Guide · Agent skill
How to use the Regulation Gap Analysis agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The reg-gap-analysis skill helps an agent check whether a new or changed privacy law or regulatory guidance applies to your organisation, and if so, what you need to change. This guide explains what an agent skill is, how to install this one, how to trigger it with plain requests, and what it needs to run well. By the end you will be able to run a first-draft gap analysis and know what to verify before relying on it.
Regulation Gap Analysisanthropics/claude-for-legal · Apache-2.0 Download the skill Quick start
- 1Create your configuration file. Write or confirm the CLAUDE.md file at the expected path, covering privacy policy commitments, regulatory footprint and DSAR systems.
- 2Install the skill. Download the ZIP, then unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings, Capabilities, Skills in the Claude apps.
- 3Confirm the plugin is available. Make sure Claude Code or a compatible agent has the claude-for-legal privacy-legal plugin installed.
- 4Start with a regulation name. Run the slash command with the regulation name in quotes, or ask in plain language whether a named law affects you.
- 5Review the scope. Check the agent's answer on jurisdiction, thresholds, sector carve-outs and dates. If the regulation does not apply, the output is a one-line note with the reason.
- 6Check the gap list. Review each requirement's Full, Partial or None rating and the citations, verifying any tagged items before relying on them.
- 7Save and assign the plan. Use the dated remediation plan, assign owners and due dates, and keep the document as the record, including for no-action decisions.
What an agent skill is and what this one does
An agent skill is a folder containing a SKILL.md file that tells an AI agent how to carry out a specific task. This skill is part of the anthropics/claude-for-legal project, in the privacy-legal plugin, and is licensed under Apache-2.0.
When a new or changed privacy law or regulatory guidance appears, the skill tells the agent to first read your saved company privacy profile. The agent then checks whether the regulation applies to you, lists its requirements, and compares each one against what you currently do.
- Scopes the regulation: jurisdiction, thresholds, sector carve-outs, effective and enforcement dates, and what is actually new compared with what you already comply with.
- Extracts each substantive requirement and sorts it into a category: Notice, Rights, Security, Vendor, Consent or Governance.
- Marks each requirement as None, Partial or Full gap, with what is missing and the effort to close it.
- Produces a prioritised remediation plan with owners, due dates and status, and saves a dated document for the record, including when no action is needed.
Prepare the required configuration file
The skill depends on a configuration file that must already exist. Without it the comparison has no company baseline. The file is expected at ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md and should describe your privacy policy commitments, your regulatory footprint, and your data subject request (DSAR) systems.
The skill reads three sections of this file: Privacy policy commitments (what you have publicly promised), Regulatory footprint (what already applies to you), and the DSAR process systems list (what you actually do operationally).
- Privacy policy commitments: what you have publicly promised.
- Regulatory footprint: what already applies.
- DSAR process, systems list: what you actually do operationally.
~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.mdInstall the skill (ZIP download or Claude apps upload)
Download the skill ZIP from the page where you found this guide. The package contains the file SKILL.md. Unzip it into one of two locations depending on how you want to use it: your personal skills folder, or a project-specific folder.
Alternatively, if you use the Claude apps, you can upload the skill there under Settings, then Capabilities, then Skills.
The skill also requires Claude Code or a compatible agent with the claude-for-legal privacy-legal plugin installed. The source does not describe the plugin installation steps, so check the claude-for-legal project for those.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings, then Capabilities, then Skills, then upload the skill
~/.claude/skills/
.claude/skills/Trigger the skill with natural requests
You can start the skill with a plain-language request. The skill's description lists phrasings it responds to, such as asking whether a regulation affects you, asking for a gap analysis against a named state privacy law, asking for a compliance check against a regulation, or pasting regulatory text.
You can also invoke it with the slash command and an optional argument. Give the regulation name in quotes, or leave the argument off and paste the guidance or regulation text after the command.
