Public Sector · Government Services · Regulatory Compliance
On-Premise AI Internal Audit Assistant
- Client
- Public agency administering EU funding · internal audit · close to €1 billion a year in payments
- Industry
- Public Sector
- Department
- Risk, Compliance & Audit
- Region
- Europe
An agency paying out close to €1 billion a year in EU funds cannot afford an audit finding missed because an auditor was on day five of retyping a regulation into a spreadsheet. Nor can it send that material to a cloud AI. So we designed an AI that never leaves the building and cannot cite a law that does not exist.
A working model of the approach on sample data. It plays on its own and pauses when scrolled away; nothing here touches a live system.
The results
- ~80%
- less auditor time per control plan Projected
- Projected: 4-6 working days become a review of a cited draft.
- 100%
- of generated lines carry a verified citation Projected
- Unverifiable answers are blocked by design.
- 0
- data leaving the premises
- Open-weight model, on-premise server, no subscription.
The challenge
Our client is a national public agency administering EU funding, with an internal audit function reporting to its audit committee. Every audited programme has to be checked against the law that governs it.
For each one, an auditor reads the programme document, searches for the matching provision across more than 20 national laws, ordinances and EU regulations, and types the result into a spreadsheet control plan line by line: about 330 requirements per plan, 4-6 working days each, with no tools.
What it was costing them
- Audit risk on EU money. A missed or outdated legal reference in an audit of EU-funded payments can end in an EU financial correction.
- The law keeps moving. Ordinances and regulations change constantly, and audits of past periods need the rule that applied on a specific date.
- Knowledge in people's heads. The expertise sat with individual auditors, and the evidence trail was manual.
- Cloud AI was never an option. The material is sensitive public-sector data. It cannot leave the building.
- 330 requirements per plan × 20+ laws and regulations = 4-6 days typed by hand, no tools
The approach
We designed a complete AI audit assistant that runs entirely inside the client's own infrastructure: no cloud, no external API, no subscription. The audit domain expertise came from our partners, certified internal auditors (CIA, CGAP).
A living legal corpus
| Source family | What is ingested |
|---|---|
| National law | All laws in force, the state gazette checked daily, supreme and constitutional court decisions |
| European law | EUR-Lex and the EU Official Journal, Court of Justice case law, transposition records, conditionality rules |
| The client's own documents | Every version of the strategic programme, secondary legislation, internal procedures and working documents |
| Audit standards | IIA Global Internal Audit Standards, COSO, COBIT, ISA 315 and 330, European Commission and Court of Auditors methodology |
- Full version history of every law. Each change is stored with its entry-into-force date and an amendment engine applies amending acts, so the system answers what the rule was on any given date.
- Reads documents like a lawyer. OCR for scanned PDFs, with articles, paragraphs and points recognised as legal structure rather than flattened into prose.
- Hybrid search. Graph, vector and full-text search over the whole corpus, fused and re-ranked, with multilingual embeddings.
A specialised model that stays in the building
The latest open-weight Gemma model, served on premise and specialised with two adapters, one for national law and one for internal audit, trained on the client's own material and retrained quarterly. Its instructions force it to answer only with legal citations, follow the control-plan format and say when it does not know.
Answers that cannot be invented
Every generated line carries its citation: article, paragraph, point, gazette issue and date. Any answer whose citation does not resolve against the corpus is blocked rather than shown. Every query is written to an immutable log. That single rule is what makes the output usable as audit evidence instead of a draft to be re-checked.
Six functions for the auditors
- Automatic control plan. Upload a programme document, get back a fully cited control plan in the team's own spreadsheet template, with an opinion on every line from three parallel AI agents: lawyer, auditor and analyst.
- Requirement check. A side-by-side view of whether every programme requirement is reflected in the applicable ordinance.
- One-click legal references, each verifiable against the source.
- Plain-language chat with cited answers.
- Internal-document check that flags clauses conflicting with current law.
