<!--
==============================================================================
  REGULATORY EXPOSURE PROFILER  —  POC v0.6 (regime -> requirements/standards & regulations)  —  June 2026
  Single self-contained file. No backend. Open in any browser to run it.
==============================================================================

  HOW TO EDIT THIS FILE  (you can safely change everything below by hand)
  ----------------------------------------------------------------------------
  This is a plain-text file. Open it in any text editor (Notepad, VS Code,
  TextEdit-as-plain-text). Change what you need, SAVE, then reload the browser
  tab. There is no "publish" step — the browser reads this file live.

  >>> NOTE: this HTML carries its OWN copy of the engine. The Excel master
      table is NOT connected to it. If you change a tier or wording in Excel,
      you must ALSO change it here (or it won't show up in the tool). Keep this
      file as the source of truth while iterating. <<<

  ----------------------------------------------------------------------------
  THREE THINGS YOU'LL WANT TO EDIT  —  search the file for these labels:
  ----------------------------------------------------------------------------

  1) RE-SKIN THE TOOL  →  search:  const BRAND
     Four lines. Change firmName, logoUrl, primaryColor, backLink for a given
     deployment (CIO Advise, AI Velocity, an MSP, or yours). Nothing else moves.

  2) CHANGE WORDING, A TIER, A NAME, OR WHEN A REGIME APPEARS  →  search:  const REGIMES
     Each regulation is ONE block that looks like this:

        {name:"NIST AI RMF", domain:"AI", tier:"should", svc:"airmf", backing:"BUILT-IP",
         why:"You use AI, so you carry AI-risk obligations ...",
         trigger:d=>d.uses_ai},

     - name    : the label the visitor sees. Edit the text in quotes.
     - tier     : "must"  /  "should"  /  "optional"   ← change the word in quotes to re-tier.
     - why      : the one-line explanation the visitor reads. Rewrite the text in quotes.
     - domain   : which group it appears under (AI, Cyber, Financial, Healthcare,
                  Privacy, EU-spillover, Sector). AI and Cyber are the "our focus" spine.
     - svc      : "airmf" or "csf" = badged "We can help" + routes to a Self-Assessment.
                  null = shown but not badged/routed (outside your service lanes).
     - backing  : "BUILT-IP" or "AUTHORED" — provenance note for you; visitor never sees it.
     - trigger  : the rule for WHEN it appears (advanced — see #3). Leave alone if unsure.

     To change ONLY language or a tier: edit the quotes. You cannot break the
     logic by editing text inside quotes.

  3) CHANGE THE TRIGGER LOGIC (advanced)  →  the  trigger:d=>...  line in each block
     'd' is the visitor's answers. Examples already in use:
        trigger:d=>true                              (always appears)
        trigger:d=>d.uses_ai                         (appears if they use AI)
        trigger:d=>d.phi_data                        (appears if they handle health data)
        trigger:d=>d.uses_ai && d.eu_nexus           (BOTH must be true)
        trigger:d=>d.industry==="Technology/SaaS"    (industry equals a value)
        trigger:d=>d.firm_type.includes("Broker-dealer")
     The available answer keys are listed in the DIALS block (search: const DIALS)
     and the derived ones in the derive() function (search: function derive).
     If you're unsure here, change the wording/tier instead and leave triggers to a build session.

  ----------------------------------------------------------------------------
  WHAT THIS POC DOES NOT DO (by design — these are the production stage):
    - No email capture, no emailed PDF, no lead routing. "Print / Save as PDF"
      uses the browser's own print dialog.
    - The Self-Assessment links are stubs ("coming soon") until those tools ship.
  ----------------------------------------------------------------------------
  Disclaimer shown to users: informative only, not legal or business advice.
==============================================================================
-->
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Regulatory Exposure Profiler — Boanta</title>
<meta name="description" content="Free tool: see which regulations actually touch your business — AI, cybersecurity, privacy, and your industry — tiered by must-have, should-have, and optional. A directional starting map, not legal advice.">
<link rel="canonical" href="https://boanta.com/tools/regulatory-exposure-profiler.html">
<!-- Open Graph / social preview -->
<meta property="og:type" content="website">
<meta property="og:title" content="Regulatory Exposure Profiler — Boanta">
<meta property="og:description" content="Answer a few questions, get a tailored map of the regulations that touch your business — tiered by what's mandatory, expected, and optional.">
<meta property="og:url" content="https://boanta.com/tools/regulatory-exposure-profiler.html">
<meta property="og:image" content="https://boanta.com/og-image.jpg">
<meta property="og:site_name" content="Boanta">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:title" content="Regulatory Exposure Profiler — Boanta">
<meta name="twitter:description" content="See which regulations touch your business in about a minute. Free, directional, no account.">
<meta name="twitter:image" content="https://boanta.com/og-image.jpg">
<meta name="theme-color" content="#0B3D91">

