Statutory AI: Aligning Large Language Models With Legal Norms

# Statutory AI: Aligning Large Language Models With Legal Norms
Source: [https://arxiv.org/html/2608.28593](https://arxiv.org/html/2608.28593)
11institutetext:JustAI, Évreux, France
11email:\{cindy\.delage,marc,jonathan\}@justai\.co
\*Corresponding author22institutetext:INSA Rouen Normandie, Rouen, France
22email:stephane\.canu@insa\-rouen\.frContent warning: this paper includes examples that may contain harmful or offensive language\.

###### Abstract

With the increasing development of AI regulatory frameworks, ensuring that artificial intelligence systems, particularly generative models, operate in accordance with legal and ethical standards has become a critical priority\. Existing proposals for AI alignment and value\-guided behavior, however, face some limitations\. Approaches such asConstitutional AIdepend on human supervision, while broad normative frameworks like theGood\-for\-Humanity \(GfH\)principle may be overly general and ambiguous to provide actionable governance guidance\. To overcome these limitations, we propose a hybrid approach called Statutory AI that employs pre\-existing human\-authored principles drawn from specific themes within a legal corpus\. Specifically, Statutory AI uses legal texts as a constitutional framework, enabling AI systems to autonomously critique and revise their outputs according to established norms\. It operates in two stages, both using Chain\-of\-Thought prompting\. The first stage classifies the user prompt into one of the identified themes, while the second stage analyzes it in conjunction with relevant articles selected from the legal corpus of that theme\. To illustrate the potential of our approach, we conducted an experiment involving 1,000 red\-teaming prompts and five penal themes: discrimination, disclosure of confidential information, violence, fraud, and abuse of vulnerable persons\. Statutory AI reduced harmful content by 52 to 59 percentage points across tested models, approximately 10 percentage points higher than standard Constitutional AI, while cutting computation time by over 50%\.

## 1Introduction

With the rise of Generative AI systems and their continuous improvement\[[25](https://arxiv.org/html/2608.28593#bib.bib1)\],\[[2](https://arxiv.org/html/2608.28593#bib.bib2)\],\[[11](https://arxiv.org/html/2608.28593#bib.bib3)\], ensuring alignment between generated content and human values has become a central concern\[[16](https://arxiv.org/html/2608.28593#bib.bib4)\]\. The key challenge is to guarantee that generated outputs are aligned with human values—namely, that they are helpful, honest, and harmless\[[3](https://arxiv.org/html/2608.28593#bib.bib23)\]\. Within this broader issue, particular attention has been devoted to the detection and prevention of harmful content, such as discriminatory or violent material, the disclosure of private information, or the spread of misinformation\. Recent studies have shown that even state\-of\-the\-art models can still produce harmful content\[[21](https://arxiv.org/html/2608.28593#bib.bib22)\]\.

The alignment challenge is partially mitigated through Reinforcement Learning from Human Feedback \(RLHF\)\[[8](https://arxiv.org/html/2608.28593#bib.bib5)\]\. However, RLHF’s reliance on human feedback makes it costly and difficult to scale\. To address this limitation, researchers have proposed “AI\-as\-a\-judge” paradigms\[[5](https://arxiv.org/html/2608.28593#bib.bib7)\],\[[15](https://arxiv.org/html/2608.28593#bib.bib8)\], in which model behavior is guided by human\-defined rule sets rather than individual annotations\. While these approaches reduce dependence on human annotators, they still rely on manually written constitutions\.

To further minimize human intervention, Anthropic has explored whether constitutions could be replaced by more general guiding principles, such as the succinct directive to “do what’s best for humanity,” known as the GfH principle\[[18](https://arxiv.org/html/2608.28593#bib.bib9)\]\. However, such principles are inherently subjective and susceptible to interpretative biases, which may inadvertently lead to discriminatory outcomes\.

We propose an intermediary approach between GfH and fully specified constitutions: the use of laws\. Laws are systems of rules which a country or community recognizes as regulating the actions of its members and which may be enforced by the imposition of penalties\[[26](https://arxiv.org/html/2608.28593#bib.bib30)\]\. Legal texts aim to capture collective human values in a structured and explicit manner\. By leveraging their clarity and public intelligibility, laws can reduce the ambiguity and bias associated with general constitutions, while offering improved robustness for AI models\.

Importantly, there is no need for new human annotations, as these laws are already well defined\. In this work, we take an initial step by focusing on penal law\. Harmful content is often related to behaviors explicitly defined as illegal in national penal codes—such as discrimination, violence, or fraudulent activities—making penal law a particularly relevant starting point for mitigating generative AI risks\.

We explore the following research question: Can existing legal systems function as constitutions within the LLM\-as\-a\-judge framework, providing robust definitions of harmfulness without the need for additional handcrafted rules? To facilitate reproducibility, the code, prompts, and evaluation data are publicly available111[https://github\.com/justai\-labs/statutory\-ai](https://github.com/justai-labs/statutory-ai)\.

### 1\.1Related Work

Recent efforts have focused on democratizing constitution design\[[15](https://arxiv.org/html/2608.28593#bib.bib8)\], or reverse\-engineering implicit principles from feedback\[[13](https://arxiv.org/html/2608.28593#bib.bib10)\],\[[7](https://arxiv.org/html/2608.28593#bib.bib26)\]\. OpenAI’s research\[[19](https://arxiv.org/html/2608.28593#bib.bib25)\]explored detecting harmful content through predefined categories such as harassment and identifying whether a given prompt belongs to such a category\. While these approaches refine constitutional AI, they rely on newly crafted principles or curated taxonomies\.

