Architecture

What happens after you click Start Assessment

Twelve stages, each with one job — AI reasoning only where language understanding is genuinely needed, everything decidable by a plain rule resolved without it. This page walks the whole system the way you'd present it in a design review.

AI Product

FinTech

RegTech

System Design

Enterprise SaaS

V_01 / Problem

Traditional compliance review is manual, slow, inconsistent across reviewers, and hard to audit after the fact. Generic LLMs promise to speed this up, but most produce plausible-sounding compliance advice with no way to check where a conclusion actually came from — and in a regulated domain, an unverifiable answer is worse than no answer at all. RegImpact was designed around three things a faster tool alone doesn't give you: trust, traceability, and explainability.

V_02 / End-to-End Architecture

The complete production pipeline, in order. Every stage below is live in this build — nothing here is aspirational.

Stage 1Structured Onboarding

Business value — Captures ground truth up front instead of making the AI guess at facts the user already knows.Technical value — Multi-select Step 1 form — categories, geographies, customer segments, regulated entities, capabilities — typed as StructuredProductInfo and trusted over any AI inference from here on.

Stage 2Rule Engine

Business value — Reduces unnecessary AI inference for the cases that don't need judgment at all.Technical value — Deterministic, no-AI checks: category-to-area mapping decides which regulations even apply; per-clause keyword absence detection pre-empts clauses with zero supporting signal. Can only ever conclude "insufficient information," never fabricate a compliant verdict.

Stage 3Assessment Cache

Business value — Avoids recomputing identical assessments, cutting both latency and inference cost to near zero on a repeat.Technical value — Each AI stage hashes its normalized inputs (case/whitespace/order-insensitive) and checks a versioned cache before calling the model — a hit skips the call and the daily quota entirely.

Stage 4AI Inference Layer

Business value — Puts reasoning only where it's genuinely needed — reading language and judging intent, not arithmetic.Technical value — One abstraction (lib/ai/provider.ts) behind every model call. Routes, prompts, and schemas only ever know "the AI inference engine" — the provider is swappable without touching business logic.

Stage 5Mirror Understanding

Business value — Lets the user verify the AI's interpretation before an assessment ever begins, catching a misread early and cheaply.Technical value — Client-only screen, no network call — splits "what you told us" from "what we inferred" from "what's still missing," with a computed Assessment Readiness score.

Stage 6Adaptive Discovery

Business value — Only asks the follow-up questions that would actually change the compliance answer — not a generic twenty-item intake form.Technical value — 3-5 targeted questions generated from what structured inputs and inferred elements don't already cover.

Stage 7Versioned Regulatory Knowledge Base

Business value — Separates regulatory content from business logic, so regulations can evolve without touching the pipeline.Technical value — Authority → regulatory area → document → version registry (lib/knowledgeBase), each document carrying type, status, publication date, and supersession links.

Stage 8Retrieval

Business value — Tests a product only against the regulations that actually apply to it, not the entire corpus regardless of fit.Technical value — Two direct filters, no ranking: declared categories select regulatory areas, then only clauses whose document is currently Active are pulled — a superseded document drops out automatically.

Stage 9Citation Verification

Business value — Every finding is traceable back to real regulatory source material, not a plausible-sounding paraphrase.Technical value — Verified flag, document version, publication date, and issuing authority are all resolved server-side against the Knowledge Base — never taken from the model's own output.

Stage 10Finding Classification

Business value — Applies the same standard to every clause, so the report can show confirmations, not just problems.Technical value — Every clause in scope is classified compliant, non-compliant, potential gap, or info required — structured AI output validated against a Zod schema, streamed as each finding completes.

Stage 11Executive Report Generator

Business value — Lets an executive understand compliance posture within seconds, not by reading every finding.Technical value — Compliance score, risk level, and launch recommendation are computed deterministically from the classified findings — arithmetic, not a second round of model judgment.

Stage 12PDF Export

Business value — Produces a shareable, auditable deliverable a compliance team can actually file.Technical value — Browser-native print with dedicated print theming — the dark UI flips to a light, paginated document automatically, no separate PDF-rendering service.

V_03 / Why This Architecture?

Every major layer exists because of a specific decision, not by default.

Rule EngineReduces unnecessary AI inference for deterministic cases — but is deliberately narrow: it can only conclude "nothing to test," never "compliant," since mentioning a topic doesn't confirm the regulation's actual terms are met.

Assessment CacheAvoids recomputing identical assessments, reducing latency and inference cost — versioned so a prompt/rule/corpus change invalidates old entries automatically, never silently returning something stale.

Mirror UnderstandingLets users verify AI interpretation before an assessment begins, rather than discovering a misread three steps later in a finished report.

Adaptive DiscoveryOnly asks follow-up questions that would actually change a finding's classification — asking anything else is friction with no signal.

Versioned Regulatory Knowledge BaseSeparates regulatory content from business logic, so regulations evolve independently — adding a circular or amendment is new data, not a code change.

Citation VerificationEvery finding is traceable back to regulatory source material — a model can misquote confidently, so trust is resolved server-side, never taken on the model's word.

Executive SummaryAllows executives to understand compliance posture within seconds — a number they'll act on should come from auditable arithmetic, not AI self-assessment.

