There is a quiet failure mode in AI-assisted compliance work. A model reads a policy, compares it to a framework, and produces a tidy gap list. The list looks authoritative. Some of it is wrong — not obviously wrong, but wrong in the way that only surfaces when an auditor asks you to show where the requirement actually says what the model claimed it said.
The problem is not that AI is unsuitable for gap analysis. It is that an ungrounded model is rewarded for sounding right rather than being right. The remedy is grounding.
What grounding actually means
A grounded system does not answer from the model’s parametric memory of what GDPR or DORA “generally requires.” It retrieves the specific provision that applies, and constructs its answer from that retrieved text. Crucially, it returns the provision alongside the answer, so a human can verify the claim against the source in one click.
The difference shows up most sharply at the paragraph level. “Article 32 requires appropriate security measures” is the kind of statement a model can produce from memory, and it is true but useless. A grounded answer points to the exact paragraph, quotes its operative wording, and lets you see whether your control genuinely satisfies that obligation or merely sounds related to it.
Three properties of a defensible gap finding
When we evaluate whether a gap analysis is fit to put in front of an auditor, we look for three properties:
-
Traceability. Every finding links to a specific provision — article and paragraph — not a framework in general. If you cannot click from the finding to the source text, it is an opinion, not evidence.
-
Faithful citation. The text shown is the actual wording of the provision, not a paraphrase that may have drifted. Paraphrase is fine for explanation; it is not fine as the basis of a compliance claim.
-
Scope awareness. A gap is only a gap relative to your obligations. A finding that ignores your baseline (say, NIST LOW vs HIGH) or your service model (IaaS vs SaaS) produces noise — gaps that are not actually yours, or missed gaps that are.
Why this is an architecture decision, not a prompt
You cannot reliably prompt your way out of hallucination. Asking a model to “only state what’s supported by the source” helps at the margin, but the guarantee has to come from the system design: retrieve first, ground the generation in what was retrieved, and surface the source so verification is cheap.
That ordering — retrieve, then ground, then cite — is what separates a tool that accelerates expert work from one that quietly manufactures liability. The expert stays in the loop, but spends their time verifying well-sourced findings instead of fact-checking plausible fiction.
The payoff
Done well, grounded gap analysis changes the economics of compliance consulting. The slow, error-prone part — reading every provision and cross-referencing it to the client’s posture — gets faster and more reliable. The valuable part — judgement about materiality, remediation priority, and risk appetite — stays firmly human, and is now supported by evidence that holds up when someone pushes back.
This article is general information, not legal advice. The point of grounding is precisely that you should verify every finding against its cited source.