HIPAA, the EU AI Act, the FTC and TCPA, state bar rules, and a growing set of state AI laws all reach the chatbot, voice agent, and AI tools a small business already uses. This toolkit gives you an 85-item scored self-assessment with a workbook, a regulatory guide with every date and case checked against its primary source, and a remediation and training plan to close the gaps.
Version 3.0, updated 19 October 2026. Instant download by email after payment. Licensed to one organization, every employee included. Licence terms. 14-day refund, any reason. How refunds work. Download a sample (PDF), the opening pages of one document.
Three regulatory fronts moved in 2025 and 2026. Most small businesses have not caught up.
If you deploy AI in the EU, or the output of your AI is used there (an EU client, an EU employee), you are in scope. Chatbot and deepfake disclosure duties have applied since 2 August 2026. The July 2026 amendment moved the high-risk duties for hiring, credit, and insurance systems to 2 December 2027. Fines up to EUR 35 million or 7 percent of turnover.
Any AI vendor that touches patient information is a business associate under the existing rules. Since 1 May 2025, practices that take Medicare or Medicaid must review AI decision support tools for discriminatory inputs. Texas requires patients to be told when AI is used in their care, and California bars bot names that imply a licence, both since 1 January 2026. The HHS Security Rule overhaul is still pending.
The ABA's Formal Opinion 512 (July 2024) and more than fifteen state and local bars, from Florida in January 2024 to California's revised guidance in May 2026, apply the existing rules to AI: confidentiality, verification, supervision, fees, and client disclosure. Courts have sanctioned lawyers for fabricated AI citations every year since 2023, with 2026 orders reaching five-figure personal payments and fee awards near USD 95,000.
Built by a CISSP/CISM-certified security professional. Not a marketing agency running a checklist.
85 weighted items across 5 areas: HIPAA and health information (19), the EU AI Act (18), FTC and TCPA (15), legal ethics for law firms (23), and US state AI laws (10). Every item states how to verify it, the evidence to file, and the action when it fails. Start here.
1 Word documentFive chapters, one per regime: who it binds, what it requires of a business that deploys AI, the dates, the penalties, the enforcement record, and the primary sources. Covers the EU AI Act as amended in July 2026, the FTC's AI cases from Rite Aid to Air AI, the FCC's AI voice ruling, HIPAA and Section 1557, the ABA and state bar opinions, and the state AI laws of Colorado, Utah, California, Illinois, Texas, New York, Maine, and Washington.
1 Word documentA remediation matrix of 52 actions in four tiers (stop today, quick wins, critical, standard), each with owner, effort, evidence, and the assessment items it closes. Four training modules with talking points a manager can deliver, five scenarios with model answers, a 20-question knowledge check with answer key, and the training record.
1 Word documentThe 85 items as a scoring sheet: status drop-downs with a not-applicable option, score and maximum formulas, a summary by section with the rating bands, and a calendar of every dated obligation from the guide with an owner column.
1 Excel workbookIf you use chatbots, voice agents, AI scheduling, automated follow-ups, or AI-generated marketing - this is for you.
HIPAA compliance for AI chatbots, appointment systems, recall automation, review solicitation, and clinical decision support tools.
State bar ethics compliance, UPL risk from AI chatbots, client confidentiality in AI tools, citation verification, and engagement letter updates.
TCPA compliance for AI calls and texts, FTC rules for AI marketing, do-not-call compliance, and AI voice agent disclosure.
EU AI Act readiness, FTC marketing compliance, consent requirements, AI vendor terms review, and staff training that apply across industries.
This toolkit was built by a security professional, not a marketing agency.
Industry-recognized certifications in information security management and cybersecurity.
Active Information System Security Manager for a US Department of Defense contractor.
Specializing in the intersection of AI deployment and regulatory compliance for service businesses.
3 Word documents and 1 Excel workbook. 5 compliance areas.
Instant download. Three Word documents (.docx) and one Excel workbook (.xlsx). Version 3.0, 19 October 2026.
No. This toolkit provides compliance frameworks and templates based on publicly available regulatory requirements. It is not legal advice. We recommend having your attorney review completed documents before relying on them.
Three Word documents (.docx) and one Excel workbook (.xlsx). Open in Microsoft Word and Excel, Google Docs and Sheets, or LibreOffice. The workbook uses standard formulas and drop-down lists, nothing macro-based.
No. Start with the page in the assessment that lists which sections apply. HIPAA applies if you handle protected health information; the EU AI Act if you have EU clients, staff, or users; FTC and TCPA to any US business that uses AI in marketing or customer contact; legal ethics to law firms; and the state law section if you operate, hire, or serve customers in Colorado, Utah, California, Illinois, Texas, New York, Maine, or Washington, or use AI in hiring anywhere. The workbook drops the sections you mark not applicable from your score.
At least yearly, when you add an AI tool, at each dated obligation in the calendar sheet of the workbook (the EU high-risk duties on 2 December 2027, the Colorado and California dates on 1 January 2027), and after any AI-related incident. The dates in the guide were checked against primary sources on 19 October 2026; check the cited source before relying on one later.
Yes. We offer professional AI compliance audits for dental practices, HVAC companies, and law firms. Book a call to discuss your specific situation.
Already bought this toolkit? Use code SOLAS20 for 20% off any other product.
Handle CUI under DoD contracts? Get the CMMC Level 2 documentation kit: SSP template, POA&M tracker, and implementation statements with evidence guidance for all 110 NIST 800-171 controls.
Turn weeks of security questionnaire responses into hours. 85 pre-drafted answers across 13 security domains for SIG, CAIQ, and enterprise questionnaires.
Pre-built disclosure templates for SEC 8-K, NIS2, DORA, HIPAA, and state breach laws. Plus 3 tabletop exercise scenarios.
David A. Moline, CISSP | CISM
Your AI automation, built by someone who secures DoD systems.
EU AI Act obligations phase in from February 2025 to August 2027, and the toolkit's regulatory guide lists each date. HIPAA and FTC enforcement on AI is already active. Get compliant now.
Hi! I'm the Solas AI assistant. I can answer questions about our services, pricing, and how we help service businesses save time with AI automation. What can I help you with?
