You know that friend who's great at filling out forms — fast, neat handwriting, never leaves a field blank — but occasionally invents a phone number when they don't have yours? That's what this paper finds LLMs doing with EU regulatory compliance documents. Give them a rigid template like the Digital Battery Passport and they'll fill every box consistently, but they'll fabricate data to do it. Give them a loose brief like a GDPR Data Protection Impact Assessment and they'll wander unless you hold their hand with detailed prompts. The committed claim: prompt context and regulatory specificity interact in predictable ways that determine whether LLM-produced compliance artifacts are consistent, complete, or hallucinated — and nobody had systematically measured this tradeoff before. This is not a new architecture or a new model. It's an empirical evaluation of existing LLMs on a genuinely practical task that thousands of EU companies will face as ESPR and GDPR enforcement scales. The paper targets two EU regulations with very different documentation requirements. The Ecodesign for Sustainable Products Regulation (ESPR) mandates Digital Product Passports (DPPs) — structured, schema-driven records of a product's lifecycle. The GDPR mandates Data Protection Impact Assessments (DPIAs) — free-form documents requiring interdisciplinary expertise with no standardized format. The authors benchmark multiple LLMs against manually created ground-truth schemas for both artifact types, varying prompt specificity to isolate the effect of instruction detail on output quality. The key finding is an inverse relationship between regulatory strictness and prompt sensitivity. For the Digital Battery Passport (a specific DPP subtype under ESPR), strict formatting guidelines produced consistent outputs across prompt conditions — models knew what fields to fill. But that consistency came at a cost: more hallucinations, because the model would invent plausible-sounding data rather than leave a required field empty. For DPIAs, the lack of standardized format meant output quality swung wildly with prompt context — low-context prompts produced incomplete, inconsistent documents, while high-context prompts substantially improved completeness. This is a useful empirical contribution, but it sits in a crowded space. The "can LLMs do compliance" literature has been growing since GPT-4 shipped, and the core finding — structured tasks get consistent but potentially hallucinated output, unstructured tasks need more prompt engineering — is what most practitioners already suspect. The paper's value is in measuring and documenting this for two specific, real-world EU regulations rather than generic benchmarks. The ground-truth comparison against manually created schemas is the load-bearing element. The validation regime is the weak point. The authors benchmark against their own manually created ground-truth schemas — not an independent standard, not a regulatory body's gold standard, not a multi-annotator consensus. Industrial data in heterogeneous formats across company and supplier systems is acknowledged as a challenge but the paper doesn't test on real messy enterprise data; the scope appears limited to demonstrating the prompt-sensitivity tradeoff rather than proving production readiness. No code availability or pre-registration is mentioned. The practical takeaway for compliance teams: if your regulation has a rigid schema (DPPs, battery passports), LLMs can generate the structure reliably but you need human review for hallucinated data points. If your regulation is vague (DPIAs), invest in prompt engineering and contextual scaffolding or the output will be inconsistent. Neither case eliminates the need for domain experts — it shifts their role from document creation to document verification.
