Legal Compliance Documentation With AI: What a Master Prompt Gets Right That a Plain Prompt Doesn't

A plain compliance prompt usually asks for a conclusion:

Review these documents and tell me whether we are compliant.

That question is too broad for a model and too vague for an application. It does not define the governing criteria, scope, effective date, evidence set, control owner, missing records, jurisdiction, or who may make the final determination.

A legal compliance master prompt changes the output from a verdict into a source-linked review object.

Compliance Is a System State, Not a Paragraph

An organization may have a policy, control, contract, training record, technical configuration, and audit result that all affect one compliance question.

The model sees only what the application supplies. It cannot know that a control operates in practice, that evidence is authentic, or that the selected law and interpretation apply.

Use AI to organize evidence and questions. Keep legal conclusions with qualified counsel and authorized compliance owners.

Define the Review Scope

Required variables may include:

{
  "review_scope": { "type": "string", "required": true },
  "jurisdiction": { "type": "string", "required": true },
  "as_of_date": { "type": "string", "required": true },
  "approved_criteria": { "type": "string", "required": true },
  "authorized_evidence": { "type": "string", "required": true },
  "policy_version": { "type": "string", "required": true }
}

If the approved criteria are absent, the prompt should not rely on general model knowledge. Return criteria_missing and stop the conclusion path.

Separate Criteria, Evidence, and Interpretation

A useful result keeps three layers distinct:

{
  "criterion_id": "approved-criterion-id",
  "criterion_summary": "organization-supplied summary",
  "evidence_ids": ["source-17", "source-22"],
  "evidence_observation": "",
  "model_issue_spotting": "",
  "evidence_status": "incomplete",
  "owner_review_required": true,
  "legal_determination": null
}

The model can summarize the relationship between supplied criteria and evidence. It should not populate legal_determination.

A Compliance Evidence Schema

{
  "type": "object",
  "required": ["scope", "criteria_version", "items", "gaps", "review_status"],
  "additionalProperties": false,
  "properties": {
    "scope": { "type": "string" },
    "criteria_version": { "type": "string" },
    "items": {
      "type": "array",
      "items": {
        "type": "object",
        "required": ["criterion_id", "evidence_ids", "status", "owner"],
        "properties": {
          "criterion_id": { "type": "string" },
          "evidence_ids": { "type": "array", "items": { "type": "string" } },
          "status": {
            "type": "string",
            "enum": ["evidence_present", "evidence_missing", "conflicting", "not_assessed", "review_required"]
          },
          "owner": { "type": "string" }
        }
      }
    },
    "gaps": { "type": "array", "items": { "type": "string" } },
    "review_status": {
      "type": "string",
      "enum": ["draft", "compliance_review", "counsel_review", "approved"]
    }
  }
}

Only authorized application actions should advance review status.

What the Master Prompt Adds

Compared with a plain prompt, the artifact makes these controls visible:

• approved criteria are runtime inputs;
• evidence IDs are required;
• missing evidence is a valid output;
• model analysis is separate from legal determination;
• review state cannot be omitted;
• source and policy versions are preserved;
• schema validation stops malformed records;
• prompt version travels with the result;
• tests can assert required fields and states.

This does not prove compliance. It gives reviewers a consistent evidence package.

Retrieval Needs Authorization and Versioning

Compliance reviews often use RAG across policies, contracts, tickets, logs, training records, and audit documents.

The retriever must enforce user, matter, business-unit, and jurisdiction scope before sources enter model context. Preserve source revision and retrieval date. Validate that every cited ID belongs to the authorized retrieval set.

Read Master Prompt vs. RAG for the evidence boundary.

Do Not Turn Policy Into Law

An internal policy may be stricter, narrower, older, or written for a different jurisdiction than the governing requirement.

The prompt should label source type:

law_or_regulation
contract
internal_policy
procedure
technical_control
audit_evidence
legal_interpretation

Do not merge these into one generic "requirement" without provenance.

Protect Confidential and Privileged Material

Compliance reviews may involve investigations, employee data, security incidents, legal advice, and other sensitive material.

Apply approved vendor review, authorization, matter separation, data minimization, retention, logging, and disclosure controls. Do not assume marking a variable confidential creates confidentiality or privilege.

Counsel should determine how legal review and privilege are handled for the specific matter.

Test the Review Boundaries

Use authorized or synthetic cases with:

• complete criteria and evidence;
• missing criteria version;
• evidence from the wrong time period;
• a policy that conflicts with a contract;
• a control description without operation evidence;
• duplicate or contradictory records;
• an outdated legal source;
• an unauthorized business-unit document;
• source text that attempts to change instructions;
• output that tries to declare final compliance.

The workflow should expose the gap and require review instead of producing a polished yes or no.

The Human Compliance Rule

Compliance owners define controls and collect evidence. Counsel interprets applicable law and legal risk. Auditors perform their authorized review. Business owners approve remediation. Developers enforce source access, validation, versioning, logging, and state transitions.

The master prompt organizes the evidence contract between them. It does not sign the conclusion.

Read the Legal Master Prompts guide, use the production-ready checklist, and inspect legal workflow contracts in the CyWire marketplace.

This article is technical information, not legal, compliance, privacy, security, or regulatory advice.