Business Case

Pragma

A product of Cosmos AI LLC · Texas

Stop ECOA violations, HOLC redlining, EEOC discrimination, and EU AI Act breaches before they execute. Pre-execution blocking across hiring and lending — adverse action notices, FCRA two-step workflows, NYC LL144 enforcement, disparate impact analysis, immutable audit trail, compliance certificates.

The Problem

AI is making credit, hiring, and healthcare decisions at scale — with no automated guardrails against the specific regulations that carry real fines.

Regulatory Liability

ECOA, EEOC, GDPR, and the EU AI Act carry fines up to €35M or 7% of global revenue. The CFPB and EEOC are actively pursuing AI discrimination cases — Workday's class action covers millions of applicants.

Monitoring Is Too Late

Every compliance tool on the market monitors after the fact. By the time a report flags a biased loan denial, the harm has happened and the liability is already created.

Proxy Variables Are Invisible

Zip code, last name, and email domain are race and national origin proxies under ECOA. Models use them routinely. No existing tool detects them in real-time and blocks the decision before it executes.

Value Proposition

Pre-execution blocking, not post-hoc reporting. Every AI decision is screened against specific regulations before it executes.

For Engineering Teams

  • Python SDK — one-line integration: client = Pragma(OpenAI(), policy_id="hr-v1")
  • Firewall verdict on every call: block / override_required / allow
  • Automatic risk flag detection (bias, discrimination, fairness, transparency)
  • Regulatory mapping — EEOC, GDPR, EU AI Act, NYC LL144, CFPB auto-cited
  • Batch CSV evaluation, counterfactual bias audit, PDF audit report
  • Compliance-aware chat API for conversational AI use cases
  • Proxy Variable Guard — ECOA/Reg B proxy field detection on every evaluation
  • EU AI Act data lineage — register AI systems, track all 15 articles (Arts. 4–6, 9–15, 17, 25, 27, 30, 33), issue compliance certificates

For Legal & Compliance Teams

  • Proactive enforcement — blocks violations before they execute
  • Immutable audit trail — sha256-hashed inputs, firewall verdicts, proxy vars detected
  • HITL Override — human investigators record override reasons per EU AI Act Art. 14
  • EU AI Act Compliance Certificate — PDF readiness report for all 15 articles, SELF-ASSESSMENT ONLY watermark, valid 1 year
  • Explainable output non-technical stakeholders can read and defend
  • No PII stored — anonymous metadata only, GDPR-safe by design
  • VPC-deployable — sensitive data never leaves your infrastructure
  • August 2026 EU AI Act deadline coverage out of the box
  • AI-powered evidence collection — upload compliance docs (PDF, CSV) or take a guided interview; Claude validates evidence against the specific article's legal requirement
  • Compliance dashboard — track score trends across all registered systems, article heatmap, EU AI Act deadline countdown
Pre
Execution Blocking
Decision halted before it reaches your model — not flagged in a report afterward
7
Regulations Enforced
EEOC · ECOA · GDPR · EU AI Act · NYC LL144 · CFPB · NIST
0
PII Stored
SHA-256 hashed audit trail — GDPR-safe, regulator-ready

Target Market

Any team deploying automated decision-making that affects people.

Primary Targets

  • HR Tech Companies — AI hiring tools, resume screeners, interview scoring
  • Fintech & Banking — Loan approvals, credit scoring, fraud detection
  • Enterprise AI Teams — Internal copilots, automated workflows, policy engines
  • AI Governance Teams — Chief AI Officers, Legal, Compliance, Risk

Market Opportunity

  • $40B+ — AI governance & risk management market by 2028
  • EU AI Act — Mandatory risk assessments for high-risk AI systems from 2026
  • EEOC & CFPB — Increased US enforcement on algorithmic bias
  • 78% of enterprises — plan to expand AI use in decisions by 2026

Use Cases

Real scenarios across the two verticals Pragma is live in today — hiring and lending.

