Legal and Regulatory Advisory Group
Helping people understand the rules that protect them — and helping builders design with those rules in mind.
Health, privacy, artificial intelligence, consumer protection, cybersecurity, and access-to-information laws change constantly. They also differ by jurisdiction and by how technology is designed. The Legal and Regulatory Advisory Group is an open effort to help the KISOP community understand those rules as they evolve.
KISOP does not define the rules.
The Commons helps people find them, understand them, see when they change, and understand what questions those changes create.
KISOP does not collect or maintain your Personal Neutral Archive (PNA). Your archive stays in a location you control. The Advisory Group helps the community understand the legal and regulatory landscape while preserving that owner-controlled architecture.
We have designed:
- The Legal and Regulatory Advisory Group is the people: the group that stewards the work.
- The Legal & Regulatory Commons is the public body of knowledge the group maintains.
- J-LR is the one community job on the Jobs Board that builds and maintains the Commons. Its numbered work packages (J-LR-001 and on) belong to that job. They are not separate jobs on the board.
The Legal & Regulatory Commons
The Advisory Group stewards a public body of knowledge for two audiences.
The Commons is a public navigation layer, translation layer, provenance layer, and maintenance layer across authoritative legal and regulatory sources. It is not intended to replace legal advice, statutes, regulations, authoritative government guidance, or qualified professional counsel.
It should help a person begin with the problem they actually have. Nobody should need to know first whether to begin with HHS, the FTC, the FDA, ONC, a state regulator, a statute, or another authority.
For individuals
Start with the question you are actually trying to answer.
- How do I get my health information?
- Who can see it?
- How do I let someone help me?
- Can I correct an error?
- What changes if a caregiver or a child is involved?
- What protections apply if AI is involved?
- What happens in an emergency?
- What happens if I cannot act for myself?
- What happens after I die?
- How do I move my records between systems?
For builders
Start with what the proposed mechanism actually does.
- Does data leave the individual's chosen location?
- Who can see, process, transmit, or infer information?
- Does the mechanism introduce a regulated relationship?
- Is an AI provider or another external service involved?
- Is consent or authorization necessary?
- Is identity verification necessary?
- Can permission be withdrawn?
- Could the mechanism become clinical decision support?
- Could medical-device regulation become relevant?
- Does the mechanism introduce new security or breach obligations?
Problem first → relevant regulatory authorities second.
A reader is never asked to know the names of statutes in advance. The Commons starts from the question and leads outward to the authorities that govern it.
How this sits beside existing resources
KISOP does not replace HHS, the FTC, the FDA, ONC, state regulators, statutes, courts, or legal counsel. Existing government and commercial resources already cover portions of this landscape.
The Commons lets a person begin with the human problem or the design problem, then navigate outward to the relevant authorities.
one real-world question → relevant authorities → two interpretations
For me as an individualWhat rights, risks, or protections should I understand?
For me as a builderWhat does this mean before I design something?
Behind both interpretations, every entry shows the same chain:
primary authority → jurisdiction → effective date → interpretation → disagreement → practical implication → last verified → next review → change history
How a Commons entry is built
Every maintained legal or regulatory entry makes its provenance and its uncertainty visible. Each one carries these sections, in this order.
- What the law says
- Primary legal authority.
- What regulators say
- Regulations, official guidance, and enforcement positions.
- What we think it means
- Qualified analysis, clearly identified as interpretation.
- Where people disagree
- Material competing interpretations.
- What this means for individuals
- Plain-language implications.
- What this means for builders
- Practical design implications.
- What we don't know
- Open questions and unresolved issues.
- What changed
- Visible change and version history.
- Sources
- Primary authority first.
- Review metadata
- Status, jurisdiction, effective date where relevant, last verified, verified by, next review, change history.
The review metadata sits at the top of every entry, like this example:
When an entry passes its review date, it says so at the top, before anything else:
Review overdue — information may have changed.
Five publication rules
- Primary sources first. Statutes, regulations, official agencies, courts, and authoritative standards are the basis of every published legal assertion.
- Every legal statement has a jurisdiction and a date. A sentence such as “the law requires…” does not appear without the legal context it applies to.
- Separate law from guidance. Statutes, regulations, agency guidance, enforcement positions, professional interpretation, and community recommendations are labeled as what they are.
