Every recommendation must trace back to a specific passage in a source document. Without it, the system is unverifiable, and unverifiable answers are not compliance answers; they are decoration.

We treat the absence of acceptable citations as a hard rejection at the guardrail layer: the system says 'I don't know' rather than fabricating coverage.

For regulated workloads where data cannot leave the estate, open-source models on local infrastructure are not a fallback; they are the default. The capability gap with hosted frontier models has narrowed to the point where well-engineered retrieval and re-ranking matter more than the underlying model size.

Where data classification permits, hybrid architectures route the most ambiguous cases to a frontier model under controls. The choice is not all-or-nothing.

The compliance AI systems that pass audit are not autonomous. Every consequential decision is reviewed by an authorised officer; the agent's role is to compress the time-to-judgement, not to displace the judgement.

Designing for that architecture from the start (review queues, decision capture, escalation rules) produces a system that auditors and operators trust. Bolting it on later produces a system that is permanently in pilot.

Every prompt, every retrieved passage, every model version, every reviewer action: stored, immutable, and searchable. The audit trail is the artefact that makes the system defensible long after the engineers who built it have moved on.

We build the audit log before the model integration. It is cheaper to instrument from day one than to retrofit under regulator pressure.

We measure compliance AI on three things: time saved by reviewers, the proportion of recommendations accepted by reviewers (and by external auditors after the fact), and the absence of incidents, both data-handling incidents and incorrect-recommendation incidents that escape review.

Speed without trust is worthless in this domain. Trust without speed does not justify the build. Both have to land.