<!-- Google Analytics 4 -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-36YT20FMQJ"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'G-36YT20FMQJ');
</script>

<!-- No remote font dependency. Uses a native system sans-serif stack (very close to Inter)
     so no build tool ever tries to resolve an external font URL. Bulletproof for static hosting. -->

<style>
  /* Palette matched to boanta.com — deep navy accent, light/airy, sans-serif.
     Variable NAMES are kept from the original build so existing rules still work;
     only their VALUES changed. --teal* now carries the site's navy as the accent. */
  :root{
    --teal-bg:#EAF0FA; --teal:#0B3D91; --teal-ink:#0A2E6E; --teal-soft:#8FB0E0;
    --blue-bg:#EAF0FA; --blue:#0B3D91; --blue-ink:#0A2E6E;
    --gray-bg:#F4F5F7; --gray:#6B7280;
    --ink:#111827; --paper:#FFFFFF; --line:#E5E7EB;
    --must:#B2362A; --should:#B9770E; --opt:#6B7280;
    --shadow:0 1px 2px rgba(17,24,39,.04),0 10px 30px rgba(17,24,39,.06);
  }
  *{box-sizing:border-box}
  html,body{margin:0}
  body{
    background:var(--paper); color:var(--ink);
    font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;
    font-size:16px; line-height:1.6;
    -webkit-font-smoothing:antialiased;
  }
  .wrap{max-width:880px; margin:0 auto; padding:0 24px}

  /* ---- header / hero ---- */
  header.hero{
    border-bottom:1px solid var(--line);
    background:
      radial-gradient(110% 130% at 88% -25%, var(--teal-bg) 0%, transparent 50%),
      var(--paper);
  }
  .brandbar{display:flex;align-items:center;gap:12px;padding:22px 0 0}
  .brandhome{display:inline-flex;align-items:center;gap:12px;text-decoration:none;cursor:pointer}
  .brandhome:hover .brandname{opacity:.72}
  .brandlogo{height:30px;width:auto;display:block}
  .brandname{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-weight:600;font-size:18px;letter-spacing:-.01em;color:var(--teal-ink)}
  .hero-inner{padding:34px 0 40px}
  .eyebrow{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-weight:500;letter-spacing:.14em;text-transform:uppercase;
    font-size:12px;color:var(--teal);margin:0 0 14px}
  h1{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-weight:700;font-size:clamp(32px,5.5vw,48px);line-height:1.06;
    letter-spacing:-.02em;margin:0 0 16px;color:var(--ink)}
  h1 em{font-style:normal;color:var(--teal)}
  .lede{font-size:20px;max-width:60ch;margin:0 0 22px;color:#3a3a37}
  .lede b{font-weight:500;color:var(--ink)}
  .promise{display:inline-flex;align-items:center;gap:9px;font-size:14px;color:var(--gray);
    font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif}
  .dot{width:6px;height:6px;border-radius:50%;background:var(--teal-soft);display:inline-block}

  /* ---- covered-regimes badge wall ---- */
  .wall{padding:24px 0 6px}
  .wall-label{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-size:12px;letter-spacing:.1em;text-transform:uppercase;
    color:var(--gray);margin:0 0 12px}
  .chips{display:flex;flex-wrap:wrap;gap:7px}
  .chip{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-size:12.5px;font-weight:500;padding:5px 11px;border-radius:999px;
    border:1px solid var(--line);background:#fff;color:#54534f;white-space:nowrap}
  .chip.spine{border-color:var(--teal);color:var(--teal-ink);background:var(--teal-bg)}

  /* ---- form ---- */
  section.panel{margin:34px 0;background:#fff;border:1px solid var(--line);border-radius:16px;
    box-shadow:var(--shadow);overflow:hidden}
  .panel-head{padding:20px 26px;border-bottom:1px solid var(--line);
    background:linear-gradient(var(--paper),#fff)}
  .panel-head h2{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-weight:600;font-size:20px;margin:0;color:var(--teal-ink)}
  .panel-head p{margin:5px 0 0;font-size:14.5px;color:var(--gray)}
  .panel-body{padding:10px 26px 26px}

