🌍 English | 🇻🇳 Tiếng Việt 📖 Actionable User Guide | 🇻🇳 Hướng dẫn Sử dụng

10 AI-Powered Compliance Skills for Product Managers — covering 35+ jurisdictions, ISO standards, and flexible compliance depth

Building globally compliant software is traditionally slow, expensive, and legally risky. The SafeAI-Global Compliance Suite acts as your embedded Legal & Security co-pilot, shifting compliance entirely to the left—straight into the hands of Product Managers and Engineers.

For Product Leadership (CPO/PM):

• ⚡ Accelerate Time-to-Market (TTM): Generate engineering-ready, legally compliant PRDs in minutes. Never wait weeks for external legal reviews that delay sprint cycles.
• 🛡️ De-Risk Product Launches: Automatically identify and mitigate regulatory risks (GDPR, CCPA, SEC, DORA) before a single line of code is written. Prevents expensive post-launch fines.
• 💯 Immediate Quality Control: Instantly gauge your PRD's compliance readiness with the SafeAI-Global Score (Privacy, Security, and Transparency pillars).
• 📉 Prevent "Compliance Overkill": Ensure you only apply the regulations necessary for your specific target market and product tier, avoiding unnecessary development bloat.

For Engineering Leadership (CTO/DevSecOps):

• 🔄 Zero-Friction Handover: Use /safeai export jira to instantly transform PRDs into Epics and Gherkin BDD Acceptance Criteria. Legal constraints become code constraints.
• 🏗️ DevSecOps Ready: Generate Terraform/OPA policies direct from PRDs. Validate implementation automatically in CI/CD using locally run safeai-lint.
• 🔍 Secure Vibe Coding: Audit AI-generated code (/safeai scan) for secrets, hallucinated dependencies, and compliance gaps instantly within your IDE.

Not every PRD needs full compliance. To prevent over-engineering simple features, the agent asks you to choose your depth at the start of every chat:

Tip: You don't have to wait for the bot to ask. Just say "Standard PRD" or "Full compliance for EU" in your very first prompt to skip Step 0.

Type /template [industry] [region] to instantly grab a tailored PRD skeleton for your specific market:

See the full list of templates in SKILL.md.

The SafeAI-Global suite uses a Hub-and-Spoke architecture. You always start with the Global Hub, and pivot to deep-dive Spoke experts only when you hit heavily regulated verticals.

               ┌─────────────────────────────────────────┐
               │    🌐 SafeAI-Global PRD Agent (Hub)     │
               │   ───────────────────────────────       │
               │   • Covers 35+ Jurisdictions            │
               │   • Cross-border Data Transfers         │
               │   • Defines AI Governance               │
               └───────────────────┬─────────────────────┘
                                   │
              [ Step 0: Auto-Detects Region & Depth ]
                                   │
   ┌─────────────┬───────────┬─────┴─────┬───────────┬─────────────┬─────────────┐
   ▼             ▼           ▼           ▼           ▼             ▼             ▼
┌───────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌───────────┐ ┌───────────┐
│ 🇻🇳 Vietnam │ │ 🇪🇺 GDPR │ │ 🏥 HIPAA│ │ 💳 Fin  │ │ 🌏 ASEAN│ │ 📝 Stand. │ │ 🤖 AI/Risk│
│ Compliance│ │  Expert │ │  Expert │ │ Tech    │ │  Data   │ │    PRD    │ │   Expert  │
├───────────┤ ├─────────┤ ├─────────┤ ├─────────┤ ├─────────┤ ├───────────┤ ├───────────┤
│ • SBV 2345│ │ • GDPR  │ │ • SaMD  │ │ • PCI   │ │ • SG, TH│ │ • No Legal│ │ • NIST AI │
│ • AI/Cyber│ │ • AI Act│ │ • PHI   │ │ • PSD2  │ │ • ID, PH│ │ • Fast TTM│ │ • Ethics  │
└───────────┘ └─────────┘ └─────────┘ └─────────┘ └─────────┘ └───────────┘ └───────────┘
*(Plus specialized nodes for US Privacy, EdTech, and Code Scanning)*

> **The Hub Workflow:** Start your chat with the **Global PRD Agent**. If it detects a highly regulated domain (like Healthcare in the US, FinTech in Europe, or deep compliance requirements in Vietnam), it will automatically recommend you switch to the specialized **Spoke** skill for a deeper audit.

npx skills add datht-work/safeai-global-agent

This will show all 9 skills — select the ones you need.

This project uses a Modular Knowledge Engine architecture. To use it in a web interface, you need to provide both the Agent Instructions (SKILL.md) and the Knowledge Base (knowledge/ folder).

🇻🇳 Vietnam · 🇨🇳 China · 🇯🇵 Japan · 🇰🇷 South Korea · 🇮🇳 India · 🇸🇬 Singapore · 🇦🇺 Australia · 🇹🇭 Thailand · 🇲🇾 Malaysia · 🇮🇩 Indonesia · 🇵🇭 Philippines

🇪🇺 EU · 🇬🇧 UK · 🇨🇭 Switzerland · 🇹🇷 Turkey · 🇦🇪 UAE · 🇸🇦 Saudi Arabia · 🇮🇱 Israel · 🇳🇬 Nigeria · 🇿🇦 South Africa · 🇰🇪 Kenya · 🇪🇬 Egypt

🇺🇸 US (Federal + CA, CO, TX, VA, NY) · 🇨🇦 Canada · 🇧🇷 Brazil (LGPD, Digital ECA) · 🇲🇽 Mexico · 🇦🇷 Argentina · 🇨🇴 Colombia · 🇵🇪 Peru

The agent is trained to map product features to strict international frameworks (applied automatically in Smart and Full Audit modes):

💡 Want to see it in action? Look at examples/sample-prd-output.md for a complete compliance PRD output.

• ✅ Zero executable code — Markdown-only skills
• ✅ Zero runtime dependencies — No supply-chain risk
• ✅ No network calls — No external connections
• ✅ No data collection — Stateless operations
• ✅ CI/CD audited — GitHub Actions security pipeline
• ✅ LLM Evaluated — Automated promptfoo testing with Golden Datasets

See SECURITY.md for full policy and CONTRIBUTING.md for knowledge standards.

See CHANGELOG.md for detailed version history.

We welcome contributions! Especially:

• 🌍 New country regulations
• 🔄 Regulation updates
• 🐛 Citation corrections
• 📝 PRD template improvements

See SECURITY.md for security-related contribution guidelines.

MIT License — see LICENSE for details.

The SafeAI-Global Knowledge Base heavily relies on up-to-date legal facts. Please audit the following major frameworks to ensure our knowledge/ directory is accurate:

• EU AI Act: Monitor AI Office guidelines ahead of the August 2, 2026 enforcement milestone.
• Vietnam PDPL: Ensure all facts align with Law No. 91/2025/QH15 and Decree 356/2025/ND-CP.
• US State Privacy: Validate enforcement for Maryland (MODPA), Indiana, Kentucky, and Rhode Island.
• ISO Standards: Review EN ISO/IEC 42001:2026 regional adoptions and ISO 27001:2022 amendments.

Action:

1. Validate the facts in knowledge/ against official sources (e.g., Official Journals, NIST, ISO).
2. If changes exist, open a PR with updated Markdown tags.
3. Run npm run eval to ensure the PRD generator still behaves correctly via promptfoo.

⚠️ Disclaimer: This suite provides compliance guidance, not legal advice. Always consult qualified legal counsel for final compliance decisions.

Built with ❤️ by SafeAI-Global Team · v5.0.0 · March 2026