Skip to content
All notes

22 Jul 2026 · 2 min read

Compliance is a decision problem, not a text problem

Why Lexelligence puts a rules engine first and calls a language model only when the regulation is genuinely ambiguous.

EU AI ActAgentic AISystems Design

The obvious way to build compliance software in 2026 is to put the regulation in a vector store, retrieve the relevant passages, and ask a language model whether the system complies. It demos beautifully. It is also the wrong shape for the problem.

Most of a regulation is not ambiguous

Read the EU AI Act closely and a large share of it resolves to conditions that a program can evaluate exactly. Does the system fall in Annex III? Is it a general purpose model above the compute threshold? Is there a human in the loop for this decision class? These are lookups and boolean checks. They have determinate answers, and an auditor can be shown why the answer came out the way it did.

Handing those to a language model trades a correct answer for a plausible one, and gives up the audit trail in the bargain.

Where the models earn their place

The genuinely hard parts are the edges: whether a particular deployment context counts as "employment", whether a given mitigation is "appropriate", whether two systems constitute one system. Language matters there, precedent matters, and no lookup table will settle it.

That is a much smaller surface than the whole regulation, and it is the surface worth spending inference on.

The architecture that follows

  • A rules-first decision engine that evaluates everything determinate, and records which clause drove each answer.
  • Multi-tenant PostgreSQL, because compliance state is relational and long-lived, and because tenants must not be able to see each other under any circumstance.
  • Workflow orchestration, since a compliance answer is rarely one question. It is a sequence with dependencies and human sign-off points.
  • Selective model calls at the ambiguous nodes, with the prompt, retrieved clauses, and answer all persisted for audit.

The result is a system where the expensive, non-deterministic component runs on maybe five percent of the questions, and where every answer can be traced to either a clause or a recorded model call.

What this costs

It is slower to build than the retrieval-first version. You have to actually encode the regulation, which means reading it properly and arguing about interpretations before writing any code.

That reading is not overhead. It is the product.