A separate line of work argues that laws can serve as specifications for AI: the “law informs code” agenda\[[22](https://arxiv.org/html/2608.28593#bib.bib34)\]frames legislation, statutory interpretation, and legal reasoning as a computational engine for translating vague human values into precise directives, and a broader vision of “law\-following” AI agents has been proposed\[[23](https://arxiv.org/html/2608.28593#bib.bib35)\]\. Closest in spirit, He et al\.\[[14](https://arxiv.org/html/2608.28593#bib.bib36)\]draw on statutory interpretation theory to reduce interpretive inconsistency when models apply natural\-language principles\. These works, however, either remain conceptual or import legal methods of interpretation\. To the best of our knowledge, this is the first work to integrate pre\-existing legal provisions into a Constitutional\-AI\-style critique–revision loop for LLM harmlessness alignment\.

This research also aligns with efforts to enhance AI models’ understanding of the potential consequences of user prompts\[[27](https://arxiv.org/html/2608.28593#bib.bib11)\], and may complement approaches such as case\-based reasoning\[[12](https://arxiv.org/html/2608.28593#bib.bib12)\], which address the question of which values should be chosen to align generated responses\.

Recent research\[[1](https://arxiv.org/html/2608.28593#bib.bib24)\]highlighted several shortcomings that may arise when constitutional principles are defined by private corporations, including the neglect of social context\. That work introduced the concept of Public Constitutional AI, which aims to involve the public in the drafting process to ground constitutions in human judgment\. By relying on human\-defined laws, our approach takes a step toward bridging this gap\.

### 1\.2Broader Impact

The motivation behind both general principles and specific constitutions in Constitutional AI has been to reduce the need for costly human annotations\. Our work proposes a middle ground: the AI remains autonomous in its critique and revision processes, and no additional human annotation is required to define the guiding principles\. By leveraging pre\-defined laws as those principles, we incorporate a form of human input, thereby preserving the objective of AI alignment—ensuring that AI\-generated responses remain consistent with human needs and values, without incurring additional human cost\.

## 2Statutory AI Approach

Our method is more closely related to the specific constitutional domain than to the general one, as it relies on a set of well\-defined principles rather than a single broad statement\. The Statutory AI consists of a dictionary of legal articles combined with Chain\-of\-Thought \(CoT\) reasoning\.

It is decomposed into two stages:

1. 1\.The AI Assistant receives the user prompt and classifies it into one of five key themes from the red\-teaming dataset: discrimination, confidential information disclosure, fraudulent abuse of a vulnerable person, violence — physical or psychological, and fraud\. The prompt can be classified as ’NaN’ if it does not pertain to any of the themes\. These five themes cover roughly 80% of the red\-teaming dataset and were retained as representative for this proof of concept\.
2. 2\.Each prompt is associated with a specific category\. For each category, relevant articles of the penal code were manually selected by the authors and provided to the AI Assistant \(see Appendix\)\. The choice of the articles was made by selecting the most relevant ones for each group \(containing information or definitions for each category\)\. The Assistant first responds without additional guidance\. Subsequently, it is asked to critique its previous response in light of the relevant legal articles, and then to revise it to ensure that it contains no harmful or unlawful content\. Where appropriate, it is encouraged to cite the relevant legal articles \(see method section for detailed prompts\)\. When the category is undefined \(NaN\), constitutional provisions cannot be applied\. This limitation is not addressed in the present proof of concept but is left for future work\.

In both the critique and revision phases, Chain\-of\-Thought \(CoT\) prompting\[[31](https://arxiv.org/html/2608.28593#bib.bib16)\]is used, as\[[6](https://arxiv.org/html/2608.28593#bib.bib6)\]shows that it improves performance in Constitutional AI\.

### 2\.1Datasets and Models

The classification stage serves as a preprocessing layer that assigns prompts to appropriate legal categories and provides the relevant statutory context\. To avoid confounding effects from classification errors, we employed a single state\-of\-the\-art model: Gemini 2\.5 Flash\[[11](https://arxiv.org/html/2608.28593#bib.bib3)\]\. This model was selected over other recent alternatives \(\[[25](https://arxiv.org/html/2608.28593#bib.bib1)\],\[[2](https://arxiv.org/html/2608.28593#bib.bib2)\]\) and over the Pro version of Gemini 2\.5 due to its accessibility for rapid POC development\. Manual tests were conducted to confirm its ability to classify red\-teaming prompts \(see[3](https://arxiv.org/html/2608.28593#S3)\)\.

For the critique/revision stage, we tested three models: Mistral 7B, Gemini 2\.5 Flash and Qwen3\-VL\-30B\-A3B\-Thinking\. Mistral 7B was selected based on the expectation of high susceptibility to red\-teaming attacks\. Gemini 2\.5 Flash was chosen among recent proprietary models \(\[[25](https://arxiv.org/html/2608.28593#bib.bib1)\],\[[2](https://arxiv.org/html/2608.28593#bib.bib2)\],\[[11](https://arxiv.org/html/2608.28593#bib.bib3)\]\) due to budgetary constraints and its reported effectiveness against classical red\-teaming scenarios \(26\.9% vulnerability in Automated Red Teaming \(ART\)\[[11](https://arxiv.org/html/2608.28593#bib.bib3)\]\)\. Qwen3\-VL\-30B\-A3B\-Thinking was selected as a representative of high\-capability open\-source models, as its MoE architecture achieves competitive performance with state\-of\-the\-art proprietary models\[[4](https://arxiv.org/html/2608.28593#bib.bib33)\]while remaining deployable at scale\.

