TL;DR: A vibe coding compliance checklist has five parts: GDPR basics, EU AI Act Article 50 notice, SOC 2 readiness, a privacy policy that matches your real data flows, and data retention jobs that run on their own. AI builders skip all five. This page gives you the full checklist, and a free scan tests your live app in about 60 seconds.
You built your app with Lovable, Bolt, Cursor, or v0. It works. But working code is not lawful code. The AI wired the features. It did not wire the privacy layer. No consent records. No real delete flow. No note that tells users an AI is talking to them. Those gaps are yours to close before launch.
This checklist walks the five parts in order. Run it top to bottom. Fix what fails. Then re-check. That is the whole method. Most founders can clear it in days, not weeks.
Why this checklist cannot wait until launch day
AI builders are great at features. They do not reason about lawful basis, or delete requests, or AI notice rules. Nobody prompted them to.
The numbers back this up. Symbiotic Security scanned 1,072 AI-built apps: 98% had at least one flaw, and 16% had critical issues. A CMU study found 61% of AI-written code had at least one security flaw. Across 100 apps we scanned ourselves, the average Launch Readiness Score was 42/100.
These gaps and the security gaps share one root cause. The AI wrote code that works. Not code that keeps records. That is the missing 20%. All of it can be checked.
Part 1 — GDPR basics
GDPR does not care where your office is. It cares where your users live. One EU signup brings your app in scope. Check these six items:
- Lawful basis, per data type. Consent, contract, or legitimate interest. Pick one for each type of data you hold. Write it down.
- Right to erasure. The delete button must delete. A soft-hidden row is not erasure. Test it, then look in the database.
- Data export. Users can download their data in a form they can use, like JSON or CSV.
- Consent records. Timestamped and stored. A checkbox that vanishes on submit is not a record.
- Database rules. Row Level Security on every table. Owner-scoped policies. A policy of
USING (true)counts as off. - Sub-processor list. Every third-party API that touches user data gets named in your policy. Payments, email, AI models — all of them.
The database item does the most damage. CVE-2025-48757 exposed 170+ Lovable-built apps that shipped with weak or missing RLS. Open tables are not just a breach risk. They are a GDPR breach in waiting. Test yours with the free RLS checker.
This page stays at checklist depth. For the full walkthrough, read our GDPR guide for vibe-coded apps.
Part 2 — EU AI Act Article 50
Mark the date: August 2, 2026. That is when Article 50 starts to apply in the EU.
The rule is simple. If your app has a chatbot, generates content, or makes auto choices a user sees, you must tell users an AI is involved. At the point of use. Not buried on page nine of your terms.
Break the rule and the fine runs up to €15 million or 3% of global turnover, whichever is higher. For a small SaaS, that is not a line item. That is the company.
- Say it is an AI wherever users meet the model: chat widgets, AI-made text, auto choices.
- Keep a short doc: what the AI does and what data feeds it.
- Write down where a human checks the AI's work, if anywhere.
- Track Article 50 on its own line, apart from GDPR consent.
Not sure if it applies to you? Our EU AI Act guide for SaaS founders answers that in plain terms.
Part 3 — SOC 2 readiness
SOC 2 is not a badge you buy. It is a set of controls you run, then prove you ran. And to be clear about our own limits: we do not certify SOC 2. A licensed auditor does that. What we do is get you ready.
Getting ready for it starts here:
- Access logs. Who touched what data, and when. Most AI-built backends log errors and nothing else.
- Least privilege. Every key and service role gets only the access it needs. AI builders often grant admin scope by default.
- Change records. A trail of what changed in production and who approved it.
- Incident plan. Written before the breach, not made up during it.
- Vendor list. A paper trail for every vendor your app leans on.
None of this is exotic. It is the boring layer big buyers expect, and vibe-coded builds almost never have it.
Part 4 — A privacy policy that matches reality
Ask an AI builder for a privacy policy and you get canned text. It reads fine. It just has nothing to do with your actual data flows. A policy that holds up needs to state:
- What you collect, by type: account info, usage logs, payment data, AI prompt history.
- How long you keep each type, and why you chose that period.
- Where the data lives — region matters under GDPR — and who can reach it.
- How a user asks to be deleted, and the time frame you commit to.
