marcoMorcos1/ai-grc-compliance-architect

LLM-powered compliance scoping tool that generates audit-ready roadmaps against ISO 27001, Egypt's Law 151, and NTRA's 2024 cybersecurity framework — with a citation-grounding system to prevent regulatory hallucination. # AI GRC Compliance Architect An LLM-powered compliance scoping tool that generates audit-ready roadmaps against **ISO/IEC 27001:2022**, the **Egyptian Personal Data Protection Law (Law 151 of 2020)**, and the **NTRA Regulatory Framework for Providing Cybersecurity Services (2024)** — with a citation-grounding system built specifically to prevent the LLM from inventing regulatory citations. **Try it live with zero setup →** — a "View Sample Report" button runs the full pipeline against real, previously-verified output. No API key needed. --- ## Table of Contents - Why this project - How it works - The core problem: citation grounding - Three real bugs found in production testing - Tech stack - Setup - Demo mode - Known limitations --- ## Why this project Scoping a compliance audit for a B2B company is normally manual and expert-driven: someone with GRC expertise reads through a company's data handling, infrastructure, and existing controls, then cross-references overlapping regulatory frameworks to determine what's actually required. This project automates that first pass — not to replace a GRC auditor, but to demonstrate what a *responsibly built* LLM tool looks like in a domain where a hallucinated citation isn't a minor UX bug, it's a wrong legal claim. ## How it works ``` Company metadata (Streamlit form: Firmographics, Data Classification, Infrastructure & Tech Stack, Security Baseline) │ ▼ Structured JSON payload ───────► System prompt + frameworks_reference.json │ ▼ LLM (Gemma 4 26B A4B via OpenRouter, with retry, timeout, and auto-router fallback) │ ▼ Generated Markdown report │ ▼ validate_citations() cross-checks every cited control/article ID against the reference data — flags anything invented │ ▼ Rendered report + Markdown/PDF export + SQLite history ``` Every recommendation is tailored to the submitted company profile — data types actually handled, hosting/tech stack, and which security controls are already in place — not a generic checkl …