Norma AI

Data protection officers must understand fast-moving AI regulation without a large legal budget. A DPO at a mid-market company faces 144 articles of the EU AI Act, GDPR overlap, and other jurisdictions — thousands of hours of dense legal language — while everyday questions ("which article applies to this new HR tool?") and law changes go unanswered without an expensive law firm at $300–$1,000 per hour. The pain is high-severity and daily: no quick reference to the applicable law, no plain-English translation, no alert when regulations change, and no way to judge the reliability of any answer they do find.

Norma AI is an AI governance copilot that explains privacy and AI regulations in plain English under one umbrella. Users set a persona, industry, jurisdiction, and AI systems, then get a personalized dashboard, a searchable regulation library documented down to sub-articles, and an assistant that answers compliance questions. Every answer is grounded exclusively in the official regulatory text — the demo focused on the EU AI Act for a fintech DPO — and follows a fixed format: a plain-English answer, the cited article, the recommended action, who it applies to, the applicable penalty, and a confidence level (🟢 High / 🟡 Medium / 🔴 Low). Penalties over €1M trigger an explicit recommendation to consult a lawyer. Pricing is freemium: 10 free assistant questions, then Pro and Team tiers.

Norma runs on a RAG pipeline over the EU AI Act PDF. Text is extracted with pdfplumber, then Claude Haiku structures each chunk into article, title, summary, obligations, penalty, and tags. Content is chunked (up to 1,500 words with overlap) and embedded into Pinecone across two namespaces — one for the assistant's raw chunks, one for the structured regulation library. Claude Haiku was chosen over Sonnet and GPT-5.5 because this is structured retrieval, not complex reasoning: it follows the format every time, cites articles consistently, and costs far less. It never answers from memory — an open-book exam where the book is the retrieved articles. Dynamic date injection ({{TODAY}}, {{DEADLINE}}, {{DAYS_LEFT}}) grounds deadline answers. Automated evals across accuracy, grounding, format, edge cases, and RAG quality rose from a 50% first pass to 85% after fixing retrieval (query enhancement mapping "chatbot disclosure" to Article 50, manual chunks for hard-to-retrieve articles) and the prompt.

Norma is aimed at DPOs and legal counsels, with CTOs, executives, and CFOs planned for future releases; the capstone is built around the DPO persona. The archetype is Sonia, a DPO at a fintech SaaS company using AI for recruitment, chatbots, and credit scoring, with no budget for a law firm and a looming EU AI Act deadline. The listed customer base is B2C, sold as individual Pro subscriptions and Team company subscriptions. Persona selection reframes answers — a DPO gets deployer obligations, a CTO gets technical requirements, a CEO gets a penalty summary.

The regulatory pressure is real and time-bound: the EU AI compliance market is projected to grow from $1.2B in 2024 to $6.8B by 2028, driven by the August 2026 enforcement deadline, an estimated 50,000+ companies required to comply, and parallel regulation across the US, UK, and Canada pointing to a $12B global addressable market by 2029. No dominant self-serve player exists. Because incorrect guidance carries liability, Norma keeps humans in the loop and refuses out-of-domain questions — asking clarifying questions for vague queries and declining to answer on unloaded regulations. Launch runs through a closed pilot with 10 friendly DPOs for accuracy validation, then public beta, then full self-serve. Critical issues — wrong penalty figures or hallucinated obligations — are defined as fix-within-24-hours.