  .q{padding:18px 0;border-bottom:1px dashed var(--line)}
  .q:last-child{border-bottom:0}
  .q-label{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-weight:500;font-size:16.5px;margin:0 0 4px;color:var(--ink)}
  .q-help{font-size:13.5px;color:var(--gray);margin:0 0 12px}
  .opts{display:flex;flex-wrap:wrap;gap:8px}
  .opt{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-size:14.5px;padding:8px 15px;border:1px solid var(--line);
    border-radius:10px;background:#fff;color:#46453f;cursor:pointer;transition:all .13s ease;
    user-select:none}
  .opt:hover{border-color:var(--teal-soft);background:var(--teal-bg)}
  .opt.sel{border-color:var(--teal);background:var(--teal);color:#fff;font-weight:500}
  select.opt{min-width:240px;cursor:pointer;appearance:none;
    background-image:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='8'%3E%3Cpath d='M1 1l5 5 5-5' fill='none' stroke='%235F5E5A' stroke-width='1.5'/%3E%3C/svg%3E");
    background-repeat:no-repeat;background-position:right 13px center;padding-right:34px}
  .q.hidden{display:none}
  .sub{margin-top:8px;padding-left:14px;border-left:2px solid var(--teal-bg)}

  .actions{display:flex;gap:12px;align-items:center;flex-wrap:wrap;padding:22px 0 4px}
  .btn{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-weight:600;font-size:16px;border:0;border-radius:11px;
    padding:14px 28px;cursor:pointer;transition:transform .1s ease,box-shadow .15s ease}
  .btn-primary{background:var(--teal);color:#fff;box-shadow:0 6px 18px rgba(15,110,86,.22)}
  .btn-primary:hover{transform:translateY(-1px);box-shadow:0 10px 26px rgba(15,110,86,.30)}
  .btn-ghost{background:#fff;color:var(--teal-ink);border:1px solid var(--line)}
  .btn-ghost:hover{border-color:var(--teal)}

  /* ---- report ---- */
  #report{display:none;margin:30px 0 10px;animation:rise .4s ease}
  @keyframes rise{from{opacity:0;transform:translateY(8px)}to{opacity:1;transform:none}}
  .rep-head{display:flex;justify-content:space-between;align-items:flex-end;gap:16px;
    flex-wrap:wrap;border-bottom:2px solid var(--teal-ink);padding-bottom:14px;margin-bottom:6px}
  .rep-title{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-weight:600;font-size:26px;color:var(--teal-ink);margin:0}
  .rep-sub{font-size:14.5px;color:var(--gray);margin:4px 0 0;max-width:54ch}
  .rep-count{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;text-align:right;font-size:13px;color:var(--gray);line-height:1.3}
  .rep-count b{display:block;font-size:30px;color:var(--teal-ink);font-weight:600}

  .legend{display:flex;gap:18px;flex-wrap:wrap;margin:16px 0 6px;font-size:13px;color:var(--gray)}
  .lg{display:inline-flex;align-items:center;gap:7px}
  .pill{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-weight:600;font-size:11px;letter-spacing:.04em;
    padding:2px 9px;border-radius:999px;text-transform:uppercase}
  .pill.must{background:#F6E2DF;color:var(--must)}
  .pill.should{background:#F6ECD8;color:var(--should)}
  .pill.opt{background:#ECEBE6;color:var(--opt)}
  .lg .badge-dot{width:13px;height:13px;border-radius:4px;background:var(--teal);display:inline-block}