- Never hide uncertainty. When qualified experts disagree, the entry documents the competing interpretations. It does not manufacture certainty.
- Staleness is visible. Every maintained page shows its review status. Material past its review date says so.
Before you build: the builder gate
The gate is a reusable legal and regulatory design review. A builder answers these questions before designing or releasing a new mechanism. It is meant to become the legal and regulatory counterpart of a security threat model.
Where information goes
- Does personal information leave the individual's chosen location?
- Does KISOP receive it?
- Can a builder receive it?
- Does a third party receive it?
- Is information sent to an AI model or an external service?
- Does the mechanism infer new health information?
- Is information remotely logged?
- Is anything cached, retained, or backed up?
Who can gain access
- Can another person gain access?
- How is that person's authority established?
- Is consent required?
- Is authorization required?
- Can permission be withdrawn?
Who is involved
- Are children involved?
- Are vulnerable adults involved?
What the mechanism does
- Does the mechanism provide medical recommendations?
- Could it constitute clinical decision support?
- Could it become regulated medical-device software?
- Does it create a regulated healthcare relationship?
What duties it creates
- Does it create new breach-notification obligations?
- Does it create material cybersecurity obligations?
The architecture
- Does it change the owner-controlled Personal Neutral Archive architecture?
The design rule
If a proposed mechanism changes the Personal Neutral Archive's owner-controlled architecture, flag it for Legal & Regulatory review before release.
The job on the Jobs Board: J-LR
One umbrella job builds and maintains the Commons. The work packages below belong to it. They are not separate jobs, and the board does not grow by one job per package.
| Job | Build and Maintain the Legal & Regulatory Commons |
|---|
| Job ID | J-LR |
|---|
| Kind | Legal / regulatory / public knowledge |
|---|
| Steward | Legal and Regulatory Advisory Group (Carmen answers for the record until the group is formed) |
|---|
| Work model | Initial build + continuing maintenance |
|---|
| Status | proposed — named, on the board |
|---|
| The record | The whole record on the Jobs Board → |
|---|
The problem
People increasingly have to make consequential decisions involving health information, privacy, AI, digital identity, and other technologies, while the laws governing those systems are difficult to understand and constantly changing.
Builders face the problem from the other direction. A technically simple feature can introduce new privacy, healthcare, consumer-protection, security, or regulatory obligations.
The job
Build and continuously maintain an open Legal & Regulatory Commons for KISOP. The Commons should help individuals understand their rights and help builders identify legal and regulatory considerations before designing or releasing new mechanisms.
Material should be:
- understandable to non-lawyers
- traceable to authoritative sources
- jurisdiction-specific
- dated
- visibly reviewed
- visibly maintained
- transparent about uncertainty
This is public regulatory infrastructure. It is not individual legal advice.
The lifecycle for this job: seven steps
Publication is one step in the loop. When something changes, the work goes around again: Updated → Verified → Published → Monitored.
The Jobs Board's own loop has four steps: Name, Fund, Build, Released. This job carries seven because legal and regulatory knowledge can go stale after it is published. The same seven steps may later serve other maintained knowledge: safety information, medical information, standards, registries, translations.