If your policy says one thing and your database does another, the policy makes things worse. It is written proof you knew the rules.
Part 5 — Data retention that runs on its own
Retention is the quiet one. Nothing crashes when you keep data too long. The app hums along. Your database just grows into a bigger risk every day it runs.
Two steps close it. Set a retention period for each data type. Then set a job that deletes it on a schedule. Set it once. Let it run. A rule with no job behind it is a wish. We often see apps holding full chat logs and deleted-user rows long past any period their policy claims.
The full checklist, in one table
| Category | What to check | Common vibe-coded failure |
|---|---|---|
| GDPR | Lawful basis, erasure, export, consent logs | No documented basis; delete is soft-hide only |
| EU AI Act (Article 50) | AI disclosure at the point of use | Chatbot never says it is an AI |
| SOC 2 foundations | Access logs, least privilege, incident plan | Service keys with full admin scope |
| Privacy policy | Matches real data flows and retention periods | Boilerplate with no link to practice |
| Data retention | Automated deletion jobs on a schedule | No job; data kept forever |
| Database rules | RLS on, owner-scoped, on every table | Policies set to USING (true) |
| Security headers | CSP, HSTS, X-Frame-Options set | No headers at all |
How to test it without reading code
You do not need to read the code the AI wrote. Test the live app instead — that is what a regulator, a buyer, or an attacker sees.
- The free scan scores your live URL out of 100 across all four audit areas.
- The security headers checker shows which browser defenses your host sends.
- The API rate limit checker tests if your endpoints push back under load.
- The RLS checker tests if your tables answer to the public anon key.
What it costs
The scan is $0. The Compliance Score is $799 one time: 60 checks across GDPR, the EU AI Act, SOC 2, and ISO 27001, plus an AI policy review, template docs, and a report. The $799 is credited toward DFY Compliance Setup at $2,999, where a CTO makes every fix. Ongoing checks with drift alerts run $399 a month.
On the security side, the full Launch Readiness Audit is $499 one time: a branded report, a ranked fix plan with a time cost for each fix, and how you stack up against 200+ audited apps. See a sample report before you buy.
Comparing us to your current shortlist? Read how we stack up against Sprinto, Thoropass, and Vanta — or see a sample compliance report.
FAQ
What should be on a vibe coding compliance checklist?
Five parts: GDPR basics (lawful basis, delete rights, export, consent records), EU AI Act Article 50 notice, SOC 2 readiness (logs, least privilege, an incident plan), a privacy policy that matches your real data flows, and data retention jobs that run on their own. AI builders skip all five by default.
Does GDPR apply if my company is not in the EU?
Yes. GDPR follows your users, not your office. If one EU resident can sign up for your app, GDPR applies to the data you hold on them. Where your company is registered does not change that.
What happens on August 2, 2026 under the EU AI Act?
Article 50 starts to apply. If your app has a chatbot, generates content, or makes auto choices a user sees, you must tell users an AI is involved, at the point of use. Break the rule and the fine runs up to 15 million euros or 3% of global turnover.
Do I need SOC 2 before launch?
No. You need SOC 2 readiness, not the report itself. Start the habits an auditor will ask about: access logs, least-privilege keys, change records, and a written incident plan. Get the formal report later, when a big buyer asks for it. We prep you for SOC 2. We do not certify it.
How do I run this checklist without reading code?
Scan your live URL. The free scan tests what your app exposes to the public, with no code access and no install, in about 60 seconds. It is free. The Compliance Score runs 60 checks across GDPR, the EU AI Act, SOC 2, and ISO 27001 the same way.
What does a compliance check cost?
The baseline scan is $0. The Compliance Score is $799 one time: 60 checks, an AI policy review, template docs, and a report. That $799 is credited toward DFY Compliance Setup at $2,999 if you want the fixes done for you.
The deadline for Article 50 does not move because your product is still in beta. The pattern is the same one our vibe coding security guide shows for every AI tool: the code works, the defaults do not. Run the checklist. Fix what fails. Launch clean.
Find your compliance gaps in 60 seconds
Free scan of your live URL. No code access. No install. A Launch Readiness Score out of 100 and the list of gaps to fix.
Run the free scan — $0