ThemeGovernance, Legal & Risk
CardCard 31 of 66
Questions5 to explore

Laws & permits

From legal requirements to getting permits

Every organization operates inside a framework of laws, licenses, and permits, and the ones that apply to yours are worth knowing before you need them.

The legal requirements that touch a business depend on what it does, where it operates, who it employs, and what it handles. Employment law, data protection, health and safety, sector-specific regulation, import and export rules, environmental requirements: the list is longer for most organizations than the founders first realized.

Documenting the legal landscape is not about becoming a legal expert. It is about knowing which obligations you are actively managing and which ones you may have overlooked. A simple map of the main legal areas that apply, with a note on who is responsible for each, goes a long way.

Permits and licenses expire and need renewal. When the person who originally obtained a permit leaves, the organization sometimes loses track of it entirely. A register that is checked at least annually prevents that.

What to capture

For this part of the company brain, what is worth writing down and keeping current. The goal is not a complete archive but a living record that new people can read and returning people can trust.

Applicable laws & regulations

The main legal frameworks that govern how the organization operates, including any sector-specific regulation that requires active compliance work.

Permits & licenses

A register of permits and licenses the organization holds, including the issuing authority, scope, and renewal date.

Compliance owners

Who is responsible for monitoring and maintaining compliance with each significant legal requirement.

Regulatory relationships

Any ongoing relationships with regulators or licensing bodies, including the contact person and history of interactions.

Questions to explore

Use these on your own or in a group. There are no right answers, only better conversations.

Which laws and regulations most directly affect how the organization operates day to day?
Are there any permits or licenses that would stop operations if they lapsed?
Who in the organization keeps track of regulatory changes that could affect the business?
Are there legal requirements that you know apply but have not yet fully addressed?
What would you need to show a regulator if they audited you tomorrow?

Things to notice

Regulatory requirements often change gradually, and organizations that complied when they set up can find themselves out of step years later without realizing it.
Permits obtained during startup are sometimes tied to the individual founder rather than the company entity, which creates a handover problem that only surfaces at the wrong moment.
Assuming that general legal advice covers sector-specific requirements is a common gap: the rules for handling food, financial services, healthcare, or personal data each add a layer that general counsel may not have flagged.