# Governance-First AI GPT for EU AI Act SME Compliance (TESSA) > Source: > Published: 2026-10-24 19:13:33+00:00 ## The Short Answer TESSA improves EU AI Act SME compliance guidance by using governance-first grounding that forces answers through a use-case, stakeholder-role, and risk workflow. In evaluation on 100 benchmark questions, it reached higher governance alignment than a standard ChatGPT baseline in an LLM-assisted check (90% vs 83%). So what: for practitioners, you can replace generic “tell me about the EU AI Act” support with a structured compliance conversation that produces role- and risk-relevant next steps. Caveat: like any compliance aid, TESSA’s value depends on maintaining current regulatory knowledge; the approach therefore includes a human-validated regulatory update mechanism rather than relying on unreviewed model knowledge. Governance-First AI GPT for EU AI Act SME Compliance (TESSA) ## Introduction If you’re an SME trying to make sense of the **EU AI Act**, you don’t need more generic “AI explanations.” You need something that helps you translate legal requirements into real governance steps—without accidentally going off-track. That’s exactly what a new research effort explores in [TESSA: A Governance-Oriented Custom GPT for SME Guidance under the EU AI Act](https://arxiv.org/abs/2610.30822). The study (pre-print version) presents **TESSA**, a governance-oriented Custom GPT built in the OpenAI Custom GPT environment. The big question the researchers tackle: can an LLM-based assistant—when grounded in the right regulatory knowledge and structured to ask the “right” compliance questions—be practically useful for non-legal stakeholders? And does it behave consistently enough to trust with education and decision support? They evaluated TESSA against a baseline `ChatGPT` setup using **100 benchmark questions** across **10 thematic categories**, and used a multi-layer evaluation approach: governance alignment checks (with lawyer validation), human expert review, and consistency testing across repeated executions. In short: this isn’t “cool demo” work—it’s about whether governance grounding improves compliance guidance in a measurable way. ## Why This Matters Here’s what feels different (and more urgent) right now: AI governance isn’t staying theoretical. Many SMEs are actively deploying AI features, and the “we’ll figure it out later” approach is getting expensive—especially when risk classification, documentation duties, and stakeholder responsibilities aren’t obvious until you need them. This research lands at a very practical time because you can imagine the exact situation TESSA targets: **Scenario you can apply today:** A product team is rolling out a generative AI feature (say, summarising customer support tickets) and asks: *“Are we low-risk, limited-risk, or something else—and what governance duties come with that?”* TESSA’s design aims to guide that conversation by first identifying **use case → role → risk → guidance**, instead of letting the model freestyle. That’s the key difference: it turns a vague “tell me about the EU AI Act” request into a structured compliance workflow. Where this builds on earlier AI assistant research is the shift from “LLMs as information chatbots” to “LLMs as governance educators with guardrails.” Previous systems often focused on legal Q&A quality broadly. TESSA goes further by adding **governance-oriented grounding** and a **human-validated regulatory update mechanism**—two ingredients that directly target reliability and currency, which are the usual weak points in compliance-oriented copilots. (If you want to see what they did and how they tested it, the full details are in the paper at [https://arxiv.org/abs/2610.30822](https://arxiv.org/abs/2610.30822).) ## Governance-First Grounding: How TESSA Turns Prompts into Compliance Workflows One reason compliance guidance is hard for SMEs is that the EU AI Act isn’t just “facts”—it’s a structured set of responsibilities that depend on context: your role, your use case, and the risk level. A general-purpose assistant may explain concepts, but it can miss the contextual steps that determine *what you should do next*. TESSA’s approach is basically: **stop the model from wandering and force a compliance-shaped route**. ### The “Question → Use Case → Role → Risk → Guidance → Output” sequence When you ask a question, TESSA identifies: - the relevant **use case** - your **stakeholder role** (who you are in the supply chain: provider/deployer/etc.) - the **AI risk classification** likely tied to that scenario Then it produces guidance using a structured pattern the paper calls the **Structured Governance Guidance Pattern (SGGP)**, with: - role-specific