Question 1

What does done-for-you marketing compliance overlay actually deliver?

Accepted Answer

Completions builds and operates a marketing compliance overlay bundle on the compliance-overlay-manager agent for regulated operators running marketing across healthcare, alcohol, firearms, financial services, pharmacy, dental, and other regulated verticals across multiple states and jurisdictions. Per-vertical rule libraries: healthcare runs HIPAA Security Rule 164.308 administrative safeguards and 164.312 technical audit controls, FDA OPDP 21 CFR 202 drug-claim review, ADA Title III digital accessibility (Robles v. Domino's), and state medical-board mandatory-reporter rules;  runs the state- Metrc 12-state regime with per-license per-discount-floor and per-promotion-prior-approval where applicable; alcohol runs DISCUS tied-house rules, state ABC board guidance, and per-state per-cash-discount-floor and per-credit-policy rules; firearms runs ATF 18 USC 922 and 27 CFR 478, NICS 18 USC 922(t), and state-firearms-bound-book rules; financial services runs SEC Reg FD, Reg G, Item 7 MD&A, FINRA Rule 2210, SOX Section 404, and GLBA Safeguards Rule; pharmacy runs DEA Schedule II-V 21 CFR 1304/1305/1306, FDA OPDP, and state pharmacy-board rules; dental runs state dental-board rules and ADA Council on Dental Practice guidance. Per-jurisdiction-overlay-config composition: the overlay manager composes rules by intersection with set-union, set-intersection, and set-difference operators, applies a priority tier (federal-preemption, state-stricter, locality-stricter), and breaks ties via a tie-break rule (highest-tier, most-restrictive, most-recent-effective). Rule extraction from upstream regulatory sources: a multi-model LLM-as-judge ensemble (OpenAI GPT-5, Anthropic Claude Opus 4.7, Google Gemini Ultra, Mistral Large, Cohere Command R+, Meta Llama-3.1-405B) extracts structured rules from the operator regulatory-source feed (Westlaw, LexisNexis, Bloomberg Law, Wolters Kluwer, Compliance.ai, Thomson Reuters, the Federal Register, state-AG opinions, agency guidance, court decisions, and enforcement actions) with citation, effective date, and confidence-tier annotation. Pre-filter deterministic gating: every marketing output passes through a deterministic gate against the composed per-vertical per-jurisdiction overlay before any LLM scoring runs, so cheap-to-detect violations fail fast. LLM semantic compliance scoring: outputs that pass the deterministic gate run through the LLM-as-judge ensemble for semantic conformance with explainability trace. Borderline routing: outputs that score in a borderline band route to operator counsel queues (per vertical, per state, per claim) through the operator workflow engine (Temporal, Inngest, Trigger.dev, or Vercel Queues) with per-route SLA and explainability trace. Attorney-relationship continuity: Completions accesses attorney work-product under operator-controlled attorney-client privilege; operator counsel remains the policy authority. Block-with-explanation: when an output would violate, the gate blocks with a counsel-readable explanation citing the rule, jurisdiction, citation, and effective date. Per-statute audit trail: every gate decision, LLM score, counsel-routing event, override, and rule-library version persists to operator-controlled WORM storage (AWS S3 Object Lock, Google Cloud Storage retention, Azure Blob immutable, or Snowflake Time Travel) at per-statute retention windows — Lanham 7 years, FTC 7 years, HIPAA 6 years, PCI DSS 1 year, SEC 3 years, FINRA 3 years, state- Metrc per-state, DEA 2 years, FDA 3 years, ATF 20 years, EPA per-program, WEEE/RoHS/REACH per-program, COPPA, GINA, GDPR, CCPA, and EU AI Act Articles 5/13/14/15/22/50 record-keeping where applicable. Operator owns every artifact. Completions owns the orchestration knowledge.

Question 2

Why is the marketing compliance overlay typically operator-side rather than regulatory-source-vendor- or GRC-vendor- or LLM-vendor-shipped?

