How a Credit Bureau Got an AI App Build-Ready in 12 Weeks

A global credit reporting company sells a background lookup product to real estate agents, who use it mainly to decide whether it's safe to meet a stranger at an empty property. The company wanted to rebuild it as an AI-first mobile app without creating new regulatory risk. Background data falls under the FCRA and GLBA, and an assistant that could be talked into a personal lookup or a stalking pattern was a non-starter, with up to $4M a year in revenue exposed to misuse. Agents also complained that reports buried real risk under duplicate minor infractions, and the client's IT team was capable but stretched.

Boxcar ai ran three workstreams in parallel. Voice-of-customer research with residential agents, a commercial broker, a team lead and association buyers produced a prioritized opportunity map led by an AI safety screen. Technical discovery with the client's IT team prototyped on iOS and Android, recommended a cloud LLM for launch plus IBM Granite 4 on-device for privacy-sensitive and offline use, and confirmed that iOS blocks incoming-call screening without a private Apple entitlement. The third workstream specified Compliance Buddy, a governed assistant in which the LLM classifies intent and emits structured commands that the app enforces: workflow separation between Safety Search and Prospecting, logged permissible-purpose certification, a 0.85 confidence threshold, anti-abuse detection, progressive escalation, and a hash-chained audit trail.

Discovery started in early October 2025 with three workstreams running in parallel so each could feed the others. Customer interviews with residential agents, a commercial broker, a team lead and real estate association buyers showed residential agents wanted a simple safe-or-not-safe answer, commercial users would trade speed for accuracy, and associations only renew tools members use. Technical discovery interviewed the client's IT team and prototyped on iOS and Android, which surfaced that iOS won't allow incoming-call screening without a private Apple entitlement. That finding led to draft partnership proposals for the platform owner and carriers. The AI requirements were written in a fixed testable format (trigger, classification, system response, user-facing copy, evidence record, test types) so engineers and auditors could work from one spec. By late December the client had a validated direction, 27 requirements, and two delivery paths: an 8-week MVP in four two-week sprints and a 12-week full build, both sized for five developers.

Enterprises in regulated industries such as financial services, data and identity, insurance and healthcare that want customer-facing AI with an audit trail, especially where IT capacity is limited and leadership wants a build-ready plan before committing engineering budget.