instructions - risk classification information - compliance considerations - plain-language explanations - practical recommendations A helpful analogy: think of TESSA like a compliance GPS. You can still get to the destination with a normal map app, but a GPS that knows your departure point (role), road closures (risk classification), and destination (governance duties) reduces the odds you take a “technically plausible” but wrong turn. ### What “governance-oriented grounding” buys you The research motivation is clear: the baseline LLM knowledge might be present, but without grounding you risk: - missing governance nuance - overgeneralising - losing traceability to the actual regulatory sources - producing advice that sounds confident but isn’t aligned to what the guidance intends In the study, the grounding is built from four main components inside the Custom GPT: - **System instructions** - a **published EU AI Act guidance knowledge base** - a **use case / AI list risk classification repository** - **human-validated regulatory updates** ## What the Researchers Actually Tested: Benchmark Design, Lawyer Validation, and Human Review To avoid the “it seems good” problem, the authors evaluate TESSA like a product that must pass gates—not like a demo that must only impress. ### 100 benchmark questions across 10 EU AI Act themes They built a benchmark of **100 scenarios** in **10 thematic categories**, including: - AI literacy - startup and student projects - risk classification - compliance duties - prohibited AI practices - high/limited/minimal-risk AI - `GPAI` and foundation models - SME perspectives Each scenario was designed to be realistic for people who aren’t legal experts but still need to act responsibly. ### Traceability validation: did responses match the grounding sources? The first evaluation phase checks whether answers align with: - the **published EU AI Act guidance knowledge base** and - **official EU AI Act sources** They rate alignment using a three-level scale: **Yes / Partial / No**. Then the study layers in the most important quality control: an **experienced AI regulation lawyer** validates the final classifications. ### Two independent “quality lenses”: lawyer and human experts For the human expert review, they used structured assessment across **five dimensions**: 1. **Legal alignment** 2. **Educational clarity** 3. **Governance suitability** 4. **Hallucination risk** 5. **Overall assessment** There were two reviewer perspectives: - an **AI regulation lawyer practitioner** (final results) - an **AI regulation researcher** (also used to validate the assessment process) This matters because compliance quality isn’t just factual accuracy—it’s also “is the explanation usable, proportional, and structured for governance?” ## TESSA vs Baseline ChatGPT: The Measured Differences That Matter Now to the numbers. The paper compares TESSA to a baseline `ChatGPT` interface using the same underlying `GPT-5` model, but without the custom instructions, domain knowledge, or governance-oriented grounding. ### Governance alignment results (lawyer-validated) Here’s what the lawyer validation found across the 100 scenarios: | System | Yes | Partial | No | Full Alignment (%) | |---|---|---|---|---| | `TESSA` (lawyer) | 71 | 27 | 2 | 71% | | Baseline `ChatGPT` (lawyer) | 70 | 30 | 0 | 70% | **Takeaway:** TESSA is basically on par with baseline for legal/governance alignment on the strict lawyer scoring—**71% vs 70%**—but it also tends to structure governance guidance more effectively (more on that below). ### LLM-assisted preliminary checks (before lawyer validation) Before the lawyer review, an LLM-assisted preliminary review estimated alignment higher than the lawyer did: | System | Yes | Partial | No | Full Alignment (%) | |---|---|---|---|---| | `TESSA` (LLM-assisted prelim.) | 90 | 10 | 0 | 90% | | Baseline `ChatGPT` (LLM-assisted prelim.) | 83 | 17 | 0 | 83% | This drop is a useful detail: it suggests the baseline model and TESSA can both sound plausible while still missing governance nuance that a lawyer would catch. ### Human expert review: where TESSA shows its strength Educational clarity was a strong point for both systems—TESSA just edges out on a few dimensions. For the lawyer review (Table 3 in the paper): - **Educational clarity:** - `TESSA` : 99 “Strong”, 1 “Acceptable”, 0 “Weak” - Baseline `ChatGPT` : 92 “Strong”, 8 “Acceptable”, 0 “Weak” - **Governance suitability:** - `TESSA` : 84 “Strong”, 13 “Acceptable”, 3 “Weak” - Baseline `ChatGPT` : 76 “Strong”, 23 “Acceptable”, 1 “Weak” - **Hallucination risk:** - `TESSA` : 61 low, 36 medium, 3 high - Baseline `ChatGPT` : 78 low, 21 medium, 1 high - **Overall assessment:** - `TESSA` : 59 “Strong”, 