Design and Evaluation of a Sovereign Retrieval-Augmented Generation System for Knowledge Retrieval in Cybersecurity and Artificial Intelligence Governance

Abstract

Governance, Risk and Compliance (GRC) knowledge management is complex, document heavy, and increasingly burdened by regulatory pressure from frameworks such as the GDPR, NIS2, and the EU AI Act. Existing tools fall short. Generic Large Language Model (LLM) assistants lack domain focus and reliable source citation, while enterprise GRC platforms require budget and integration effort that smaller organizations cannot afford. This thesis addresses this gap by designing, implementing, and evaluating a sovereign Retrieval-Augmented Generation (RAG) system for GRC knowledge retrieval in the cybersecurity and AI governance domains.

Following a Design Science Research methodology, the system was built around a double vector search retrieval mechanism, a source labelling pipeline enabling inline, verifiable citations, and a self-hosted PostgreSQL database using the pgvector extension. Sovereignty was treated as a core design principle, leading to the selection of Mistral AI as the LLM provider for its European data residency, and to an architecture supporting future migration to a fully local deployment. The resulting prototype supports two use cases, conversational knowledge retrieval and document drafting, both grounded in the same retrieval pipeline.

The system was demonstrated to a panel of GRC consultants, who responded positively to the grounding and citation mechanism, identifying it as central to building trust in real consultancy work. Document drafting was received more unevenly. Evaluation shows that grounding and access control were enforced structurally, while full data sovereignty was not achieved due to reliance on Mistral's hosted API. This work contributes a working sovereign RAG architecture for the GRC domain, its application to two real use cases, and a reasoned positioning against existing GRC tools.