Compliance Agent: Explainable Policy Copilot

Most "AI Lawyers" fail because they act as black-box oracles. You feed them a contract, ask if it's compliant, and they confidently output "Yes" or "No", often hallucinating clauses or missing subtle regulatory shifts.

The problem

For high-stakes compliance, you don't need a machine to make the final call; you need a machine to aggressively screen, surface risk indicators, and provide explainable evidence so a qualified human can make the final call faster. Most tooling in this space collapses that distinction: it asks the model to be the compliance officer instead of assisting one.

Compliance Agent is my attempt at the screening-only architecture: a copilot for legal-tech teams that never claims to render a legal opinion.

compliance-agent check --policy privacy_v1.txt --rules gdpr_rules.yaml

How it works

The diagram above is the whole pipeline. It's a deterministic screening layer that avoids unsupervised generation in favor of three composed stages:

1. Regulatory retrieval. Ingests and queries regulations (e.g., GDPR, EU AI Act) using LangChain and ChromaDB.
2. Drift detection. Detects meaningful semantic changes between policy versions using the embedded LegalDrift engine (see LegalDrift).
3. Rule screening. Evaluates explainable YAML rules for obligations, permissions, and prohibitions using a built-in lightweight DDL-style reasoner.

The YAML reasoner: determinism over generation

Instead of asking an LLM "Is this policy GDPR compliant?", you define explicit rules in YAML. These rules map to specific legal modalities: obligations (must be done), permissions (may be done), and prohibitions (must not be done).

rules:
  - id: "GDPR-CONSENT-001"
    type: "obligation"
    description: "Consent must be obtained before processing personal data"
    predicates:
      - name: "has_consent"
        condition: "document contains explicit consent language"
        weight: 1.0

By separating the rule logic from the semantic matching, we gain massive auditability. The embedding model is only used to evaluate the narrow condition against retrieved chunks, returning a confidence score. The reasoner aggregates these predicates based on their weight and the rule type.

Rule type	Predicate evaluates to true	Predicate evaluates to false
Obligation	Requirement satisfied — no flag	Gap flagged: required evidence missing
Permission	Enabling evidence present — no flag	Noted, but not necessarily a violation
Prohibition	Violation flagged — forbidden evidence found	Clean — forbidden evidence absent

This lets compliance teams build reusable, version-controlled "rule packs." Before publishing a rule pack, the CLI's validate-rules command checks for missing fields, duplicate IDs, or invalid weights.

Semantic drift detection

Policies are rarely written from scratch; they evolve. When a company updates its privacy policy, the compliance team needs to know: did the substantive meaning change, or did marketing just rewrite it?

Compliance Agent integrates statistical hypothesis testing on the document embeddings. If a paragraph's embedding distribution shifts significantly (yielding a low p-value), the agent flags it as "Drift Detected", directing the human reviewer's attention to the newly introduced obligations or silently removed protections.

What it produces

The end product is not a boolean "Pass/Fail." It's a structured Markdown or JSON report containing:

1. Drift analysis: what semantically changed from the baseline policy.
2. Rule evaluations: which YAML rules passed, which failed, and why (with quoted evidence snippets).
3. Regulatory grounding: if a rule failed, the exact text from the ingested regulation that necessitates it.

Limitations as a feature

Tools that touch legal documents owe their users an honest account of what they cannot do. Compliance Agent is built with strict limitations in mind:

• It is not a legal opinion. It screens for risk; it does not make legal determinations.
• Conservative semantics. Because it relies on statistical matching, human reviewers must confirm findings.

Check out the code and contribute rule packs on GitHub: OsamaMoftah/compliance-agent.