Citation graphs for compliance — why every AI output needs receipts.
When an auditor asks where a compliance conclusion came from, the team should be able to retrieve the source and review history without rebuilding the analysis. A citation graph connects those records to the final output.
The problem with "the AI said so"
A coverage matrix may look complete while leaving its conclusions unexplained. Before approving it, a reviewer needs to know which source passages were used, how the mappings were made and who checked them.
Recording those steps creates a trail from the final output back to the original regulatory text. A citation graph makes that trail available for review.
What a citation graph actually is
A citation graph is a directed graph where every node is a piece of compliance content (a regulation paragraph, an extracted obligation, a policy clause, a control, an evidence artifact) and every edge records a transformation: extracted from, mapped to, drafted from, approved by. Every output node has a path back to the source nodes that produced it.
A representative citation graph for a drafted control runs like this. The identifiers below are illustrative, not a customer record or a quote from DORA:
- Source paragraph — an official publication, fetched on a known date and pinned to a content version.
- Extracted obligation — a structured proposition with the source location and extraction method attached.
- Applicability decision — entity and scope decision with a named owner and rationale.
- Mapped policy clauses — candidate internal clauses, each linked to its own controlled version.
- Coverage assessment — full, partial or not covered, with a rationale for the elements met and missing.
- Drafted control — A new control language proposal, generated by the AI with the prompt and source references attached.
- Human decision — reviewer, timestamp, disposition, edits and rationale recorded.
- Published artifact — final control version in the target system, with a back-pointer to the chain.
That's the mechanic. Click any node, walk backward to source. Click the source, walk forward to every output it produced.
Why this is harder than it sounds
"Just track citations" is easy to say. The reasons it tends to be implemented badly:
1. Source pinning is nontrivial. Regulator websites change. URLs rot. Documents get republished with the same headline but different paragraph numbering. A citation back to "MAS Notice 626" without a version stamp is a citation to whatever the regulator's site happens to be hosting today. The system has to fetch the source, hash the content, store the hash, and re-fetch on a schedule to detect changes.
2. Character-level offsets matter. "DORA Article 6" is a citation. "DORA Article 6, paragraph 1, second sentence, characters 234–411" is a defensible citation. The first one looks fine in a footnote and falls apart in audit. The second survives a regulator asking "show me the exact text."
3. AI outputs are fluid; citations have to be sticky. An LLM might phrase "recovery time objective" as "RTO" or "time to recovery" or "recovery time targets" depending on the run. The citation needs to bind the output to the source it was derived from, not to the wording, so you can re-run the model without breaking the chain.
4. Human edits compound. The reviewer accepts an AI draft with three edits. The next reviewer further edits. Six months later, an auditor asks "what did the AI originally propose?" If the system has lost the diff history, the answer is "we don't know." That's a finding.
5. Cross-references explode. DORA Article 28 cites the underlying directive, an RTS that cites three ESA Q&As that cite a separate directive. A citation graph that doesn't traverse those cross-references gives auditors half the picture.
Minimum evidence model
The W3C PROV-O Recommendation provides a useful neutral foundation: entities, activities and agents connected by provenance relationships. A compliance implementation can specialise that pattern as follows.
| Record | Required fields | Why it matters |
|---|---|---|
| Source entity | Issuer, canonical URL, publication and effective dates, retrieved time, content hash, language | Reconstructs the exact source used |
| Transformation activity | Type, input IDs, rule or model version, parameters, timestamp | Explains how one record became another |
| Decision activity | Reviewer, role, disposition, rationale, edits, time | Separates a suggestion from an accountable conclusion |
| Output entity | Version, status, owner, target system, published time | Identifies what was actually relied upon |
| Change event | Old and new source hashes, affected-node query, triage status | Supports controlled re-assessment |
What a good citation graph looks like in practice
Two properties matter most:
Traversability in both directions. Forward (source → output) and backward (output → source). Auditors usually start from the output ("show me the trail for this control"). Regulators sometimes start from the source ("show me everything affected by this article"). The graph supports both equally.
Persistence under change. When the regulator updates a paragraph, every output downstream gets flagged automatically. The graph isn't a snapshot taken on day one; it's a live structure that updates with the source. That's how a compliance matrix stays current without re-running everything from scratch every quarter.
The five things to demand of any AI compliance vendor
If you're evaluating a tool that claims it produces "audit-ready" output, run it through these checks:
- Click any output, see source paragraph. Not "see the regulation." See the exact paragraph, with character offsets if you ask for them.
- Source is version-pinned. If the regulator republishes the document tomorrow, your citation still points to what was law when you made the decision. The graph stores both pointers — current and historical.
- Diff view exists. AI draft vs. published version, every edit timestamped, every reviewer recorded. Without this, "human in the loop" is a marketing claim, not an audit fact.
- Cross-references resolve. Citations to RTS, ITS, Q&As, and bulletins are first-class graph nodes, not flat text references.
- Change propagation is visible. When a source paragraph changes, the system shows you which obligations, gaps, and controls downstream are affected — automatically.
Treat missing controls as explicit product risks. The acceptable minimum depends on the use case, but no claim of audit readiness should rely on a demonstration alone: test export, history, access control, change behaviour and reconstruction with your own sample.
Why this is durable infrastructure
Models can be replaced; the controlled history still needs to survive. A version-pinned, cross-referenced and diff-tracked graph requires source ingestion, data modelling, access control, retention, reviewer workflow and ongoing quality checks.
Evaluate this infrastructure before contracting, including its failure modes and export path, rather than discovering the boundary during an audit.
How Sia RegAI uses the citation graph
RegReview monitors a controlled source set, preserves versions and helps reviewers identify which extracted obligations may be affected by a change. RegMatcher carries those approved obligations into assessments against policies and controls, retaining the source, mapping rationale and human decision as the workflow is repeated.
This makes the graph useful beyond a one-off analysis: teams can revisit an interpretation when the source changes, route it to the right reviewer and see which downstream mappings need reassessment. A product evaluation should still use your own sample and verify source pinning, permissions, review history and export behaviour.
Test whether the review trail can be retrieved
During a product evaluation, select a completed output and ask a reviewer to retrieve its source, transformation history and approval record. Record any gaps that require manual reconstruction before deciding whether the workflow meets your audit needs.