<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Regulatory Compliance Tracking — API Reference

## Obligation Schema

```json
{
  "regulation": "GDPR",
  "obligation": "Data breach notification",
  "reference": "Art. 33",
  "requirement": "Notify DPA within 72 hours",
  "mapped_controls": ["IR-001", "IR-002"],
  "evidence": ["ir_plan.pdf", "notification_template.docx"],
  "status": "compliant",
  "last_assessed": "2026-01-15",
  "next_deadline": "2026-12-31"
}
```

## Agent Commands

```bash
# Inventory obligations
node agent.js --action inventory --input regulations.json

# Monitor regulatory changes
node agent.js --action monitor --input current_regulations.json

# Generate compliance report
node agent.js --action report --input obligations.json --output report.json
```

## Key Regulatory Deadlines

| Regulation | Requirement | Frequency | Deadline |
|-----------|-------------|-----------|----------|
| PCI DSS | ASV scans | Quarterly | End of quarter |
| SOC 2 | Type II audit | Annual | Per engagement |
| HIPAA | Risk analysis | Annual | Calendar year |
| GDPR | Breach notification | As-needed | 72 hours |
| SEC | Cyber disclosure | As-needed | 4 business days |
