💻 computer science

Agentic Retrieval-Augmented Generation for Verifiable Regulatory Compliance in Urban Cyber-Physical Systems

This paper proposes a Verification-First Agentic RAG framework that integrates deterministic validation agents to ensure regulatory accuracy and prevent hallucinations in Urban Cyber-Physical Systems, demonstrating superior performance in supersession detection and compliance reasoning compared to existing methods.

Original authors: Sathiska Priyad, Gayathri Karthick

Published 2026-09-12

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Sathiska Priyad, Gayathri Karthick

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Cities are becoming increasingly complex organisms, where physical infrastructure like roads and water pipes is deeply intertwined with digital networks of sensors, software, and artificial intelligence. These interconnected systems, known as urban cyber-physical systems, promise to make our cities more sustainable and resilient. They can monitor air quality in real time, optimize energy use, and manage traffic flow with a level of intelligence that was once impossible. However, as these digital brains grow more powerful, they must also navigate a labyrinth of rules. Every city operates under a dense web of environmental laws, safety codes, and planning regulations that change frequently and differ from one place to another. For a city to function safely and legally, its automated systems must not only understand these rules but also know exactly which version of a rule is currently in force. If a system relies on an outdated law or a regulation that no longer applies to a specific neighborhood, the consequences could range from inefficient resource use to serious legal violations that undermine public trust.

The challenge lies in how we teach computers to reason about these laws. In recent years, a technology called retrieval-augmented generation has emerged as a powerful tool for this task. Imagine a computer that can instantly search through millions of legal documents to find the answer to a question, then write a clear explanation based on what it found. This approach has shown great promise, but it has a critical flaw: the computer often cannot tell the difference between a law that is currently active and one that was replaced years ago. Because the old and new laws often look very similar in their wording, the system might confidently cite a rule that has been repealed, leading to dangerous or incorrect advice. This is particularly risky in the context of smart cities, where decisions about infrastructure and public safety must be absolutely reliable.

Researchers at York St John University have developed a new approach to solve this problem, creating a system that prioritizes verification before it ever attempts to generate an answer. Instead of letting the artificial intelligence guess which laws are valid, they built a framework that acts like a strict auditor. The system first searches for relevant regulations, but before it allows the main AI to write a response, a separate, specialized component checks the legal status of every single document it found. This component looks at specific metadata, such as the date a law was passed and whether a newer version has officially replaced it. It acts as a gatekeeper, ensuring that only current, legally enforceable, and applicable regulations are used to form the final advice. If the system cannot find a valid, up-to-date rule, it is designed to admit it does not know, rather than making up an answer.

In their study, the researchers tested this new framework against several existing methods using a collection of real European regulations and international standards. They created a set of 78 specific questions designed to trick the systems, including scenarios where an old law looked almost identical to a new one. The results showed that the new verification-first system was far superior at spotting outdated rules. It correctly identified superseded regulations in 88 percent of the cases, a significant improvement over the other methods, which struggled to detect these changes and often relied on the outdated information. The system also proved to be highly accurate in determining whether a rule applied to the specific jurisdiction in question, avoiding the common error of citing laws from the wrong region.

Perhaps most importantly, the system did not sacrifice speed or efficiency for this extra layer of safety. While the process of checking every document adds a step, the researchers found that the system remained fast enough for practical use in real-world city management. It processed queries with a speed that was competitive with, and in some cases faster than, the other advanced methods tested. The study demonstrated that by separating the task of finding information from the task of verifying its legal validity, the system could provide trustworthy, transparent, and auditable advice. This means that city planners and automated systems can rely on the output with a much higher degree of confidence, knowing that the recommendations are grounded in laws that are actually in effect today.

The researchers emphasize that this approach represents a shift in how we build artificial intelligence for high-stakes environments. Rather than relying on the AI to intuitively understand the complex and shifting landscape of human law, the system uses a deterministic, rule-based check to confirm facts before any reasoning takes place. This ensures that the final output is not just a fluent-sounding paragraph, but a legally sound recommendation. While the current tests focused on European regulations, the framework is designed to be adaptable to other legal systems and jurisdictions. The study concludes that for smart cities to truly become sustainable and trustworthy, their digital decision-makers must be equipped with this kind of rigorous verification, ensuring that the laws guiding our urban future are always current, accurate, and applicable.

