# An Agentic RAG and Evaluation Framework for Assurance Case Generation: Industrial Use Case for the EU Cyber Resilience Act Compliance

arXiv: https://arxiv.org/abs/2608.19509 · HTML: https://mlsanity.com/paper/2608.19509/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 10 of its 22 references that are in the map.
- First posted on arXiv 19 Aug 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 10 of 10)

- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [Supervising Model Attention with Human Explanations for Robust Natural Language Inference](https://mlsanity.com/paper/2104.08142/) (2021)
- [Step-by-Step Fact Verification System for Medical Claims with Explainable Reasoning](https://mlsanity.com/paper/2502.14765/) (2025)
- [A Principles-based Ethics Assurance Argument Pattern for AI and Autonomous Systems](https://mlsanity.com/paper/2203.15370/) (2022)
- [CoDefeater: Using LLMs To Find Defeaters in Assurance Cases](https://mlsanity.com/paper/2407.13717/) (2024)
- [Explainable Compliance Detection with Multi-Hop Natural Language Inference on Assurance Case Structure](https://mlsanity.com/paper/2506.08713/) (2025)
- [Automatic Instantiation of Assurance Cases from Patterns Using Large Language Models](https://mlsanity.com/paper/2410.05488/) (2024)
- [Trusta: Reasoning about Assurance Cases with Formal Methods and Large Language Models](https://mlsanity.com/paper/2309.12941/) (2023)
- [Evaluating Assurance Cases as Text-Attributed Graphs for Structure and Provenance Analysis](https://mlsanity.com/paper/2604.20577/) (2026)
- [LLMs as Judges: Toward The Automatic Review of GSN-compliant Assurance Cases](https://mlsanity.com/paper/2511.02203/) (2025)

## Abstract (arXiv)

Complying with the EU Cyber Resilience Act (CRA) is a resource-intensive challenge for SMEs due to the complexity of cybersecurity conformity assessment. Yet, it is essential for demonstrating regulatory compliance and ensuring product security and resilience. To address this, we introduce an automated framework for generating Assurance Cases (ACs) using an agentic Retrieval-Augmented Generation grounded in a formal Claim-Argument-Evidence logic. By systematically mapping technical documentation requirements, the framework streamlines the generation of certification evidence. We validate our approach on a case study of Catalink's PATROLIoT wildfire monitoring system, where the agentic RAG generated 70 ACs with high grounding density (~4.4 artefacts per AC). The proposed Natural Language Inference (NLI) evaluator achieves 0.88 accuracy, which provides robust evidence grounding and traceability, while expert-validated plausibility (3.06) supports interpretable justifications. For practitioners, this work provides a scalable, interpretable approach for automating mandatory CRA conformity assessments, reducing manual effort while maintaining transparent decision support.