Agentic compliance triage
ComplianceLens
An internal tool for fintech product teams that triages a new feature idea against the EU AI Act, classifies credit and lending risk, and generates the right downstream artifacts for legal and design.
What it is
ComplianceLens is an internal tool for fintech product teams that triages a new feature idea against the EU AI Act. It decides what additional information it needs, classifies risk, and generates the right downstream artifacts: a legal handoff memo and a design disclosure checklist for the people who need to act on them.
Credit scoring, loan decisioning, fraud detection, and mobile banking features all land squarely in the EU AI Act's high-risk categories. Most fintech product orgs are still running manual, inconsistent reviews: a PM writes up a feature, Legal looks at it eventually, and nobody's quite sure which obligations apply. ComplianceLens makes that loop faster and more defensible.
Why it's agentic, not just a form
The core design decision is that this is a state machine with a reasoning loop, not a static intake form. Risk classification under the AI Act genuinely depends on incomplete information, so "decide if I have enough info" isn't a fake affordance, it's the actual job. The agent:
{ feature_description, gathered_facts: [], risk_classification: null, confidence: low }
- 1 Assess: do I have enough info to classify risk under the AI Act?
- 2 If no → decide what's missing → ask one targeted clarifying question
-
3
If yes → call
classify_risk→ return structured{ risk_tier, triggering_articles, confidence, rationale } - 4 If classification confidence is low → flag for human review instead of guessing
-
Assessenough info to classify?
-
no
Ask a questionround += 1loops back to Assess
-
yes
classify_risk()call the tool
-
confident
Stop — classified
-
low confidence
Stop — escalate to humanalso reached at 3 rounds
-
confident
-
no
The "when to stop" condition is the most important design decision. Endless agent loops are a recognized failure mode in agentic UX right now. An explicit stopping rule, including max iterations, confidence threshold, and an escalate-to-human fallback, is exactly the kind of judgment that no model should make on its own.
The tools and skills
The agent has four tools and two skills. Tools fetch or compute; skills produce a crafted deliverable for a specific audience.
Tools fetch data or run computations. The agent calls them directly during its reasoning loop, and results feed back into the next step.
| Function | What it does |
|---|---|
| search_ai_act_articles(query) | Retrieves relevant articles and recitals by keyword. Keeps the classification grounded in actual regulatory text rather than baked-in assumptions. |
| classify_risk(feature) | Returns a structured object: { risk_tier, triggering_articles, confidence, rationale }. The confidence score gates the agent's next move and is what an eval script can grade. |
| check_precedent() | Pulls from a small set of prior cases so the agent can reason by analogy as well as by article lookup, adding a second axis of reasoning beyond pure rule retrieval. |
| generate_team_brief(role) | Same underlying classification, audience-shaped output. Legal gets a compliance memo; Design gets a disclosure checklist. One source of truth, multiple registers. |
Skills are packaged prompts that produce a crafted deliverable for a specific audience. The agent invokes them once classification is confident. They don't loop, they output.
| Function | What it does |
|---|---|
| draft_legal_handoff() | Packages classification + rationale + triggering articles into a structured memo in legal register, ready to route to counsel without further editing. |
| produce_disclosure_ux_checklist() | Translates the classification into designer-facing questions: does this feature need a disclosure banner? A human-override control? Audit logging? An appeal flow? |
Multi-turn state and explainability
The demo conversation is built around 2–3 turns where something meaningful changes. A PM describes an iOS credit screening app that analyzes mobile behavioral signals to score creditworthiness. The agent identifies a missing piece of information: decision authority. The PM clarifies that a loan officer reviews the score before any decision; the agent re-runs classification and explains why the tier still applies (human oversight changes which obligations apply, not whether high-risk classification applies at all). The PM then asks about adding an explainability feature for declined applicants; the agent explains it satisfies Article 13 transparency obligations without lowering the tier.
That "explain why the answer changed" moment is the key demo beat: explainability, state continuity, and judgment in one turn. The case file panel on the right builds in real time as facts are gathered, so the PM can see exactly what the agent knows and what it's still waiting for.
What gets escalated, and why
Two things sit explicitly outside the tool's scope and are surfaced as routing signals rather than answers. GDPR consent validity: mobile behavioral data collected on iOS may trigger data minimization and consent obligations, but that's a privacy question, not an AI Act question. Any classification where confidence falls below the threshold after three rounds of information gathering escalates to human review rather than producing a low-confidence output the PM might act on.
Knowing what to hand off, and making the handoff legible, is as important as knowing what to do yourself.
The eval design
The part most designers skip. An eval set of ~15 feature descriptions, each with an expected risk tier, triggering articles, and notes on the reasoning, lets you actually grade the agent's outputs rather than rely on vibes. The interesting metric isn't accuracy on obvious cases. It's whether the agent correctly chose to ask a clarifying question on genuinely ambiguous inputs rather than guessing, and whether it ever called something minimal-risk when it was actually high-risk. In a credit screening or fraud detection tool, false negatives are the dangerous direction.
Open the standalone prototype to walk through the reasoning loop yourself: describe a feature, answer the clarifying question, and see the risk classification, legal memo, and design checklist it produces.
View ComplianceLens →