← All work  ·  Case 06 of 09 · POC

Enterprise Healthcare GRC SaaSAI Compliance ToolingProduct Owner2026 · 4-week POC

Compliance officers shouldn't be typing questions off a PDF.

A $0, four-week proof of concept that reads federal healthcare regulations and drafts compliance question sets in minutes, built to prove the AI would actually work before asking anyone to fund it.

~2 min
To generate 252 questions
vs. days, manually
98%
Passed validation
guardrails (demo run)
70–80%
Projected editorial time cut
(target, not yet measured)
$0
Infra spend
local POC, solo build
01The problem

Two people, hand-authoring every question and every field.

The compliance question-set product sells curated checklists that let a hospital self-assess against federal healthcare regulations. A two-person editorial team reads 30–40 page regulatory documents line by line, drafts a question for every requirement, and hand-populates 14 metadata fields per question: category, citation, risk score, entity type, and more. A single document takes days. Every existing question set then needs quarterly re-review against the current regulation, with no diff tool, so re-checking means re-reading the whole thing.

02Discovery

The manual step wasn't dumb. It just quietly expired.

Mapping the workflow surfaced a clean split: the mechanical majority of the work (extraction, formatting, first-pass classification) is automatable. The expert minority, final judgment on correctness and risk, is not, and shouldn't be. Five-whys on "why is this still manual in 2026?" landed on the real root cause: a workflow assumption, humans must transcribe this, that was true for years and stopped being true once vision-capable LLMs got good enough to read dense regulatory prose. Nobody had re-checked the assumption.

"A compliance tool that fabricates a citation once is dead. The design has to make that structurally impossible, not just unlikely."
03Approach

AI drafts. A human approves. Nothing ships unreviewed.

Two pipelines: one reads a regulatory document and drafts a full question set matching the editorial team's exact template; the other snapshots a regulatory source, diffs it against the last version, and classifies what actually changed. Both are strictly advisory: the model never auto-publishes, and if it can't ground a citation in the source text, it flags [VERIFY] instead of guessing.

The scoping call: built it as a zero-budget, local proof of concept first, with no cloud spend and no infrastructure ask, specifically to prove AI output quality before pitching the larger investment. A POC's job is to de-risk the bet, not impress a demo audience.
04Outcome

A real demo run, honestly labeled.

232 questions, multiple daysmanual (baseline)
+252 questions, ~2 minutesAI draft (demo run)
No change-alerting at allbefore
+98% of drafts passed guardrailsdemo run, unvalidated by editors
05My role

What I owned, solo.

Discovery
Process-mapped the manual workflow with the editorial team; built the automation map that separated mechanical from expert work.
Product framing
Positioned the tool as an accelerator, not a replacement, the decision that made it adoptable in a trust-sensitive domain.
Prompt & guardrail design
Wrote the extraction prompt, the citation-grounding rules, and the validation checks that flag rather than fabricate.
Full build
Ingestion, both AI pipelines, a small web UI, all in a four-week, zero-budget window.
06Lessons

Framing is the product, not a feature of it.

Assist vs. replace is the real product decision. In a trust-sensitive domain, that framing choice matters more than any single feature. It's the difference between a tool a compliance team adopts and one they fear.

A cheap POC is how you earn the expensive conversation. Proving AI quality at zero infrastructure cost is what unlocks the budget conversation for the real build, not the other way around.

Never let the model choose between citing and fabricating. Give it a third option, flag for review, and the failure mode becomes "too cautious," never "confidently wrong."

Let's build what actually ships.