Executive Summary

Retrieval-augmented generation architectures face unique compliance challenges in regulated industries. This primer identifies five production-ready patterns that satisfy SEC, HIPAA, and GDPR requirements without sacrificing retrieval quality.

Pattern 1: Air-Gapped Vector Stores

Use case: Highly sensitive data (medical records, M&A documents) Compliance: HIPAA, GDPR Article 32 Trade-off: 15-20% retrieval latency increase

Architecture: Vector database deployed in isolated VPC with no internet egress. Embedding model runs on-premises. Audit logs immutable via blockchain anchoring.

Pattern 2: Federated Retrieval with Differential Privacy

Use case: Cross-border data sharing Compliance: GDPR Chapter V, Schrems II Trade-off: 8-12% accuracy reduction on rare entity queries

Architecture: Queries distributed across regional vector stores. No raw data crosses jurisdictional boundaries. Differential privacy noise added at query time.

Pattern 3: Encrypted Embeddings at Rest

Use case: Financial services, legal discovery Compliance: SEC Rule 17a-4, GDPR Article 32 Trade-off: 25% storage overhead, key management complexity

Architecture: All embeddings encrypted with customer-managed keys. Decryption occurs only in secure enclaves during query execution.

Pattern 4: Audit-First Design

Use case: Regulated decision systems Compliance: SEC, HIPAA, EU AI Act Trade-off: 30% infrastructure cost increase

Architecture: Every retrieval and generation step logged immutably. Human review queues for high-stakes outputs. Complete lineage tracking from source document to final response.

Pattern 5: Hybrid Human-in-the-Loop

Use case: Clinical decision support, legal advice Compliance: FDA 21 CFR Part 11, state bar requirements Trade-off: Response latency 2-5×, requires trained reviewer pool

Architecture: Automated retrieval with mandatory human validation gates. Confidence scoring determines escalation path. Full audit trail for regulatory inspection.

Implementation Checklist

  • Data classification mapping complete
  • Encryption key management documented
  • Audit log retention policy defined
  • Incident response procedures tested
  • Third-party security assessment scheduled
  • Regulatory counsel review obtained

Corrections: submit-evidence