The situation
Banks and finance companies in Saudi Arabia must be able to show that their documents comply with the Personal Data Protection Law (PDPL). Manual document review was slow, and two reviewers could reach different conclusions on the same policy.
What we built
- An LLM review engine that checks client documents against the law and a knowledge base.
- Gap scoring against the law. Each document is scored against PDPL and the client’s internal compliance framework, producing an automatic gap report, so reviewers start from a ranked list rather than a blank page.
- A remediation pipeline that drafts new, compliant document text for the gaps it finds.
- A multi-agent chatbot built on LangGraph, with tool calls, so compliance staff can question the findings and the regulation directly.
- Vision OCR using a Qwen vision model, so scanned documents are reviewed under the same rules as digital ones.
Engineering decisions
Model routing for cost and accuracy. Five open-weight models are balanced against each other by task. Simpler steps go to cheaper models, and harder judgements go to stronger ones.
Evaluation built in. The chatbot is evaluated with DeepEval and Ragas, and generated documents reach 95 percent content fidelity.
Infrastructure as code. The platform runs on Google Cloud Run, with Terraform-managed infrastructure, CI/CD and Langfuse tracing, so it can be reproduced and audited.
What it changed
The platform moved from nothing to production with a team of three and is now used by banks and finance companies in Saudi Arabia. Document review that was slow and inconsistent when done by hand now starts from an automatic gap report and drafted remediation.
Planning an AI system under PDPL? Read our Saudi PDPL checklist for AI systems in banks.