In modern corporate architectures, a large-scale transformation is underway: organizations are transitioning from legacy Enterprise Content Management (ECM) systems to intelligent information management. The leading industry association AIIM emphasizes that this transition requires the implementation of Intelligent Document Processing (IDP) systems, which automate data classification and extraction where manual labor was previously required. However, the implementation of IDP solutions creates a serious architectural challenge: data extraction by AI models is a probabilistic process that does not guarantee absolute accuracy without human oversight.
For technical leaders, enterprise architects, and CTOs, this means the emergence of new operational risks. The entry of unverified or partially incorrect data from AI models directly into accounting systems (ERP, CRM) threatens financial losses and regulatory non-compliance. To avoid this, IDP architecture must include a multi-level validation system that combines model confidence assessment, business logic verification, and hybrid human-in-the-loop control.
Probabilistic nature of AI: why classic OCR is no longer enough
Traditional Optical Character Recognition (OCR) systems operated on rigid templates. They were deterministic: the system either found text at a defined coordinate of the document or returned an error. Modern IDP systems process unstructured documents flexibly, but each extracted value is accompanied by a confidence score.
This means that any AI extraction result is a hypothesis that the system must verify. Mature IDP systems should not operate as a "black box." According to AIIM recommendations, they must include fallback rules for processing rare or non-standard document types so that the system automatically routes complex cases for review.
Legislative framework and risk management
When automating document workflows, architects must rely on clear legal frameworks. The Law of Ukraine "On Electronic Documents and Electronic Document Management" establishes that an electronic document must contain specific mandatory fields to maintain legal validity. The absence or incorrectness of such fields renders the document invalid.
To manage these risks, it is advisable to rely on international standards, in particular the NIST Cybersecurity Framework (CSF) 2.0. This framework structures control through six key functions: Govern, Identify, Protect, Detect, Respond, and Recover. In the context of document processing, this means the system must not only detect recognition errors (Detect) but also implement clear blocking scenarios (Respond), stopping transactions until the data is confirmed by an operator.
Safeguard architecture: three levels of data control
A reliable IDP platform must include three sequential validation circuits:
- Level one: Confidence score filtering. The system evaluates the mathematical confidence of the AI for each field. If the extraction score for critical financial or legal fields falls below a set threshold, the field is flagged for manual review.
- Level two: Logical cross-validation. Extracted data is compared against external sources of truth. An example is the automatic verification of extracted counterparty details against internal ERP system directories to confirm their relevance.
- Level three: Legal and cryptographic verification. Verification of signature authenticity (QES/KEP). The system integrates with official registries of the Central Certification Authority (CCA) to confirm the validity of the certificate and the integrity of the signed file.
Quality assessment and human-in-the-loop (HITL)
Since AI models cannot guarantee perfect accuracy, a hybrid control circuit (Human-in-the-loop, HITL) is a fundamental necessity. Documents with a low extraction confidence level must be instantly routed for human verification to avoid blocking the overall data flow.
It is also important to systematically measure the performance of AI components. For example, the ECM/DMS platform Nectain implements a built-in AI quality assessment process that compares machine extraction with reference data verified by humans. Such error rate analysis allows technical teams to adjust algorithms and fine-tune automation thresholds without increasing risks.
Building a reliable IDP based on the UnityBase platform
Implementing deep validation and integration with ERP or state registries requires a proper architectural foundation. Products of the Intecracy Group technological alliance—an alliance of independent companies linked by partner agreements and share exchanges—are built on the low-code platform UnityBase (a joint development of the alliance companies, where InBase acts as a key developer). UnityBase is a full-stack JavaScript platform designed for developing high-load enterprise applications.
Thanks to a unified domain metadata model and built-in access control (RBAC, RLS, ACL), architects can configure business validation rules directly at the database management system level and generate REST API for interaction with other corporate systems. Solutions such as the electronic document management system Megapolis.DocNet and Scriptum.DMS (with an integrated AI center for classification) function on the basis of UnityBase. These products provide a full management cycle—from AI recognition to QES verification and maintaining a complete audit log of operations.
Data validation strategy matrix in IDP based on process criticality
| Criterion | Low risk (e.g., internal requests, archives) | High risk (e.g., financial primary documents, contracts) |
|---|---|---|
| Extraction method | Automatic AI analysis with basic format rules | Hybrid (AI + mandatory cross-validation with ERP) |
| Confidence score threshold | Reduced threshold allowed (e.g., >значна частина) for auto-approval | High threshold (e.g., >значна частина), everything else to HITL |
| Legal verification | Not required or basic file integrity check | Mandatory QES/KEP validation via CCA integration |
| Fallback actions | Error logging and automatic return to author | Blocking in ERP, immediate routing for manual audit |
Implementing multi-level validation in IDP is the only way to scale intelligent document processing in critical processes. Balancing automation and human control, built on a reliable architectural foundation, ensures high efficiency without compromising compliance and data security.
FAQ
How to configure the confidence score for automatic document processing without human intervention?
The confidence score is configured based on the criticality of the document. For general or non-critical data, the automation threshold can be lower, but for financial and legal primary documents, it must be high (e.g., above 95%). Data that the system recognizes with a confidence level below the set threshold is automatically routed to an operator via the Human-in-the-loop (HITL) interface.
What requirements of the Law of Ukraine 'On Electronic Documents' define the mandatory fields for maintaining legal validity?
According to the Law of Ukraine 'On Electronic Documents and Electronic Document Management,' an electronic document is information recorded in the form of electronic data. For this document to have legal force and not be rejected solely due to its electronic form, it must contain the mandatory fields defined by legislation.
How to integrate an IDP system with QES/KEP registries for automatic signature verification on documents?
The IDP architecture involves integrating verification services with the official registries of the Central Certification Authority (CCA). The system automatically compares the cryptographic data of the signature (QES/KEP) with current certificate registries, verifying whether the signature is valid and whether the document's integrity has been compromised after signing.