A common compliance-AI pattern is simple: a user supplies a contract and receives a confident-sounding summary. The summary may be useful, but it is not enough for a legal review unless the reviewer can inspect the supporting evidence.
The problem wasn't the summary. The problem was that nobody could verify it. A compliance officer's job is not "read this and trust me." It's "show your work, with a paragraph reference, and be ready to defend it in front of a regulator who already disagrees with you." Confident prose is the opposite of what the role requires.
Citation is not a feature. It's the product.
A regulatory finding without a source citation is a guess in fancy clothing. The bar in this domain is not "is the model right?" — it's "can the model show me where it got that, in the original text, in the original language, with the original date stamp, and with a clear path back to the source of authority?"
That bar rules out a lot of architectures. It rules out anything that rephrases and discards. It rules out anything that hallucinates a paragraph number and hopes you don't check. It rules out RAG implementations where retrieval is fuzzy and generation papers over the gaps with confident-sounding text.
The right question for any regulatory AI isn't "how smart is it?" — it's "what is the audit trail when it's wrong?"
Two kinds of wrong
Two common error types matter in legal review, and they are not symmetrical. A false positive — flagging a clean clause as risky — wastes a lawyer's afternoon. A false negative — missing a material disclosure obligation — can be a fine, a consent decree, or a front-page story.
Systems that optimize for "answer-ness" tune for false positives. Systems that optimize for evidence tune for false negatives, because the structure forces the model to find a citation or admit it can't. That second behavior is what a compliance officer actually wants.
What "evidence-first" looks like in practice
Three concrete properties:
One. Each material claim should identify the primary source that supports it, together with enough location and version information for a reviewer to reproduce the citation. A summary or press release is not a substitute for the controlling text.
Two. Each interpretation should be timestamped against the relevant version and application date. For example, Article 9 of the EU AI Act sets risk-management requirements for high-risk AI systems, but whether those duties apply depends on classification, role, scope, and the Act's phased application schedule. Consolidated text, official guidance, and application dates must be tracked separately.
Three. Every disagreement is logged. When two analysts (human or model) reach different conclusions on the same paragraph, that delta becomes a row in a queue, not a fact buried in a transcript.
None of this is glamorous. It is, however, the work required for a reviewable record. The official materials referenced on this site are listed in the Regulatory source register.