Appearance
AI Requirement Extraction
Extraction is the AI capability with the largest measurable effect on compliance workload, and the one where the human gate matters most.
What it does
Given a regulatory document, extraction proposes the discrete obligations it contains, each with the source text it derived from.
The output is a candidate set. Nothing enters your requirement library until a person publishes it.
Where extraction is used
| Context | Input | Output |
|---|---|---|
| Smart Extract | An uploaded regulatory document | Candidate requirements |
| Regulatory change triage | An accepted change event | Candidate requirements |
| Control source ingestion | A policy, procedure or standard | Candidate controls |
| Inspection candidates | An examination report | Candidate observations |
All four follow the same pattern: extract, review, adopt or reject.
Provenance
Every candidate carries:
| Field | Purpose |
|---|---|
| Source document | Which file it came from |
| Source location | Where in the document |
| Extracted text | What the extractor read |
| Original wording | The exact source text |
| Confidence | The extractor's assessed confidence |
| Provenance metadata | Model, pass and prompt version |
This is what lets a reviewer check a candidate against its source rather than against their memory of the document.
Persisted layers
For control source ingestion, the document is stored broken into layers: document, section, paragraph, sentence, extracted control, normalised control.
The practical consequence: a better extractor can be run over the same persisted text without re-uploading the document. Controls in a register can be regenerated, compared and superseded rather than frozen at whatever quality the extractor had on the day.
Character offsets are computed against a canonical text reproducible from the stored units, so a candidate's citation back into the source stays valid across parser changes.
Confidence banding
Candidates carry a confidence value and a recorded band.
| Band | Routing |
|---|---|
| Auto | High confidence, verbatim from the source |
| Review | Normal review queue |
| Validate | Lower confidence; check carefully against the source |
The band is stored on the candidate, not recomputed
Bands are recorded at extraction time rather than derived at read time. A later threshold change never silently rewrites how an existing candidate was released.
Without this, adjusting a threshold would retroactively change the apparent basis on which past controls were published.
Banding routes attention. It is not a quality guarantee, and an auto-band candidate is still a proposal.
What extraction does well
| Strength | Why |
|---|---|
| Enumerating obligations in structured documents | Numbered clauses, tables of requirements, and definition-led standards decompose reliably |
| Preserving source text | The citation is mechanical, not interpretive |
| Consistency across a long document | It does not tire on page 80 |
| Speed | Hours instead of days |
What extraction does badly
| Weakness | What to do |
|---|---|
| Granularity judgement | The most common error. A duty split too finely becomes unownable; left too coarse it becomes unassignable. Merge and split during review |
| Distinguishing obligation from definition | "For the purposes of this circular, material means..." often arrives as a candidate. Reject it |
| Restated duties | Executive summaries restate obligations. Merge rather than publishing both |
| Jurisdictional nuance | It reads text; it does not know which of two overlapping regimes applies to you |
| Scanned documents | An image without a text layer produces nothing or garbage |
The publication gate
Publication is the only step that creates obligations
An unpublished extraction session has no compliance effect whatsoever. It does not appear in registers, it does not affect any determination, and it is not part of your obligation set.
A candidate becomes a requirement when a person publishes it, and never before.
Reviewing extraction output well
Read the source alongside the candidate. Every candidate shows the text it derived from. If they do not correspond, reject.
Aim for ownable units. The test: could a single accountable person complete this? If it needs three departments, split it. If it is a fragment of a duty, merge it.
Reject aggressively. A 40% rejection rate on a policy document is normal and healthy. Publishing everything produces a register full of non-obligations that dilute every count you compute from it.
Capture deadlines. Where a clause carries a date, record it so it reaches the GRC Calendar.
Failure behaviour
| Failure | Result |
|---|---|
| AI provider unavailable | The extraction job records an error with a code; the session moves to failed |
| Document not convertible | Extraction produces nothing or garbage; check the converted text in the session artefact |
| AI entitlement off | Extraction is unavailable; import and manual authoring are unaffected |
Permissions
| Action | Permission |
|---|---|
| Run the Smart Extract wizard | library.smart_extract |
| Import framework catalogues instead | library.import |
| Ingest control source documents | control_source.ingest |
| Publish candidate controls | control_source.publish |
| Extract inspection candidates | inspection.extract |
| Use AI features | ai.use plus the AI entitlement |
Example
A 94-page outsourcing circular.
| Metric | Value |
|---|---|
| Candidates extracted | 47 |
| Published as-is | 22 |
| Published after editing | 9 |
| Merged | 6 into 3 |
| Split | 3 into 6 |
| Rejected | 7 |
| Final requirements | 40 |
| Review time | Under two hours |
| Estimated manual effort | 1.5 days |
What was rejected: four definitions, two cross-references to other circulars, and one recital.
What was split: three clauses each containing a "maintain and review" pairing. Maintaining a register and reviewing it quarterly are different duties with different owners and different evidence.
What was merged: the circular restated its three core duties in an executive summary. Publishing both would have produced three phantom obligations that would have appeared uncovered forever.
The two deadlines captured: a transitional compliance date and an initial notification date, both now on the GRC Calendar.
Troubleshooting
"Extraction returned very few candidates." Usually a conversion problem rather than a model problem. Check the converted text in the session artefact.
"Candidates do not match the document." Report it. Citation drift indicates a conversion issue worth investigating before publishing anything from that document.
"Extraction failed." Check the error code. The most frequent causes are an unreadable document and an unavailable AI provider.
"I published something I should not have." Retire the requirement through the library. Publication is reversible; it is simply governed.