Regarding the datasets, conventional benchmarks such as ALERT\[[29](https://arxiv.org/html/2608.28593#bib.bib17)\]or the dataset proposed by Perez et al\.\[[28](https://arxiv.org/html/2608.28593#bib.bib18)\]are available\. However, recent models such as Gemini 2\.5 Flash exhibited no vulnerabilities to these datasets during manual testing, consistent with\[[11](https://arxiv.org/html/2608.28593#bib.bib3)\]\. Indeed, these datasets rely on relatively explicit prompts, such as"Any suggestions for poisoning someone without killing them?"\. While such queries were effective in earlier evaluations, recent models are now generally able to detect the associated risk and refuse to provide an answer\. As a result, these benchmarks may underestimate the vulnerability of current systems, as they do not adequately capture more subtle or obfuscated adversarial prompts that are increasingly required to bypass modern safety mechanisms\. Consequently, this study focuses on the Adversarial Dataset\[[17](https://arxiv.org/html/2608.28593#bib.bib19)\], which yielded a 58% vulnerability rate in a 100\-prompt test with Gemini 2\.5 Flash\. For Mistral 7B, vulnerability exceeded 93% in initial tests on the same 100 prompts\. A sample of 1000 adversarial prompts, randomly selected from the dataset, was deemed sufficient for this proof of concept\.

### 2\.2Detailed Method

#### 2\.2\.1First Step: Classification of the Prompt

The prompts are processed by the classifier model \(see previous section on datasets and models,[2\.1](https://arxiv.org/html/2608.28593#S2.SS1)\) in batches of ten\. The model is instructed to classify each prompt individually into one or more of the following legal risk categories:

1. 1\.Discrimination ;
2. 2\.Confidential Information Disclosure ;
3. 3\.Fraudulent Abuse of a Vulnerable Person \(i\.e\., exploiting a vulnerable person’s ignorance or weakness with the intent to cause serious harm\) ;
4. 4\.Violence — physical or psychological \(e\.g\., insults or verbal abuse\) ;
5. 5\.Fraud \(i\.e\., deceiving someone by using a false identity, misrepresenting status, or employing deceptive practices to unlawfully obtain money, goods, or services\)\.

The first two categories are relatively straightforward\. The remaining three categories, however, are more nuanced and potentially open to interpretation\. To address this, we provided additional details, examples, and definitions \(as indicated in parentheses\) to help the model better interpret these categories\.

The AI assistant is required to associate each prompt with one or more categories, based on the estimated legal risk\. If a prompt does not clearly fall into any of the predefined categories, the assistant is instructed to classify it as “NaN”\. Upon completion of the classification step, a dataframe is produced containing two columns: one listing the original prompts and the other indicating the category or categories assigned by the model\. Because this step is critical to the accuracy of the Statutory AI approach in the subsequent critique–revision phase, additional manual evaluations were conducted to verify the assistant’s classification capabilities\.

A dictionary of legal references corresponding to each possible label is also defined manually by the authors\. This dictionary links each category to relevant legal articles\. Priority is given to articles providing a general definition of the illegal action, and additional related articles are included when they are represented in red\-teaming prompts \(based mainly on\[[29](https://arxiv.org/html/2608.28593#bib.bib17)\],\[[28](https://arxiv.org/html/2608.28593#bib.bib18)\], and\[[17](https://arxiv.org/html/2608.28593#bib.bib19)\]\)\.

Full details are provided in the Appendix; however, as an illustrative example, the labelConfidential Information Disclosureis associated with Article 226\-13 of the French Penal Code, which states:“The disclosure of confidential information by a person entrusted with it by virtue of their position, profession, or a temporary assignment is punishable by one year of imprisonment and a fine of 15,000 euros\.”

The articles are translated into English to ensure consistency with the Constitutional AI method, and English is used consistently regardless of the country from which the laws originate\. The translations were performed and verified manually by the authors to preserve the original meaning as accurately as possible\.

This dictionary supports the AI assistant by enabling it to better detect situations in which its initial response could potentially constitute harmful or illegal content under applicable legal frameworks\.

#### 2\.2\.2Second Step: Process of Critique and Revision

Once classified, the prompts and the first AI assistant’s response are provided to the AI assistant again, together with the following instruction:

"Here are several legal articles\. Read them and critique the previous assistant’s response: could it potentially lead to a violation of any of these articles, even minimally, and therefore constitute an illegal action? If so, explain precisely why, citing the relevant legal articles\. Break down your reasoning into logical steps\."

The relevant legal articles corresponding to the classification labels accompany the prompt\.

Once the critique has been produced, a new prompt instructs the AI assistant to revise its original response:

"Taking into account the discussion provided—especially the critique of the assistant’s initial response—revise the assistant’s original reply to ensure it contains no harmful or unlawful content\. Where appropriate, reference the relevant legal articles mentioned in the discussion\. The revised response must not include anything that could encourage harmful, unethical, or illegal actions, whether directly, indirectly, or even in a fictional or creative context\. Attention: You must maintain a polite, kind, and educational tone regardless of how serious or inappropriate the user’s request may be\. Always keep an empathetic and positive attitude to gently redirect the conversation toward something useful for the user, without including any dangerous or illegal content\. Empathy is especially important in emotionally charged contexts \(for example, when someone is in deep distress — but not limited to such cases\)\. Break down your reasoning into logical steps\."

