How startups in regulated industries are using AI

PONS, a legal AI startup, detailed three design decisions behind its platform on Microsoft Azure, including separating public legal knowledge from customer data, using managed services, and implementing security controls. The platform, which supports research, drafting, contract review, and due diligence for regulated organizations, encrypts customer data with AES-256 and runs on Azure OpenAI in Sweden Central. PONS credited Microsoft for Startups with providing credits and technical guidance that helped its small team address regulatory requirements.

Summary PONS shares three design decisions behind its legal AI platform on Microsoft Azure, from separating public legal knowledge and customer data to using managed services and implementing security and compliance controls. The article highlights practical considerations for startups developing AI for regulated enterprise customers. Building legal AI for regulated industries requires more than connecting a model to documents. For startups serving regulated industries, the challenge isn’t only model capability, but how the system handles trusted sources, private data, infrastructure priorities, and compliance requirements. PONS built its legal AI platform around those constraints. Running on Microsoft Azure https://azure.microsoft.com?wt.mc id=legalarchitecture azure blog mfsmktg , it supports research, drafting, contract review, due diligence, and matter management for law firms, in-house legal teams, and other regulated organizations. This post examines three design decisions behind the platform and what startups developing AI for regulated customers can learn from them. Through Microsoft for Startups https://www.microsoft.com/startups?wt.mc id=legalarchitecture apply blog mfsmktg , PONS was able to access Startup credits, technical guidance, and timely introductions while developing its EU-hosted Azure architecture. According to PONS, this support helped its small team test architectural decisions against real workloads and address technical requirements for regulated customers. Building AI for regulated enterprise customers? Eligible startups can apply to Microsoft for Startups for access to Startup credits that unlock as you build, developer tools, technical guidance, and opportunities to reach customers. Inside the PONS legal AI architecture on Azure The hard part of legal AI is the data. Our Data Factory grounds answers in real, current legislation and case law, then connects it to your own matters and files—without leaving our Azure tenancy or running through a public model. Your data is our highest priority: it’s encrypted with AES-256 before it reaches the database, at rest in Azure, and in transit—three layers, by default. Tobias Zimmergren, CTO and technical co-founder, PONS The PONS platform https://pons.io/?wt.mc id=legalarchitecture pons blog mfsmktg consists of two primary components: the PONS Data Factory and the PONS AI Engine. The PONS Data Factory is a continuous pipeline that validates, collects, cleans, and indexes public legal sources, including legislation, case law, and precedents. It adds semantic metadata, hierarchical structure, vector embeddings, and source-linked references to create a curated legal corpus available across multiple jurisdictions. The PONS AI Engine supports cited reasoning, drafting, contract review, and structured extraction. It operates against both the Data Factory corpus and separately stored customer documents which don’t enter the Data Factory , with outputs evaluated for legal accuracy, context coverage, language, and structure, and automatically rerun on failure. The backend doesn’t call the engine directly—work is published to a queue that the AI Engine polls, so it scales independently of the request path. It’s powered by Azure OpenAI https://azure.microsoft.com/products/ai-foundry/models/openai/?wt.mc id=legalarchtecture azureopenai blog mfsmktg and hosted in Azure Sweden Central. Customers also configure matters, playbooks, templates, and a connected knowledge base, creating the context needed for firm-specific workflows and legal analysis. Design decision one: Separate trusted knowledge from private context PONS intentionally separates its public legal corpus from customer data. The Data Factory is designed to continuously collect and update public legal sources across jurisdictions. According to PONS, customer documents remain separate, and the one-directional data flow means they do not enter the Data Factory and are processed independently through the AI Engine. Each company’s data remains in isolated storage and database containers within their EU-region Azure environment, encrypted in transit and at rest, with access scoped to individual users by default. This boundary allows PONS to update and validate its legal corpus without incorporating private customer material into that pipeline. It also gives the platform a clear architectural control for demonstrating where customer data resides and preventing it from becoming part of the public legal knowledge layer. Startups should consider this pattern when their product combines a continuously updated body of trusted information with customer-specific or sensitive data, particularly when the two require different access, residency, or governance controls. Establishing the boundary early can reduce the risk of private data becoming entangled with shared ingestion and indexing pipelines as the product scales. Decision two: Use managed Azure services to focus engineering effort on differentiation For PONS, choosing managed services was an engineering-prioritization decision: buy the undifferentiated infrastructure lift, and concentrate the team on legal-data quality, reasoning, evaluation, and customer workflows. This principle shaped the Azure architecture. Azure