- Historical look-ups for audits of past periods.
Auditors' corrections feed back into the model. Access is role-based (auditor, manager, admin), with a REST API, VPN remote access and a visual timeline of each law's history. We audited the hardware requirements and sized a single on-premise AI server for the client to procure.
- Legal sources
- Versioned corpus
- Hybrid retrieval
- Specialised model
- Citation check
- Control plan
- Requirement from the programme
- Article, paragraph, point cited
- Gazette issue and date
- Lawyer, auditor, analyst opinion
- Unverifiable citations blocked
Compliance by design
| Requirement | How the design meets it |
|---|---|
| Data residency | One server inside the agency. Nothing is sent to any cloud service |
| GDPR | Personal data in audit files processed only on premise, under the agency's control |
| EU AI Act | Traceability (every output cited), human oversight (auditors approve), unverifiable output blocked |
| Public-sector security and NIS2 | Isolated server, no internet dependency for the AI, role-based access, immutable query log |
| Lock-in | Open-weight model and open-source stack, handed over outright, no subscription |
Technology
| Layer | What we designed with |
|---|---|
| Model | Gemma 4 open-weight with LoRA adapters, served by vLLM |
| Retrieval | bge-m3 embeddings, ArcadeDB for graph, vector, full-text and bi-temporal storage, fusion ranking and re-ranker |
| Documents | Tesseract OCR with Cyrillic correction, MinIO document store |
| Platform | PostgreSQL immutable query log, Redis, REST API, Docker, Prometheus and Grafana |
The outcome
All figures below are projected from the agency's current process and the architecture benchmarks.
| Today | With the assistant (projected) | |
|---|---|---|
| One control plan | 4-6 working days of drafting | A generated draft reviewed within a day |
| Requirements per plan | ~330, typed by hand | Extracted, classified and cited automatically |
| Legal references | Searched manually across 20+ acts | Verified against a versioned corpus |
| Past-period audits | Reconstructing old texts | The rule as it stood on the audited date |
| Data leaving the premises | None | None |
- Roughly 80% less auditor time per control plan.
- Around 330 requirements per plan extracted, classified and traced to a specific legal provision.
- Every line audit-grade: cited, correct for the audited date, and blocked if the citation cannot be verified.
- Audit knowledge moves from individuals into a system the whole department shares.
- No recurring licence and no vendor lock-in.
The risk most teams miss
The law changes every week. An AI audit tool without automated gazette monitoring and version history is out of date within a quarter, and confidently wrong.
Built with
The tools this ran on, by the layer each one carried.
- Apps & integration
- AI
- Data & cloud
PostgreSQLOpen-source relational database for platforms and audit logs.
DockerContainers for self-hosted and on-premise deployments.
Microsoft ExcelConfiguration workbooks and reports owned by the business.
ArcadeDBMulti-model database for graph, vector and full-text retrieval.
RedisIn-memory store for queues and caching.
MinIOS3-compatible object storage you can host yourself.
PrometheusMetrics collection for self-hosted systems.
GrafanaDashboards for system and usage monitoring.
Related work
Public Sector3evidence sources cross-checked per projectEU Grant Expense Verification Automation for an Italian RegionRegional government · Italy · managing authority for EU structural fundsRead the case
Professional Services13steps in every KYC case workflowKYC and AML Case Management Platform for a UK Compliance PracticeRisk and compliance practice · United Kingdom · KYC and AML reviews for financial-services and other UK organisationsRead the case
Investment & Real Assets€150MIFC facility the platform protectsESG Compliance Intelligence PlatformInvestment group · Europe · €150M sustainability-linked IFC facility with ESG covenantsRead the case
Next step
Start the same conversation
Tell us the process that keeps breaking. We will come back with what it would take to fix it, what it would cost, and what we would measure.
Or write to us directly: •••••@•••••••.•••
- A reply from a partner within one business day
- Fixed scope and fixed fee, agreed before we start
- The maps and the backlog are yours either way