This instruction emphasizes that no harmful, unethical, or illegal content should remain in the final revised version and that empathy is required\. Initial manual evaluations revealed that the model’s responses could sometimes appear overly strict, almost rude, and emotionally detached\. Thus, the explicit requirement for empathy aims to address and mitigate this issue\.

Once the first revision is completed, the method is considered finished\. Because Statutory AI does not rely on multiple principles randomly selected during the process, it does not require different critique and revision cycles\.

The Anthropic Constitutional AI method is implemented only in the first part of the supervised stage \(see\[[5](https://arxiv.org/html/2608.28593#bib.bib7)\]\): the critique–revision loop\. For the purposes of this proof of concept, only this stage is implemented in this work\. The discussion will examine whether future research should implement the complete methodology, including Supervised Fine\-Tuning \(SFT\) and Reinforcement Learning \(RL\)\.

## 3Main Results

### 3\.1Computational environment and model configurations

All experiments were conducted using Python 3\.12\.3\. Gemini 2\.5 Flash was accessed via the Google Generative Language API using thegoogle\-generativeaiPython library \(version 3\.0\.0\)\. Mistral 7B was executed locally using theOllamaframework \(version 0\.5\.1\), with the quantized versionmistral:7b\[[24](https://arxiv.org/html/2608.28593#bib.bib21)\]\(7\.25B parameters, Q4\_K\_M\)\. Qwen3\-VL\-30B\-A3B\-Thinking was accessed via a HuggingFace inference endpoint, using the quantized version Qwen3\-VL\-30B\-A3B\-Thinking\-1M\-Q8\_0\.

Local experiments were run on a Windows 11 system equipped with an Intel\(R\) Core\(TM\) i7\-14650HX processor \(16 cores\), 16 GB RAM, and an NVIDIA GeForce RTX 4060 Laptop GPU \(8 GB VRAM\)\. All tests were executed with default settings\.

### 3\.2First Step: Classification of the Prompt

Because our objective is not to evaluate classification performanceper se, but rather the statutory critique–revision mechanism, the classifier model was fixed throughout the experiments\. This allows us to isolate the contribution of the statutory approach from potential variability in classification\.

To ensure that the classifier did not introduce bias into the critique–revision results, we performed human verification on 278 prompts out of the 1000 available \(95% confidence level, 5% margin of error\[[9](https://arxiv.org/html/2608.28593#bib.bib20)\]\)\. The sample preserved the class distribution observed in the full dataset \(see Figure[1](https://arxiv.org/html/2608.28593#S3.F1)\)\.

![Refer to caption](https://arxiv.org/html/2608.28593v1/x1.png)Figure 1:Relative share of penal themes across 1,000 prompts\.Table[1](https://arxiv.org/html/2608.28593#S3.T1)presents precision and recall for each category, using human annotations as ground truth\.

Table 1:Classifier performance \(278 prompts, human annotations as ground truth\)Both precision and recall exceed 80% for all classes, which is sufficient to validate the classifier and proceed to the critique–revision stage\. Notably, the labelsDiscriminationandConfidential Information Disclosureachieved performance levels above 95%\.

The NaN prompts cover topics such as assisted murder, false historical events, and sexually explicit content\. Future work will further investigate these cases to ensure the generalizability of the methodology\.

### 3\.3Second Step: Process of Critique and Revision

A total of 1,000 prompts not classified as “NaN” are randomly sampled from the dataset\. For each prompt, we generate an original answer using the model under evaluation \(Mistral 7B, Qwen 30B or Gemini 2\.5 Flash\)\. This answer is not moderated and is referred to as the original response\.

We then generate revised versions using both moderation methods\. The Constitutional AI approach is applied as described in\[[5](https://arxiv.org/html/2608.28593#bib.bib7)\], limited to four critique–revision loops \(no fine\-tuning or reinforcement learning at this stage\)\. Few\-shot examples from\[[5](https://arxiv.org/html/2608.28593#bib.bib7)\]are used, and Chain\-of\-Thought reasoning is applied with the instruction: “Break down your reasoning into logical steps\.”

For the Statutory AI, the method described in Section[2\.2](https://arxiv.org/html/2608.28593#S2.SS2)is applied\. No examples are used\. Only one critique–revision loop is required, since all relevant legal articles are provided during the first critique phase\. The same Chain\-of\-Thought instruction is used\.

The results are evaluated by two LLM\-as\-a\-judge systems: GPT\-5 and Gemini 2\.5 Flash\. GPT\-5 is treated as the primary independent judge, while Gemini 2\.5 Flash is used as a secondary judge only, as its involvement in the tested method introduces a potential bias discussed in the Discussion section\. For both judges, reasoning steps were regularly reviewed by the authors to ensure judgment quality\. The same evaluation protocol is applied to both moderation methods\.

The judges return the following metrics:

- •Initial vulnerability: whether the original response was harmful \("Yes"/"No"\)\.
- •Comparison score: binary score \(0 or 1\) assigned to each method, prioritizing the reduction of harmfulness while preserving usefulness\. The judge is instructed to treat harmfulness as the primary criterion, while usefulness only affects the score if a response becomes substantially less relevant \(e\.g\., purely evasive or lacking any meaningful guidance\)\. Minor differences in wording or completeness are not penalized\. This ensures that safer responses are not favored at the expense of practical usefulness\.
- •Final vulnerability: whether the revised response still contains harmful content \("Yes"/"No"\)\.

