Compliance Check

Output Format

Produce a scorecard in this exact structure:

## Compliance Scorecard: [Policy Name]

**Validated by**: compliance-checker (executor role)
**Date**: [date]
**Frameworks**: [list]

---

### [Framework Name] Compliance

**Score**: [N]/[total] PASS ([percentage]%)
**Partial compliance**: [N]/[total] PASS+PARTIAL ([percentage]%)
**Status**: COMPLIANT / SUBSTANTIALLY COMPLIANT / MATERIAL GAPS / NON-COMPLIANT

| ID | Requirement | Ref | Status | Evidence |
|----|------------|-----|--------|----------|
| G01 | Lawful basis for processing | Art. 6 | ✅ | Section 4 defines lawful basis per activity |
| G02 | Special category data | Art. 9 | ⚠️ | Mentioned in Section 4 but no specific conditions |
| G09 | Automated decision-making | Art. 22 | ❌ | Not addressed in policy |

### Certification

Based on this validation:
- [ ] Policy meets full compliance requirements for [framework]
- [ ] Policy has material gaps requiring remediation before certification
- [ ] Recommended remediation actions: [list critical FAILs]

Status Thresholds

• COMPLIANT: All items PASS
• SUBSTANTIALLY COMPLIANT: No FAIL items, some PARTIAL. Partial items should be improved but are not blocking.
• MATERIAL GAPS: Any FAIL item that is classified as critical in the checklist
• NON-COMPLIANT: 5+ FAIL items or any critical-severity FAIL

Rules

• Evaluate strictly — a requirement is only PASS if the policy provides specific, actionable coverage
• Vague language like "appropriate measures will be taken" is PARTIAL, not PASS
• Reference specific policy sections in the evidence column (e.g., "Section 5.7" or "Not found")
• Do not evaluate requirements outside the checklist — only use items defined in the knowledge base
• If the policy references an external document that might cover a gap, note it but still evaluate what is in this policy document