Start a similar project
Building an AI product that must survive enterprise legal review, not only a demo? TechAelia's AI engineering team designs the grounding, orchestration, and compliance architecture under production AI platforms.
Contact UsTHE WORK
Problem to production
How we moved from a hard constraint to a system running in production.
- 01
The challenge
Generic AI content fails the first test enterprise buyers apply: can you prove it?
Enterprise sales content faces three hard requirements that a standard language-model wrapper cannot satisfy.
It must be accurate, since an unsupported claim is rejected by a buyer's legal team. It must be specific to the reader, since a message written for a CFO does not land with an engineer. And increasingly, especially for any vendor selling into Europe, it must be defensible: what is the AI generated content disclosure requirement under EU law? Article 50 of the EU AI Act requires that AI-generated content be marked in a machine-readable, detectable format, with enforcement beginning 2 August 2026 and civil penalties reaching into the tens of millions of euros for non-compliance.
Cosellus needed an architecture where content quality and content governance were solved by the same system, not bolted on afterward. That single design decision became the core engineering challenge.
- Sales content had to cite a real source for every factual claim, not just sound plausible
- Persona targeting had to be a first-class reasoning step, not a prompt-engineering trick
- Every generated asset had to carry proof of its own AI origin, tamper-evident and machine-readable
- Human approval had to sit in the loop before anything shipped, with an audit trail that survives even after source data is deleted
- 02
Our approach
Three governance tiers, one retrieval pipeline, and a model layer designed to swap, not rebuild.
TechAelia's engineers designed the knowledge layer first, then layered governance and orchestration above it.
A tri-store system splits relational data (PostgreSQL) from semantic search (ChromaDB vector embeddings) from relationship mapping (Neo4j graph), with a fail-closed tenant filter so one customer's data can never leak into another's results, even on a malformed query. Above that sits a retrieval-augmented generation pipeline: an intent classifier extracts the target persona, vector search retrieves the most relevant source passages, the model writes strictly from that retrieved evidence, and a grounding score flags any output that leans too far on ungrounded reasoning.
Content generation itself runs through a structured multi-agent pipeline orchestrated with LangGraph rather than a single model call: an intelligence layer analyzes uploaded documents for strategic readiness, a plan-before-execute flow surfaces the intended output for approval, and checkpoints guide the user through calls-to-action, persona-specific value propositions, and a final pre-delivery review. The model layer was engineered to be swappable by configuration across OpenAI, Azure OpenAI, Anthropic, Google Gemini, and Perplexity, plus local open-source models for embeddings and reranking, so the platform stays current as new models ship without a rewrite.
- Fail-closed multi-tenant isolation across three separate data stores
- Grounding score computed on every generated asset before delivery
- LangGraph-orchestrated agent pipeline with plan-before-execute human checkpoints
- Model layer swappable by configuration across five external providers plus local inference
- 03
Our implementation
Compliance engineered into the delivery boundary, not appended as a policy document.
The team engineered EU AI Act Article 50 compliance directly into the content-delivery pipeline.
Every delivered HTML asset carries an embedded, tamper-evident manifest that software can detect as AI-generated, meeting the Article 50(2) machine-readable marking requirement, and the marking service fails closed: if it cannot produce the manifest, delivery is blocked rather than shipping unmarked content. An append-only, tamper-proof audit ledger records who approved each asset, when, and a cryptographic fingerprint of the content, and that record survives even after the source campaign is deleted for GDPR purposes.
On the infrastructure side, the team owned deployment and release safety for a live, revenue-generating platform: idempotent database migrations so a deploy can never wedge production, off-site backups for the vector and graph stores, secrets management, and access control across a Docker-containerized stack running on Microsoft Azure with a Python/FastAPI backend and a React/TypeScript frontend.
- Machine-readable, tamper-evident provenance manifest embedded at the point of delivery
- Fail-closed marking service: no manifest, no delivery
- Append-only audit ledger surviving source-data deletion for GDPR compliance
- Idempotent migrations and instant rollback via feature flags for zero-downtime production deploys