Table[2](https://arxiv.org/html/2608.28593#S3.T2)presents the metrics for both judges as percentages over the 1,000 tested prompts\.

Table 2:Initial vulnerability and post\-moderation results \(GPT\-5 / Gemini 2\.5 Flash as judges\)Table[3](https://arxiv.org/html/2608.28593#S3.T3)reports the mean computation time per prompt\.

Table 3:Mean computation time per prompt \(seconds\)Figure[2](https://arxiv.org/html/2608.28593#S3.F2)illustrates the evolution of vulnerability across the three stages \(initial output, after Constitutional AI, after Statutory AI\), based on GPT\-5 evaluations\.

![Refer to caption](https://arxiv.org/html/2608.28593v1/x2.png)Figure 2:Vulnerability levels for tested models across three stages: initial outputs, after Constitutional AI, and after Statutory AI \(GPT\-5 as judge\)\. Lower values indicate better safety \(i\.e\., fewer harmful responses\)\.We find that both LLMs\-as\-a\-judge assign a score of 1 to Statutory AI more often than to the Constitutional AI approach, regardless of the critique–revision model\. GPT\-5 appears more lenient overall, while Gemini 2\.5 Flash places greater emphasis on stylistic factors\. Nevertheless, both judges agree that vulnerability decreases substantially: by at least 42 percentage points with Constitutional AI and at least 52 percentage points with Statutory AI\.

Statutory AI outperformed the Constitutional AI baseline across both judges and all tested models, as confirmed by McNemar’s test\[[20](https://arxiv.org/html/2608.28593#bib.bib27)\]\(Judge Gemini 2\.5 Flash — Mistral 7B:χ2​\(1\)=27\.8\\chi^\{2\}\(1\)=27\.8,p<1\.3×10−7p<1\.3\\times 10^\{\-7\}; Gemini 2\.5 Flash:χ2​\(1\)=22\.0\\chi^\{2\}\(1\)=22\.0,p<2\.8×10−6p<2\.8\\times 10^\{\-6\}; Qwen 30B:χ2​\(1\)=53\.41\\chi^\{2\}\(1\)=53\.41,p=2\.71×10−13p=2\.71\\times 10^\{\-13\}; Judge GPT\-5 — Mistral 7B:χ2​\(1\)=16\.65\\chi^\{2\}\(1\)=16\.65,p=4\.5×10−5p=4\.5\\times 10^\{\-5\}; Gemini 2\.5 Flash:χ2​\(1\)=60\.17\\chi^\{2\}\(1\)=60\.17,p=8\.7×10−15p=8\.7\\times 10^\{\-15\}; Qwen 30B:χ2​\(1\)=53\.65\\chi^\{2\}\(1\)=53\.65,p=2\.39×10−13p=2\.39\\times 10^\{\-13\}\)\. Absolute gains ranged fromΔ=\+7\.7\\Delta=\+7\.7to\+13\+13percentage points, corresponding to small\-to\-medium effect sizes \(Cohen’sh≈0\.18h\\approx 0\.18–0\.510\.51\[[10](https://arxiv.org/html/2608.28593#bib.bib28)\]\)\. Matched odds ratios indicate that Statutory AI was approximately1\.51\.5–4\.54\.5times more likely to succeed in cases where Constitutional AI failed\.

These improvements are consistent across models and judges, suggesting that alignment with statutory norms enhances harmlessness while maintaining robustness across evaluation setups\[[30](https://arxiv.org/html/2608.28593#bib.bib29)\]\.

Differences between judges do not alter this conclusion\. While absolute vulnerability scores vary, relative reductions remain comparable across evaluators\. In cases of divergence, Gemini 2\.5 Flash tends to reward explicit pedagogical explanations and legal grounding\. For example:"Statutory AI demonstrated a superior reduction of harmfulness by explicitly rejecting the premise \[…\] and leveraged the provided legal article to explain the potential legal and ethical harm\."GPT\-5, by contrast, focuses more directly on harmfulness mitigation:"Statutory AI refrained from continuing the harmful scenario, flagged legal and ethical concerns, and redirected to safe resources\."

Overall, across the five tested themes, a single critique–revision loop grounded in statutory articles produced responses that consistently outperformed the Constitutional AI baseline\. These findings support the validity of using pre\-defined legal frameworks as alignment principles and motivate further extension of the method beyond this proof of concept\. Limitations and future directions are discussed in the next section\.

### 3\.4Discussion and Future Directions

Several reflections emerge from this proof of concept and call for broader validation across additional datasets and models:

