How does retrieval-augmented generation make AI answers about compliance trustworthy?

Quick answer

Retrieval-augmented generation (RAG) means the AI doesn't answer from memory. When you ask OptiTech's copilot "does NIS2 apply to us?", the system first retrieves the relevant passages from an indexed corpus (the actual legal texts, MSB's regulations, and your own control and evidence data) and then generates an answer grounded in those passages, with citations. You can click through to the source and verify every claim.

Why plain LLM answers aren't good enough for legal content

A general-purpose language model asked about NIS2 will produce something plausible. Plausible is the problem: it may cite article numbers that don't exist, mix up the EU directive with national implementation, or describe thresholds from a draft that changed. In compliance, a confidently wrong answer is worse than no answer, because someone acts on it.

RAG addresses this structurally:

Grounding. The model only reasons over retrieved source passages, dramatically reducing invented facts.
Citations. Every answer links to the exact legal text or internal record it relied on.
Freshness. When a regulation updates, the index updates; the model's training date stops mattering for the answer content.
Your context. Because your controls and evidence are in the index, "what are we missing for ISO 27001?" is answered from your actual gap data, not generic advice.

The guardrails around the AI

OptiTech applies three policies on top of RAG:

Source citations always. Answers about legal requirements cite the law, the regulation section, or the internal record.
Human review in the loop. AI-drafted policies and questionnaire answers are drafts until a person approves them. Nothing auto-publishes.
EU-hosted models. Inference runs on EU-hosted LLMs, and your data never leaves the EU or trains anyone's models. See how the AI searches legal texts and evidence.

What to ask any vendor about their AI

Ask where inference runs and whether your data is used for training, ask to see a wrong answer (every system has them) and how it's surfaced, and ask whether citations point to sources you can open. If the answers are vague, the AI is a demo feature, not a compliance tool.