Governance capability experiment
Regulatory workflow decision support
A regulatory-workflow backend prototype with inventory, retrieval, classification, evidence, remediation, audit, and report modules. It is a decision-support system under development, not legal advice or a conformity assessment.
Business ↔ technology bridge · Governance capability experiment
Explores evidence-linked regulatory workflow without presenting generated guidance as legal authority.
This is a portfolio and source interpretation—not a customer, deployment, certification, or outcome claim.
System inventory, risk classification, evidence, remediation, and reporting are often fragmented across legal, compliance, product, and engineering teams.
Separate deterministic inventory and workflow state from retrieval-assisted interpretation, and preserve named human review points.
Inventory, retrieval, classification, evidence, remediation, audit, and report modules with migrations and selected mocked test seams.
Evidence gaps and classification uncertainty return to product scope, control design, accountable owners, and release planning.
Source evidence
A regulatory-workflow backend prototype with inventory, retrieval, classification, evidence, remediation, audit, and report modules. It is a decision-support system under development, not legal advice or a conformity assessment.
Repository evidence is not client, deployment, certification, or outcome evidence.
Architecture
Three source layers: regulatory feed monitoring, retrieval-assisted obligation extraction, and a tamper-evident audit chain. Regulator acceptance of any record must be assessed separately.
Source map only: a layer can represent implemented code, an adapter boundary, or documented design. It does not assert a configured production service.
The source represents three EUR-Lex ATOM feeds (EU AI Act, GDPR, AI General), parsing of new instruments by CELEX, severity extraction (critical/high/low), and a Mistral impact-analysis step against the registered AI-system inventory. No live monitoring is claimed.
The source represents Mistral + RAG over a corpus of Articles, Annexes, and EDPB guidance: obligation extraction, cross-regulation overlap mapping (AI Act ↔ GDPR ↔ NIS2), risk classification, and gap analysis, with confidence scores and Article-level citations. Outputs require expert review.
The source models classification, gap, remediation, timestamp, and reviewer records in an audit chain. Whether an exported record meets a legal or regulator requirement must be assessed separately.
The Problem
Why regulatory compliance is broken
The EU AI Act alone spans 180+ pages, 113 articles, and 13 annexes. Cross-referencing with GDPR, NIS2, and DORA multiplies the burden exponentially.
Compliance officers spend weeks extracting obligations from regulatory text, mapping them to business units, and building documentation from scratch.
Spreadsheets for tracking, Word for documentation, email for collaboration. No single system connects obligations to evidence to audit trails.
Organisations discover regulatory changes after deadlines pass. No automated monitoring means compliance is always playing catch-up.
Modules
8 workflow modules represented in the prototype source
Source scope only: an entry can describe implemented code, a documented adapter, or a configured workflow. It is not a statement that a production service is active.
01
The source represents horizon scanning over 3 EUR-Lex ATOM feeds (EU AI Act, GDPR, AI General): CELEX parsing, severity levels (critical/high/low), and Mistral impact analysis against registered AI systems. No live monitoring is claimed.
02
The source represents an AI system inventory with Mistral-assisted mapping to EU AI Act risk tiers, with confidence scores, reasoning, and Article references. Legal classification remains a human decision.
03
Retrieval-assisted obligation extraction and cross-regulation mapping are represented in source. Completeness and legal interpretation require expert review.
04
Policy ingestion and retrieval-assisted comparison workflows are represented in source. The result is a review queue, not a compliance determination.
05
The source represents drafting of 5 compliance document types from identified gaps: policies, procedures, technical documentation, checklists, and risk assessments — with confidence scoring and PDF/CSV/Markdown export. Drafts require accountable review.
06
The source models a multi-user workspace with role-based access: obligations assigned to departments, task completion tracked, and compliance work visible across a team.
07
The backend models hashed audit records, evidence versions, and review state. Operational immutability, retention, and chain of custody depend on deployment controls.
08
The source represents three report types: audit reports for regulators, board reports for executives, and progress reports over time, with PDF export and scheduled delivery. Regulator acceptance must be assessed separately.
EU AI Act coverage
Compliance theatre is a list of articles in a PDF. Compliance practice is each article mapped to a specific AI system, with evidence, owner, and last-review date. Below: the articles the prototype represents per registered system. Extracted obligations require expert review.
Repository surface only: availability, completeness, performance, and operational fitness require separate validation.
ART. 4The source includes role-based literacy tracking, quiz, and record-generation workflows. It does not certify a person's competence or an organisation's Article 4 compliance.
ART. 5A rule and retrieval workflow maps a registered system against prohibited-practice categories and references. Legal classification remains a human decision.
ART. 6The source represents an Annex III risk-class assessment with Mistral-generated reasoning, a confidence score, and a per-Annex obligation tree. It is designed to re-run on registry events (model swap, scope change, training-data update).
ART. 9Continuous identification, estimation, evaluation, and treatment of risks. The prototype is designed to link each identified risk to its mitigation control and to take evidence from a CI pipeline (test pass/fail, model card, eval suite). No live integration is asserted.
ART. 10Training, validation, and testing datasets with representative coverage, bias detection, and lineage. The prototype is designed to cross-reference a dataset registry against the Annex IV technical-documentation requirements.
ART. 11Annex IV technical file: system purpose, design, training methodology, performance metrics. The prototype is designed to generate the document skeleton, fill in evidence from the registry, and flag missing sections per Annex IV.1–9. Drafts require accountable review.
ART. 12The prototype represents event-schema and audit-record checks for registered systems. It does not establish that an external operational pipeline emits complete or legally sufficient logs.
ART. 13Instructions for use, including intended purpose, accuracy, robustness, foreseeable misuse, and human-oversight measures. The prototype is designed to draft the deployer-facing transparency notice against an Article-13 checklist.
ART. 14Effective oversight measures designed into the system. The prototype is designed to evaluate an oversight design against four capabilities drawn from Article 14 (understand, monitor, override, disable) and to produce a gap analysis for review.
ART. 15Performance metrics, robustness to errors, faults, inconsistencies; cybersecurity against adversarial attacks. The prototype is designed to collect eval-suite results, red-team reports, and an SBOM into the Annex IV evidence block. No live integration is asserted.
Tech Stack
Named technologies identify repository dependencies or adapter surfaces; they do not assert a live integration or deployment.
Source Code
The Aegis AI prototype source code is available upon request for evaluation and partnership purposes.
To access the source code, please sign the Non-Disclosure Agreement. This is a standard legal formality.
Beyond Aegis AI, I offer hands-on consulting to help you build and secure AI systems.
Twelve to twenty-four weeks to risk-classify your AI systems, support the provider-led conformity assessment and engineer the evidence, produce the Annex IV technical documentation, and stand up post-market monitoring — with special depth on the high-risk categories that apply to autonomous, industrial, and robotics deployments
Partnership
For teams exploring a reviewable regulatory workflow with explicit legal and system-owner gates.
From demo to dependable operation. Subscribe for new Physical AI reading.
Unsubscribe anytime. No spam, ever.