- •Evaluation bias: A potential bias arises when Gemini 2\.5 Flash is used both within the pipeline and as a judge\. To mitigate this, we activated Chain\-of\-Thought reasoning for the LLM\-as\-a\-judge and manually reviewed its justifications\. We also introduced GPT\-5 as an independent evaluator\. Results remain largely consistent across judges, with discrepancies mainly related to stylistic assessments rather than harmfulness detection\.
- •Role of the classification step: The classification stage is central to the methodology\. It prevents arbitrary legal references and enables a single targeted critique–revision loop\. As illustrated in multiple cases, success depends primarily on correctly identifying harmful content \(e\.g\., discrimination or privacy violations\), which the classification step ensures\. Across examples, the LLM\-as\-a\-judge frequently emphasized that effectiveness stemmed from explicitly identifying and refusing harmful elements\.
- •Pedagogical strength of legal grounding: all tested models were able to critique and revise their responses using legal articles\. The LLM\-as\-a\-judge often viewed explicit legal grounding as a robust and pedagogical justification for refusal\. Compared to Constitutional AI, which may rely on broader ethical principles, Statutory AI tends to block harmful content more directly and justify refusals with explicit references to codified norms\.
- •Limitations: One limitation observed in manual evaluations concerns tone\. Legal references can make responses appear overly formal or insensitive\. This was mitigated by explicitly requiring empathy and pedagogical framing in the revision prompt\. While effective in this proof of concept, this adjustment should be validated on larger and more diverse datasets\. Another major limitation concerns thematic coverage\. In its current form, Statutory AI operates on only five predefined penal themes, meaning harmful content outside these categories may not be properly identified\. This restricted scope reflects the proof\-of\-concept nature of the framework rather than a conceptual limitation of statutory grounding itself\. By contrast, Constitutional AI relies on broader principles that can capture more diffuse or socially constructed harms\. The two approaches are therefore complementary: Constitutional AI provides wider coverage, whereas Statutory AI offers stronger robustness and interpretability for clearly codified harms\. Extending the taxonomy to additional legal domains is a necessary next step\.
- •Necessity of full legal articles\. An open question concerns whether providing full legal articles is necessary, or whether labels alone would suffice\. Preliminary evidence suggests that access to explicit articles improves revision quality, particularly for smaller or more vulnerable models\. Moreover, legal references introduce a pedagogical dimension, transforming refusals into structured explanations grounded in publicly recognized norms\.

This work opens the door to intermediate alignment methodologies between handcrafted constitutions and broad principles such as GfH\. Future research should extend the analysis to additional legal themes, datasets, and models with varying vulnerability levels, and evaluate the approach in real\-world settings, including integration into the full pipeline \(e\.g\., supervised fine\-tuning or reinforcement learning\)\. Ablations across quantization levels and model scales are also needed to assess robustness under deployment constraints and to analyze how architectural factors influence harmlessness gains\. Exploring training\-time integration, rather than inference\-only moderation, would further clarify safety–efficiency trade\-offs in terms of token consumption, latency, and throughput\.

If validated at scale, leveraging pre\-defined legal frameworks may offer a practical alternative to designing new constitutions and provide a structured mechanism for grounding AI refusals in collectively defined norms across legal systems\.

\{credits\}

#### 3\.4\.1Acknowledgements

This work was supported by the EulCat project, co\-funded by the European Union \(European Regional Development Fund — ERDF\) and the Normandy Region \(France\)\. The authors used ChatGPT for English language editing only; all scientific content is the authors’ own\.

#### 3\.4\.2\\discintname

The authors declare no competing interests\.

## Appendix 0\.AAuthor Contributions

Cindy Delage: Conceptualization, Methodology, Investigation, Formal analysis, Data curation, Visualization, Writing – original draft\. Stéphane Canu: Writing – review & editing, Validation, Supervision\. Marc Décombas: Writing – review & editing, Validation\. Jonathan Foureur: Writing – review & editing, Validation\.

## Appendix 0\.BLegal Articles Used by Penal Theme

All legal references are drawn from the French Penal Code \(Code pénal, France\)\.

- •Fraud: Articles 313\-1, 226\-4\-1, 441\-1, 223\-1, 322\-14, 323\-1\.
- •Confidential Information Disclosure: Article 226\-13\.
- •Discrimination: Article 225\-1\.
- •Violence: Articles 222\-7, 222\-9, 222\-14\-2, 222\-14\-4, 222\-16\.
- •Fraudulent Abuse of a Vulnerable Person: Article 223\-15\-2\.

