RAG over compliance documents

Compliance documents — PCI-DSS, scheme rulebooks, regulatory guidance — are consulted often, change occasionally, and require precise citation. This makes them a well-shaped use case for retrieval-augmented generation, with specific engineering demands.

Written October 2025 from an internal compliance-support pilot.

What makes this use case tractable

• The source corpus is well-defined. Not every document that ever existed; a specific set of authoritative sources.
• Answers can be exact. Compliance questions usually have a defined answer; the RAG system doesn't need to reason, it needs to retrieve and paraphrase.
• Citations are required. The answer without a citation isn't useful to a compliance reviewer.
• Freshness matters. When a scheme updates its rulebook, the RAG index must reflect that within days.

The engineering

• Document ingestion pipeline. Handles PDF, HTML, DOCX. Chunks with awareness of document structure — sections stay together, tables aren't split.
• Chunk metadata. Each chunk carries source document, version, section reference. Citations are precise.
• Retrieval with document filtering. A merchant asking about PCI can filter to PCI sources; an issuer asking about scheme rules filters to scheme rules.
• Answer verification. Before returning, the system checks that every claim in the answer maps to a specific chunk in the sources. Claims without support are removed.
• Version pinning. The user's answer is pinned to specific document versions; if the versions change, the answer is invalidated and rebuilt.

What to avoid

• Blending sources. Two documents saying different things should produce a response noting the disagreement, not a paraphrase that averages them.
• Answering from outdated versions. The freshness discipline has to be tight for this to be useful.

Compliance RAG done right is a support-team force multiplier. Done wrong, it's a source of confidently wrong advice.