Hiring Vertical — 6 User Journeys Each stage of the hiring process carries its own compliance exposure
Journey Stage Tools in Use What Pragma Catches Regulation
1. Resume Screening HireAI, Workday AI, Greenhouse Graduation year → age inference; HBCU excluded from preferred schools list; no bias audit on file; candidate not notified 10 days before tool used ADEA · Title VII · NYC LL144
2. Skills Assessment Pymetrics, HireVue Assess, Codility No accommodation process for timed tests; assessment cohort skews younger; disparate impact across protected groups ADA · ADEA · EEOC UGESP
3. AI Video Interview HireVue, Spark Hire, Modern Hire AI analyzes facial expressions and speech without candidate knowing; no written consent; no data deletion right offered IL AIVIA · ADA · ADEA
4. Background Check Checkr, Sterling, First Advantage Generic rejection email sent after CRA hit — no Pre-Adverse Notice (§604(b)(3)), no dispute window, no Final Adverse Notice (§615(a)) FCRA §604(b)(3) · §615(a)
5. Final Hiring Decision ATS, hiring manager + AI score AI confidence score built on graduation year and unexplained employment gap; human oversight not documented; selection rate below UGESP 4/5ths threshold ADEA · ADA · EU AI Act Art. 14
6. Offer & Compensation ATS offer module, comp bands Prior salary anchored to offer amount — a known proxy for the gender pay gap; banned in CA, NY, CO, WA regardless of AI involvement CA AB-168 · NY §194-a · CO EPEWA
Lending Vertical — AI Chatbot & Underwriting

Loan Approval — Redlining

Input decision:

"Deny loan — zip 60620 flagged as high default risk geography"
ECOA — zip code is race proxy FHA — historically redlined zip

Zip 60620 maps to a historically redlined Grade D zone on Chicago's South Side. Using it as a factor violates ECOA and the Fair Housing Act regardless of credit score.

AI Chatbot — Adverse Action Notice

Input decision:

"I'll just reject it — credit 598, DTI 52%, 2 missed payments"
FCRA §615(a) — no adverse action notice ECOA §1002.9 — notice required within 30 days

Credit bureau was used in the decision. ECOA §1002.9 and FCRA §615(a) both require written adverse action notices before the file is closed.

Revenue Model

Free for developer adoption. Self-serve Growth tier for teams. Enterprise contracts for the compliance budget where real revenue lives.

Free
$0
forever — no credit card
  • 100 evaluations / month
  • Web & mobile app access
  • PDF report downloads
  • Guest access (no sign-in)
  • Firewall verdict + regulatory refs
  • API key access
  • Team / org accounts
Growth — Self-Serve
$299
per month · Stripe Checkout
  • 2,000 evaluations / month
  • Web & mobile app access
  • API key access — SDK integration
  • EU AI Act Certificate — 15-article PDF
  • ECOA Proxy Variable Guard
  • Immutable audit trail — HITL override
  • Org accounts + shared decision history
  • Manage via Stripe Customer Portal
Enterprise — Talk to us
$10K–$100K
annual contract · usage-based API tier
  • Unlimited evaluations + API keys
  • Pre-execution firewall — embedded in your AI pipeline
  • ECOA Proxy Variable Guard — 20+ fields auto-detected
  • EU AI Act Certificate — 15-article compliance PDF, valid 1 year
  • Immutable audit trail — SHA-256 hashed, regulator-ready export
  • Custom block thresholds & risk policies per team
  • Self-hosted / VPC deployment — data never leaves your infrastructure
  • SAML SSO + org accounts + shared decision history
  • SLA + dedicated compliance engineering support

Competitive Advantage

Every other tool generates a compliance report after the decision runs. Pragma blocks the decision before it executes.