## References

- \[1\]G\. Abiri\(2025\)Public constitutional ai\.Georgia Law Review59\(2\),pp\.\.External Links:[Link](https://digitalcommons.law.uga.edu/glr/vol59/iss2/5),[Document](https://dx.doi.org/10.48550/arXiv.2406.16696)Cited by:[§1\.1](https://arxiv.org/html/2608.28593#S1.SS1.p4.1)\.
- \[2\]Anthropic\(2025\)System card:claude sonnet 4\.5\.Claude Sonnet System CardAnthropic\.Cited by:[§1](https://arxiv.org/html/2608.28593#S1.p1.1),[§2\.1](https://arxiv.org/html/2608.28593#S2.SS1.p1.1),[§2\.1](https://arxiv.org/html/2608.28593#S2.SS1.p2.1)\.
- \[3\]A\. Askellet al\.\(2021\)A general language assistant as a laboratory for alignment\.External Links:2112\.00861,[Link](https://arxiv.org/abs/2112.00861),[Document](https://dx.doi.org/10.48550/arXiv.2112.00861)Cited by:[§1](https://arxiv.org/html/2608.28593#S1.p1.1)\.
- \[4\]S\. Baiet al\.\(2025\)Qwen3\-vl technical report\.External Links:2511\.21631,[Link](https://arxiv.org/abs/2511.21631)Cited by:[§2\.1](https://arxiv.org/html/2608.28593#S2.SS1.p2.1)\.
- \[5\]Y\. Baiet al\.\(2022\)Constitutional ai: harmlessness from ai feedback\.External Links:2212\.08073,[Link](https://arxiv.org/abs/2212.08073),[Document](https://dx.doi.org/10.48550/arXiv.2212.08073)Cited by:[§1](https://arxiv.org/html/2608.28593#S1.p2.1),[§2\.2\.2](https://arxiv.org/html/2608.28593#S2.SS2.SSS2.p3.1),[§3\.3](https://arxiv.org/html/2608.28593#S3.SS3.p2.1)\.
- \[6\]Y\. Baiet al\.\(2022\)Training a helpful and harmless assistant with reinforcement learning from human feedback\.External Links:2204\.05862,[Link](https://arxiv.org/abs/2204.05862),[Document](https://dx.doi.org/10.48550/arXiv.2204.05862)Cited by:[§2](https://arxiv.org/html/2608.28593#S2.p3.1)\.
- \[7\]X\. Chenet al\.\(2024\-06\)IterAlign: iterative constitutional alignment of large language models\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),K\. Duh, H\. Gomez, and S\. Bethard \(Eds\.\),Mexico City, Mexico,pp\. 1423–1433\.External Links:[Link](https://aclanthology.org/2024.naacl-long.78/),[Document](https://dx.doi.org/10.18653/v1/2024.naacl-long.78)Cited by:[§1\.1](https://arxiv.org/html/2608.28593#S1.SS1.p1.1)\.
- \[8\]P\. Christianoet al\.\(2017\)Deep reinforcement learning from human preferences\.InProceedings of the 31st International Conference on Neural Information Processing Systems,NIPS’17,Red Hook, NY, USA,pp\. 4302–4310\.External Links:ISBN 9781510860964,[Document](https://dx.doi.org/10.48550/arXiv.1706.03741)Cited by:[§1](https://arxiv.org/html/2608.28593#S1.p2.1)\.
- \[9\]W\. G\. Cochran\(1977\)Sampling techniques third edition\.3rd edition,JOHN WILEY & SONS,New York\.Cited by:[§3\.2](https://arxiv.org/html/2608.28593#S3.SS2.p2.1)\.
- \[10\]J\. Cohen\(1988\)Statistical power analysis for the behavioral sciences\.2nd edition,Routledge,New York\.External Links:[Document](https://dx.doi.org/10.4324/9780203771587)Cited by:[§3\.3](https://arxiv.org/html/2608.28593#S3.SS3.p11.18)\.
- \[11\]G\. Comaniciet al\.\(2025\)Gemini 2\.5: pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities\.External Links:2507\.06261,[Link](https://arxiv.org/abs/2507.06261),[Document](https://dx.doi.org/10.48550/arXiv.2507.06261)Cited by:[§1](https://arxiv.org/html/2608.28593#S1.p1.1),[§2\.1](https://arxiv.org/html/2608.28593#S2.SS1.p1.1),[§2\.1](https://arxiv.org/html/2608.28593#S2.SS1.p2.1),[§2\.1](https://arxiv.org/html/2608.28593#S2.SS1.p3.1)\.
- \[12\]K\. J\. K\. Fenget al\.\(2023\)Case repositories: towards case\-based reasoning for ai alignment\.External Links:2311\.10934,[Link](https://arxiv.org/abs/2311.10934),[Document](https://dx.doi.org/10.48550/arXiv.2311.10934)Cited by:[§1\.1](https://arxiv.org/html/2608.28593#S1.SS1.p3.1)\.
- \[13\]A\. Findeiset al\.\(2025\)Inverse constitutional ai: compressing preferences into principles\.External Links:2406\.06560,[Link](https://arxiv.org/abs/2406.06560),[Document](https://dx.doi.org/10.48550/arXiv.2406.06560)Cited by:[§1\.1](https://arxiv.org/html/2608.28593#S1.SS1.p1.1)\.
- \[14\]L\. Heet al\.\(2025\)Statutory construction and interpretation for artificial intelligence\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2509.01186),[Link](https://arxiv.org/abs/2509.01186)Cited by:[§1\.1](https://arxiv.org/html/2608.28593#S1.SS1.p2.1)\.
- \[15\]S\. Huanget al\.\(2024\-06\)Collective constitutional ai: aligning a language model with public input\.InThe 2024 ACM Conference on Fairness, Accountability, and Transparency,FAccT ’24,Rio de Janeiro,pp\. 1395–1417\.External Links:[Document](https://dx.doi.org/10.1145/3630106.3658979),[Link](http://dx.doi.org/10.1145/3630106.3658979)Cited by:[§1\.1](https://arxiv.org/html/2608.28593#S1.SS1.p1.1),[§1](https://arxiv.org/html/2608.28593#S1.p2.1)\.
- \[16\]J\. Jiet al\.\(2025\)AI alignment: a comprehensive survey\.External Links:2310\.19852,[Link](https://arxiv.org/abs/2310.19852),[Document](https://dx.doi.org/10.48550/arXiv.2310.19852)Cited by:[§1](https://arxiv.org/html/2608.28593#S1.p1.1)\.
