Compliance Agent

Open-source compliance copilot for screening policies against regulatory obligations, detecting policy drift, and producing explainable review signals for human experts.

Compliance Agent is a practical screening layer for legal-tech and compliance teams. It helps reviewers find likely gaps, risky policy changes, and supporting regulatory context before a human expert makes the final call.

Component	What it does	Powered by
Rule Screening	Evaluates explainable YAML rules with severities, citations, applicability gates, and exceptions	Built-in lightweight DDL-style reasoner
Regulatory Retrieval	Ingests and queries regulations (GDPR, EU AI Act examples included)	LangChain + ChromaDB (`[rag]` extra)
Drift Detection	Detects meaningful changes between policy versions	LegalDrift (`[drift]` extra)

This is not legal advice and is not a replacement for legal review. Compliance Agent produces review signals, evidence snippets, and risk indicators for qualified humans to evaluate.

Install

pip install compliance-agent            # lightweight core: rule screening + reports
pip install 'compliance-agent[rag]'     # + regulatory retrieval (ChromaDB, sentence-transformers)
pip install 'compliance-agent[drift]'   # + policy drift detection (LegalDrift)
pip install 'compliance-agent[dashboard]'  # + Streamlit dashboard
pip install 'compliance-agent[all]'     # everything

Quick Start

1. Check a policy against rules

compliance-agent check \
  --policy sample_data/policies/privacy_v1.txt \
  --rules sample_data/rules/gdpr_rules.yaml

Exit codes make this CI-friendly: 0 = all applicable rules passed, 1 = findings, 2 = input error. Add --format json for machine-readable output and --verbose for full per-rule traces.

2. Validate a rule pack

compliance-agent validate-rules --rules sample_data/rules/gdpr_rules.yaml

3. Generate a review report

compliance-agent report \
  --policy sample_data/policies/privacy_v1.txt \
  --rules sample_data/rules/gdpr_rules.yaml \
  --output compliance-report.md

Reports can be written as Markdown (.md) for human review, JSON (.json) for automation, or self-contained HTML (.html) for sharing. Every report carries an audit provenance block: timestamp, tool version, and SHA-256 hashes of the policy and rule pack. See docs/report-schema.md.

4. Ingest and query regulations (requires `[rag]`)

compliance-agent monitor --source ./sample_data/regulations/
compliance-agent monitor --source ./sample_data/regulations/ --query "human oversight"

5. Detect drift between policy versions (requires `[drift]`)

compliance-agent drift \
  sample_data/policies/privacy_v1.txt \
  sample_data/policies/privacy_v2.txt

6. Reason about a scenario

compliance-agent reason \
  --scenario sample_data/rules/scenario_gdpr_check.yaml \
  --rules sample_data/rules/gdpr_rules.yaml

Scenario reasoning resolves obligations, permissions, and prohibitions into a decision: ALLOW, ALLOW_WITH_OBLIGATIONS, or BLOCK.

7. Launch the dashboard (requires `[dashboard]`)

compliance-agent dashboard

Every tab has a one-click "use bundled sample data" toggle, and check results can be downloaded as Markdown/JSON reports.

Architecture

  Ingest Regulations ──→ [ RAG Engine ] ──→ Relevant context
                                                 ↓
  Policy v1 vs v2 ────→ [ LegalDrift ] ──→ Drift detected
                                                 ↓
  Rules (YAML) ───────→ [ Reasoner ] ─────→ Review signal
                                                 ↓
                                         [ Dashboard / Report ]

For detailed architecture, see docs/architecture.md.

CLI Reference