Sentry Ip And Compliance

---
name: sentry-ip-and-compliance
description: "This skill explains common IP moves and the most-cited compliance regimes for early-stage product companies. It does not file your trademark, write your privacy policy, or interpret a regulator's order. Escalate to counsel any time you're in a regulated industry (health, finance, legal services, any"
metadata:
  author: wayland
  version: "1.0.0"
  category: "sentry"
---

# IP and compliance

## Not legal advice; escalate when

This skill explains common IP moves and the most-cited compliance regimes for early-stage product companies. It does not file your trademark, write your privacy policy, or interpret a regulator's order. Escalate to counsel any time you're in a regulated industry (health, finance, legal services, anything touching minors), facing an active claim, expanding internationally, or processing personal data at meaningful scale.

## When to load this mode

The user is naming a product and asking about trademark, has a copyright question, is launching to EU users and wondering about GDPR, is shipping AI and wondering about disclosure, or has been told they need a privacy policy.

## Procedure

Four categories. For each, what to know and the first concrete step.

**1. Trademark.** Protects a brand identifier (name, logo, slogan) used in commerce. (a) The U.S. and many jurisdictions confer common-law rights from first use, even unregistered. (b) Registration (USPTO, EUIPO) gives broader rights and is required for serious enforcement. (c) Before naming, run a clearance search — USPTO TESS, EUIPO, general web. Rebrand cost from infringement dwarfs the search fee.

**2. Copyright.** Protects original works (code, copy, images, music, video) once fixed in a tangible medium. You own copyright in what you create unless: work-for-hire, assigned, or licensed. Practical: (i) written IP assignment from every contractor. (ii) Don't reuse images, code, or music without checking the license. (iii) Open-source carries terms; ignoring GPL/AGPL copyleft creates real exposure. AI-generated content has unsettled copyright treatment — treat outputs as potentially uncopyrightable until case law lands.

**3. Privacy and data protection.** Several overlapping regimes:

- **GDPR (EU/UK).** Applies whenever you process personal data of people in the EU/UK. Personal data is broad (emails, IPs, cookies, device IDs). Required: privacy policy, lawful basis, DPA with vendors, process for handling data-subject requests. Fines are large and enforcement is real.
- **U.S. state privacy laws.** California (CCPA/CPRA) is most enforced; Colorado, Virginia, Connecticut, Utah, and others have similar regimes.
- **Sectoral rules.** HIPAA (health), COPPA (under-13s), GLBA (financial), FERPA (education). Requirements go well beyond a generic policy.

First step: map what data you collect, from whom, why, where it goes, how long. The privacy policy is the public summary of that map. Without the map, the policy is fiction.

**4. AI compliance.** A moving target. As of 2026:

- **EU AI Act.** Risk-tier framework; most consumer AI lands in "limited risk" with disclosure obligations. High-risk uses (employment, credit, education, biometrics) have heavier obligations.
- **U.S. state disclosure laws.** California, Texas, and others require AI-content disclosure in certain contexts (political content, deepfakes, commercial chatbots).
- **Sectoral application.** AI in hiring, lending, or healthcare gets the underlying sector's regime.

First step: name where AI shows up, what decisions it influences, whose rules apply. Write the disclosure copy. If any high-risk use is in scope, get counsel.

## Decision rules

- **Search before you name.** Clearance is cheap; rebrand is not.
- **Written IP assignment from every contractor.** Default assumptions are not in your favor.
- **Map data before writing the policy.** A mismatched policy is worse than no policy.
- **GDPR-style discipline by default.** Cheaper to build for the strictest regime than retrofit later.
- **Disclose AI use.** Disclosure cost is near zero; failure-to-disclose cost is rising.

## Anti-patterns

- **Picking a name another company in your category uses.** Cheap to avoid, expensive to fix.
- **Stock images, code, or music without checking the license.** Top copyright-claim trigger.
- **Lifting a privacy policy from a competitor.** You inherit their disclosures; enforced on your reality.
- **Treating GDPR as "an EU problem."** One EU user with one email puts you in scope.
- **Open-source code in a commercial product without a license review.** GPL/AGPL can affect the whole product.
- **Shipping AI with no disclosure.** Growing enforcement target.

## Before / after

**Before:** *Solo founder launches a SaaS product, picks a name without searching, copies a competitor's privacy policy, uses AI images from an unclear license, ships a chatbot with no AI disclosure. Eighteen months in: a similarly named company sends a cease-and-desist (rebrand ~$40k). A user files a GDPR deletion request the policy promised but the founder never built a process for. An EU regulator opens an inquiry.*

**After:** *Same founder, four moves on day one. (1) USPTO + EUIPO clearance before naming. (2) Maps data, writes a policy that matches; sets up a deletion mailbox. (3) Licensed image sources, keeps licenses.txt. (4) One-line "this chatbot uses AI" disclosure. Cost: ~$1,500 and a few hours. None of those problems happen.*

**Disclaimer:** I am not your lawyer. This is a framework, not legal advice. For trademark filing, drafting your privacy policy on real data flows, AI compliance in any regulated sector, and any active dispute, you need actual counsel.