Cutting Document Review Time From Minutes to Seconds.
Insurance, compliance, and cybersecurity teams are still spending 20–40 minutes searching long PDFs for answers. BIS Advisors built and validated an AI-powered document intelligence system that turns those lookups into grounded, cited answers in a few seconds — across representative policies, SOC 2 reports, NIST frameworks, cyber endorsements, ESG reports, regulatory guidance, and audit evidence packages.
Lookup-time reduction in the evaluated test set
Typical response time in the tested configuration
Answer quality in the evaluated test set
No unsupported answers in the evaluated test set
Case Study Status & Facts
The work described here is a technically validated proof of concept. The results below were observed under the documented test conditions; they are not guarantees of equivalent production outcomes.
- Engagement stage
- Proof of concept (POC) — internally validated, not yet a production deployment
- Evaluation type
- Structured manual evaluation: answers reviewed and scored against the source material
- Data type
- Evaluation and reference documents (insurance and cyber policies, SOC 2 reports, NIST frameworks, endorsements, audit evidence)
- Deployment environment
- Test environment — GCP L4 GPUs and an on-prem RTX 4090
- Evaluation size
- ~120 questions (roughly half insurance, half SOC/NIST)
- Intended users
- Underwriting, claims, compliance, and audit teams handling document-heavy workflows
- Current status
- Validated prototype with documented architecture; production architecture available for implementation with client teams
- Documented in
- Full case study (PDF)
Business Problem
Underwriting, claims, audit, and compliance teams rely on long, dense documents every day:
- 30–200+ page cyber and property insurance policies
- Endorsements, exclusions, riders, and cyber addenda
- SOC 2 Type I/II reports
- NIST 800-53 and 800-171 control frameworks
- ESG and regulatory reports
- Audit evidence PDF collections
These documents are technical, cross-referenced, carrier- or vendor-specific, and often stored across multiple systems. Manual lookup can take 20–40 minutes per question, especially around exclusions, deductibles, or control verification, leading to:
- Slower underwriting turnaround and operational delays
- Inconsistent interpretation across reviewers and teams
- Elevated compliance and regulatory risk
- Analyst frustration and cognitive fatigue
- Time lost during submissions, audits, and investigations
Solution Overview
BIS Advisors implemented a Python-based Retrieval-Augmented Generation (RAG) pipeline optimized specifically for insurance, audit, and compliance workflows. Instead of relying on keyword search and manual scrolling, analysts ask natural-language questions and receive grounded answers, supported by citations to their own documents.
System Capabilities
- Parses and indexes dense, representative PDFs
- Retrieves the most relevant paragraphs, clauses, or controls
- Generates grounded answers using only retrieved content
- Returns answers in 2–7 seconds under the tested configuration
- Includes citations to policy sections or SOC/NIST controls
- Returns “Not present in the document.” when content is absent
- Handles multi-document libraries and cross-document questions
- Supports cloud, hybrid, and secure on-prem deployments
Technical Stack (High-Level)
The system uses a modern, self-hosted AI stack designed for regulated environments:
- Language: Python (RAG pipeline)
- LLM: Llama 3.1 Instruct 8B (self-hosted)
- Inference: vLLM
- Embeddings: Dedicated embedding model selected through retrieval evaluation
- Vector DB: FAISS
- Deployment: GCP L4 and on-prem RTX 4090 (hybrid)
- Guardrails: strict grounded-answer prompting + fallback refusal for unsupported questions
This is not a general-purpose chatbot. It is a focused RAG system for serious, document-centric work, designed for the security and governance constraints of regulated environments.
Engineering Notes From the Build
What Mattered Most in Practice
- PDF parsing and normalization often mattered more than model size — OCR quality, tables, fonts, and headers heavily influenced recall.
- Chunk size and overlap had a large effect on coverage and cross-referenced sections.
- Embedding quality was critical for insurance and SOC/NIST recall, especially in long, technical documents.
- Grounding-first prompts kept outputs grounded and defensible in the evaluated test set.
Infrastructure & Stability
- In the tested GPU configuration, a clean Linux installation with an RTX 4090 was more stable than the evaluated WSL environment.
- In the tested configuration, approximately 80–85% GPU memory utilization provided a workable balance between throughput and stability.
- Very long answers (>2–3k tokens) increased latency nonlinearly, so answer length and context depth were tuned per workflow.
Evaluation Approach & Performance
Evaluation Approach
To produce defensible metrics, we used a structured evaluation covering both insurance and SOC/NIST workloads:
- ~120 total test questions
- ~50–60 insurance coverage and endorsement questions
- ~50–60 SOC 2 / NIST control interpretation questions
- Scoring rubric: Correct / Partially Correct / Incorrect
- Answers manually reviewed against the source material
- Grounding manually verified by tracing each answer back to source text
- Latency measured across repeated runs on both GCP L4 and on-prem RTX 4090
The goal was realistic performance — not “perfect demo” numbers.
Performance Highlights
Latency (L4 vs RTX 4090)
- Typical response time on GCP L4: ~5–7 seconds across all question types.
- Range: approximately 0.5 to 15 seconds, primarily driven by answer length and context depth.
- Under identical conditions, an on-prem RTX 4090 ran ~3.5× faster than an L4, with similar answer quality.
Answer Quality
- Answer quality in the low-to-mid 90% range in the evaluated test set of insurance and SOC/NIST questions.
- No unsupported answers were observed in the evaluated test set under the documented strict-grounding configuration.
- Clear traceability from every answer back to the underlying source text.
