TESSA: A Governance-Oriented Custom GPT for SME Guidance under the EU AI Act: Design, Implementation, and Evaluation

The multidimensional evaluation framework is well designed and transparently reported, combining automated traceability checks, an external lawyer review, and triplicate consistency testing. Both systems scored exceptionally high on educational clarity, confirming that modern LLMs can effectively communicate regulatory concepts to non-legal audiences. The authors also openly disclose limitations such as manual data collection and evaluator involvement. "Educational clarity was the strongest category for both systems." "The framework was developed to evaluate i) the correctness of the responses and ii) their usefulness for SME-oriented compliance education and governance support."

The primary weakness is the thin empirical delta between TESSA and the unmodified baseline. The LLM-assisted governance alignment metric (90% vs. 83%) proved poorly calibrated against the lawyer-validated result (71% vs. 70%), yet the abstract foregrounds the inflated automated score. Additionally, TESSA underperformed baseline ChatGPT on legal alignment (53 versus 67 "Strong" ratings) and hallucination risk (61 versus 78 low-risk ratings), suggesting the custom prompts may introduce subtle distortions. Evaluator bias is also present: "Part of the human expert review was conducted by the first author, introducing a potential source of evaluator bias." Moreover, "The lawyer review applied a stricter interpretation of governance expectations than the preliminary LLM-assisted assessment, resulting in several responses being reclassified from full alignment to partial alignment."

The evidence supports the narrow claim that governance-oriented grounding shapes the style and emphasis of responses—TESSA did score higher on governance suitability—but it does not convincingly demonstrate a gain in factual correctness or legal reliability. Comparisons to prior assistants such as Chatlaw and AssistantGPT are only motivational; no empirical benchmarking against other legal or compliance chatbots is attempted. There is also a risk of circularity because the expected outcomes were drawn partly from a published knowledge base co-authored by the same group. As noted, the benchmark used "expected outcomes developed from a published EU AI Act guidance knowledge base [10] and relevant official EU AI Act sources [3]," and "Responses from 100 benchmark scenarios were compared with the corresponding expected outcome."

Reproducibility is partially enabled by a public Zenodo dataset containing benchmarks and classifications, but several barriers remain. Because OpenAI's Custom GPT lacked API access, the authors collected and scored 600 responses manually, which invites transcription errors and makes exact replication arduous. Critical implementation details—such as temperature, top-p, or the full text of system instructions—are not disclosed, and the evaluated version link was redacted for review. The authors state that "The Custom GPT platform did not provide direct API access for automated benchmarking. Consequently, responses were collected and evaluated manually, increasing evaluation effort and introducing a potential risk of recording errors." Data availability is, however, commendable: "The supplementary dataset used to evaluate TESSA is available on Zenodo at https://doi.org/10.5281/zenodo.22874463."