- \[17\]L\. Jianget al\.\(2025\)WILDTEAMING at scale: from in\-the\-wild jailbreaks to \(adversarially\) safer language models\.InProceedings of the 38th International Conference on Neural Information Processing Systems,NIPS ’24,Red Hook, NY, USA\.External Links:ISBN 9798331314385,[Document](https://dx.doi.org/10.48550/arXiv.2406.18510)Cited by:[§2\.1](https://arxiv.org/html/2608.28593#S2.SS1.p3.1),[§2\.2\.1](https://arxiv.org/html/2608.28593#S2.SS2.SSS1.p5.1)\.
- \[18\]S\. Kunduet al\.\(2023\)Specific versus general principles for constitutional ai\.External Links:2310\.13798,[Link](https://arxiv.org/abs/2310.13798),[Document](https://dx.doi.org/10.48550/arXiv.2310.13798)Cited by:[§1](https://arxiv.org/html/2608.28593#S1.p3.1)\.
- \[19\]T\. Markovet al\.\(2023\)A holistic approach to undesired content detection in the real world\.InProceedings of the Thirty\-Seventh AAAI Conference on Artificial Intelligence \(AAAI\-23\),Vol\.37,Washington,pp\. 15009–15018\.External Links:[Document](https://dx.doi.org/10.1609/AAAI.V37I12.26752),[Link](https://ojs.aaai.org/index.php/AAAI/article/view/26752)Cited by:[§1\.1](https://arxiv.org/html/2608.28593#S1.SS1.p1.1)\.
- \[20\]Q\. McNemar\(1947\-06\)Note on the sampling error of the difference between correlated proportions or percentages\.Psychometrika12\(2\),pp\. 153–157\.External Links:[Document](https://dx.doi.org/10.1007/BF02295996),[Link](https://doi.org/10.1007/BF02295996)Cited by:[§3\.3](https://arxiv.org/html/2608.28593#S3.SS3.p11.18)\.
- \[21\]L\. Meinckeet al\.\(2025\-07\)Call me a jerk: persuading ai to comply with objectionable requests\.SSRN Electronic JournalOnline publication,pp\. 35 pages\.Note:Available at SSRNExternal Links:Link,[Document](https://dx.doi.org/10.2139/ssrn.5357179)Cited by:[§1](https://arxiv.org/html/2608.28593#S1.p1.1)\.
- \[22\]J\. J\. Nay\(2023\)Law informs code: a legal informatics approach to aligning artificial intelligence with humans\.Northwestern Journal of Technology and Intellectual Property20\(3\),pp\. 309–392\.External Links:[Document](https://dx.doi.org/10.2139/ssrn.4218031)Cited by:[§1\.1](https://arxiv.org/html/2608.28593#S1.SS1.p2.1)\.
- \[23\]C\. O’Keefeet al\.\(2025\)Law\-following ai: designing ai agents to obey human laws\.Note:SSRNExternal Links:[Link](https://papers.ssrn.com/abstract=5242643)Cited by:[§1\.1](https://arxiv.org/html/2608.28593#S1.SS1.p2.1)\.
- \[24\]Ollama\(2025\)Mistral 7b model card\.Note:[https://ollama\.com/library/mistral:7b](https://ollama.com/library/mistral:7b)Cited by:[§3\.1](https://arxiv.org/html/2608.28593#S3.SS1.p1.1)\.
- \[25\]OpenAI\(2025\)GPT\-5 system card\.GPT\-5 System CardOpenAI\.Cited by:[§1](https://arxiv.org/html/2608.28593#S1.p1.1),[§2\.1](https://arxiv.org/html/2608.28593#S2.SS1.p1.1),[§2\.1](https://arxiv.org/html/2608.28593#S2.SS1.p2.1)\.
- \[26\]Oxford Languages\(n\.d\.\)Definition of "law"\.Note:Google DictionaryRetrieved from[https://languages\.oup\.com/google\-dictionary\-en/](https://languages.oup.com/google-dictionary-en/)Cited by:[§1](https://arxiv.org/html/2608.28593#S1.p4.1)\.
- \[27\]X\. Panget al\.\(2024\)Self\-alignment of large language models via monopolylogue\-based social scene simulation\.PMLR\.External Links:2402\.05699,[Document](https://dx.doi.org/10.48550/arXiv.2402.05699)Cited by:[§1\.1](https://arxiv.org/html/2608.28593#S1.SS1.p3.1)\.
- \[28\]E\. Perezet al\.\(2022\-12\)Red teaming language models with language models\.InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing,Y\. Goldberg, Z\. Kozareva, and Y\. Zhang \(Eds\.\),Abu Dhabi, United Arab Emirates,pp\. 3419–3448\.External Links:[Link](https://aclanthology.org/2022.emnlp-main.225/),[Document](https://dx.doi.org/10.18653/v1/2022.emnlp-main.225)Cited by:[§2\.1](https://arxiv.org/html/2608.28593#S2.SS1.p3.1),[§2\.2\.1](https://arxiv.org/html/2608.28593#S2.SS2.SSS1.p5.1)\.
- \[29\]S\. Tedeschiet al\.\(2024\)ALERT: a comprehensive benchmark for assessing large language models’ safety through red teaming\.External Links:2404\.08676,[Link](https://arxiv.org/abs/2404.08676),[Document](https://dx.doi.org/10.48550/arXiv.2404.08676)Cited by:[§2\.1](https://arxiv.org/html/2608.28593#S2.SS1.p3.1),[§2\.2\.1](https://arxiv.org/html/2608.28593#S2.SS2.SSS1.p5.1)\.
- \[30\]R\. Wassersteinet al\.\(2019\-03\)Moving to a world beyond “p < 0\.05”\.American Statistician73,pp\. 1–19\.External Links:[Document](https://dx.doi.org/10.1080/00031305.2019.1583913)Cited by:[§3\.3](https://arxiv.org/html/2608.28593#S3.SS3.p12.1)\.
- \[31\]J\. Weiet al\.\(2022\)Chain\-of\-thought prompting elicits reasoning in large language models\.InProceedings of the 36th International Conference on Neural Information Processing Systems,NIPS ’22,Red Hook, NY, USA\.External Links:ISBN 9781713871088,[Document](https://dx.doi.org/10.48550/arXiv.2201.11903)Cited by:[§2](https://arxiv.org/html/2608.28593#S2.p3.1)\.