Accepted Answer

Six engineering surfaces sit between operator data infrastructure and a working marketing compliance overlay bundle, and they sit outside the design center of the regulatory-source, GRC, audit-management, workflow, LLM, and WORM-storage ecosystems that own the upstream and downstream primitives. Surface 1 — Regulatory-source ingestion and structured rule extraction: Westlaw, LexisNexis, Bloomberg Law, Wolters Kluwer, Compliance.ai, and Thomson Reuters ship strong feed primitives but rule extraction calibrated to the operator-specific vertical and jurisdiction set is operator-side modeling. Surface 2 — Per-vertical per-jurisdiction overlay composition: composing HIPAA, FDA OPDP, ADA Title III, state medical-board, state- Metrc, DISCUS, state ABC board, ATF, NICS, state-firearms bound-book, SEC, FINRA, SOX, GLBA, DEA, FDA tobacco, state pharmacy board, state dental board, ADA Council, FTC, Lanham, state-AG UDAP, COPPA, GINA, GDPR, CCPA, 11 state rights acts, EU AI Act, and EU DSA into a single intersection with deterministic conflict resolution is operator-counsel-side. Surface 3 — Pre-filter deterministic gating + LLM semantic scoring: GRC vendors (Onspring, LogicGate, Resolver, MetricStream, ServiceNow GRC, Hyperproof, Drata) ship strong attestation primitives but treat marketing-output gating as out-of-scope; LLM-as-judge vendors (OpenAI GPT-5, Anthropic Claude Opus 4.7, Google Gemini Ultra, Mistral Large, Cohere Command R+, Meta Llama-3.1-405B) ship strong inference primitives but per-vertical calibration is operator-side. Surface 4 — Borderline routing to counsel: Temporal, Inngest, Trigger.dev, and Vercel Queues ship strong durable-workflow primitives but the routing policy (which output goes to which counsel queue with which SLA) is operator-counsel-side. Surface 5 — Attorney-relationship continuity and attorney-client privilege preservation across the workflow is operator-counsel-managed. Surface 6 — WORM audit trail at per-statute retention windows: AWS S3 Object Lock, Google Cloud Storage retention, Azure Blob immutable, and Snowflake Time Travel ship strong evidentiary primitives but the per-statute window choice (Lanham 7 years, FTC 7 years, HIPAA 6 years, SEC 3 years, FINRA 3 years, DEA 2 years, FDA 3 years, ATF 20 years, EPA per-program, EU AI Act record-keeping) is operator-counsel-side. Audit-management vendors (Workiva, Diligent, AuditBoard, ACL Robotics, Galvanize) ship strong attestation primitives but treat marketing-output-level audit as out-of-scope. Completions runs orchestration across all six surfaces under one Tier 3 Fractional CMO with AI Swarm engagement; operator owns the artifacts and can in-house at any time.

Question 3

What does the engagement look like across Tier 1, Tier 2, and Tier 3?

Accepted Answer

Tier 1 AI Readiness Assessment (2-3 weeks, diagnostic): audits the six surfaces above against the operator stack — which regulatory-source vendors are wired today (Westlaw, LexisNexis, Bloomberg Law, Wolters Kluwer, Compliance.ai, Thomson Reuters), which GRC or audit-management vendor anchors attestation today, which workflow engine runs borderline routing, which LLM-as-judge models are accessible, what WORM-storage infrastructure exists, and where the per-vertical per-jurisdiction rule library needs counsel review. Tier 2 AI Swarm Setup Sprint (4-8 weeks): builds the marketing compliance overlay on the compliance-overlay-manager agent, with the per-vertical rule libraries reviewed by operator counsel per vertical and per jurisdiction. Tier 3 Fractional CMO with AI Swarm (6-month minimum, 1-2 days/wk embedded): continues operating the overlay end-to-end and coordinating with the adjacent brand-spec-authoring, master-record-canonicalization, borderline-routing, cs-agent-assist, and every content-producing agent in the operator swarm.

Question 4

Who owns the rule library, attorney relationship, and audit trail during engagement?

Accepted Answer

Operator owns 100% of every artifact. The per-vertical rule library is versioned in the operator repo with attorney-approved per-rule, per-citation, and per-effective-date annotations. The per-jurisdiction-overlay-config lives in the operator repo with attorney-approved intersection-resolution and conflict-resolution policies. The attorney relationship is operator-owned and operator-counsel-maintained; Completions accesses attorney work-product under operator-controlled attorney-client privilege. The rule-extraction code and the overlay-composition code live in the operator repo with operator-controlled deploy pipeline. The pre-filter deterministic gate code and the LLM-as-judge scoring code live in the operator repo. The LLM prompt library lives in the operator repo with attorney-approved prompts for borderline-routing and override-citation. LLM API credentials (OpenAI, Anthropic, Google, Mistral, Cohere, Meta) sit under operator billing. Regulatory-source subscriptions (Westlaw, LexisNexis, Bloomberg Law, Wolters Kluwer, Compliance.ai, Thomson Reuters) sit under operator billing and operator credentials. GRC and audit-management vendor credentials (Onspring, LogicGate, Resolver, MetricStream, ServiceNow GRC, Hyperproof, Drata, Workiva, Diligent, AuditBoard) sit under operator billing where the operator runs them. Workflow-engine credentials (Temporal, Inngest, Trigger.dev, Vercel Queues) sit under operator billing. The audit trail persists to operator-controlled WORM storage (AWS S3 Object Lock, Google Cloud Storage retention, Azure Blob immutable, or Snowflake Time Travel) with per-statute retention windows operator-counsel-policy-approved. Completions owns the orchestration knowledge — how to design per-vertical rule libraries, how to tune per-jurisdiction overlay composition, how to debug intersection-resolution cascades, how to manage attorney-relationship continuity through change events, and how to coordinate the compliance overlay with the brand-spec-authoring, master-record-canonicalization, borderline-routing, cs-agent-assist, and content-producing-agent siblings in the operator swarm. The operator can in-house at any time; Completions credentials revoke immediately on engagement-end and the attorney relationship continues unbroken.