Capability Pragma FairNow / Saidot / KomplyAI Holistic AI / Credo AI Manual Compliance Review
Pre-execution decision blocking Yes — decision halted before it executes No — compliance assessment only, no runtime firewall No — model inventory & risk governance, no blocking No
ECOA proxy variable guard Yes — 35+ fields auto-detected, compound risk detection, CFPB-cited No No No
EU AI Act 15-article certificate Yes — live checklist + AI-validated evidence + PDF certificate Partial — assessment without AI evidence validation Partial — enterprise scope, no self-serve certificate Expensive consulting, months
AI-powered evidence collection Yes — document upload + guided interview scored by Claude No — self-declaration only No — checkbox-based No
HOLC redlining geo detection Yes — 500+ zip codes, 35 US cities (deterministic, L1) No No No
ECOA adverse action notice generator Yes — §1002.9 + FCRA §615(a), one API call No No No
Disparate impact analysis (EEOC 4/5ths) Yes — group-level pass rates, flagged automatically Partial (some tools) Partial (model-level) No
Dynamic rule engine (DB-backed, per-org) Yes — live config, per-org overrides, no redeploy No No No
Compliance dashboard + trend charts Yes — score snapshots, sparklines, heatmap, deadline countdown Limited Partial No
Immutable audit trail Yes — SHA-256 hashed, HITL override No Partial Manual logs
API-first, one-line SDK integration Yes — Pragma(OpenAI(), ...) No No No
Speed to first compliance check Under 5 minutes Days (setup required) Weeks (enterprise onboarding) Months
Price Free / $299/mo / Enterprise Enterprise only Enterprise only ($500+/seat/mo) $50K+ consulting

Compliance Coverage

18 regulations and frameworks enforced across lending, employment, EU, and model risk — active in production today.

US Federal — Lending & Credit
ECOA — Equal Credit Opportunity Act
Reg B, 12 CFR §1002. Prohibits credit discrimination based on race, color, religion, national origin, sex, marital status, age, or public assistance income. Pragma detects proxy variables, redlining, and income-source penalization.
Fair Housing Act
42 U.S.C. §3604/3605. Prohibits discrimination in residential real estate and mortgage lending. Pragma's HOLC redlining check enforces this — 500+ ZIP codes mapped to historically redlined Grade D zones.
FCRA — Fair Credit Reporting Act
15 U.S.C. §1681m. Requires adverse action notices when a credit report is used to deny credit. Pragma flags missing or inadequate notices and generates compliant ECOA §1002.9 + FCRA §615(a) notices.
CFPB UDAAP
CFPA §1031. Prohibits Unfair, Deceptive, or Abusive Acts and Practices in consumer financial services. Pragma flags abusive use of consumer data and opaque AI-driven decisions.
US Federal — Employment
Title VII — Civil Rights Act
42 U.S.C. §2000e-2. Prohibits employment discrimination based on race, color, religion, sex, or national origin. Pragma detects discriminatory language and criteria in AI hiring decisions.
ADEA — Age Discrimination in Employment Act
29 U.S.C. §623. Prohibits discrimination against workers 40+. Pragma detects age proxies — graduation year, years to retirement, "digital native" requirements.
ADA — Americans with Disabilities Act
42 U.S.C. §12112. Prohibits discrimination based on disability. Pragma detects disability-related proxy fields and criteria that screen out protected applicants.
US State Laws — CA · NY · IL
NYC Local Law 144
Requires annual independent bias audits for automated employment decision tools used in NYC hiring. Pragma flags when an AI hiring tool lacks a required bias audit.
NY DFS — AI Fairness Guidance
New York Dept of Financial Services Circular 1. Requires AI fairness testing in insurance and lending. Pragma applies NY DFS fairness checks alongside federal ECOA rules.
California CPRA / AB-2771
Expands CCPA. Requires disclosure of automated decision logic and consumer opt-out rights. Pragma flags decisions lacking required CPRA transparency disclosures.
California AB-168 — Salary History Ban
Prohibits using prior salary history in hiring decisions — a known proxy for the gender pay gap. Pragma detects salary history as a decision factor.
Illinois AIVIA — AI Video Interview Act
Requires disclosure and consent before using AI to analyze video interviews. Pragma flags AI video screening decisions that lack required AIVIA disclosures.
Illinois Human Rights Act
Extends anti-discrimination protections to employment decisions made using AI. Pragma applies IHRA checks on top of federal baselines for Illinois-based decisions.
European Union
EU AI Act (Reg. 2024/1689)
World's first comprehensive AI regulation — live August 2026. Pragma enforces 14 articles:
Art. 5 — Prohibited Practices Art. 6 — High-Risk Classification Art. 9 — Risk Management Art. 10 — Data Governance Art. 11 — Technical Docs Art. 12 — Record-Keeping Art. 13 — Transparency Art. 14 — Human Oversight Art. 15 — Accuracy & Robustness Art. 17 — Quality Management Art. 26 — Deployer Obligations Art. 27 — FRIA Art. 43 — Conformity Assessment Art. 49 — EU Database Registration
GDPR Art. 22
Prohibits fully automated decisions with legal or significant effects without human review or explicit consent. Pragma flags automated decisions that lack required human oversight safeguards.
Policy Frameworks
NIST AI RMF 1.0
15 controls across Govern / Map / Measure / Manage. NIST's voluntary framework for managing AI risk and building trustworthy AI systems. Activated as a policy pack — per-org enrollment from the dashboard.
SR 11-7 + SR 26-2
13 controls covering model validation, governance, and ongoing monitoring. Federal Reserve supervisory guidance for model risk management — required for any bank or credit union using AI models in financial decisions.