V_04 / Regulatory Knowledge Base

A regulation isn't one static file — RBI amends, clarifies, and circulars its guidelines continuously. So the corpus is a Knowledge Base, not a PDF: Digital Lending already coexists with Guidelines/Circulars/FAQs/Amendments as document types it could hold (today it has one — the 2022 Guidelines), and KYC/AML the same for Master Directions/Circulars/FAQs. See the Knowledge Base page for what's live today versus modeled for later.

AuthorityWho issues the regulation — e.g. Reserve Bank of India. A plain string, not a closed type, so a new authority (SEBI, IRDAI, NPCI) is new data.

Regulatory AreaA domain under that authority — Digital Lending, KYC/AML, and five more areas modeled but not yet documented (PPI, Payment Aggregator, Account Aggregator, NBFC, UPI).

DocumentsOne area can hold several — a guideline, its circulars, amendments, FAQs. Each is its own document with its own lifecycle.

Document MetadataPublication date, effective date, version, status, jurisdiction, verification status — reusable across any authority, nothing hardcoded to RBI.

Clause-Level StructureDocuments aren't stored as raw text — each is pre-segmented into individually-citable clauses at authoring time. At today's scale (19 clauses across two documents) there's no automated runtime chunking step, and none is needed yet.

RetrievalFilters to clauses whose document is currently Active within the areas a product's categories select.

Citation VerificationEvery citation resolves its document's version, publication date, and authority — alongside the verified flag — before it ever reaches a report.

AssessmentThe pipeline consumes clauses the same way regardless of which document or version they came from — this restructuring never touched assessment logic.

This is what lets the architecture support regulatory evolution instead of depending on one document staying frozen in time.

V_05 / Trust & Explainability

RegImpact avoids black-box AI by keeping every step between a raw finding and the executive summary visible and checkable.

Finding

Evidence

Citation

Verification Status

Confidence Reasoning

Executive Summary

FindingOne row per clause tested, classified compliant / non-compliant / potential gap / info required.

EvidenceWhat was found in the product description or structured inputs, and what was missing — both recorded, not just one.

CitationThe exact clause the finding is based on, joined by id — not free text a model could drift from.

Verification StatusResolved server-side from the Knowledge Base — an unverified source renders an explicit "needs legal review" notice.

Confidence ReasoningWhy the model landed on this confidence level, in its own words — not just a number with no justification.

Executive SummaryAggregated deterministically from every finding above — auditable arithmetic, not a second AI opinion.

A real finding from the sample reportDisbursal routed through the partner NBFC's pooled settlement accountNon-Compliant

Evidence FoundDescription explicitly states disbursal is routed through the partner NBFC's pooled settlement account before reaching the borrower.

Evidence MissingNone — the evidence found is direct and unambiguous.

Inference MadeNone — this is stated in the description, not inferred.

Confidence ReasoningThe description explicitly states disbursal is routed through a pooled settlement account — direct, unambiguous evidence of the exact structure this clause prohibits, not an inference.

V_06 / Technology Stack

Frontend

Next.js

React

TypeScript

Tailwind CSS

Backend

Next.js Route Handlers

Supabase

Database

PostgreSQL

Authentication

Signed session cookie (HMAC) — single-owner admin gate, no user table

Provider-agnostic AI layer

Prompt engineering

Structured outputs (Zod)

Knowledge Layer

Versioned Regulatory Knowledge Base

Retrieval-Augmented Generation

Citation verification

Decision Layer

Rule engine

Adaptive discovery

Finding classification

Performance

Assessment cache

Stage cache

NDJSON streaming

Deployment

Vercel

Version Control

GitHub

V_07 / Scalability

Current

Digital Lending

KYC / AML

Future

Payment Aggregator

PPI

Account Aggregator

NBFC

UPI

DPDP Act

SEBI

IRDAI

International Regulations

Every item on the right extends the Knowledge Base — a new authority, area, or document — rather than requiring a change to retrieval, discovery, or assessment logic.

V_08 / Implementation Detail

Streaming

/api/generate responds with NDJSON — one JSON event per line (step / finding / done / error). The client renders findings as they arrive; step messages narrate real server-side stages, not a simulated progress bar.

Data Model

assessmentsid, product_name, description, created_at.

questionsDiscovery Q&A per assessment, persisted as answered.

findingsOne row per clause tested — classification, confidence, evidence found/missing.

finding_impactsProduct / UI / engineering / business impact statements.

finding_citationsSource clause(s) per finding — verified flag, document version, publication date, and authority all resolved server-side.

recommendationsOrdered, actionable recommendations per finding.

daily_usageOne row per calendar date — the shared AI-inference quota counter.

ai_cacheStage-level cache of AI responses, keyed by normalized input hash + prompt/rule/corpus/schema version.

ai_optimization_metricsOne row per calendar date — cache hits/misses, rule engine decisions, token/time savings.

Cost Protection

Every AI-inference-calling route checks and atomically increments a shared daily counter before calling the inference engine — never after. A cache hit or a rule-engine decision never reaches this counter, since no AI call happened. Configurable via MAX_DAILY_ASSESSMENTS.

Honest scope note: Digital Lending and KYC/AML are the two areas with active documents today. KYC/AML clauses are unverified — reconstructed from general knowledge, not transcribed from the current source text — and every citation built from them carries that flag through to the report.

See a completed assessment →Explore the Knowledge Base →Read the case study →