The conversation about AI in regulated industries has matured. A year ago, the question was "can we use this at all?" Today the question is "what's the right architecture for our compliance posture, our procurement vehicle, and our institutional reality?" That's a much better question.
This article explores architecture and evaluation principles for regulated AI. It describes design considerations for the expanded AdaptCX platform, not findings from full-platform customer deployments.
The procurement reality
Public-sector procurement is the determining variable that most AI vendors underestimate. A great product that can't be purchased on an existing contract vehicle, can't be deployed in an agency's own GCP, and can't produce deployment artifacts — that great product will lose to a worse product that can.
- Procurement route: confirm the available contract vehicle for the selected implementation.
- Cloud posture: evaluate Sovereign Deployment against the organization's deployment requirements.
- Deployment support: agree required control mappings, audit artifacts and personnel screening.
- Data controls: confirm the required encryption-key management and audit-log destinations.
The compliance reality
Compliance posture is not a feature you bolt on. It's a substrate that every product capability must respect. A bot that gives a great answer but routes the conversation through a vendor's logging system is a non-starter. A document AI that extracts forms accurately but stores them in a CMEK-incompatible bucket is a non-starter.
The right question isn't "can your AI be compliant?" It's "is compliance a precondition or a postcondition of your architecture?"
What we'd build differently
If we were starting AdaptCX today, we would still pick deterministic-first conversation, Sovereign Deployment, and audit chain by default. We'd be even more aggressive about it. The temptation in any AI build is to lean on generative everywhere — and the lesson we keep learning is that the regulated work always wants the deterministic answer first.
Three principles we hold
- Start with known answers. Versioned playbooks can define known responses. Where AI is used, evaluate its grounding and source references.
- Audit is a precondition. Define the interaction events and source references the workflow needs to record, then verify the resulting audit history in the selected deployment.
- Review the deployment boundary. Evaluate Sovereign Deployment within your Google Cloud environment, including the selected encryption-key controls and audit-log destination.
The next eighteen months
Procurement teams should evaluate security boundaries, applicable AI requirements and deployment responsibilities for their own jurisdiction and workload. These considerations do not establish future legal requirements or a preferred architecture for every organization.
Start with the controls and operational requirements of the organization, then evaluate the architecture against them. The expanded AdaptCX platform builds on an earlier, smaller version.
If you'd like to talk about your specific compliance posture, your procurement vehicle, or your existing GCP estate — Schedule one here →.