Review Item Regulatory Flagging Prompt for Compliance Triage

This prompt is designed for compliance engineers and operations leads who need to triage a stream of review items—such as flagged transactions, content moderation decisions, or product change requests—against a defined regulatory framework. The job-to-be-done is not to make a final compliance determination, but to produce a structured, citable regulatory relevance flag that a human reviewer can quickly verify. The ideal user is someone who maintains a library of regulatory obligations and needs to route items to the correct handling procedure without manually cross-referencing regulations for every incoming item.

To use this prompt effectively, you must supply the review item's full content, a structured list of applicable regulatory obligations with their citation IDs and plain-language descriptions, and the organization's defined handling rules. The prompt is most reliable when the regulatory obligations are specific and scoped—broad, overlapping, or vaguely worded obligations will produce noisy flags. You should also define a risk tolerance in your constraints, as this controls the trade-off between over-flagging (false positives that waste reviewer time) and under-flagging (missed obligations that create exposure).

Do not use this prompt for making autonomous blocking decisions, for interpreting regulations it has not been explicitly provided, or for items where the regulatory framework is ambiguous and requires legal interpretation. This prompt is a triage accelerator, not a replacement for qualified compliance review. If an item could trigger a mandatory regulatory filing, a Suspicious Activity Report, or a disclosure obligation with legal liability, the output must always be treated as a preliminary flag requiring human confirmation. The prompt also should not be used in isolation for high-volume, low-latency systems where a false-negative rate above zero is unacceptable—in those cases, pair it with a deterministic rule engine for known patterns and use this prompt only for edge cases that fall outside the rules.

This prompt template is designed to be the core instruction set for an AI model performing first-pass regulatory triage on a review item. It takes a raw item and a defined regulatory framework as input and produces a structured flagging decision. The template uses square-bracket placeholders for all dynamic inputs, allowing you to wire it directly into an application harness. The goal is not to make a final legal determination but to surface potential obligations, cite the specific rules in question, and recommend a handling path for a human compliance engineer.

textCopy
You are a compliance triage assistant. Your task is to analyze a review item against a specific regulatory framework and flag any potential obligations.

INPUT ITEM:
[REVIEW_ITEM_TEXT]

REGULATORY FRAMEWORK:
[REGULATORY_FRAMEWORK_DESCRIPTION]

OUTPUT SCHEMA:
Respond with a valid JSON object matching this schema:
{
  "flags": [
    {
      "obligation_id": "string",
      "obligation_name": "string",
      "relevant_excerpt": "string",
      "rationale": "string",
      "suggested_handling": "route_to_compliance_review" | "auto_approve_with_notes" | "escalate_to_legal"
    }
  ],
  "overall_risk_assessment": "low" | "medium" | "high" | "critical",
  "summary_notes": "string"
}

CONSTRAINTS:
- Only flag an obligation if the item text contains a direct or strongly implied connection to the rule.
- Cite the specific obligation name or ID from the provided framework.
- Quote the most relevant sentence from the review item as the `relevant_excerpt`.
- If no obligations are triggered, return an empty `flags` array and an `overall_risk_assessment` of "low".
- Do not invent obligations that are not in the provided framework.
- Your `summary_notes` should be a concise, factual summary of the item's regulatory surface area, not a legal opinion.

To adapt this template, replace the placeholders with your application's live data. [REVIEW_ITEM_TEXT] should be the full content of the item to be reviewed, such as a customer support ticket, a generated marketing copy, or a product change description. [REGULATORY_FRAMEWORK_DESCRIPTION] is the most critical part; it should contain a structured list of the specific rules, obligations, and their IDs that the model should check against. For example, you might paste in a subset of GDPR articles, PCI DSS requirements, or internal company policies. The quality of the framework description directly determines the quality of the flags. A vague framework will produce vague, unhelpful flags, while a precise one will yield actionable results.

Before deploying this prompt, test it with a golden dataset of items that have known regulatory outcomes. Evaluate the model's output for false positives (flagging a rule that doesn't apply) and false negatives (missing a clear obligation). Pay close attention to the suggested_handling field; a misclassification here can route a critical item to an auto-approval path, creating significant risk. Always ensure that any item with a suggested_handling other than auto_approve_with_notes is placed in a human review queue with the full AI-generated flagging context attached.

This prompt is designed to be called as a pre-screening step before an item enters a human compliance review queue. The application should submit the review item content, the applicable regulatory framework, and the jurisdiction context. The model returns a structured flagging decision with obligation citations and handling recommendations. Because this is a high-risk compliance workflow, the implementation must treat the model output as a recommendation, not a final determination. Every flagged item must route to a qualified human reviewer, and a sample of unflagged items should be audited to catch false negatives.

Validation and retry logic is critical. Parse the model's JSON output and validate that regulatory_relevance_flag is a boolean, obligation_citations is an array of strings, and handling_recommendation is one of the allowed enum values (ROUTE_TO_COMPLIANCE_REVIEW, STANDARD_REVIEW, AUTO_APPROVE_WITH_AUDIT). If the output fails schema validation, retry once with an error message injected into the prompt context. If the retry also fails, log the failure and escalate the item to a human reviewer with a VALIDATION_FAILURE flag. Do not silently default to AUTO_APPROVE on parse errors—this is a common failure mode that can bypass compliance gates entirely.

Logging and audit trail requirements are non-negotiable. Store the full prompt input, model response, validation result, and final routing decision for every item. Include the model version, timestamp, and any retry attempts. This audit log serves as evidence for internal governance reviews and external regulatory inquiries. For items flagged as ROUTE_TO_COMPLIANCE_REVIEW, attach the model's obligation citations and handling rationale directly into the reviewer's queue item so they can assess the flagging quality without re-running the prompt. Model choice matters: use a model with strong reasoning and instruction-following capabilities (e.g., Claude 3.5 Sonnet or GPT-4o). Avoid smaller or faster models for this task unless you have calibrated their false-negative rate against a golden dataset and confirmed it meets your risk tolerance.

Human-in-the-loop integration is the core of this workflow. The prompt output should never directly block or approve an item. Instead, it sets a handling_recommendation that your application uses to route the item. Items flagged for compliance review should appear in a dedicated queue with the model's citations pre-populated. Implement a sampling audit where 5-10% of items flagged as STANDARD_REVIEW or AUTO_APPROVE_WITH_AUDIT are randomly pulled for human review to detect false negatives. Track the false-negative rate over time and trigger a prompt review if it exceeds your defined threshold. Finally, build a feedback loop: when a human reviewer overrides the model's flagging decision, capture the override reason and use it to improve future prompt versions or fine-tuning datasets.