Regulatory Text Evidence Extraction Prompt

This prompt is built for a specific, high-stakes job: given a described business scenario or compliance obligation and a corpus of regulatory text, extract the exact passages that apply, along with their citation paths and a clear explanation of why they are relevant. The ideal user is a compliance engineer, audit system builder, or legal operations developer who needs traceable, auditable evidence—not a general summary or legal advice. The output is designed to be consumed by downstream systems (e.g., obligation registers, audit trails, control mapping tools) or by human reviewers who must verify that every extracted rule is correctly sourced and scoped.

Use this prompt when you have a well-defined scenario (e.g., 'We process EU customer payment data and store it in US data centers') and a bounded set of regulatory documents (e.g., GDPR articles, PCI DSS requirements, internal policies). The prompt is not a general legal research tool, a contract review assistant, or a substitute for legal counsel. It is also not designed for open-ended regulatory exploration, multi-jurisdictional surveys without a specific fact pattern, or situations where the regulatory text is ambiguous and requires interpretive legal analysis. In those cases, the prompt may over-extract or misattribute rules, creating false confidence.

Before using this prompt, ensure you have: (1) a clear, factual description of the scenario or obligation, (2) the full text of the relevant regulations with stable section identifiers, and (3) a defined output schema that your downstream system can validate. The prompt includes placeholders for [SCENARIO], [REGULATORY_TEXT], and [OUTPUT_SCHEMA] so you can adapt it to different regulatory domains. If you are operating in a regulated industry where incorrect extraction could lead to compliance failures, always pair this prompt with a human review step and an automated validation harness that checks for missing obligations, hallucinated citations, and over-extraction of irrelevant rules.

This prompt template is designed for compliance engineers who need to extract exact regulatory passages that apply to a described scenario or obligation. The template uses square-bracket placeholders that you replace with your specific inputs before sending to the model. Each placeholder represents a critical input dimension: the scenario description, the regulatory corpus to search, the expected output structure, extraction constraints, and the risk level that determines how conservative the extraction should be.

textCopy
You are a regulatory compliance evidence extraction system. Your task is to identify and extract exact regulatory passages from the provided regulatory corpus that apply to the described scenario or obligation.

## SCENARIO
[SCENARIO_DESCRIPTION]

## REGULATORY CORPUS
[REGULATORY_TEXT]

## OUTPUT SCHEMA
Return a JSON object with the following structure:
{
  "extractions": [
    {
      "regulation_id": "string (section or paragraph identifier from source)",
      "exact_text": "string (verbatim regulatory text)",
      "citation_path": "string (hierarchical reference, e.g., Title X > Part Y > Section Z)",
      "applicability_reasoning": "string (why this passage applies to the scenario)",
      "obligation_type": "string (one of: prohibition, requirement, permission, definition, exemption, reporting, recordkeeping, other)",
      "relevance_score": "number (0.0 to 1.0, where 1.0 means directly applicable)"
    }
  ],
  "coverage_assessment": {
    "scenario_fully_addressed": "boolean",
    "missing_obligation_areas": ["string (areas not covered by extracted passages)"],
    "overall_confidence": "number (0.0 to 1.0)"
  },
  "extraction_metadata": {
    "total_passages_reviewed": "number",
    "passages_extracted": "number",
    "extraction_timestamp": "string (ISO 8601)"
  }
}

## CONSTRAINTS
[EXTRACTION_CONSTRAINTS]

## RISK LEVEL
[RISK_LEVEL]

## INSTRUCTIONS
1. Extract only passages that are directly applicable to the scenario. Do not include tangentially related or background provisions.
2. Quote regulatory text exactly as it appears. Do not paraphrase, summarize, or alter wording.
3. If a passage contains defined terms, include the definition if it appears in the corpus.
4. For each extraction, explain specifically why the passage applies to the scenario.
5. If the scenario describes multiple obligations, extract passages for each distinct obligation.
6. Flag any scenario obligations that have no corresponding regulatory passage in the coverage assessment.
7. If [RISK_LEVEL] is "high", apply a stricter relevance threshold and include more detailed applicability reasoning.
8. If [RISK_LEVEL] is "high", add a "limitations_and_caveats" field to each extraction noting any interpretive uncertainty.
9. Do not fabricate regulatory text. If a passage does not exist in the corpus, do not create one.
10. If the regulatory corpus is insufficient to address the scenario, set coverage_assessment.scenario_fully_addressed to false and explain gaps.

Adaptation guidance: Replace [SCENARIO_DESCRIPTION] with a clear description of the business scenario, transaction, or compliance question. Replace [REGULATORY_TEXT] with the full text of the relevant regulatory corpus, including section numbers and hierarchical structure. Replace [EXTRACTION_CONSTRAINTS] with specific instructions such as jurisdiction filters, date ranges, or exclusion criteria. Replace [RISK_LEVEL] with low, medium, or high to control extraction conservatism. For high-risk workflows, always route outputs through human review before relying on extractions for compliance decisions. The output schema is designed to be machine-readable for downstream validation, audit logging, and integration with compliance management systems.

This prompt is designed to be a single step inside a larger compliance workflow, not a standalone chatbot. The application layer is responsible for providing the correct regulation corpus, managing the extraction request, validating the output, and deciding whether the result is reliable enough to surface to a user or feed into a downstream system. Treat the prompt as a function call: structured input in, structured output out, with strict validation before the output leaves the harness.

The implementation harness should enforce a strict JSON output schema. After the model responds, validate that every extracted passage includes a non-empty regulation_text, a complete citation_path (e.g., 12 CFR Part 1026.4(a)), and a non-empty applicability_reasoning field. Reject any output where the citation path does not match a known structure in the provided regulation corpus. If the model returns malformed JSON, use a repair prompt that provides the raw output and the expected schema, and retry once. If the repair fails, log the failure and escalate for human review. For high-risk obligations (e.g., those involving reporting deadlines, consumer disclosures, or monetary thresholds), flag the extraction for mandatory human approval before it enters any system of record.

Model choice matters. Use a model with strong instruction-following and structured output capabilities, such as gpt-4o or claude-3-5-sonnet, and set temperature to 0 or near 0 to minimize variance in regulatory text extraction. If your compliance pipeline processes large regulation corpora, pre-chunk the regulations by section or subpart and use retrieval-augmented generation (RAG) to supply only the most relevant chunks as [CONTEXT]. This reduces token cost and limits the model's ability to hallucinate regulations that are not in the provided context. Log every extraction with the full prompt, model response, validation result, and reviewer decision for audit purposes.

Common failure modes to instrument for: the model extracts a regulation that sounds relevant but does not actually apply to the described scenario (over-extraction); the model misses a critical obligation because the scenario description was ambiguous (under-extraction); the model fabricates a plausible-sounding citation that does not exist in the source corpus (hallucination). Mitigate over-extraction by adding a [CONSTRAINTS] block that instructs the model to only extract regulations where applicability is clear and direct. Mitigate under-extraction by running a second 'obligation gap check' prompt that reviews the scenario against the full regulation index and flags potentially missed sections. Mitigate hallucination by cross-referencing every extracted citation against a known list of valid regulation paths before the output is accepted.

Do not use this prompt for real-time consumer-facing applications without a human-in-the-loop review step. Regulatory extraction errors can carry legal and financial consequences. The harness should treat every extraction as a draft recommendation until a qualified reviewer confirms it. For batch compliance audits, run the prompt across all scenarios, aggregate the extractions, and present a review dashboard that highlights low-confidence extractions, missing citations, and conflicting obligations for prioritized human attention.