Use a documented acceptance decision rather than a supplier’s general compliance assurance. The following matrix is the desk’s recommended operational framework.
| Gate | Minimum evidence | Suggested treatment if missing | Accountable buyer |
|---|---|---|---|
| Product classification | Written account of stakes, credits, prizes, purchases and redemption. | Hold classification-sensitive functionality. | Product owner and counsel |
| Publishing permission | Agreement or other suitable written authorisation covering the intended use. | Do not count the title as authorised catalogue coverage. | Founder or procurement lead |
| Territorial suitability | Separate rights, promotional and technical-availability records. | Restrict the unresolved placement pending review. | Legal and product |
| Promotional destinations | Named destination products and reviewed commercial relationships. | Remove or suspend disputed calls to action. | Commercial and editorial |
| Privacy behaviour | Data map, role allocation and applicable choice-handling tests. | Hold unassessed collection or tracking. | Privacy and engineering |
| Children’s data | Audience assessment and applicable COPPA/state-law controls. | Escalate before collecting covered data. | Privacy lead |
| Accessibility | Agreed target, test scope and documented exceptions. | Resolve critical barriers or provide an approved alternative. | Product and engineering |
| Continuity | Withdrawal process, change notice and fallback plan. | Limit pilot exposure until exit risk is understood. | Product director |
For each item, record documented, supplier-claimed, observed, inferred or unknown. A successful launch test supports only the observed environment; it should not be used as a substitute for contractual or legal evidence.
What should the first 30 days look like?
These are recommended work periods, not statutory deadlines:
Days 1–7: identify material exposure. Inventory suppliers, game modes, promotional destinations and scripts. Separate demo-only pages from pages connected to wagering or prize-bearing products. Identify missing permission documents and unresolved state reviews.
Days 8–14: collect evidence. Request rights schedules, data-flow descriptions, audience assessments and change-control terms. Obtain legal review of the highest-risk promotional arrangements. Establish which privacy laws apply to the publisher rather than assuming the supplier’s answer transfers automatically.
Days 15–30: test and decide. Run a bounded pilot covering launch success, privacy choices, age-related controls where applicable, accessibility and denied-access behaviour. Publish an acceptance record with unresolved issues, owners and due dates.
For renewals, ask: what changed since the previous approval? Repeat the assessment when the supplier changes endpoints, data recipients, promotional features, game modes or territory conditions.