Owner notifications: on by default. To opt an owner out, leave

owner_slack

empty.

1. Show the user exactly what you're about to send and to whom: "I'm about to send this to [N] people: [preview]."
2. Wait for an explicit yes.
3. If the message contains any citations, deadlines, or compliance conclusions, add: "⚠️ The citations in this message are unverified — I'm not confirming they're current before sending. Do you want me to add a 'verify before acting' line?"
4. Never send without the confirm. Not on a cadence. Not in a batch. Not because it was sent yesterday.

~/.claude/plugins/config/claude-for-legal/regulatory-legal/gap-tracker.yaml

Note on comment-tracker.yaml:

~/.claude/plugins/config/claude-for-legal/regulatory-legal/comment-tracker.yaml

is a sibling file owned by the comments skill. It is written to by reg-feed-watcher (which logs NPRMs automatically) and the comments skill (which tracks user-initiated comment decisions). This skill does not read or cross-reference it. If you modify the comment-tracker schema, update both actual consumers.

gaps:
  - id: GAP-001
    requirement: "[what the reg requires]"
    regulation: "[name + cite]"
    policy_affected: "[name or 'new policy needed']"
    gap_type: "partial"  # none | partial | full | new-policy | watch | comment-decision
    owner: "[name from policy index]"
    owner_slack: "[Slack user ID or handle, if known]"
    opened: 2026-03-01
    due: 2026-06-01  # reg effective date, internal deadline, or comment deadline
    status_verified: true  # false if upstream policy-diff could not confirm the rule is in force; unverified items never hit 🔴 Overdue
    status: "open"  # open | in-progress | closed | risk-accepted
    notified: false  # set to true after assignment notification sent
    resolution: ""  # filled on close

status_verified: false

watch

watch

gap_type

none

none

partial

full

new-policy

watch

due:

comment-decision

due:

watch

comment-decision

~/.claude/plugins/config/claude-for-legal/regulatory-legal/CLAUDE.md

[PLACEHOLDER]

• Gap-response triager missing: leave assignment open and append to the output: "No triager is set in

  ## Gap response process

  . Assign one with

  /regulatory-legal:cold-start-interview --redo

  or by editing

  ~/.claude/plugins/config/claude-for-legal/regulatory-legal/CLAUDE.md

  so new gaps get routed."
• Owner unknown for a newly-ingested gap (no owner in policy library): log the gap with

  owner: [unassigned]

  and append: "[N] gaps were ingested without an owner because the policy library doesn't name one for the affected policy. Fill in the Owner column in the policy library to route them."
• Escalation path missing for an overdue material gap: still report it as overdue, and append: "No escalation path is set for material overdue gaps. Configure it with

  /regulatory-legal:cold-start-interview --redo

  or by editing

  ~/.claude/plugins/config/claude-for-legal/regulatory-legal/CLAUDE.md

  ."

gap_type

• partial

  ,

  full

  ,

  new-policy

  ,

  none

  : if due date is within 30 days and a reminder has not been sent in the last 7 days, PREVIEW a Slack DM (subject "⏰ Reminder: compliance gap due in [N] days") and wait for per-send confirm before sending.

• comment-decision

  : if comment deadline is within 21 days and a reminder has not been sent in the last 7 days, PREVIEW a Slack DM (subject "💬 Comment-decision deadline in [N] days") and wait for per-send confirm before sending.

• watch

  : no auto-reminder. Revisit when the tracker is reviewed or an NPRM is logged for the same regulation.
• If due date has passed on a compliance gap: flag as overdue in the report and PREVIEW a Slack DM — wait for per-send confirm before sending.
• If comment deadline has passed on a

  comment-decision

  item and no comment was filed: flag as overdue, PREVIEW a Slack DM (wait for per-send confirm), and ask the owner to update to

  risk-accepted

  (deliberate no-comment) or

  closed

  (comment filed) with a note.
• Record reminder timestamps in the tracker to avoid repeat nags.
• Batch reminders still require per-send confirm — previewing "you're about to send 12 DMs" and waiting for yes counts; silently firing a batch does not.

## Who's using this

Certifying compliance — or closing a gap as resolved — has legal consequences. The certification can be used against the company if it's later shown to be wrong, and premature closure leaves exposure unaddressed. Have you reviewed this with an attorney? If yes, proceed. If no, here's a brief to bring to them:

• The gap (requirement, source, what the policy diff found)
• What the proposed resolution does and does not cover
• Any residual gap or ambiguity
• Open questions and what's unresolved
• What could go wrong (overbroad certification, unresolved residual obligation, inconsistent prior position)
• What to ask the attorney (is this truly closed; should we risk-accept with rationale instead; do we need outside-counsel concurrence)

If you need to find a lawyer: your professional regulator's referral service is the fastest starting point (state bar in the US; SRA/Bar Standards Board in England & Wales; Law Society in Scotland/NI/Ireland/Canada/Australia; or your jurisdiction's equivalent).

• Close gaps on its own. Closing requires the resolution note and the human action that the note describes.
• Send Slack notifications if the Slack MCP is not configured. Falls back to flagging in the status report.
• Send more than one reminder per 7-day period per gap. Nag once, not constantly.