- "Does the Colorado Privacy Act affect us?"
- "Gap analysis for [state privacy law]"
- "Compliance check against [regulation]"
- Paste regulatory text or a summary and ask what changes for us.
/privacy-legal:reg-gap-analysis "Colorado Privacy Act"
/privacy-legal:reg-gap-analysis
[paste guidance / reg text]Read the output and the remediation plan
The output begins with the work-product header defined in your configuration file. The main body is a gap item for each requirement, followed by a remediation plan. The plan has a table of must-do items before enforcement, a table of should-do items that are lower risk, a list of requirements already compliant, and a list of accepted gaps with the rationale and who accepted the risk.
The skill flags uncertainty for attorney verification. Citations from model knowledge are tagged by confidence tier, and the reviewer note records whether a legal research connector was reachable. Check these tags before relying on the output.
- Must-do before enforcement: gap, fix, owner, due date, status.
- Should-do: same table format, lower risk.
- Already compliant: useful for a we're mostly fine summary.
- Accepted gaps: risk-accepted items with rationale.
Optional: connect a legal research tool
The skill can use a legal research connector to verify current requirements. The source mentions Westlaw, a regulator-site connector, or a firm-configured research tool. Without one, the skill cites from training knowledge and marks those citations for verification.
If a research query returns few or no results, the skill reports this and stops rather than filling the gap from web search or model knowledge without asking you first.
- With a connector: citations are checked against current sources where possible.
- Without a connector: the reviewer note says citations come from training knowledge, and the highest-risk items to spot-check are effective dates, enforcement dates and section pinpoints.
Safety notes: scripts and network
According to the skill's listing, it does not run scripts and does not use the network. It works by reading your configuration file and producing documents for your review.
The optional research connector is separate from the skill itself. If you connect one, check its own data handling and access settings. The skill is a drafting aid and does not replace legal advice.
- Runs scripts: no
- Uses network: no (the skill itself; an optional research connector is separate)
- Do not treat the output as final legal advice.
What people use it for
- A privacy team checking whether a newly passed state privacy law applies to their customer base and what must change before enforcement.
- A compliance officer documenting why no action was needed after reviewing a new regulation.
- A lawyer producing a first-draft gap analysis to check and verify before advising on it.
- Reviewing new regulatory guidance against the published privacy policy commitments to find wording that needs updating.
Frequently asked questions
Is the reg-gap-analysis skill free to use?
The skill is licensed under Apache-2.0, as stated in the item's listing. Check the license file in the project for the full terms. Any legal research connector you add may have its own costs and terms.
What do I need to run reg-gap-analysis?
You need Claude Code or a compatible agent with the claude-for-legal privacy-legal plugin installed, and a saved configuration file at ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md. A legal research connector is optional.
Where do I install an agent skill like this one?
Unzip the skill into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps, you can upload it under Settings, then Capabilities, then Skills.
Why does the skill say it cannot find my company baseline?
The skill needs the CLAUDE.md configuration file to exist before it runs. Without it, the comparison has no baseline of your privacy commitments, regulatory footprint and DSAR systems. Create the file at the expected path and run the skill again.
Can this skill give me final legal advice on a new privacy law?
No. The skill is designed to produce a first-draft gap analysis and tells the agent to flag uncertainty for attorney verification. It may cite regulation dates or section numbers from training knowledge, which can be wrong unless a legal research tool is connected.
How does this compare with doing a gap analysis manually?
The skill follows a fixed workflow: scope the regulation, extract requirements, diff against your documented practices, prioritise, and produce a dated plan. This structure can save drafting time, but the source does not compare it with other tools, so judge the output against your own review process.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits in-house privacy or legal teams, compliance staff and lawyers who need a structured first draft when a new privacy law or guidance appears, and who already maintain the required configuration file. It is a poor fit if you have no privacy profile file, or if you need a final legal opinion without attorney review, since the output must be checked against current sources.
Download the skill