Product Roadmap

From feedback flywheel to enterprise AI governance platform.

Done — MVP
  • AI Decision Firewall — block / override_required / allow verdict on every call
  • POST /evaluate-decision with 7 categories, 3 ethical frameworks, regulatory mapping
  • Compliance-aware Chat API — firewall intercepts before response is generated
  • Batch CSV evaluation (100 rows), counterfactual bias audit, PDF audit reports
  • Python SDK — Pragma(OpenAI(), policy_id=...) one-line integration, sync + async
  • Provider chain: Custom Pragma model → Claude → OpenAI → heuristic mock
  • Proxy Variable Guard — ECOA/Reg B fintech proxy field detection (zip_code, last_name, ip_country, email_domain…)
  • Immutable Audit Trail — sha256-hashed audit log, firewall verdicts, proxy vars, per-record HITL override
  • EU AI Act 15-Article Framework — Arts. 4–6, 9–15, 17, 25, 27, 30, 33 compliance checklist with evidence-based scoring
  • 5-Step Assessment Wizard — guided AI system registration replacing flat form (Step 1: System Info → Step 2: Risk → Step 3: Data → Step 4: Declaration → Step 5: Review)
  • Certificate Hardening — SELF-ASSESSMENT ONLY diagonal watermark; DECLARATION ONLY badges on articles without supporting documentation
  • Stripe Billing — Growth plan ($299/mo, self-serve Checkout), Customer Portal, webhook lifecycle management, plan rate limiting
  • Rate Limiting — Free: 100 evals/month; Growth: 2,000; Enterprise: unlimited — enforced on both single and batch evaluation
  • Security Hardening — XSS prevention (esc() helper), CORS explicit allowlist, input size limits, SQL injection guard, Stripe webhook signature verification
  • Structured logging across all backend modules (main.py, compliance_engine.py, database.py)
  • Demo System — "Try Demo — LoanSight AI" one-click button pre-fills wizard with a realistic EU credit-scoring system
  • Mobile bottom navigation bar for web dashboard on phones (scrollable, 8 tabs, iOS Safari compatible)
  • SaaS web dashboard (Evaluate, History, Batch, Audit Log 🔐, Compliance 🏛️, Dashboard, Scenarios, Settings tabs)
  • Google SSO + guest sessions, org accounts, API key management + traffic dashboard
  • Email Notifications — welcome, compliance gap reminders (30-day cadence), EU AI Act countdown (weekly); Railway cron at 09:00 UTC; Resend integration
  • Compliance Dashboard — daily score snapshots, SVG sparkline trend charts, 15-article heatmap, days-to-deadline countdown bar
  • AI-Powered Evidence Collection — document upload + guided interview (Claude scores and surfaces gaps)
  • HOLC Geo Redlining Detection — 500+ historically redlined zip codes across 35 US cities; deterministic L1 rule
  • ECOA §1002.9 Adverse Action Notice Generator — production-ready notices from one API call; FCRA §615(a) included
  • Disparate Impact Analysis — EEOC 4/5ths rule, group-level weekly pass rates, time-series drift detection; automatic alert when AIR < 0.8 for two consecutive weeks
