feature-risk-assessment

Feature Risk Assessment (UK)

Matter context

Matter context. Check ## Matter workspaces in the practice-level CLAUDE.md. If Enabled is ✗ (the default for in-house users), skip the rest of this paragraph — skills use practice-level context and the matter machinery is invisible. If enabled and there is no active matter, ask: "Which matter is this for? Run /product-legal-uk:matter-workspace switch <slug> or say practice-level." Load the active matter's matter.md for matter-specific context and overrides. Write outputs to the matter folder at ~/.claude/plugins/config/uk-legal-plugins/product-legal-uk/matters/<matter-slug>/. Never read another matter's files unless Cross-matter context is on.

---

Purpose

The launch review is broad. This is deep. When a single issue needs more than a table row — a novel AI feature, a children's product, a financial promotion, something under active CMA or ICO scrutiny — this skill produces a standalone assessment.

Not every launch needs one. Most don't. This is for the 10% where "DPIA triage done, shipped" isn't the right level of scrutiny.

When to run this

• Launch review found a pattern that's not in the calibration table (novel)
• Launch review found something in the "usually blocks" category
• GC or leadership asked "what's the risk here" and wants more than a one-liner
• The feature is in an area with active regulatory attention (AI, children, financial products, online platforms, medical devices, biometric data)
• CMA, ICO, FCA, MHRA, or Ofcom are actively looking at this space
• Someone outside legal is worried and a structured answer would help

If none of the above, the launch review is enough. Don't generate paperwork for its own sake.

Structure

1. What we're assessing

One paragraph. What the feature does, what's new about it, why it got escalated to a full assessment.

2. The risks

For each distinct risk (aim for 2-5, not 15):

### Risk [N]: [Short name]

**Scenario:** [What would have to happen for this to go wrong. Be specific —
not "CMA investigation" but "the subscription default-on enrolment triggers
CMA scrutiny under DMCC Act 2024 s 224-227 because users are enrolled without
a single click opt-in at point of first payment."]

**Who gets hurt:** [Users? The company? A third party? Specific.]

**How likely:** [Low / Medium / High — with a reason. "Low — would require
both X and Y to fail simultaneously." Not just a vibes rating.]

**How bad if it happens:** [Low / Medium / High — with a reason. "High —
CMA enforcement notice + potential civil/criminal penalty under DMCC Act 2024"
vs. "Low — ASA challenge requiring copy change, no financial penalty."]

**Existing mitigations:** [What already reduces the likelihood or impact]

**Gap:** [What's missing, if anything]

**Residual risk:** [After existing mitigations — is this acceptable or does
it need more?]