We in the UK have plenty some dating back to the feudal/monarchist era. Beached whales belong to the reigning monarch and MPs are not allowed to wear armour in Parliament for instance. See https://www.independent.co.uk/news/uk/home-news/uk-strangest-weird-laws-enforced-christopher-sargeant-sturgeon-armour-a7232586.html There used to be silly things about not being able to keep a recorded copy of a TV programme for more than a month, but I think that may have been repealed. Hopefully the COVID laws get repealed when there is little to no COVID...whenever that is...

Its nonsense to say he cant test. Your project needs to create a test database to test against, and the Lone Ranger needs to be testing his new functionality against that. You could create a script to create an empty version of your live db and load test data into it. He needs to amend his connection string to test the app against that, or at the very least if its SQL paste his changes in SSMS (or whatever your RDBMS client tool is) and run it against the test db. In the long term you could aim to create a suite of automated unit tests which are run before a deployment to reduce risk further. If its government work, here in the UK we have to conform to certain standards part of which is having a test strategy and evidence testing has taken place (and not against live data). We are audited on compliance to this. If you have similar in your locale,you could be at risk of failing an audit and losing business.