Most people prompt a model for compliance text the way they would ask a colleague: a sentence or two of description, then hope. For a blog post that works. For a data processing addendum it produces something that looks finished and is quietly wrong. The model fills every gap you leave with whatever is statistically common, and "statistically common" is not the same as "correct for this entity in this jurisdiction under this regulation."
A repeatable structure fixes more than a clever one-off prompt does. When the same stages run every time, the failure modes become predictable, and predictable failures are catchable failures. The method below has five stages, arranged so each one constrains the next. I call it DRAFT: Define, Reference, Author, Flag, Test. The name is a mnemonic, not magic. What makes it work is that no stage is optional and each has a clear job.
Why a Structure Beats a Clever Prompt
A single brilliant prompt is fragile. It works until the document type changes, the regulation updates, or a new person inherits the workflow. A staged method survives all three because the stages encode the reasoning, not just the wording.
What the Stages Buy You
- Repeatability across drafters, so output does not depend on who is at the keyboard.
- Auditability, because each stage leaves an artifact you can point to later.
- Failure isolation: when a draft is wrong, you can usually name the stage that let it through.
Stage One: Define
Before any text is generated, pin down what the document is and what binds it. This stage produces no prose; it produces constraints.
What to Establish
- The exact regulation or standard governing the document, named explicitly.
- The parties, entity types, and jurisdictions involved.
- The defined terms the business already uses, supplied verbatim.
- The hard boundaries: commitments the document must never make.
Skipping Define is the single most common cause of confident, wrong drafts. The model cannot infer your governing law.
Stage Two: Reference
A model drafting from memory will paraphrase regulations it half-remembers. Reference forces it to work from material you supply rather than from training-data averages.
Supplying Ground Truth
- Paste the relevant regulatory text, the prior approved version, or the controlling template.
- Provide real examples of how your organization phrases similar clauses.
- Where you cannot supply text, instruct the model to mark the spot for human research rather than inventing content.
This stage is where hallucinated citations are prevented, not merely caught later.
Stage Three: Author
Only now does the model write. Because Define and Reference have already constrained the space, the authoring prompt can be specific about structure rather than scrambling to supply substance.
Shaping the Output
- Specify the document's sections and their order.
- Set the register: enforceable and plain, not impressive.
- Request the draft in a form that preserves your defined terms exactly.
If you find yourself supplying substance at this stage, an earlier stage was incomplete. Go back rather than patching forward.
Stage Four: Flag
The model knows where it was uncertain; it just does not volunteer that. Flag asks it to.
Surfacing Uncertainty
- Ask the model to list every assumption it made and every spot it could not ground in supplied material.
- Have it mark commitments that carry financial, regulatory, or contractual exposure.
- Require it to identify any citation it produced from memory.
A flagged draft routes human attention to the places that need it, which is the whole economic argument for the method.
Stage Five: Test
Finally, the draft meets the review list. This is where the structure connects to verification. The checks in A Working Review List for AI-Drafted Legal and Compliance Text are the Test stage made concrete.
Closing the Loop
- Run the substance, consistency, and risk checks.
- Send hard-stop findings back to the relevant earlier stage, not forward to an editor.
- Record the model, prompt, and human edits for provenance.
How the Stages Constrain Each Other
The power of the method is not the five names; it is the ordering. Each stage narrows the space the next one operates in, so by the time the model writes, most of the ways it could go wrong have already been closed off.
The Cascade
- Define fixes the regulation, parties, and boundaries, so Reference knows what material is relevant.
- Reference supplies ground truth, so Author is shaping rather than inventing.
- Author produces a constrained draft, so Flag has a concrete artifact to interrogate.
- Flag surfaces the uncertainty, so Test knows where to aim expensive attention.
When a draft fails, this cascade lets you trace the failure to its origin. A hallucinated citation is a Reference failure, not an Author failure, even though it appeared in the authored text. Fixing it at Author, by editing the citation, treats the symptom; fixing it at Reference, by grounding the model, treats the cause. The discipline is always to repair the earliest stage that allowed the defect.
Why Patching Forward Fails
- Editing the output without fixing the input means the next draft reproduces the same error.
- Each forward patch accumulates as undocumented tribal knowledge rather than improving the repeatable process.
- A team that patches forward never sees its inputs improve, so its drafts never get cheaper to review.
A Worked Illustration
Consider drafting a data processing addendum. Without the method, you might prompt "write a DPA for our SaaS product" and receive something that looks complete. With the method, Define pins the governing regime and the actual sub-processors; Reference supplies your standard DPA template and the real data categories; Author requests the structure with your defined terms preserved; Flag asks the model to mark every obligation it inferred rather than grounded; and Test runs the full review.
What Changes
- The thin prompt produces a generic document that may commit you to obligations you never agreed to.
- The staged version produces a document grounded in your actual practice, with its assumptions surfaced for review.
- The difference is not the model's capability; it is how much of the reasoning you encoded before asking it to write.
The verification half of this illustration is exactly the work in Signals That Tell You AI Compliance Drafts Are Holding Up, where the Flag and Test stages become measured numbers.
Adapting the Method by Document Type
The five stages always run, but their weight shifts. Knowing which stage carries the load saves time. For the practical entry point, see A First Real Compliance Draft With AI, Step by Step, and for where the method strains, see Edge Cases Experts Hit When Prompting Regulated Documents.
Where the Weight Falls
- Privacy notices: Reference dominates, because accuracy against the regime is everything.
- Negotiated contracts: Define and Flag dominate, because boundaries and exposure are the risk.
- Internal policies: Author and Test dominate, because clarity and consistency drive adoption.
Frequently Asked Questions
Is DRAFT a real legal standard?
No. It is a working mnemonic for organizing prompts, not a recognized legal or regulatory framework. Its only authority comes from making errors catchable; treat it as scaffolding, not law.
Do I have to run all five stages every time?
For regulated documents, yes. The stages are cheap relative to the cost of a missed commitment. You can move quickly through stages that are well-covered by a template, but none should be silently skipped.
What if I do not have reference material for the Reference stage?
Then instruct the model to flag those sections for human research instead of inventing content. A gap you can see is safer than fabricated text that reads as finished.
Which stage catches hallucinated citations?
Reference prevents most of them by grounding the model in supplied text, and Flag surfaces any that slip through by asking the model to mark citations produced from memory. Test verifies the survivors against primary sources.
How is this different from just writing a detailed prompt?
A detailed prompt collapses all the reasoning into one step, so when it fails you cannot tell why. Staging separates concerns, which makes failures diagnosable and the workflow teachable to someone new.
Can a non-lawyer run this method safely?
For drafting and the first four stages, yes. The Test stage still routes anything with real exposure to qualified counsel. The method speeds the work up to the point where judgment is required; it does not replace the judgment.
Key Takeaways
- A staged method survives changes in document type, regulation, and personnel that a single clever prompt cannot.
- Define and Reference happen before any text is written, and they prevent most confident-but-wrong drafts.
- Author should only shape structure; if you are supplying substance there, an earlier stage was incomplete.
- Flag makes the model surface its own uncertainty so human attention lands where it is needed.
- The weight of the stages shifts by document type, but no stage is ever optional for regulated text.