  .domain{margin:22px 0 0}
  .domain.spine .domain-name{color:var(--teal-ink)}
  .domain-name{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-weight:600;font-size:13px;letter-spacing:.1em;
    text-transform:uppercase;color:var(--gray);margin:0 0 10px;padding-bottom:6px;
    border-bottom:1px solid var(--line);display:flex;align-items:center;gap:9px}
  .spine-tag{font-size:10px;letter-spacing:.08em;background:var(--teal-bg);color:var(--teal);
    padding:2px 8px;border-radius:999px}
  .reg{display:flex;gap:14px;align-items:flex-start;padding:13px 14px;margin:7px 0;border-radius:12px;
    border:1px solid var(--line);background:#fff;transition:border-color .12s}
  .reg.svc{border-color:var(--teal-soft);background:linear-gradient(#fff,var(--teal-bg) 320%)}
  .reg-tier{flex:0 0 auto;margin-top:2px}
  .reg-main{flex:1 1 auto;min-width:0}
  .reg-name{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-weight:600;font-size:17px;color:var(--ink);
    display:flex;align-items:center;gap:9px;flex-wrap:wrap}
  .reg-why{font-size:14.5px;color:#56554f;margin:3px 0 0}
  .svc-badge{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-size:11px;font-weight:600;letter-spacing:.03em;
    color:#fff;background:var(--teal);padding:2px 9px;border-radius:999px;white-space:nowrap}
  .svc-cta{margin-top:8px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-size:13.5px}
  .svc-cta a{color:var(--teal);font-weight:600;text-decoration:none;border-bottom:1px solid var(--teal-soft)}
  .svc-cta a:hover{border-bottom-color:var(--teal)}

  .cta-block{margin:30px 0 8px;padding:24px 26px;border-radius:16px;background:var(--teal-ink);color:#fff}
  .cta-block h3{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-weight:600;font-size:21px;margin:0 0 8px}
  .cta-block p{margin:0 0 16px;color:#cfe8df;font-size:15px;max-width:58ch}
  .cta-block .btn-primary{background:#fff;color:var(--teal-ink);box-shadow:none}

  footer.fine{border-top:1px solid var(--line);margin-top:40px;padding:18px 0 40px}
  .disclaimer{font-size:12.5px;color:var(--gray);line-height:1.5;max-width:78ch}
  .disclaimer b{color:#46453f;font-weight:600}
  .colophon{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;font-size:12px;color:#9a9890;margin-top:10px}

  @media (max-width:560px){
    body{font-size:16px}
    .rep-head{flex-direction:column;align-items:flex-start}
    .rep-count{text-align:left}
  }

  /* ---- print: report only, clean ---- */
  @media print{
    @page{margin:16mm}
    body{background:#fff;font-size:12pt}
    header.hero, section.panel, .cta-block, .btn, #intro-note{display:none !important}
    .wrap{max-width:none;padding:0}
    #report{display:block !important;box-shadow:none}
    .reg{break-inside:avoid}
    .domain{break-inside:avoid-page}
    footer.fine{border-top:1px solid #ccc}
    .reg.svc{background:#fff}
    a{color:var(--ink);text-decoration:none}
  }
</style>

<!-- =========================================================================
     BRAND  — edit these lines to re-skin per deployment (MSP, CIO Advise, etc.)
     ========================================================================= -->
<script>
const BRAND = {
  firmName:    "Michael Boanta",                  // shown top-left
  logoUrl:     "https://boanta.com/assets/globe-logo-DNV1U7di.png",  // site globe logo
  primaryColor:"#0B3D91",                         // boanta navy
  homeLink:    "https://boanta.com",              // logo/name links here (back to main site)
  backLink:    "https://boanta.com/contact",      // Contact page — they'll route the lead
  consultText: "Get in touch",                    // CTA label
  // routing note: skin (name/logo/color) is the deployer's; leads should route to you.
};
</script>

<!-- =========================================================================
     ENGINE  — the regime rules. Mirrors the Regime Master Table.
     Lifts into its own .json file at the Claude Code handoff (structure unchanged).
     tier: must|should|optional · domain order sets report grouping · svc=serviceable
     trigger(d): pure function over the dial object d -> boolean
     ========================================================================= -->
<script>
const SELF_ASSESS = {
  airmf: {label:"AI RMF Self-Assessment", href:"https://boanta.com/contact"},   // routes to Contact until tools ship
  csf:   {label:"CSF 2.0 Self-Assessment", href:"https://boanta.com/contact"},
};

const DOMAIN_ORDER = ["AI","Cyber","Financial","Healthcare","Privacy","EU-spillover","Sector"];
const SPINE = ["AI","Cyber"];

