Governance capability experiment
Regulatory workflow decision support
A regulatory-workflow backend prototype with inventory, retrieval, classification, evidence, remediation, audit, and report modules. It is a decision-support system under development, not legal advice or a conformity assessment.
Business ↔ technology bridge · Governance capability experiment
Explores evidence-linked regulatory workflow without presenting generated guidance as legal authority.
This is a portfolio and source interpretation—not a customer, deployment, certification, or outcome claim.
System inventory, risk classification, evidence, remediation, and reporting are often fragmented across legal, compliance, product, and engineering teams.
Separate deterministic inventory and workflow state from retrieval-assisted interpretation, and preserve named human review points.
Inventory, retrieval, classification, evidence, remediation, audit, and report modules with migrations and selected mocked test seams.
Evidence gaps and classification uncertainty return to product scope, control design, accountable owners, and release planning.
Source evidence
A regulatory-workflow backend prototype with inventory, retrieval, classification, evidence, remediation, audit, and report modules. It is a decision-support system under development, not legal advice or a conformity assessment.
Repository evidence is not client, deployment, certification, or outcome evidence.
Architecture
Three layers: continuous regulatory monitoring, AI-powered obligation extraction, and a tamper-evident audit trail that holds up under regulator review.
Source map only: a layer can represent implemented code, an adapter boundary, or documented design. It does not assert a configured production service.
Three EUR-Lex ATOM feeds (EU AI Act, GDPR, AI General) parse new instruments by CELEX, extract severity (critical/high/low), and trigger Mistral impact analysis against the registered AI-system inventory. No more catching new regulations months late.
Mistral + RAG over a curated corpus of Articles, Annexes, and EDPB guidance. Obligation extraction, cross-regulation overlap mapping (AI Act ↔ GDPR ↔ NIS2), risk classification, and gap analysis — all with confidence scores and Article-level citations.
The source models classification, gap, remediation, timestamp, and reviewer records in an audit chain. Whether an exported record meets a legal or regulator requirement must be assessed separately.
The Problem
Why regulatory compliance is broken
The EU AI Act alone spans 180+ pages, 113 articles, and 13 annexes. Cross-referencing with GDPR, NIS2, and DORA multiplies the burden exponentially.
Compliance officers spend weeks extracting obligations from regulatory text, mapping them to business units, and building documentation from scratch.
Spreadsheets for tracking, Word for documentation, email for collaboration. No single system connects obligations to evidence to audit trails.
Organisations discover regulatory changes after deadlines pass. No automated monitoring means compliance is always playing catch-up.
Modules
8 modules covering the full compliance lifecycle
Source scope only: an entry can describe implemented code, a documented adapter, or a configured workflow. It is not a statement that a production service is active.
01
Regulatory horizon scanning via 3 EUR-Lex ATOM feeds (EU AI Act, GDPR, AI General). Parses CELEX numbers, extracts severity (critical/high/low), and triggers Mistral impact analysis against your registered AI systems.
02
AI system inventory with Mistral-powered risk classification. Maps each system to EU AI Act risk tiers with confidence scores, reasoning, and Article references.
03
Retrieval-assisted obligation extraction and cross-regulation mapping are represented in source. Completeness and legal interpretation require expert review.
04
Policy ingestion and retrieval-assisted comparison workflows are represented in source. The result is a review queue, not a compliance determination.
05
Auto-generates 5 compliance document types from identified gaps: policies, procedures, technical documentation, checklists, and risk assessments — with confidence scoring and PDF/CSV/Markdown export.
06
Multi-user workspace with role-based access. Assign obligations to departments, track task completion, and maintain team-wide compliance visibility.
07
The backend models hashed audit records, evidence versions, and review state. Operational immutability, retention, and chain of custody depend on deployment controls.
08
Three report types: audit reports for regulators, board reports for executives, and progress reports for tracking improvement over time. PDF export and scheduled delivery.
EU AI Act coverage
Compliance theatre is a list of articles in a PDF. Compliance practice is each article mapped to a specific AI system, with evidence, owner, and last-review date. Below: the articles Aegis tracks per system, with the obligations it auto-extracts.
Repository surface only: availability, completeness, performance, and operational fitness require separate validation.
ART. 4The source includes role-based literacy tracking, quiz, and record-generation workflows. It does not certify a person's competence or an organisation's Article 4 compliance.
ART. 5A rule and retrieval workflow maps a registered system against prohibited-practice categories and references. Legal classification remains a human decision.
ART. 6Annex III risk-class assessment with Mistral-generated reasoning, confidence score, and a per-Annex obligation tree. Re-runs on registry events (model swap, scope change, training-data update).
ART. 9Continuous identification, estimation, evaluation, and treatment of risks. Aegis links each identified risk to its mitigation control and pulls evidence from your CI pipeline (test pass/fail, model card, eval suite).
ART. 10Training, validation, and testing datasets with representative coverage, bias detection, and lineage. Aegis cross-references your dataset registry against the Annex VIII technical-doc requirements.
ART. 11Annex IV technical file: system purpose, design, training methodology, performance metrics. Aegis generates the doc skeleton, fills in evidence from your registry, and flags missing sections per Annex IV.1–9.
ART. 12The prototype represents event-schema and audit-record checks for registered systems. It does not establish that an external operational pipeline emits complete or legally sufficient logs.
ART. 13Instructions for use, including intended purpose, accuracy, robustness, foreseeable misuse, and human-oversight measures. Aegis generates the deployer-facing transparency notice with Article-13 checklist coverage.
ART. 14Effective oversight measures designed into the system. Aegis evaluates your oversight design against the four Article-14 capabilities (understand, monitor, override, disable) and produces gap analysis.
ART. 15Performance metrics, robustness to errors, faults, inconsistencies; cybersecurity against adversarial attacks. Aegis pulls eval-suite results, red-team reports, and SBOM into the Annex IV evidence block.
Tech Stack
Named technologies identify repository dependencies or adapter surfaces; they do not assert a live integration or deployment.
Source Code
The Aegis AI platform source code is available upon request for evaluation and partnership purposes.
To access the source code, please sign our Non-Disclosure Agreement. This is a standard legal formality.
Beyond Aegis AI, we offer hands-on consulting to help you build and secure AI systems.
Twelve to twenty-four weeks to risk-classify your AI systems, support the provider-led conformity assessment and engineer the evidence, produce the Annex IV technical documentation, and stand up post-market monitoring — with special depth on the high-risk categories that apply to autonomous, industrial, and robotics deployments
Partnership
For teams exploring a reviewable regulatory workflow with explicit legal and system-owner gates.
From demo to dependable operation. Get a weekly decision note for Physical AI products.
Unsubscribe anytime. No spam, ever.