  • L1.5 Semantic Embedding Layer — sentence-transformers (all-MiniLM-L6-v2) computes cosine similarity against 70+ proxy phrase embeddings across 8 categories (geographic redlining, age, gender, disability, national origin, religion, race/ethnicity, family status); fires between deterministic L1 and LLM L2
  • Compliance Policy Packs — NIST AI RMF 1.0 (15 controls: Govern/Map/Measure/Manage) and SR 11-7 + SR 26-2 (13 controls); DB-seeded, per-org enrollment, activate/deactivate from dashboard
  • Dynamic Rule Engine — compliance rules in DB, per-org overrides, live config without redeploy
  • Indirect Phrasing Detection — 14 pattern categories ("that part of town", "near retirement", "family obligations"…)
  • State Law Overlays — California FEHA, New York HRL, Illinois HRA on top of federal baseline
  • W3C PROV JSON-LD Audit Export — machine-readable provenance document for regulators and GRC tools
  • Customer Analytics — PostHog (behavioral) + own DB (DAU/WAU/MAU, feature adoption, plan distribution); admin-only in-app dashboard
  • Lending Vertical Landing Page — lending.usepragma.co with ECOA/HOLC/FCRA positioning
  • Hiring Vertical Landing Page — hiring.usepragma.co with EEOC/FCRA/NYC LL144/IL AIVIA positioning; 6-stage user journey breakdown
  • Gemini Hiring Demo (GH-001 to GH-006) — live AI chatbot scenarios routed through Pragma's hiring compliance vertical: NYC LL144 bias audit, ADEA graduation year, Title VII HBCU exclusion, ADA employment gap, IL AIVIA video interview, FCRA background check adverse action
  • Law Research Agent — daily sweep of Federal Register (7 search terms), EEOC newsroom, and EC Digital Strategy RSS (EU AI Act); Claude classifies relevance and drafts rule configs; human-in-the-loop approval required before any rule goes live
  • Cosmos AI LLC branding — Pragma is a Cosmos AI product; cosmos.html company page at /cosmos
  • 508 tests, all passing · 80.46% coverage
Near-term — Growth
  • First pilot enterprise customer integration
  • Evidence staleness tracking — flag evidence older than 12 months
  • Remediation action plans — step-by-step gap resolution per article
  • Webhook delivery — push compliance alerts to customer systems
  • Node.js SDK — Pragma(openai, { policyId: "..." })
Scale
  • EU AI Act regulatory update feed — auto-update as guidance evolves
  • Conformity assessment workflow — full Annex VI self-assessment form
  • SAML / SSO enterprise integration
  • VPC-deployable Docker container + Helm chart for enterprise
  • HIPAA / healthcare vertical overlays
  • Multi-language support — EU market
Platform
  • Regulatory change monitoring & alerts
  • Partner integrations (Workday, Salesforce, SAP)
  • Marketplace of compliance policy templates
  • Explainability graph — decision reasoning trace
  • Cosmos AI product #2 — stealth