const REGIMES = [
  // ---- AI (spine, lead) ----
  {name:"NIST AI RMF", domain:"AI", tier:"should", svc:"airmf", backing:"BUILT-IP",
   why:"You use AI, so you carry AI-risk obligations — govern, map, measure, and manage how those systems behave.",
   trigger:d=>d.uses_ai},
  {name:"EU AI Act", domain:"AI", tier:"must", svc:"airmf", backing:"AUTHORED",
   why:"Your AI reaches the EU, which is phasing in binding obligations by AI risk level — the first hard AI law.",
   trigger:d=>d.uses_ai && d.eu_nexus},
  {name:"ISO 42001", domain:"AI", tier:"optional", svc:"airmf", backing:"AUTHORED",
   why:"A certifiable AI-management standard — voluntary, but increasingly asked for in enterprise and EU deals.",
   trigger:d=>d.uses_ai && (d.size==="Mid"||d.size==="Large"||d.enterprise_buyers)},
  // ---- Cyber (spine, second) ----
  {name:"NIST CSF 2.0", domain:"Cyber", tier:"must", svc:"csf", backing:"BUILT-IP",
   why:"Every business with data has cyber risk — this is the umbrella that maps to whatever you must certify against.",
   trigger:d=>true},
  {name:"SOC 2", domain:"Cyber", tier:"should", svc:"csf", backing:"AUTHORED",
   why:"Your business customers will ask how you protect their data — SOC 2 is the report they expect to see.",
   trigger:d=>d.industry==="Technology/SaaS" || d.b2b_processor},
  {name:"ISO 27001", domain:"Cyber", tier:"optional", svc:"csf", backing:"AUTHORED",
   why:"An internationally recognized security certification — voluntary, but a door-opener for enterprise and global deals.",
   trigger:d=>d.sensitive_data && (d.enterprise_buyers || d.eu_nexus)},
  {name:"CIS Controls", domain:"Cyber", tier:"optional", svc:"csf", backing:"AUTHORED",
   why:"A practical, prioritized starter checklist for security — the fastest way to begin if you're starting cold.",
   trigger:d=>true},
  {name:"NYDFS 500", domain:"Cyber", tier:"must", svc:"csf", backing:"BUILT-IP",
   why:"New York-licensed financial firms must meet NYDFS's specific cybersecurity rules — with annual certification.",
   trigger:d=>d.industry==="Financial Services" && d.ny_licensed},
  // ---- Financial ----
  {name:"GLBA / FTC Safeguards", domain:"Financial", tier:"must", svc:null, backing:"AUTHORED",
   why:"You handle people's financial information, so the Safeguards Rule requires a written security program.",
   trigger:d=>d.financial_function},
  {name:"SEC (Reg S-P / Advisers)", domain:"Financial", tier:"must", svc:null, backing:"AUTHORED",
   why:"As an SEC registrant you must protect customer records and information under federal securities rules.",
   trigger:d=>d.firm_type.includes("RIA") || d.firm_type.includes("Broker-dealer")},
  {name:"FINRA", domain:"Financial", tier:"must", svc:null, backing:"BUILT-IP",
   why:"Every broker-dealer is a FINRA member and answers to its supervision, recordkeeping, and cyber expectations.",
   trigger:d=>d.firm_type.includes("Broker-dealer")},
  {name:"FFIEC", domain:"Financial", tier:"must", svc:null, backing:"AUTHORED",
   why:"Banks and credit unions are examined against FFIEC IT and cybersecurity guidance by their regulators.",
   trigger:d=>d.firm_type.includes("Bank-CU")},
  {name:"SOX", domain:"Financial", tier:"must", svc:null, backing:"AUTHORED",
   why:"Public companies must prove financial reporting is backed by sound internal controls, including IT controls.",
   trigger:d=>d.publicly_traded},
  // ---- Healthcare ----
  {name:"HIPAA / HITECH", domain:"Healthcare", tier:"must", svc:null, backing:"AUTHORED",
   why:"You touch patient health data, so HIPAA's privacy and security rules apply — directly or through your contracts.",
   trigger:d=>d.phi_data},
  // ---- Privacy ----
  {name:"State Privacy (CCPA et al.)", domain:"Privacy", tier:"should", svc:null, backing:"AUTHORED",
   why:"You hold consumer personal data above a state threshold — these laws grant residents rights you must honor.",
   trigger:d=>d.consumer_data && d.state_threshold},
  // ---- EU-spillover ----
  {name:"GDPR", domain:"EU-spillover", tier:"must", svc:null, backing:"AUTHORED",
   why:"You handle data on EU residents, so the EU's privacy law reaches you regardless of where you're based.",
   trigger:d=>d.eu_nexus && d.personal_data},
  {name:"DORA", domain:"EU-spillover", tier:"should", svc:null, backing:"AUTHORED",
   why:"EU financial rules now demand operational and cyber resilience — relevant if you serve EU financial entities.",
   trigger:d=>d.industry==="Financial Services" && d.eu_nexus},
  // ---- Sector ----
  {name:"PCI DSS", domain:"Sector", tier:"must", svc:null, backing:"AUTHORED",
   why:"You handle payment-card data, so the card brands contractually require PCI DSS protections.",
   trigger:d=>d.cardholder_data},
  {name:"CMMC", domain:"Sector", tier:"should", svc:null, backing:"AUTHORED",
   why:"Defense contracts now require certified cybersecurity maturity to handle government information.",
   trigger:d=>d.dod_supply_chain},
];
</script>

