary measures (Schrems II)

### Vendor Management

- Complete Vendor Risk Assessments (`THIRDPARTYRISK_ASSESSMENT.md`)
- Assess each detected sub-processor
- Use `VENDORSECURITYQUESTIONNAIRE.md` for evaluations
- Score and document vendor risks

- Establish Vendor Onboarding Process (`VENDORONBOARDINGCHECKLIST.md`)
- Define approval workflow for new vendors
- Require DPA before integration
- Set review cadence

## Phase 4: Ongoing Monitoring & Maintenance

> Goal: Keep compliance current as your codebase evolves.

### Automated Monitoring

- Set up CI/CD compliance checks

      # .github/workflows/compliance.yml
      - uses: joechensmartz/codepliant@v220
        with:
          fail-on-missing: true

- Install pre-commit hook

      npx codepliant hook install

- Schedule periodic scans

      npx codepliant schedule install --frequency weekly

### Review Cadence

Frequency | Action | Owner | Command
--- | --- | --- | ---
Weekly | Check compliance dashboard | Engineering lead | `codepliant dashboard`
Monthly | Re-scan and update documents | Engineering lead | `codepliant update`
Quarterly | Full compliance report | CTO/CISO | `codepliant report`
Semi-annual | Vendor review cycle | Security team | Manual review
Annual | Complete compliance review | DPO/Legal | `ANNUALREVIEWCHECKLIST.md`

### Trigger-Based Updates

Re-run `npx codepliant go` whenever you:

- Add a new third-party service or dependency
- Change authentication providers
- Add AI/ML capabilities
- Expand to new markets/jurisdictions
- Change data storage or processing patterns
- Update pricing or terms

## Progress Tracker

Phase | Target Date | Status | Notes
--- | --- | --- | ---
Phase 1: Essential Documents | Week 1 | ☐ Not started |
Phase 2: Security & IR | Weeks 2-4 | ☐ Not started |
Phase 3: Advanced Compliance | Month 2 | ☐ Not started |
Phase 4: Ongoing Monitoring | Continuous | ☐ Not started |

## Regulatory Deadlines

Regulation | Deadline | Impact | Your Status
--- | --- | --- | ---
GDPR | In effect | Fines up to 4% global revenue / EUR 20M | ☐ Review required
EU AI Act | August 2, 2026 | Fines up to EUR 35M / 7% global revenue | ☐ Preparation needed
ePrivacy Directive | In effect | Cookie consent requirements | ☐ Review required

Generated by Codepliant v410.0.0 on 2026-03-19.

This roadmap is personalized to your detected stack (8 services). Re-run `npx codepliant go` after changes to update.

This document should be reviewed by a qualified compliance professional.