Question 5

What does Completions commit to on a Tier 3 engagement?

Accepted Answer

Completions commits to a 6-workstream pre-engagement-baseline reporting cycle on the compliance-overlay-manager agent: (1) Rule-Library workstream — pre-engagement baseline of which per-vertical rule libraries are attorney-approved today across healthcare, alcohol, firearms, financial services, pharmacy, dental, and any other operator vertical, then weekly reporting on rule-library coverage, rule-extraction events from upstream regulatory sources, and counsel-review cycle latency. (2) Per-Jurisdiction-Overlay workstream — pre-engagement baseline of which jurisdictions the operator markets in today and which have attorney-approved overlay-composition rules, then weekly reporting on overlay coverage and intersection-resolution events. (3) Pre-Filter-Gating workstream — pre-engagement baseline of which marketing outputs pass through deterministic pre-filter gating today, then weekly reporting on gate coverage and pre-filter outcomes. (4) LLM-Semantic-Scoring workstream — pre-engagement baseline of which outputs run through LLM-as-judge scoring today, then weekly reporting on ensemble coverage, confidence-tier distribution, and explainability completeness. (5) Borderline-Routing + Attorney-Privilege workstream — pre-engagement baseline of which counsel queues are wired today and which SLA each carries, then weekly reporting on routing decisions, counsel-feedback-cycle latency, and attorney-client privilege preservation events. (6) Audit-Trail + WORM workstream — pre-engagement baseline of WORM-storage discipline today, then weekly reporting on per-statute retention-window coverage (Lanham 7 years, FTC 7 years, HIPAA 6 years, PCI DSS 1 year, SEC 3 years, FINRA 3 years, state- Metrc per-state, DEA 2 years, FDA 3 years, ATF 20 years, EPA per-program, EU AI Act Articles 5/13/14/15/22/50 record-keeping where applicable), evidentiary-quality, and operator-account-ownership confirmation. Caveats: per-vertical and per-jurisdiction regulator policy can change without notice and require operator-counsel re-review — including HIPAA, FDA OPDP, ADA Title III, state medical-boards, state- Metrc, DISCUS, state ABC boards, ATF, NICS, state-firearms-bound-book regimes, SEC, FINRA, SOX, GLBA, DEA, FDA tobacco, state pharmacy boards, state dental boards, ADA Council on Dental Practice, FTC, Lanham Act, state-AG UDAP, COPPA, GINA, GDPR, CCPA, 11 state rights acts, EU AI Act Articles 5/13/14/15/22/50, and EU DSA; counsel-feedback-cycle latency and override decisions are operator-counsel-policy and outside Completions control; regulatory-source vendor pricing, content coverage, and feed reliability are vendor decisions outside Completions control; LLM-vendor API rate limits, model deprecation, and pricing changes are outside Completions control; WORM-storage retention windows and evidentiary-quality discipline are operator-counsel-managed; attorney-client privilege preservation is operator-counsel-managed; EU AI Act and EU DSA compliance applies only where the operator markets into the EU; per-state coverage applies per state where the operator markets; the audit trail persists to operator-controlled WORM storage on the operator cloud account; pre-filter gating coverage depends on operator content-producing-agent integration with the compliance-overlay-manager agent.

Question 6

How does engagement end and what is the operator transition path?

Accepted Answer

Tier 3 engagements are 6-month minimum with 90-day notice. At engagement end, Completions transitions back to operator in-house in 30-60 days: operating-playbook hand-off + in-house staff training across 3-5 operator team members covering per-vertical rule library maintenance, per-jurisdiction overlay composition, rule extraction methodology, pre-filter gating, LLM semantic scoring, borderline routing, attorney-relationship continuity, per-statute audit-trail retention, and WORM-storage discipline + regulatory-source subscription hand-off (Westlaw, LexisNexis, Bloomberg Law, Wolters Kluwer, Compliance.ai, Thomson Reuters) + GRC and audit-management credentials hand-off (Onspring, LogicGate, Resolver, MetricStream, ServiceNow GRC, Hyperproof, Drata, Workiva, Diligent, AuditBoard) + workflow-engine credentials hand-off (Temporal, Inngest, Trigger.dev, Vercel Queues) + LLM API credentials hand-off + rule-extraction code hand-off + overlay-composition code hand-off + pre-filter gate code hand-off + LLM-as-judge prompt library hand-off + audit-trail hand-off with WORM-storage operator-account-ownership confirmation; Completions credentials revoke immediately on engagement-end and the attorney relationship continues unbroken.

Frequently asked