AI-powered regulatory impact assessment for Indian fintech products, built to answer a specific question: can an AI compliance tool prove its findings are correct, not just produce them?
Most AI compliance demos are good at generating plausible-sounding findings. Few of them can show their work — which specific clause a finding is based on, and whether the model quoted it accurately or paraphrased it into something that sounds right but isn't. For a regulated domain like RBI fintech compliance, an unverifiable citation is worse than no citation at all.
Looks impressive in a demo — until a reviewer checks one citation and finds it doesn't hold up. Breadth without verification is the fastest way to lose all credibility at once.
Not selectedGet the trust mechanism right on Digital Lending Guidelines end to end before adding a second regulatory area. Depth a reviewer can actually check beats coverage they can't.
SelectedFaster to build, but defeats the entire premise — an AI compliance tool without a paper trail is exactly the "trust me" problem this project exists to solve.
Not selectedReading a product description against a regulation is language work, not arithmetic. The value isn't raw speed — it's applying the same standard every time, consistently, which manual review can't guarantee across reviewers.
Findings are tested against real clauses pulled from a corpus at request time, never recalled from training data. At 19 clauses today, that's a direct filter, not embeddings-based search — a deliberate, disclosed scope limit, not a hidden one. See the architecture walkthrough for the honest version.
A generic intake form asks the same questions regardless of what you're building. The AI inference engine only asks the 3-5 questions that would actually change the compliance answer for this specific product.
POST /api/synthesize(client-only)POST /api/questionsPOST /api/generateGET /report/[id]No verified source document existed for KYC/AML — only general regulatory knowledge. Options were: leave it out, ship it looking as trustworthy as the verified DLG clauses, or ship it with an explicit "unverified — needs legal review" flag that follows the citation everywhere it's shown. Chose the third — hiding the uncertainty would have contradicted the entire premise of the project.
Discovered live, during this build, that the AI inference engine's free-tier quota can be exhausted by normal testing volume. Rather than let the app depend on the provider's own rate limiting (and fail with a raw error when it hits), RegImpact enforces its own configurable daily cap in Postgres and refuses to call the inference engine at all once it's reached — a deliberate constraint, not an afterthought.
RegImpact AI hasn't run against real reviewer traffic yet, so nothing below is a claimed result — it's the KPI framework I'd instrument on day one in production, the same way I'd define success metrics before shipping any product. The one thing already true today, structurally, is that every finding carries a citation — the rest needs real usage to measure.
The current build proves the citation-verification approach end to end on two regulatory areas — Digital Lending Guidelines and KYC/AML — deliberately, before scaling breadth. Here's where the product goes from there.
See the architecture walkthrough for exactly what's built today versus what's ahead.
I'm Shriyashish Mishra, a Product Manager. I'm drawn to problems that start ambiguous — where the hard part isn't writing code, it's deciding what “correct” even means before you can build toward it.
AI products interest me because they make that ambiguity structural: a model can sound confident and still be wrong, and most products don't give a user any way to tell the difference. I think that gap — between confidence and correctness — is the actual product problem of this generation of AI tools, not a footnote to solve later. Trust and explainability aren't features you add on top; they're the design constraint everything else has to work within.
I built RegImpact AI to work that constraint end to end in a domain where it matters most — regulatory compliance, where an unverifiable answer is worse than no answer at all. See more of my work at my portfolio.