The challenge
Compliance analysts were manually checking reports against three overlapping regulatory frameworks in eight jurisdictions, where the same requirement is worded differently and carries different thresholds depending on where it applies.
Documents under review routinely contained PII that could not be sent to a third-party model, so redaction had to happen before anything left controlled infrastructure — not as a post-processing step.
Approach
01
Redact before retrieve
PII detection and redaction run at ingest, before embedding or generation. Nothing sensitive reaches the model layer at any point in the pipeline.
02
Model jurisdictions as first-class metadata
A requirement is stored once with per-jurisdiction variants attached, so retrieval filters on jurisdiction rather than the system trying to reason about which rule applies.
03
Flag gaps, do not assert compliance
Output is a ranked list of potential gaps with the specific clause and requirement cited. The determination stays with the compliance officer.
04
Measure gap detection against analyst review
Accuracy was validated by having analysts review the same reports independently and comparing findings.
Architecture
Redact
PII detection and redaction pipeline runs at ingest inside controlled infrastructure.
Index
OpenSearch holds regulatory requirements with jurisdiction, framework and threshold metadata.
Retrieve
Jurisdiction-filtered retrieval per report section so only applicable requirements are considered.
Reason
AWS Bedrock models via LangChain generate risk flags with clause-level citations.
Report
Structured gap report ranked by severity, exported for the compliance team's existing review workflow.
Results
84%Gap detection accuracy
52%Less manual review
2.3xFaster reporting
8Jurisdictions covered
3Frameworks: GDPR, HIPAA, SOC 2
What I took from it
Storing jurisdiction variants as metadata instead of asking the model to reason about applicability removed an entire class of error. The model never has to decide which rule applies — retrieval already did.
Compliance AI cut manual ESG auditing by 52% and made regulatory reporting 2.3x faster. Their expertise in regulatory AI saved us millions in potential penalties.
Stack
Orchestration
Models
Data
Privacy