<header class="hero">
  <div class="wrap">
    <div class="brandbar" id="brandbar"></div>
    <div class="hero-inner">
      <p class="eyebrow">Regulatory Exposure Profiler</p>
      <h1>See your <em>regulatory landscape</em> in about a minute.</h1>
      <p class="lede">Answer a few questions about your business. Get a tailored map of the regulations
        that touch you — <b>tiered by Must Have, Should Have, and Optional</b>, organized by domain,
        with AI &amp; cybersecurity front and center.</p>
      <span class="promise"><span class="dot"></span> No account. No jargon. A starting map, not a verdict.</span>
    </div>
    <div class="wall">
      <p class="wall-label">Standards &amp; regulations this tool maps</p>
      <div class="chips" id="chipwall"></div>
    </div>
    <div style="height:26px"></div>
  </div>
</header>

<div class="wrap">

  <section class="panel" id="form">
    <div class="panel-head">
      <h2>Tell us about your business</h2>
      <p>Everything stays in your browser. Nothing is sent anywhere in this preview.</p>
    </div>
    <div class="panel-body" id="questions"></div>
    <div class="panel-body" style="padding-top:0">
      <div class="actions">
        <button class="btn btn-primary" onclick="run()">Show my regulatory exposure →</button>
        <button class="btn btn-ghost" onclick="resetForm()">Reset</button>
      </div>
    </div>
  </section>

  <div id="report">
    <div class="rep-head">
      <div>
        <h2 class="rep-title">Your Regulatory Exposure</h2>
        <p class="rep-sub" id="rep-sub"></p>
      </div>
      <div class="rep-count"><b id="rep-n">0</b> requirements on your map</div>
    </div>

    <div class="legend">
      <span class="lg"><span class="pill must">Must</span> a rule creates an obligation</span>
      <span class="lg"><span class="pill should">Should</span> expected practice</span>
      <span class="lg"><span class="pill opt">Optional</span> voluntary maturity</span>
      <span class="lg"><span class="badge-dot"></span> we can help with this</span>
    </div>

    <div id="domains"></div>

    <div class="cta-block">
      <h3 id="cta-h">Know what applies. Now find out where you stand.</h3>
      <p id="cta-p">This map shows your obligations. The next step measures how ready you actually are —
        starting with the areas we can help you address directly.</p>
      <button class="btn btn-primary" onclick="goBack()" id="cta-btn">Talk to an advisor</button>
      <button class="btn btn-ghost" onclick="window.print()" style="margin-left:10px;background:transparent;color:#fff;border-color:#3f7d6c">Print / Save as PDF</button>
    </div>
  </div>

  <footer class="fine">
    <p class="disclaimer">
      <b>Informative only — not legal or business advice.</b> This profile is a directional starting
      point based on the information you provided. It is not an auditable determination of your
      obligations, and tier labels reflect the typical case for a business of this profile, not a
      ruling on your specific situation. Confirm with qualified counsel and your compliance function
      before acting.
    </p>
    <p class="colophon" id="colophon"></p>
  </footer>
</div>