The work packages
| Package | Name | What it covers |
|---|
| Foundation |
| J-LR-001 | Design the Legal & Regulatory Commons | Define the taxonomy, the page format, source requirements, jurisdiction conventions, legal-status labels, update history, provenance, and the review process. |
| J-LR-002 | Establish the Advisory Group | Create the charter, membership standards, independence rules, conflict disclosures, review authority, minority-view handling, and governance. |
| J-LR-003 | Build the Authoritative Source Registry | Maintain the primary sources: statutes, regulations, Federal Register material, HHS/OCR, the FTC, the FDA, ONC, state regulators and attorneys general, legislatures, courts, and relevant standards bodies. |
| J-LR-004 | Build the Law Change Tracker | Track each change as: date → jurisdiction → authority → change → effective date → affected KISOP topic → reviewer → required action. |
| Individual rights |
| J-LR-010 | Individual Rights Library | Written for ordinary people first. The first ten entries: Your Right to Your Health Information · Who Can See My Health Information? · Giving Someone Permission to Help Me · Caregivers, Family Members and Proxy Access · Children, Teens and Parents · What Happens During an Emergency? · What Happens If I Become Incapacitated? · What Happens to My Archive After I Die? · Correcting Errors in Health Records · Moving Your Records Between Systems. |
| Builder work |
| J-LR-020 | Builder Regulatory Review | Turn the builder gate above into a reusable Before You Build review, with the design rule on the Personal Neutral Archive's owner-controlled architecture at its center. |
| Regulatory maps |
| J-LR-030 | Federal Regulatory Map | First areas: HIPAA / HITECH · the FTC Act · the FTC Health Breach Notification Rule · the 21st Century Cures Act · information blocking · ONC and health interoperability · FDA digital health and software · COPPA · behavioral health and 42 CFR Part 2 · genetic information · federal research rules · relevant federal AI developments. |
| J-LR-040 | State Regulatory Map | Begins with California, Washington, Nevada, Connecticut, Oregon, Colorado, Maryland, and New York; later all 50 states and DC where appropriate. Every state entry distinguishes effective law, enacted but not yet effective, regulation pending, proposed legislation, enforcement development, and significant court decision. Proposed legislation is never presented as current law. |
| AI and emerging technology |
| J-LR-050 | AI & Emerging Technology | AI regulation · automated decision-making · agents · digital identity · age verification · biometric privacy · genetic privacy · emerging technology-specific regulation · relevant consumer-protection issues. |
| Regulatory watch |
| J-LR-060 | Regulatory Watch | Continuous monitoring of legislation, regulations, proposed rules, final rules, agency guidance, enforcement actions, significant judicial decisions, interoperability requirements, consumer-health privacy developments, AI legislation, cybersecurity regulation, reproductive-health privacy developments, and biometric and genetic privacy. |
| Translation and verification |
| J-LR-070 | Consumer Translation | Turn professional legal and regulatory analysis into material ordinary people can understand, with the legal meaning unchanged. |
| J-LR-080 | Builder Translation | Turn legal and regulatory analysis into practical design constraints, engineering questions, and pre-build considerations. |
| J-LR-090 | Continuous Verification | Scheduled review · stale-content detection · review dates · change management · version history · re-verification · publication history. |
The structure is built to grow. Individual Commons entries and the regulatory maps are added under these packages as they are built, verified, and published.
Who is in the group
The group is multidisciplinary. Lawyers can explain the law. Builders can explain what a system actually does. Clinicians can explain healthcare practice. Individuals can explain whether a mechanism works for the people it is supposed to protect. The Commons brings those perspectives together and stays clear about which conclusions are legal interpretations and which are design, ethical, clinical, or community judgments.
Core legal and regulatory roles
- Legal & Regulatory Commons Steward
- Health Privacy Counsel / Advisor
- Consumer Privacy Counsel / Advisor
- Healthcare Regulatory Counsel / Advisor
- FDA / Digital Health Regulatory Advisor
- Health Information Interoperability Advisor
- Consumer Protection Advisor
- AI Law & Governance Advisor
- Cybersecurity & Breach Law Advisor
- Children & Family Privacy Advisor
- Elder Law / Vulnerable Adults Advisor
- Behavioral Health & Substance-Use Privacy Advisor
- Genetic / Biometric Privacy Advisor
- Research Ethics & Regulation Advisor
- Civil Liberties / Digital Rights Advisor
- Accessibility & Civil Rights Advisor
Research and maintenance
- State Law Researchers
- Legislative & Regulatory Researcher
- Case Law Researcher
- Authoritative Source Librarian / Registry Maintainer
- Change Tracker / Verification Coordinator
Communication and implementation
- Plain-Language Legal Writer
- Consumer Reviewer
- Builder / Engineer Reviewer
- Security Reviewer
- Clinical Advisor
- Ethics Advisor
- Community Representative
Specialists join when a question needs them. Not every specialty needs a permanent seat.
Where this stands
What exists today: this page, the J-LR job on the Jobs Board with its work packages, the role roster, and the builder gate as a list of questions.
What does not exist yet: no Commons entry is published, no regulatory map has been built, and the Advisory Group has not been formed. Its charter is work package J-LR-002.
Nothing on this page is legal advice. For a decision, check the dated primary source and seek licensed legal help.
Next reviews: the founder's review of this page and a Spanish edition in her voice are both pending. Written September 11, 2026, from the design specification of September 9–11, 2026.
I would join the Advisory Group
I would fund J-LR
Name a question for the Commons