Lesson 7: Real gates and imagined ones
One analytical move: verify a constraint before letting it kill an idea. An imagined gate costs more than a real one, because a real one gets planned around and an imagined one silently removes an option.
About 12 minutes. Second of three short skill lessons.
Four kinds of gate
| Gate | Meaning | What to do |
|---|
| Legal | You may not, or not without permission | Find the regulator's own words. Then design within them |
| Capability | You cannot build it in the time available | Cut scope until it is false, or accept the date moves |
| Commercial | You may, but the economics do not work | This is a pricing problem wearing a costume |
| Imagined | Someone said it in a meeting and nobody checked | Twenty minutes of verification, every time |
The fourth is the dangerous one, because it never gets debated. It arrives as background fact, quietly downgrades an option, and the decision is made on a smaller menu than it should have been.
The twenty-minute verification
- Name the regulator and the instrument. "It is regulated" is not a claim; "ARCEP requires authorisation under the numbering regime" is. Only the second can be checked.
- Ask what the rule regulates: the activity or the artifact? This one question resolves most of these. Rules attach to doing a regulated thing, not to touching a regulated topic.
- Go to the regulator's own page. Law firm summaries are useful for orientation and are not the source.
- Check the date and whether it was amended. Telecoms and data rules move. A confident memory from 2018 is often simply out of date.
- Write the finding down with the URL and the date you checked. Otherwise the same myth returns next quarter.
Worked example: the ARCEP claim
There's also a real gate - recording calls in France needs ARCEP clearance before we could launch at all. [...] ARCEP clearance is a gate with an unknown timeline - we could be legally unable to launch by November.
Loss leader Product ideas, section 03
Run the procedure. ARCEP is the French electronic communications regulator. What it regulates is numbering resources and operator status: who may hold and route telephone numbers, and who counts as a provider of electronic communications services. A 2021 ordonnance went further and abolished the prior declaration requirement that used to apply to telecom operators, so classification now turns purely on the nature of the activity.12
Now apply step two - activity or artifact? ARCEP attaches to providing the telephony. It does not attach to recording a conversation. A product that records calls placed through somebody else's telephony provider is not an ARCEP-regulated operator on that basis. You come under ARCEP if you assign numbers and route calls yourself, which is a different product decision, and one you can choose not to make.
The document downgraded a well-argued idea partly on this constraint. That is the actual cost of an imagined gate: not a wasted afternoon, but a decision made on a shorter list of options.
Be fair to the author. The instinct - "recording people in France is a serious matter, check before building" - is exactly right, and better than the alternative instinct. The error was naming the wrong regulator and not checking. The correction is procedural, not a reason to trust the document less on judgement.
Where the real gate is
There is a genuine constraint here. It is not ARCEP, it is data protection, and it is a design constraint rather than a launch gate.
- CNIL on recording conversations. Recording to establish proof of a contract is lawful only where necessary: only the relevant excerpt, and only where no lighter form of proof exists. Prior information to the people recorded is required.3 Practitioner guidance puts the retention ceiling for quality and training recordings at around six months.4
- CNIL on AI. Recommendations published 22 July 2025 set out the legal bases for AI development, including legitimate interest with concrete safeguards - data minimisation, transparency, easier exercise of rights - alongside the EU AI Act where personal data is involved.5
- Loi Hoguet requires a carte professionnelle, financial guarantee, professional indemnity and periodic training to act as an estate agent.6 It constrains who may be your customer, not who may sell them software. For a vendor it is context, not a gate - though it does tell you your buyer is already a regulated professional who thinks about client data, which is a selling point if you handle it visibly well.
Read together, these turn into product requirements rather than blockers: prior information to the other party, purpose limitation, minimisation, retention policy, an easy path for a client to have their record deleted. Those are two sprints of work and a page of copy. They are not a permission you wait for.
One genuine open risk survives, and it belongs in the review: whether French sellers and buyers are comfortable being recorded at an estimation. That is not a legal question, it is a market-acceptance question, and it is answered by talking to twenty agents, not by reading CNIL. The document raises it honestly under its own risk list.
Drill: which gate is it?
Retrieval practice
Your win: you have a repeatable twenty-minute procedure for any "we can't, it's regulated" claim, and you know the one question - activity or artifact - that resolves most of them.
Primary source
Read the CNIL page on l'enregistrement des conversations téléphoniques. It is short, it is the regulator in its own words, and it is the actual constraint on the product the document recommends.
If you want the recording feature specified against CNIL requirements - what to show, what to keep, for how long - ask your teaching agent to draft it.