Governance, Risk, and Compliance Workflow for humans and AI agents.
Automates legal, security, and financial risk analysis — so analysts spend time deciding, not researching.
Vendor onboarding in security-conscious organizations is slow by design because it has to be. Analysts manually review legal agreements, security questionnaires, and financial disclosures, then synthesize findings across multiple regulatory frameworks such as PIPEDA, GDPR, CPPA, SOC 2, and PCI DSS. They coordinate across Product, Legal, Security, and Finance before a decision can be made. Shared context between reviewers is limited, findings are rarely cited to specific clauses, and decisions are difficult to audit retroactively. In many organizations, this process takes weeks.
This system compresses that timeline to hours without removing human judgment from the process.
An analyst uploads vendor documentation, and the pipeline automatically runs four parallel due diligence stages. Each AI powered stage uses retrieval-augmented generation (RAG) to ground its analysis in both the vendor’s submitted materials and an internal knowledge base of compliance frameworks. The analyst receives structured findings with per-criterion assessments, explicit evidence citations from the vendor’s own documents, identified control gaps, and a recommended risk posture.
The analyst can now review a complete, cited, multi framework risk assessment in under an hour across legal, security, and financial domains without reading raw documents end to end. The role shifts from researcher to decision maker.
What AI is responsible for includes ingesting and parsing vendor documentation, chunking and embedding content into a vector store, retrieving relevant passages against targeted compliance queries, cross-referencing vendor claims against regulatory requirements and internal control frameworks, generating structured findings with citations, and maintaining an audit trail of analysis steps and workflow decisions.
Where AI must stop is at the final approval decision and at accountability. The decision to APPROVE, APPROVE WITH CONDITIONS, or REJECT remains exclusively with a human analyst. Risk acceptance carries regulatory, financial, and operational consequences that flow to real audit findings and liability. Accountability cannot be delegated to a model. A human signature represents ownership of the decision and its downstream impact. Preserving that boundary maintains scrutiny over AI generated analysis and ensures incentives remain aligned with responsible risk management.
What breaks first at scale is enterprise readiness. As adoption expands, security and governance requirements for handling sensitive vendor documentation become primary constraints. The system must support SSO integration, role based access control, detailed logging, and defensible audit trails aligned to enterprise standards. Data residency and encryption controls must be clearly defined.
Retrieval quality is the second major pressure point. As the internal knowledge base grows and document volume increases, embedding quality and query relevance determine overall system accuracy. Improving real-world performance requires iterative refinement of the RAG pipeline, expansion and curation of the knowledge base, and investment in hybrid retrieval that combines dense and sparse methods. Cross-encoder re-ranking can further improve precision. Model versioning must be pinned in the audit log to prevent rubric drift as underlying models evolve.
GRC-AI-Automation.1.mp4
Hands-on AI experience: 2-3 years.
At KOHO Financial, I built and shipped an LLM-powered vendor security due diligence pipeline (The security review portion of this project) that reduced review turnaround from months to under a week. I was inspired by this experience to create a multi-agent workflow to assist with the entire vendor onboarding workflow end-to-end.
I have a degree in Software Engineering, where I studied machine learning and artificial intelligence.
CMPE 452: Neural and Genetic Computing
I've also explored personal projects in machine learning, such as a security intrusion detection system to classify malicious network traffic. Machine Learning Plugin for Snort3 Intrusion Detection System
git clone git@github.com:AlexPerrin/GRC-AI-Automation.git
cd GRC-AI-Automation
cp .env.example .env # fill in LLM_PROVIDER_API_KEY
docker compose up --buildThe app is running at http://localhost:5173
Optionally, seed three pre-built vendor scenarios (clean pass, legal rejection, conditional approval) to explore the full workflow without uploading real documents:
curl -X POST http://localhost:8000/dev/seedbackend/demo/explore_rag.py lets you inspect the ChromaDB vector store — list collections, dump chunks, and run semantic queries — without touching the app UI.
It connects to the ChromaDB container over the internal Docker network, so run it via docker exec inside the API container:
# List all collections and chunk counts
docker exec -it grc-ai-automation-api-1 python3 /app/demo/explore_rag.py
# Dump every chunk in a collection
docker exec -it grc-ai-automation-api-1 python3 /app/demo/explore_rag.py -c vendor_1_LEGAL_1
# Semantic query against a collection
docker exec -it grc-ai-automation-api-1 python3 /app/demo/explore_rag.py \
-c vendor_1_LEGAL_1 -q "GDPR data transfer"
# Run 6 preset compliance queries across every collection
docker exec -it grc-ai-automation-api-1 python3 /app/demo/explore_rag.py --all-queriesCollection names follow the pattern vendor_{id}_{STAGE}_{doc_id} (e.g. vendor_1_LEGAL_1) and kb_legal / kb_security for the internal knowledge base. Seed the demo data first if collections are empty:
curl -X POST http://localhost:8000/dev/seedWiki → Technical Specification
Copyright © 2026 Alex Perrin · MIT License