Matter Context
Matter context. Check the practice-level CLAUDE.md for ## 事项工作空间. If Enabled is ✗(the default for in-house legal users), skip the rest of this section—the skill uses practice-level context and the matter mechanism is not visible. If enabled and there is no active matter, ask: "Which matter is this? Run /product-legal:matter-workspace switch <事项简称> or say 实务级." Load the active matter's matter.md to get matter-specific context and override rules. Write output to the matter folder ~/.claude/plugins/config/claude-for-legal-zh/product-legal/matters/<事项简称>/. Never read files from other matters unless 跨事项上下文 is 开.
Purpose
Launch review is breadth. This is depth. When a single issue needs analysis beyond a table row—a novel AI feature, a children's product, a matter a regulator is actively watching—this skill produces a standalone assessment.
Not every launch needs this. Most don't. This is for the 10% where the review depth of "finish the personal information protection impact assessment and launch" is not enough.
When to Run
- The launch review finds a patternnot in the calibration table(brand new)
- The launch review finds something in the **"usually blocks"** category
- The legal lead or leadership asks "what's the risk here" and needs more than one sentence
- The feature is in an area ofactive regulatory attention(AI, children, biometrics, health, finance)
- Someone outside the legal team is worried and a structured answer would help
If none of the above apply, a launch review is enough. Do not generate paperwork for its own sake.
Structure
1. What We're Assessing
One paragraph. What the feature does, what's new about it, and why it has been escalated to a full assessment.
2. Risks
For each independent risk (aim for 2-5, not 15):
### 风险[N]：[简短名称]
**场景：**[需要发生什么才会导致出问题。要具体——不是"数据泄露"
而是"推荐算法因X将用户的敏感类别兴趣展示给了不该看到的人。"]
**谁受伤害：**[用户？公司？第三方？要具体。]
**可能性多大：**[低/中/高——附理由。"低——需要X和Y同时失效。"
不只是感觉评分。]
**如果发生有多严重：**[低/中/高——附理由。"高——
行政处罚+集团诉讼暴露+媒体报道"vs."低——一条愤怒的微博，无实际损害。"]
**现有缓解措施：**[已经降低可能性或影响的措施]
**缺口：**[还缺什么，如果有]
**剩余风险：**[在现有缓解措施之后——这是可接受还是需要更多？]
3. Regulatory Environment (if relevant)
Include only if a regulator is actively focused on this area. If so:
- Which regulator, and what they have recently said/done
- How this feature looks to them
- Whether we want them to hear about it from us or from a headline
In the Chinese law context, monitor the recent enforcement developments and guidance of the State Administration for Market Regulation, the Cyberspace Administration of China, the Ministry of Industry and Information Technology, public security authorities, and other industry regulators.
4. Precedent (if any)
Have other companies done something similar? What happened?
- If nothing went wrong → useful, but not decisive
- If something went wrong → how their situation differs and whether it applies here
Do not overvalue precedent. Regulators change priorities; one company getting away with it does not mean the next one will.
5. Options
Present 2-3 realistic paths:
| 选项 | 描述 | 风险降低 | 成本 |
|---|---|---|---|
| A：按设计上线 | [当前计划] | 无 | 无 |
| B：上线并增加[缓解措施] | [改动] | [多少] | [开发工作量、时间、用户体验] |
| C：不上线[组件] | [砍范围] | [多少] | [产品影响] |
6. Recommendations
Pick one. Explain why. Acknowledge what trade-off you are making.
**建议：选项[X]**
[理由。剩余什么风险。为什么可接受。谁接受。]
**如果答案是"非我能定"：**[谁决定，他们需要知道什么]
Calibration Check
Before finalizing, check against ~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md → Risk calibration check:
- Is this risk assessment calibrated tothis company, or is it generic?
- May be "High" risk for a company under a consent decree, "Medium" for one that is not
- The assessment should reflect the actual regulatory environment, litigation history, and risk appetite recorded in the practice profile
Handoff
- To AI Governance: If the deep assessment is triggered by an AI feature—which is very common—run
/ai-governance-legal:aia-generation [功能]at the same time or immediately after. The feature risk assessment builds the decision framework; the algorithm safety assessment specifically documents the AI system in the format required by AI governance. The two do not overlap: the FRA is a product legal decision document; the algorithm safety assessment is a governance record. - To Personal Information Protection: If the feature involves new data collection or processing, run
/privacy-legal:pia-generation [功能]. The risk section of the FRA may overlap with the personal information protection impact assessment—flag that overlap to avoid duplicate work, but both documents need to exist. - To AI Governance Vendor Review: If the feature uses a new AI vendor, run
/ai-governance-legal:vendor-ai-review [供应商协议], if not already completed during the launch review.
Output Format
Standalone document, 2-4 pages. Headed with the work product header in ~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md ## 输出规范 (varies by user role—see ## 使用者）。
Not a PPT deck, not a memo—it is a decision document to be read and then acted on.
Save to ~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md → the review document storage location specified by the launch review process. If the document will be shared with anyone outside the confidentiality scope (for example, posted to a broadly shared ticket), remove the work product header only for that external version, and keep the confidential original version in the matter file.
Citation Check
If the assessment cites cases, statutes, regulations, or enforcement actions—especially in the regulatory environment or precedent sections—these citations are generated by an AI model and not verified against the original sources. Before the decision document goes to the decision-maker, verify each citation's accuracy, validity, and current enforcement posture against a legal research tool (PKULaw, Wolters Kluwer, Faxin, or your firm's research platform). A risk assessment built on fictitious enforcement actions is worse than no assessment at all.
No silent supplementation. If a retrieval query against the configured legal research tool returns few or no results, report what was retrieved and stop. Do not fill in from web search or model knowledge without asking. Say: "[Tool] search returned [N] results. Coverage on [regime/precedent] appears limited. Options: (1) broaden the retrieval query, (2) try a different research tool, (3) search the web—results will be flagged
[联网检索 — 需复核], and should be verified against the issuing authority before relying on it, or (4) flag as unverified and stop. Which do you choose?" It is for the lawyer to decide whether to accept lower-confidence sources.Source attribution. Tag each citation in the regulatory environment and precedent sections with its source:
[北大法宝]、[威科先行]、[监管机构网站], or the MCP tool name for citations obtained from legal research integrations;[联网检索 — 需复核]for web search citations;[模型知识 — 需验证]for citations recalled from training data;[用户提供]for citations provided by the feature team. Tag需验证citations carry a high fabrication risk and should be checked first. Never strip or collapse the labels—decision-makers need to see which citations need to be verified first.
Close with a next-step decision tree
Close with the next-step decision tree in CLAUDE.md ## 输出规范 . Tailor the options to what this skill just produced—the five default branches (draft X, escalate, gather more facts, monitor and wait, other) are a starting point, not locked in. The decision tree is the output; the lawyer makes the choice.
What this skill does not do
- It does not evaluate every feature. Most features need only a launch review.
- It does not make decisions. It builds a decision framework. The person with authority chooses the option.
- It does not do quantitative risk modeling. If the company has a formal risk framework with numbers, use that framework—this is a qualitative assessment.