App Service https://azure.microsoft.com/products/app-service/?wt.mc id=legalarchitecture appservice blog mfsmktg runs the application, so they don’t operate servers or hand-roll deployments. Azure SQL Database https://azure.microsoft.com/products/azure-sql/?wt.mc id=legalarchitecture azuresql blog mfsmktg and Microsoft Azure Storage hold structured data and customer files with EU residency pinned to Sweden Central, which makes data location a configuration decision rather than an engineering project. Azure Key Vault https://azure.microsoft.com/products/key-vault?wt.mc id=legalarchitecture keyvault blog mfsmktg keeps secrets and certificates out of application code. Azure App Configuration holds shared non-sensitive settings, and service-to-service connections run on managed identity, so there are no credentials to rotate by hand. Analysis work is handed off through an Azure Queue Storage rather than a direct call, which lets the AI Engine scale independently of the request path, and Azure Web PubSub https://azure.microsoft.com/products/web-pubsub?wt.mc id=legalarchitecture pubsub blog mfsmktg pushes results and notifications back to the web application in real time. For the AI layer, Azure OpenAI provides the foundation models, with Microsoft Foundry https://azure.microsoft.com/products/ai-foundry/?wt.mc id=legalarchitecture foundry blog mfsmktg hosting the fine-tuned and supporting models behind the Data Factory and AI Engine. This provides PONS with frontier capability without standing up their own model-serving stack. The practical benefit is less infrastructure for a small team to operate. PONS can build on Azure capabilities for scaling, deployments, identity, logging, and regional configuration while directing more engineering effort toward the parts of the product customers evaluate. PONS accepted less low-level control in exchange for managed Azure services that support its requirements for regional deployment, identity, logging, and compliance evidence. This approach is most useful when a startup’s differentiation lies in domain-specific data, workflows, or product behavior rather than infrastructure operations. Evaluate a managed service by the recurring work it removes, the controls it supports, and how its level of flexibility aligns with product requirements. Azure’s managed services let us focus on our customers and their needs instead of infrastructure. Scaling, deployments, identity, logging—those are problems Azure has already solved at enterprise scale. We get to spend our time on the parts of the product only we can build. Tobias Zimmergren, CTO and technical co-founder, PONS Decision three: Turn compliance and security requirements into enforceable controls General counsel and procurement teams evaluate more than the AI’s capabilities. For PONS, their architecture must answer key questions, like: - Where does the data live? - Who can access it? - Can the system be audited? - Will customer documents end up training someone’s model? - Does this hold up across every jurisdiction we operate in? PONS says it addresses data location and access through regional isolation and scoped permissions. Citation-linked provenance and audit logs support traceability, while evaluation gates automatically rerun failed outputs and apply refusal-by-design when the system can’t ground an answer. Customer documents don’t enter the Data Factory and aren’t used for model training. The Data Factory’s legal corpus spans multiple jurisdictions and continues to expand, while the platform’s isolation, access, logging, and evaluation controls provide a common technical baseline. PONS also cites its SOC 2 Type II, ISO 27001, General Data Protection Regulation GDPR -related controls, and penetration testing as important entry criteria for enterprise procurement, but the underlying requirements continue to shape the platform’s architecture and controls. For startups building for enterprises in regulated markets, these questions are most useful when asked early—while boundaries around data, access, and model behavior can still be designed into the system rather than documented after the fact. For broader guidance on preparing Azure solutions for enterprise customers, see enterprise readiness for startups on Azure https://learn.microsoft.com/en-us/startups/build/enterprise-readiness/enterprise-readiness-intro?wt.mc id=legalarchitecture enterprisereadyguide blog mfsmktg . Explore the PONS legal AI platform PONS runs in production with customers across multiple EU jurisdictions, primarily serving law firms and in-house legal teams, with active pilots underway in other industries. If you’re exploring how to build citation-grounded AI with security, privacy, and governance requirements in mind, you can read more about what PONS does, the platform, and the architecture behind it at pons.io https://pons.io/?wt.mc id=legalarchitecture pons blog mfsmktg . Building for regulated enterprise customers with Microsoft for Startups As the platform developed, Startup credits through Microsoft for Startups gave PONS the flexibility to prove out architectural decisions on real workloads while managing cloud costs during early growth. Microsoft specialists provided guidance on complex technical decisions, while timely introductions helped the team address production requirements and maintain momentum as the platform scaled. If you’re building AI solutions for enterprise customers in regulated industries, Microsoft for Startups can help you build fast, scale smart, and sell more. Get started with Microsoft for Startups today https://www.microsoft.com/startups?wt.mc id=legalarchitecture apply blog mfsmktg . Access your startups benefits today Microsoft for Startups helps founders build fast, scale smart, and sell more. Apply today to unlock up to $150,000 in Startup credits to start building immediately.