Generative AI has reached the compliance function faster than the controls needed to govern it. A week of reading a new regulation can now be compressed into a single question to a chatbot. The promise is real — but so is the risk, and it's the part most often overlooked.
A general-purpose AI model answers a question about a new regulation with the same fluent confidence whether it's right or simply inventing the answer. For a bank, that's not a minor inconvenience. It's a liability.
This is the problem MiCARGPT was built to solve.
The hallucination problem is bigger than most teams realise
Independent research backs this up. Stanford researchers found general-purpose AI models hallucinating on between 58% and 88% of specific legal queries. Even purpose-built legal AI tools — the ones marketed as hallucination-free — still got it wrong 17% to 33% of the time.
The consequences aren't hypothetical. In the well-known U.S. case Mata v. Avianca, two lawyers filed a court brief citing six cases that ChatGPT had invented outright, complete with fabricated quotations. When asked to confirm the cases were real, the model said yes. Their firm was fined $5,000.
For a bank operating under the EU AI Act and DORA, that kind of failure isn't just embarrassing — it's a regulatory finding waiting to happen.
MiCARGPT: grounding, not generation
The instinct is to solve this with a bigger, smarter model. The more effective fix is to change what the model is allowed to do.
MiCARGPT doesn't answer from general training — it answers from a controlled, curated library of primary sources, and it shows its working. It runs a disciplined three-step loop: curate a vetted source library, retrieve the exact passage that answers the question, then ground the answer in that retrieved evidence — with the source attached.
Tested head-to-head against a general ChatGPT baseline on identical questions about the EU's Markets in Crypto-Assets Regulation (MiCAR), the difference was stark. MiCARGPT mapped the exact transitional deadline to 1 July 2026; the generic model offered a vague "up to 18 months." MiCARGPT named the full set of regulatory exclusions; the generic model missed the ones that actually cause firms to be misclassified.
What it takes to build one properly
Building a regulatory AI assistant a supervisor would actually sign off on isn't just a prompt-engineering exercise. It requires:
- A genuine build decision between a lightweight Custom GPT and a fully owned enterprise RAG (retrieval-augmented generation) architecture
- Testing against seven core model capabilities — from grounded retrieval to audit logging
- Testing the wider platform against seven further capabilities across governance and adoption
- Configuration that answers directly to the EU AI Act and DORA, not just general best practice
Read the full blueprint
Our new whitepaper, MiCARGPT: Build Your Own Regulatory AI, sets out the complete delivery blueprint — the architecture decision, the seven capabilities to test for, the full MiCARGPT vs. ChatGPT comparison, and how to configure for regulatory compliance from the first document.
Download the MiCARGPT whitepaper to get the full picture, or book a meeting with one of our experts to talk through how this applies to your organisation.
