# Compliance & Operations Checklist — AI US Growth Agency

## Client Onboarding Compliance

### Before Engagement Starts
- [ ] Business registration verified (country of origin)
- [ ] Product safety compliance checked (FCC, CPSC, FDA if applicable)
- [ ] Meta Business Manager / Google Ads account status: no active policy violations
- [ ] Ad account ownership verified (client is legal owner)
- [ ] Signed MSA (Master Services Agreement)
- [ ] Signed SOW (Statement of Work) for specific engagement
- [ ] Signed DPA (Data Processing Agreement) if accessing customer data
- [ ] IP/creative rights declaration signed (client warrants ownership of provided assets)

### Cannot Accept
- [ ] Products lacking required safety certifications
- [ ] Products with unsubstantiated health/medical claims
- [ ] Evidence of fake reviews (patterns, timestamp clusters, generic content)
- [ ] Infringing IP (counterfeit, unauthorized brand use, stolen creative)
- [ ] Deceptive pricing or bait-and-switch practices
- [ ] Products requiring professional licensure that brand lacks

## FTC Compliance Checklist

### Advertising Truthfulness
- [ ] All claims substantiated with evidence (screenshots, tests, certifications)
- [ ] "Before/after" claims have documented proof
- [ ] Price comparisons reference actual prevailing prices
- [ ] "Free" or "guarantee" terms have clear terms and conditions
- [ ] No deceptive formatting (hidden disclaimers, fine print)

### Reviews & Endorsements
- [ ] No fake or purchased reviews
- [ ] Incentivized reviews properly disclosed
- [ ] Material connections disclosed (#ad, #sponsored, "paid partnership")
- [ ] Reviewers are actual product users
- [ ] No review gating (soliciting only positive reviews)

### Influencer / Creator Content
- [ ] Clear written agreement with creators
- [ ] FTC disclosure requirements communicated to creators
- [ ] Creator content reviewed before publishing
- [ ] Rights/license documented (usage period, platforms, exclusivity)
- [ ] Portrait/voice/music rights cleared

### AI-Generated Content
- [ ] All AI-generated ad copy reviewed by human
- [ ] All AI-generated creative reviewed by human
- [ ] No deceptive AI-generated personas or fake testimonials
- [ ] AI image/video generation respects IP and likeness rights

## Data Privacy & Security

### Data We Access
- [ ] Read-only ad account access (Meta, Google)
- [ ] Read-only analytics access (GA4, Shopify)
- [ ] No direct access to customer PII unless essential and DPA-signed

### Data We Protect
- [ ] Client ad performance data: stored in company workspace, not shared
- [ ] Client financial data: encrypted at rest, access logged
- [ ] No storing of customer credit card, SSN, or health data
- [ ] Employee access: least privilege, role-based

### Departure / Offboarding
- [ ] Remove agency access from all client accounts within 24h
- [ ] Export and deliver all client-owned data
- [ ] Delete client data from agency systems (confirm in writing)
- [ ] Document handoff for ongoing campaigns

## Insurance & Legal

### Recommended (Consult Attorney)
- [ ] Professional liability / E&O insurance
- [ ] Cyber liability insurance
- [ ] General liability insurance

### Contract Terms to Include
- [ ] Limitation of liability
- [ ] Indemnification (mutual where appropriate)
- [ ] Dispute resolution (arbitration, jurisdiction)
- [ ] Termination for convenience (30-day notice)
- [ ] Force majeure

> ⚠️ THIS IS A BUSINESS DRAFT — NOT LEGAL ADVICE.
> All legal documents must be reviewed by a qualified attorney before use.