02Compliance
Model the domain first
AI on top of documents gives you fast drafts and reports, and all of it has to be verified from scratch. Model the domain first, and compliance becomes a state you can trust: you assert every piece of information, and every change is checked the same way, every time.
AI has been hyped everywhere, and compliance is no exception. Doubts about whether AI is capable enough are fading fast. Beyond them, we see two things holding AI back in compliance. One is trust, which we come back to below. The other is how AI is used: to automate workflows.
Workflows inherit our problems
To automate a workflow, we ask an AI to carry out the steps that already exist, on the material that already exists. It inherits our problems with them.
Those problems are well documented. Notified bodies report that 65% of MDR technical files arrive missing at least half of the required information.1 The FDA's most frequent findings at device manufacturers are in processes that should connect records but don't: corrective and preventive actions, complaint handling and supplier controls.2
Compliance is a state, not a workflow
Compliance, consistency, traceability and coherence are states: at any moment, they hold or they don't. No existing system holds them as states. They are rebuilt by hand for each review or audit.
An AI workflow could rebuild them faster: read every document, compare it with every other, report the contradictions. But across thousands of documents that is a huge task, and to take accountability for the result, every source and every conclusion has to be verified. Next time, it starts again from scratch, and its answer may differ.
Model the domain
A state needs somewhere to live. For us, that is a graph that models the domain: the types of information, the relationships between them, and what we expect of each (see Compliance is a graph).
For every type, the expectations are declared up front, as two kinds of rule:
- Deterministic rules check that a link is there. A paragraph must link to an obligation. A design input must trace to a design output.
- Judgement rules are bounded AI tasks. An output must address every input it traces to. Two paragraphs implementing the same requirement must be consistent. A term must mean the same thing wherever it is used.
Owning the state
With the expectations declared, compliance is whether they are met, at any moment. Every decision, interpretation and assertion the company's experts make is wired into the graph. Nothing is recreated: an answer rests on what they decided, not on what an agent reconstructed today.
When something changes, the graph already knows what it affects. Deterministic checks run directly. Where judgement is needed, the AI is triggered deterministically: make the same change in Lumidocs a hundred times, and the same narrow questions are asked, with the same context. Nobody has to remember to ask, and no agent has to rediscover what is connected to what.
Every judgement is recorded as the AI's. Rather than verifying an agent's whole report, the team reviews confined, atomic judgements and asserts its review of each. Through them, it owns the state as a whole. How that history is made trustworthy is the subject of Trusting AI in compliance.
Sources
-
FDA Form 483 observations for devices, fiscal year 2025, as analysed by Meddeviceguide; primary data at FDA. ↩