While Priscilla is away
Work continues — head to Compliance QA Playground for a self-directed independent build: a Streamlit app answering HIPAA questions through three reasoning frameworks (baseline, RAG, agentic) in both single-question and chat modes. Full write-up, suggested build order, and deliverable checklist are on that page.
Welcome
Welcome to the ComplianceGPT Lab REU. Over the next six weeks you will work as a researcher in an active AI lab, learning to ask research questions, run experiments, analyze results, and communicate your findings.
This program is built around one central question:
Can we build AI systems that make reliable decisions about whether an action complies with a regulation — and explain why?
A patient question like "Can I request my medical records?" or "Can I delete my health data?" can simultaneously touch HIPAA, GDPR, CCPA, COPPA, SOX, and GLBA. Answering correctly requires knowing which laws apply, what each one says, and whether the specific circumstances satisfy the relevant exceptions. ComplianceGPT automates that reasoning.
You will study this problem from the AI and NLP side. The pipeline you'll work with includes Large Language Models, structured information extraction, and a compliance reasoning engine. The reasoning engine is a black box — you call it via an API. Your research lives entirely in the AI/NLP extraction layer.
No prior AI or legal experience is required. What is required: curiosity, consistency, and the willingness to be wrong and try again.
Key Facts
| Dates | Jun 22 – Jul 31 |
| Lab | NCS Room 242 |
| Mentor | Priscilla Kyei Danso |
| Final Presentation | July 31 |
| Schedule | Wed on campus · Thu/Fri remote |
About the REU
The AI Innovation & Diffusion REU is a six-week research program run by Stony Brook University's AI Innovation Institute, in partnership with Farmingdale State College and Suffolk County Community College. Each student works directly with a graduate mentor on a real research project.
This lab's focus is Trustworthy AI for Legal Compliance. We build systems that can read real-world privacy scenarios and determine whether they comply with regulations like HIPAA, GDPR, CCPA, and more. Our system, ComplianceGPT, achieves 94.2% accuracy on a benchmark of 137 real HIPAA court cases — tying a frontier model with a 4B local model.
Expectations
What is expected of you
- Attend Wednesday on-campus sessions (NCS 242, 10am). Thursday and Friday are remote work days — post a Slack update by noon. Monday is available for ad hoc roadblock resolution. Notify in advance if you cannot attend Wednesday.
- Work the hours — 11am–4pm is independent research time. This is not optional.
- Communicate early — if you are stuck, blocked, or falling behind, say so on the same day. Never wait until Friday to say you've been stuck since Monday.
- Finish things — a focused 1-week project is better than a half-finished 3-week project. Scope down; do not abandon.
- Be a good lab citizen — give honest feedback to peers, take notes, respect each other's time.
What you can expect from me
- I will respond to Slack messages within a few hours on weekdays.
- I will give written feedback on every deliverable within 48 hours.
- I will write you a strong letter of recommendation if you put in the work.
- I will help you scope your project realistically so you finish with something to show.
- I will co-author any paper that comes from this work and handle submission logistics.
- I will introduce you to other researchers, faculty, and opportunities.
The Black Box Rule
ComplianceGPT contains a formal reasoning engine internally. You will never open it, modify it, or need to understand it. You interact with it through a Python API. Think of it like a database: you run queries, get results, analyze them. The query engine's internals are irrelevant to your research. Your research is about the AI/NLP extraction layer — prompting, model selection, error analysis, adversarial robustness, explanation quality.
The Research Pipeline
Here is the full system. Your work lives in the shaded area.