RAG compliance depends on the system around retrieval

Retrieval-augmented generation, or RAG, connects a model to selected external information at request time. Under the EU AI Act, the legal analysis still depends on the resulting AI system, intended purpose, actor role, and applicable category.

RAG can improve source relevance and make evidence visible. It can also retrieve an unauthorized document, stale record, or misleading chunk and place it inside a consequential decision path.

Use the exact legal duty and retrieval architecture together. This article requires legal, privacy, and security review.

RAG has no standalone AI Act category

A RAG system used for an internal project brief and a RAG system ranking job candidates can share technical components. Their intended purposes differ.

Classify the downstream system first. Record the upstream model provider separately. Then map the requirements that apply to the provider or deployer. RAG is an implementation fact inside that assessment.

Article 10 data governance has a defined scope

Article 10 establishes data and data-governance requirements for high-risk systems using techniques involving model training with data. It addresses training, validation, and testing datasets and specified governance practices.

Do not casually state that every retrieved document is an Article 10 training dataset. Retrieval-time context, evaluation data, application input, and model-training data can occupy different roles. Legal and technical owners map each data surface to the relevant provision.

Other high-risk requirements may still make retrieval information important, including risk management, documentation, instructions, accuracy, logging, and deployer input-data duties. GDPR and confidentiality rules can apply independently.

Review seven retrieval boundaries

Add caching and administrative routes. A cache created for a privileged user can cross the boundary if the next request lacks a fresh permission decision.

Authorization must run before model context

A system prompt asking the model to respect permissions runs after retrieval. The model has already received the text.

Carry the caller identity and purpose into the retrieval query. Filter at the source, database policy, index, or application layer with deterministic authorization. Recheck evidence before consequential output where permissions can change quickly.

Tenant isolation is only one layer. People inside one organization can have different project, finance, HR, or client rights.

A Skybridge source scope left one wider route

Skybridge introduced per-agent source scoping for prompt-time knowledge. An implementation review found that an active vault-search tool could still search a wider workspace than the preassembled digest.

That finding established the release standard: prompt-time source filtering and runtime authorization must cover the same perimeter across every route.

The historical account is retained as a design lesson. Every search, direct read, preview, citation, export, automation, and administrative endpoint receives the same authorization decision before release.

Test data quality, provenance, and change

Permission is necessary and incomplete as a full quality test.

Create cases with conflicting authorized sources, a superseded record, missing permission metadata, an inaccessible citation, a changed user role, and a provider outage. Record which chunks entered context, their versions, and the expected output behavior.

For a consequential result, define source authority. A recent email may mention a change without approving it. The system should preserve the distinction instead of ranking recency above business status.

Monitor retrieval drift after source, embedding, chunking, model, or ranking changes. The RAG access-control guide provides the deeper technical pattern.

Evaluate retrieval and generation separately. Retrieval tests measure whether the right authorized evidence appears in the candidate set and whether forbidden evidence stays out. Generation tests measure whether the model uses that evidence accurately, preserves conflicts, cites the correct source, and stops when support is insufficient. A single answer score hides which layer failed.

Create a small acceptance corpus from fictional or authorized material. Include authoritative records, superseded versions, duplicates, similar project names, missing metadata, conflicting dates, and instructions embedded inside content. Record the expected sources and output behavior for every case. Re-run the corpus after a change to chunking, embeddings, ranking, source connector, or model.

The operating dashboard should show retrieval denials, empty results, inaccessible citations, permission-sync failures, stale-source warnings, and correction rates. Aggregate where possible and restrict content access. A quality metric based only on helpful answers will reward a system that retrieves more information than the caller may receive.

RAG and AI Act questions

Does RAG make an AI system compliant?

No. RAG is an architecture pattern. Compliance depends on the system, intended purpose, roles, applicable duties, and operating evidence.

Is source citation required by the AI Act?

Requirements vary by system and duty. Source and provenance evidence can support risk management, documentation, oversight, accuracy, and accountability even where no universal citation rule applies.

Can RAG use personal data?

That requires a separate GDPR and applicable-law assessment covering purpose, legal basis, necessity, access, rights, retention, security, providers, and transfers.