85 Rules. 16 Regulations. Zero LLM Cost.

The $30K Question

Compliance officers at banks, hospitals, and tech companies spend weeks reviewing documentation against regulations. Did the privacy policy actually cite GDPR Article 7 correctly? Does the SAR narrative contain all five Ws that FinCEN requires? Is the SOX 404 assessment referencing PCAOB AS 2201 properly, or did someone paraphrase the statute into something it doesn't say? Consultants charge $30K-$500K to answer these questions. They read documents, check them against regulations, and produce findings. The work is important. It's also mechanical enough that a linter should do 80% of it. Redline does the 80%.

How It Works

85 Vale rules across 16 regulation files. YAML definitions, each mapping to a specific regulation paragraph. When the linter flags something, it doesn't say "this might be wrong." It says: "this phrase violates §164.312(a) of HIPAA" or "this disclosure is missing the timeline required by GDPR Article 12(3)."

python -m redline lint your-policy.md --regulations gdpr,hipaa

The output is a gap report: what's missing, what's imprecise, and what's citing the wrong source. Each finding links to the regulation text.

What We Found When We Audited Ourselves

Spot-checked 10 of our own 85 rules. Found one fabricated rule (attributed NIST 800-88 concepts to HIPAA), six imprecise rules (wrong article numbers, absolute statements where the regulation says "where feasible"), and three clean. That 70% error rate on a sample of 10 is exactly why this tool needs to exist. If our own rules had drift, imagine what happens in a 200-page compliance manual that hasn't been checked against the current regulation text in two years. We fixed all seven findings. 75 rules still need the same audit. The tool works; the rules need verification against primary sources. That's the current work.

Coverage

Regulation	Rules	Focus
GDPR	10	Consent, data subject rights, breach notification, DPO, DPIA
HIPAA	10	Access controls, PHI handling, breach notification, BAAs
SOX	11	Section 302/404 controls, PCAOB standards, material weakness
BSA/AML	13	CIP, CDD, SAR narratives, CTR, beneficial ownership
PCI-DSS	9	Cardholder data, prohibited storage, encryption, access
SOC 2	10	Trust services criteria, control descriptions
ISO 27001	10	Information security controls, risk assessment
FINRA	10	Suitability, communications, supervision
SEC	9	Marketing rule, ADV filing

Why Deterministic

LLMs hallucinate regulation citations. We tested this. Ask Claude to check a document against HIPAA and it will produce plausible-sounding section numbers that don't exist. Ask it to verify GDPR compliance and it will paraphrase Article 7 into something Article 7 doesn't say. Deterministic rules don't hallucinate. A Vale pattern either matches or it doesn't. The rule either cites the right paragraph or it's wrong at authoring time, not at runtime. That's the entire value proposition: compliance checks that are auditable, repeatable, and don't cost $0.01 per page in API calls. Stack: Vale, Python CLI, YAML rule definitions. Open source, Apache 2.0.