<script>
/* ---------- dial definitions (drives the form UI) ---------- */
const DIALS = [
  {key:"industry", label:"What industry are you in?", type:"select",
   options:["Healthcare","Financial Services","Professional Services","Retail/E-commerce","Manufacturing","Technology/SaaS","Other"]},
  {key:"uses_ai", label:"Do you use AI in your operations or products?",
   help:"Counts anything — Copilot, ChatGPT, embedded models, AI features you ship.", type:"bool"},
  {key:"publicly_traded", label:"Is your company publicly traded?", type:"bool"},
  {key:"firm_type", label:"Which best describes your firm?", type:"multi",
   help:"Choose all that apply.", showIf:d=>d.industry==="Financial Services",
   options:["RIA (investment adviser)","Broker-dealer","Bank-CU (bank or credit union)","Other financial"]},
  {key:"ny_licensed", label:"Are you licensed or operating in New York?", type:"bool",
   showIf:d=>d.industry==="Financial Services"},
  {key:"financial_function", label:"Do you provide financial services or handle other people's financial information?",
   help:"Lending, advising, tax prep, accounting, payments, financing — even if you didn't pick Financial Services above.", type:"bool"},
  {key:"cardholder_data", label:"Do you store, process, or transmit payment-card data?", type:"bool"},
  {key:"phi_data", label:"Do you handle patient or health information (PHI)?",
   help:"Either as a provider/plan, or as a vendor that touches PHI for one.", type:"bool"},
  {key:"consumer_data", label:"Do you collect personal data about consumers?", type:"bool"},
  {key:"eu_nexus", label:"Do you have customers, users, or staff in the EU?", type:"bool"},
  {key:"enterprise_buyers", label:"Do you sell to enterprise or government buyers?", type:"bool"},
  {key:"dod_supply_chain", label:"Do you do business with the US Department of Defense or its supply chain?", type:"bool"},
  {key:"size", label:"How large is your company?", type:"select",
   options:["Small","Mid","Large"]},
];

/* derived dials (not asked directly) */
function derive(d){
  d.firm_type = d.firm_type || [];
  d.personal_data   = !!(d.consumer_data || d.eu_nexus);
  d.sensitive_data  = !!(d.phi_data || d.financial_function || d.consumer_data || d.cardholder_data);
  d.b2b_processor   = !!(d.industry==="Technology/SaaS" && d.enterprise_buyers);
  // state threshold: treat Mid/Large with consumer data as over a state threshold (POC heuristic)
  d.state_threshold = !!(d.consumer_data && (d.size==="Mid" || d.size==="Large"));
  return d;
}

/* ---------- state ---------- */
let STATE = {};
function defaults(){STATE = {industry:"", size:"", firm_type:[]}; DIALS.forEach(q=>{if(q.type==="bool")STATE[q.key]=false;});}
defaults();

/* ---------- apply brand ---------- */
(function brand(){
  if(BRAND.primaryColor){document.documentElement.style.setProperty('--teal',BRAND.primaryColor);}
  const bb=document.getElementById('brandbar');
  const inner = (BRAND.logoUrl?`<img class="brandlogo" src="${BRAND.logoUrl}" alt="">`:"")
    + `<span class="brandname">${BRAND.firmName}</span>`;
  bb.innerHTML = BRAND.homeLink
    ? `<a href="${BRAND.homeLink}" class="brandhome">${inner}</a>`
    : inner;
  document.getElementById('colophon').textContent =
    "Regulatory Exposure Profiler · directional preview · "+new Date().getFullYear();
  document.getElementById('cta-btn').textContent = BRAND.consultText;
  // chip wall from the engine
  const cw=document.getElementById('chipwall');
  REGIMES.forEach(r=>{
    const c=document.createElement('span');
    c.className="chip"+(SPINE.includes(r.domain)?" spine":"");
    c.textContent=r.name; cw.appendChild(c);
  });
})();

/* ---------- render form ---------- */
function renderForm(){
  const host=document.getElementById('questions'); host.innerHTML="";
  DIALS.forEach(q=>{
    const wrap=document.createElement('div'); wrap.className="q"; wrap.dataset.key=q.key;
    if(q.showIf && !q.showIf(STATE)) wrap.classList.add('hidden');
    let html=`<p class="q-label">${q.label}</p>`;
    if(q.help) html+=`<p class="q-help">${q.help}</p>`;
    if(q.type==="bool"){
      html+=`<div class="opts">
        <div class="opt ${STATE[q.key]===true?'sel':''}" data-v="yes">Yes</div>
        <div class="opt ${STATE[q.key]===false?'sel':''}" data-v="no">No</div></div>`;
    } else if(q.type==="select"){
      html+=`<div class="opts"><select class="opt" data-sel="1">
        <option value="">Select…</option>`+
        q.options.map(o=>`<option ${STATE[q.key]===o?'selected':''}>${o}</option>`).join("")+
        `</select></div>`;
    } else if(q.type==="multi"){
      html+=`<div class="opts sub">`+
        q.options.map(o=>{const v=o.split(" (")[0];
          return `<div class="opt ${(STATE.firm_type||[]).includes(v)?'sel':''}" data-multi="${v}">${o}</div>`;}).join("")+
        `</div>`;
    }
    wrap.innerHTML=html;
    host.appendChild(wrap);

