Open questions, counsel items, and the verify list
This is the honest list of what is not settled. Items move off this page only when a human closes them with a decision and a date.
Counsel and adviser decisions needed#
| # | Question | Affects | Safe default meanwhile |
|---|---|---|---|
| 1 | Appoint a UK Article 27 representative and an EU representative; confirm ICO fee registration | Scribe, AIBookly, any UK or EU user | Disclose Indian storage and transfer tools; keep UK and EU marketing passive |
| 2 | UK VAT registration (no threshold for B2C digital services) and EU OSS; US sales-tax nexus monitoring | Scribe, AIBookly, Digitailor, Nimitra, Rollout | Use Stripe Tax for calculation; track sales by country and state from day one; B2B with VAT numbers only until registered |
| 3 | GST treatment of each export line under LUT; Softex and EDPMS applicability for SaaS subscriptions; FIRC handling | RM Bills, every foreign sale | Zero-rate exports under LUT with FIRC filed; CA review quarterly |
| 4 | Per-school payment aggregator structure (Razorpay Route vs per-school merchant accounts) | Tulip | No fee collection until settled |
| 5 | RM Music: licensing path or permanent private status | RM Music | Private household use only |
| 6 | Medical-device classification and evaluation plan for the RM Pharma reader and DuoFlow | RM Pharma, DuoFlow | Investigational labelling; no clinical claims |
| 7 | Google restricted-scope verification and CASA for Gmail access | Digitailor, Folio (Calendar) | Forwarding-address design or postpone inbox access |
| 8 | Attorney review of CoParent, Tulip, isdwell, Nimitra, Scribe, Dwell legal drafts | All | Drafts stay marked "draft, under review" |
| 9 | Immigration-authorship guidance for AI-assisted books used in petitions | AIBookly, Merit | Document human authorship; disclose AI assistance to counsel |
| 10 | Online Safety Act scoping: which RM services have UK links and are user-to-user | Nest, Meet, Drive, Music, MyJanata, Rollout | Complete an illegal-content risk assessment template for Nest and Meet |
| 11 | Trademark search and filing for product names (Meet, Drive, Nest, Planet, Atlas, Tulip, Folio, Rollout, Nimitra, Scribe, Digitailor, isdwell, Dwell) | All | House mark always present; no third-party trade dress |
| 12 | DMCA agent registration with the US Copyright Office | Drive, Nest, MyJanata, Rollout | Takedown page and mailbox live anyway |
| 13 | Data Protection Officer or contact person appointment and publication | All (DPDP) | Grievance page with a named person |
| 14 | SEBI posture if Lakshmi is ever shown outside the company | Lakshmi | Internal only |
| 15 | Dietitian or nutrition-advice licensing in target US states for individualised plans | RM Health | Educational suggestions; coach title only |
| 16 | Commercial-use terms of the ISP line and insurance (cyber, general liability) for hosting clients | RM Cloud | Disclose nothing beyond what is true; get quotes |
| 17 | Colorado AI Act and California ADMT applicability review for Dwell, LegalOS, Merit, RM Health | Those apps | Human-decides design, notices, impact assessment drafts |
| 18 | Company annual calendar: ROC filings, GST returns, TDS, professional tax, Shops and Establishments (AP), statutory audit, board meetings, DPIIT and Udyam registrations | Company | CA and CS engaged; calendar in RM Home |
Security debts with legal consequences#
- Rotate and purge: Calendar/Folio
server/.env(Google client secret, SECRET_KEY, mail password), Meet historical secrets (rotated, flags pending), CoParent shared SECRET_KEY (three-key split), LegalOS documented passwords, any key that appears in memory notes. - Scribe has no Postgres backups; Meet keeps state in process memory; RM Health runs on SQLite with one worker.
- Meet: E2EE claim, host authorisation, serve.cjs traversal, dev guest endpoint in production.
- CoParent: E2EE claim, 65B wording, attorney-access model.
- Tulip: global Razorpay key for school fees.
- Digitailor: channel-terms review and bot-detection response policy.
- Authenticator: 2.5 GB untracked tree; bring it under version control without secrets.
Verify list (law that may have moved after 2026-08-21)#
| Item | Why it matters | Check |
|---|---|---|
| DPDP Rules commencement dates and the exact breach-report timeline and rights-response period | Every app | MeitY notifications |
| IT Rules synthetic-media labelling amendment final text | Any generated media | MeitY |
| FTC click-to-cancel status after the 2025 vacatur; any new rulemaking | Subscriptions | FTC |
| Colorado AI Act effective date (30 June 2026) and any amendments | Dwell, LegalOS, Merit, RM Health | Colorado legislature |
| EU AI Act Annex III high-risk timeline (Digital Omnibus delay proposal) | EU users | EUR-Lex |
| California CPPA ADMT and risk-assessment regulations phase-in | US users | CPPA |
| UK DMCC subscription-contract provisions commencement | UK subscriptions | CMA, DBT |
| UK PECR analytics-cookie exemption scope after the Data (Use and Access) Act 2025 | UK cookie layer | ICO |
| Apple and Google external-purchase-link rules by market | In-app subscriptions | App Store and Play policy pages |
| GST e-invoicing threshold; UK VAT and EU OSS rules for non-resident digital suppliers | Billing | CBIC, HMRC, EU |
| RBI recurring-payment limits and e-mandate rules; PA Directions 2025 | Indian billing, Tulip | RBI |
| CERT-In Directions amendments | Logging and reporting | CERT-In |
| TRAI consent-registration (DCA) rollout for commercial messaging | SMS and WhatsApp | TRAI |
| Medical Devices Rules software classification guidance | RM Pharma, DuoFlow | CDSCO |
| COPPA amended rule compliance date (April 2026) | Any US minors | FTC |
| State privacy laws adding or lowering thresholds (Texas, Nebraska, Maryland, and new states) | US users | State AGs |
| Online Safety Act codes and Ofcom guidance updates | UK U2U services | Ofcom |
Review cadence#
- Quarterly: verify list, vendor register, access review, open counsel items.
- On every new app or new data class: app register entry before first user.
- Twice a year: incident drill, restore drill, copy audit for banned claims.
- Yearly: full playbook review with counsel; update
REVIEWED.