An Agentic RAG and Evaluation Framework for Assurance Case Generation: Industrial Use Case for the EU Cyber Resilience Act Compliance
Source
arxiv.org
Author
Fariz Ikhwantri, Iker Lasa Ojanguren, Dusica Marijan, Maria I. Maslioukova, Jos\'e Arias Marin, Pavlos Kosmides
Date
Why it matters
Shows a workable pattern for generated compliance artifacts: constrain the AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → to Claim-Argument-Evidence structure over real technical documentation, then verify groundingTying a model's answers to checkable sources — retrieved documents, live data, tool results — instead of letting it answer from memory alone.Full definition → automatically with an NLI evaluator — 0.88 accuracy across 70 generated assurance cases.
Terms in this piece · Glossary
RAG — Retrieval-augmented generation — fetching relevant documents first and pasting them into the model's context so it answers from your data instead of memory.
grounding — Tying a model's answers to checkable sources — retrieved documents, live data, tool results — instead of letting it answer from memory alone.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
articleTesting and Evaluation of Agentic AI Systems In Military Command and ControlUlysse Richard, Heather Frase, Sarah Cao, Di Cooke, Sebastian Kwon, Adrianna Tan
articleFrom Traceability to Justifiability: Accountability Structures in Agentic Software EngineeringRashid Azarang
articleSupporting Industrial Test-Failure Analysis with LLM-Based Systems: An Experience ReportEric Jansson, Per Strandberg, Thomas S\"orensen, Eduard Paul Enoiu, Wasif Afzal