Deployment & Cost Considerations
Different organizations have different risk profiles, data residency requirements, and cost constraints. The solution was validated across on-prem and cloud GPUs, with a focus on stability and predictable cost per question.
On-Prem RTX 4090
- Fast, predictable performance for 8B-class models in the tested environment
- Documents and embeddings can remain within client-controlled infrastructure, subject to the surrounding access, logging, backup, and security architecture
- After hardware acquisition, on-prem infrastructure may reduce incremental inference expense, although electricity, depreciation, maintenance, cooling, support, and resilience costs remain
- WSL was less stable than a clean Linux installation in the tested GPU configuration; production suitability depends on the specific infrastructure and workload
Cloud (GCP L4)
- Stable, easy to deploy, runs 24 GB VRAM models comfortably
- Ideal for distributed teams or variable workloads
- Typical configuration: ~8–10 hours/day scheduled uptime, yielding roughly $400–$500/month in compute cost
- At ~40k–50k monthly questions, effective compute cost works out to approximately $0.008–$0.0125 per question ($400/50,000 to $500/40,000). This estimate covers GPU compute only and excludes implementation, integration, storage, networking, support, monitoring, and other operating costs.
Example Hybrid Architecture
- In the tested environment, the on-prem 4090 handled most daily workloads
- Cloud GPUs were used for burst capacity, after-hours usage, or special projects
- The right deployment model depends on each organization's workload, risk profile, and data-residency requirements
API Models & Escalation
The architecture supports a “local-first, escalate-when-needed” strategy:
- A local-first architecture can handle appropriate routine requests and escalate selected complex, ambiguous, or high-risk questions to larger or externally hosted models. Routing thresholds and the expected distribution between local and external models must be established through workload-specific evaluation.
- This approach may keep costs more predictable while preserving access to larger models when warranted.
Business Impact (evaluated workflows)
Before AI
- 20–40 minutes per lookup on long PDFs
- Several documents open side-by-side for each question
- Repeated manual cross-referencing of clauses and controls
- High variance between reviewers and teams
- Significant cognitive load and fatigue
With the AI assistant (in the evaluated test set)
- Grounded, cited answers in seconds instead of minutes
- Cited responses that can be quickly verified in source documents
- Potentially more consistent interpretation across analysts — not measured with operational client teams
- ~80–90% reduction in manual lookup time in the evaluated test set
- Lower lookup effort in the evaluated workflow; team-level throughput was not measured
- Clear traceability from every answer back to its source text; audit-defensibility outcomes were not measured
Potential Applications Across Teams
These are potential applications, not measured client outcomes. This POC was validated internally and did not measure results with operational client teams.
Underwriting
Could support faster submission review and identification of conditions, deductibles, sublimits, exclusions, and carrier-specific language by attaching citations to relevant source material.
Claims
Could support faster policy-language lookup and more consistent review by attaching citations to relevant source material. This POC did not measure production claims-adjudication outcomes.
Compliance & Audit
Could support faster SOC 2 evidence lookup and traceable NIST control review. This POC did not measure completed audit outcomes, regulatory approval, or assessor productivity.
Adoption & Change Management
A key finding from this build and evaluation: the technology works in tests, but production adoption requires intentional change management.
- Analysts must trust the system enough to use it daily
- Managers need clarity on which questions AI should handle vs. when to escalate
- Teams need training on grounded answers vs. free-form AI “guesses”
- Compliance and audit functions need documentation, governance, and clear usage policies
- Integration into existing underwriting, claims, and audit workflows is essential for real ROI
Training, governance, workflow integration, and management support may improve the likelihood of adoption. This internally validated POC did not measure production adoption or organizational outcomes.
Key Lessons Learned
- Python is highly productive for insurance/compliance RAG work.
- In the tested grounded-QA workflow, the evaluated instruction-tuned configuration performed better than the corresponding base-model configuration.
- In the evaluated workflows, retrieval, ranking, and data quality often mattered more than model size alone.
- WSL was less stable than a clean Linux installation in the tested GPU configuration; production suitability should be evaluated for the specific infrastructure and workload.
- In enterprise AI engagements, change management, training, governance, and organizational support can be as important to adoption as model performance.
Roadmap
Building on this capability, BIS Advisors is expanding AI-powered document intelligence in several directions:
- Advanced policy comparison and version-difference views
- Automated mapping between SOC, NIST, and ISO frameworks
- Enhanced audit evidence extraction and tagging
- Multi-stage retrieval and evidence review workflows
- Support for larger and more complex document libraries
- Running larger models (e.g., Llama 3.1 70B or equivalents) on A100 and H100 GPUs to compare accuracy and latency in high-complexity environments
- Internal “Ask Your Documents” portals for enterprise teams, with access control and audit logging
These are potential future enhancements that would require separate implementation and evaluation. Their operational, compliance, and performance effects have not yet been measured.
Ready to See This on Your Documents?
The evaluated POC demonstrated technical feasibility for the tested document-intelligence workflows and consistently returned grounded, cited answers in seconds under the documented test conditions. If your teams are still scrolling through long PDFs to answer routine questions, a focused pilot on your own documents can usually demonstrate value quickly.
We are based in Florida with the company incorporated in Colorado, serving clients across the United States. Florida organizations may request optional on-site sessions when appropriate.
📞 Call us: +1 (303) 632-7874
✉️ Email: consulting@bisadvisors.com
Good Fit If…
- You rely on long insurance, compliance, cyber, ESG, or audit PDFs for daily decisions.
- You have security or regulatory constraints on where documents and answers can live.
- You want grounded, defensible answers — not black-box AI responses.
- You’re open to a scoped pilot on your own documents before scaling to the enterprise.