    if(q.type==="bool"){
      wrap.querySelectorAll('.opt').forEach(el=>el.onclick=()=>{
        STATE[q.key]= el.dataset.v==="yes"; renderForm();
      });
    } else if(q.type==="select"){
      wrap.querySelector('select').onchange=e=>{STATE[q.key]=e.target.value; renderForm();};
    } else if(q.type==="multi"){
      wrap.querySelectorAll('.opt').forEach(el=>el.onclick=()=>{
        const v=el.dataset.multi; const arr=new Set(STATE.firm_type||[]);
        arr.has(v)?arr.delete(v):arr.add(v); STATE.firm_type=[...arr]; renderForm();
      });
    }
  });
}
renderForm();

/* ---------- run engine ---------- */
function run(){
  const d=derive(Object.assign({},STATE));
  const hits=REGIMES.filter(r=>{try{return r.trigger(d);}catch(e){return false;}});
  // group by domain order
  const byDom={};
  hits.forEach(r=>{(byDom[r.domain]=byDom[r.domain]||[]).push(r);});
  const tierRank={must:0,should:1,optional:2};
  const host=document.getElementById('domains'); host.innerHTML="";
  DOMAIN_ORDER.forEach(dom=>{
    if(!byDom[dom]) return;
    const block=document.createElement('div');
    block.className="domain"+(SPINE.includes(dom)?" spine":"");
    let h=`<p class="domain-name">${dom}${SPINE.includes(dom)?'<span class="spine-tag">our focus</span>':''}</p>`;
    byDom[dom].sort((a,b)=>tierRank[a.tier]-tierRank[b.tier]).forEach(r=>{
      const tierClass=r.tier==="must"?"must":r.tier==="should"?"should":"opt";
      const tierWord=r.tier==="must"?"Must":r.tier==="should"?"Should":"Optional";
      const svc=r.svc?SELF_ASSESS[r.svc]:null;
      h+=`<div class="reg ${r.svc?'svc':''}">
        <div class="reg-tier"><span class="pill ${tierClass}">${tierWord}</span></div>
        <div class="reg-main">
          <div class="reg-name">${r.name}${r.svc?'<span class="svc-badge">We can help</span>':''}</div>
          <p class="reg-why">${r.why}</p>
          ${svc?`<p class="svc-cta">→ <a href="${svc.href}">${svc.label}</a> <span style="color:#9a9890">(in development — get in touch)</span></p>`:''}
        </div></div>`;
    });
    block.innerHTML=h; host.appendChild(block);
  });
  // counts + subtitle
  document.getElementById('rep-n').textContent=hits.length;
  const must=hits.filter(r=>r.tier==='must').length;
  const ind=STATE.industry||"your business";
  document.getElementById('rep-sub').textContent =
    `Based on what you told us about ${ind.toLowerCase()==="other"?"your business":ind.toLowerCase()}, `+
    `here is the regulatory landscape that commonly applies — ${must} Must-Have${must===1?'':'s'} among ${hits.length} requirements.`;
  document.getElementById('report').style.display="block";
  document.getElementById('report').scrollIntoView({behavior:'smooth',block:'start'});
  // GA4: track that a visitor completed the dials and saw a result (the conversion signal)
  if(typeof gtag==='function'){
    gtag('event','profiler_result_shown',{
      industry: STATE.industry||'unspecified',
      regimes_shown: hits.length,
      must_haves: must,
      uses_ai: !!STATE.uses_ai
    });
  }
}
function resetForm(){defaults();renderForm();document.getElementById('report').style.display="none";}
function goBack(){
  if(typeof gtag==='function'){ gtag('event','profiler_cta_click',{destination:'contact'}); }
  if(BRAND.backLink && BRAND.backLink!=="#"){
    // open in a new tab so the visitor's report stays open behind it (they can still print/save)
    window.open(BRAND.backLink,'_blank','noopener,noreferrer');
  } else {
    document.getElementById('form').scrollIntoView({behavior:'smooth'});
  }
}
</script>