A compliance RAG copilot for the EU AI Act and GDPR

Most AI tools answer every question. In compliance, a confident wrong answer is worse than none, because someone might act on it.

So I built a system designed to say "I don't know" when the law doesn't support an answer.

Ask a question in plain English and you get one of two things: ✅ An answer where every claim links to the exact Article or Recital it came from 🟠 An honest abstention that explains why the sources can't support an answer

How it works • A six-step LangGraph agent: plan → retrieve → rerank → generate → critique → human check • The critic can send a weak draft back for better evidence, with hard caps on retries and token spend • Citations are checked against the sources the model actually saw. Invented ones are removed, not trusted • 1,437 passages from the AI Act and GDPR, with embeddings computed locally on CPU

Measured, not claimed (37-question golden set) • 36/37 correct abstention decisions, 0 false answers • 0.99 faithfulness to sources • 0.97 recall@5

Runs on $0/month: free-tier hosting end to end (Cloud Run, Vercel, Neon, Upstash), with provider fallback on every model call.

Stack: Python · FastAPI · LangGraph · Postgres + pgvector · Next.js · AI SDK

🔗 Try it live: ai-lab-web-ten.vercel.app