Technical Summary: Agentic Retrieval-Augmented Generation for Verifiable Regulatory Compliance in Urban Cyber-Physical Systems

Problem Statement
Urban Cyber-Physical Systems (UCPS) integrate IoT, AI, and digital infrastructures to support sustainable urban governance, environmental monitoring, and resilient public services. However, ensuring regulatory compliance within these systems is increasingly difficult due to the continuous evolution of environmental, cybersecurity, municipal planning, and AI governance regulations across different jurisdictions. Existing Retrieval-Augmented Generation (RAG) approaches, while improving evidence retrieval, remain vulnerable to hallucinations, regulatory supersession errors (relying on outdated laws), and jurisdictional inconsistencies. These systems typically lack deterministic mechanisms to verify whether retrieved regulations are temporally valid, legally enforceable, or applicable to the specific urban context before generating compliance recommendations. This gap poses significant risks to sustainable infrastructure planning and public trust.

Methodology
The paper proposes a Verification-First Agentic Retrieval-Augmented Generation (Agentic RAG) framework designed to separate correctness-critical regulatory verification from probabilistic generative reasoning. Inspired by the Simplex principle in safety-critical Cyber-Physical Systems, the architecture employs three coordinated agents:

Retrieval Agent: Performs semantic retrieval of regulatory documents from a curated knowledge base (indexed at the clause level with metadata such as validity status, commencement/repeal dates, and supersession links) using dense vector search (BAAI/bge-large-en-v1.5). It returns top- $k$ candidates without making validity judgments.
Critic Agent (Core Innovation): A deterministic verification layer that validates retrieved evidence before language model generation. It performs four specific checks using structured metadata and authoritative registry lookups:
- Temporal Validity: Confirming the regulation is currently active.
- Supersession Detection: Identifying if the regulation has been amended, replaced, or withdrawn.
- Jurisdictional Validation: Ensuring applicability to the target governance context.
- Compliance-Scope Verification: Confirming relevance to the user query.
  If evidence fails validation, the Critic Agent triggers a bounded re-retrieval process. If no valid evidence is found after iterations, the system executes a structured abstention strategy.
Formatting Agent: Generates structured, auditable compliance reports containing citations, supporting evidence, and reasoning based only on the validated evidence. If evidence is insufficient, it returns a structured abstention response to prevent unsupported reasoning.

The framework was evaluated against four baselines (BM25, Dense RAG, Self-RAG, and Corrective RAG/CRAG) using a curated corpus of EU regulations, directives, and international standards (including both active and superseded instruments) and a benchmark of 78 regulatory compliance probes.

Key Contributions

Verification-First Architecture: Development of an Agentic RAG framework specifically for regulatory reasoning in UCPS that validates evidence prior to generation.
Deterministic Critic Agent: Introduction of a non-probabilistic agent capable of validating temporal validity, supersession status, and jurisdictional applicability, shifting the trust boundary from the language model to verifiable registry data.
Auditable Reasoning Framework: Design of a system incorporating bounded re-retrieval and structured abstention mechanisms to prevent unsupported compliance decisions.
Empirical Evaluation: A comparative study demonstrating improvements in retrieval ranking quality, hallucination reduction, and regulatory traceability.

Results
The experimental results highlight significant improvements in regulatory reasoning reliability:

Supersession Detection: The proposed framework achieved a detection rate of 0.88 (95% CI: 0.76–0.97), substantially outperforming baselines which ranged from 0.42 to 0.61.
Critic Agent Validation: The standalone Critic Agent achieved perfect performance (Precision = Recall = F1-score = 1.00) on a benchmark of 30 manually labeled regulatory chunks, confirming that temporal validity decisions are governed by deterministic rules rather than probabilistic inference.
Retrieval Quality: The framework improved ranking quality, achieving an nDCG@5 of 0.75, compared to 0.53–0.59 for baselines, by promoting temporally valid regulations to higher ranks.
Generation Quality: The framework achieved a Faithfulness score of 1.00, indicating all generated claims were supported by validated evidence. It also achieved the highest Context Precision (0.43).
Computational Efficiency: The framework demonstrated competitive efficiency, with a P25 latency of 2.74 seconds (lower than all baselines) and median token consumption of 3,488, avoiding the high overhead seen in iterative approaches like CRAG.

Significance and Claims
The paper claims that this work demonstrates that deterministic verification significantly improves the reliability, transparency, and trustworthiness of regulatory reasoning for sustainable urban governance. By separating the correctness-critical verification layer from the generative layer, the framework mitigates the risks of hallucinations and the use of superseded regulations. The authors assert that this approach provides a robust architectural foundation for trustworthy regulatory compliance in Urban Cyber-Physical Systems, moving beyond the limitations of purely similarity-based retrieval. The study concludes that while current LLM-based systems rely on probabilistic reasoning, the integration of deterministic verification offers a practical path toward verifiable and auditable decision support in complex, evolving regulatory environments.

Technical Summary: Agentic Retrieval-Augmented Generation for Verifiable Regulatory Compliance in Urban Cyber-Physical Systems

More like this