37 “Acceptable”, 4 “Weak” - Baseline `ChatGPT` : 75 “Strong”, 24 “Acceptable”, 1 “Weak” **How to interpret this without overreading it:** TESSA seems to trade a bit of fluency/overall “legal confidence” for stronger governance-focused structure—especially around **stakeholder responsibilities and proportional governance practices**. So the headline isn’t “TESSA is universally better.” It’s more like: **TESSA is better at teaching compliance in a governance-shaped way**, while baseline `ChatGPT` is slightly better at overall legal alignment/assessment on this rubric. ## Consistency Under the Hood: Does It Stay Stable, or Does It Drift? For compliance guidance, consistency is a big deal. If the same question produces different risk classifications or contradictory governance duties each time, you can’t build a reliable workflow on top of it. ### Repeated executions across 100 scenarios (600 total responses) They ran each of the **100 benchmark scenarios three times** on both systems: - `TESSA`: 300 responses - baseline `ChatGPT`: 300 responses Consistency was scored across five dimensions, and then rolled up into a normalized **Overall Consistency Score (OCS)**. ### Consistency results | Metric | `TESSA` | Baseline `ChatGPT` | |---|---|---| | Stable | 98 | 98 | | Minor Variation | 0 | 1 | | Major Variation | 2 | 1 | | Average OCS | 0.969 | 0.976 | | Std dev (OCS) | 0.139 | 0.108 | | `OCS ≥ 0.75` (%) | 98 | 99 | | `OCS ≥ 0.90` (%) | 94 | 96 | | Hallucination drift low (%) | 98 | 99 | **Bottom line:** both systems are highly stable. The difference in OCS is tiny (**-0.007**), and hallucination drift stayed low (** 98% vs 99%**). That’s a big reassurance: governance grounding (the thing you might worry would add rigidity or bias) didn’t destroy consistency. In this setup, it looks compatible with reliable behavior. ## The “Regulatory Update” Piece: Human-Validated Currency, Not Just One-Time Knowledge One of the quiet failure modes for compliance assistants is that regulations and guidance evolve. If your system uses a static dataset, it becomes outdated fast—and outdated compliance guidance is worse than no guidance. TESSA includes a **human-validated regulatory update mechanism** designed for continuous monitoring with human oversight. ### How updates flow into the system They used two connected workflows: 1. **Automated candidate collection** - built with `n8n` automation - pulls candidate updates from governance resources and academic databases - merges and de-duplicates content - stores items into a structured review queue 2. built with 3. **Human review + controlled publication** - reviewers check relevance, accuracy, and alignment with governance objectives - only validated updates are incorporated into TESSA’s repositories This is a practical governance idea: don’t treat regulatory content as “training data forever.” Treat it like an operational knowledge base with a review process. If you’re building compliance support tools, this part is worth copying—because it directly addresses the maintenance burden that SMEs usually can’t handle alone. ## Key Takeaways - **TESSA is governance-first, not just answer-first.** It routes questions through a workflow:**use case → role → risk → guidance** , then outputs structured compliance recommendations. - **Governance alignment is comparable to baseline `ChatGPT`, using strict lawyer validation:****71% for TESSA vs 70%** for baseline across**100 benchmark scenarios** . - **TESSA shines in governance suitability and SME-friendly structuring** , while baseline performs slightly better on overall legal assessment. - **Consistency is high for both systems.** Across repeated runs (600 total responses), TESSA’s average**OCS is 0.969** vs**0.976** for baseline—differences are negligible. - **The standout “trust” feature is the human-validated regulatory update mechanism.** Automated monitoring is paired with human review to keep guidance current. If you’re an SME team, this study suggests a direction that’s genuinely useful: compliance copilots shouldn’t just “explain the law.” They should **guide you through the decision structure**—with grounding, validation, and update processes that make the output dependable enough to learn from (and eventually to operationalise). ## Sources Used This article is a plain-English breakdown of the following peer-reviewed preprint. Read the original for full methodology and results: - [TESSA: A Governance-Oriented Custom GPT for SME Guidance under the EU AI Act: Design, Implementation, and Evaluation](https://arxiv.org/abs/2610.30822) — arXiv - Authors: Authors: Chalisa Veesommai Sillberga, Kai-Kristian Kemella, Pekka Sillberga, Katri Harjuveteläinenb, Mika Saaria, Pekka Abrahamssona