Bina.ai

Turning CNIL data-breach sanctions into funding briefs for collective actions, with every quote checked word for word against the decision.

Event: Mistral LLM × Law Hackathon
Where: Paris, October 2026
Result: First place, team of five
Stack: TypeScript, Express, Mistral API

Bina.ai landing page: from a CNIL sanction to a funded action de groupe, with a live funding brief for the Free Mobile data breach. — The landing page, with a live brief for the Free Mobile decision: 396 CNIL sanctions scanned, 277 funders on the list.

What it does

Hosted by Mistral AI, sponsored by Stanford Law School, Legora, Hector AI, Jus Mundi and Sciences Po.

Sheharyar Ishfaq built the backend of Bina.ai, which won first place at the Mistral LLM × Law Hackathon in Paris in October 2026 with a team of five. Since the French law of 30 April 2025, an association can bring a collective action on behalf of people hurt by a data breach. When the CNIL sanctions a company, its decision already establishes the fault, the facts and who was affected. Bina finds those decisions, turns each one into a funding brief an association can send, and matches it with litigation funders.

The hard part is trust. A funder can't act on a brief that misquotes the ruling, so every quote in it is checked by code against the decision before anyone reads it.

Bina's association desk listing CNIL and European Commission decisions, triaged for collective-action potential, with fines and priority labels. — The association desk: every sanction the CNIL publishes, scanned every six hours and triaged without a model call.

How it works

Radar

Scrapes the CNIL sanctions list every six hours and triages it with rules: 396 decisions scanned, 36 worth a closer look.

Reading the decision

Reads the PDF's text layer first, exact and free, and falls back to Mistral OCR only for scans. Long decisions get embeddings and retrieval; the 153-page EU decision was taking about 40 seconds to read whole.

The brief

Mistral Medium extracts the facts at temperature 0, each with its quote. Damages, opt-in rates and the five scores are computed in code from the legal team's tables.

Funders and chat

Funders are matched criterion by criterion in code, and an agent answers questions about the decision with checked quotes and a visible trace of what it did.

The quote check

The model proposes quotes; code decides whether they stand. Each quote is normalised (apostrophes, dashes, hyphenation, spacing) and must appear on the cited page or a neighbouring one. If it doesn't, the checker tries to repair it from the decision's own words, but only when negations and numbers are identical, so a fix can never flip the meaning. Quotes that still fail are dropped from the pitch and marked as not found in the brief and the chat.

Draft brief

The regulator found that “the company did not implement measures appropriate to the risk” and noted that “customers were never informed of the breach”.

Press the button to check both quotes.

Source ruling, page 14

… the restricted committee considers that the company did not implement measures appropriate to the risk, within the meaning of Article 32 of the GDPR. The customers concerned were informed by email on …

The quote check, on example text.

On the Free Mobile decision, 16 of 16 quotes in the brief were verified, four of them after repair; on the 153-page EU decision, 14 of 14.

My part

I built the backend: the Express and TypeScript API, the Mistral pipeline, the quote checker, the radar and the funder matching, about 160 commits over the hackathon weekend and the week after. One teammate built the first version of the interface, which I then wired to the API, and three law students owned the legal method: the rules in the prompts, the damage tables and the funder list.

A Bina case page for the Free Mobile decision, showing the funding brief with scores for claim value, victims, defendant, harm and timeline, next to the association's details form. — A case page: the funding brief, with facts from the decision locked and the association's details still to fill in.

Hard calls

Code checks every quote; the model only proposes

Anything a funder relies on has to be traceable, so verification is deterministic code, not a second model call. Page and paragraph numbers are located by code as well, never taken from the model.

The model never does arithmetic

Claim values, opt-in rates, the funder's share and the scores come from the legal team's tables in code. The model extracts facts; the numbers are computed, so the same decision always gives the same brief.

No probability of winning

A CNIL sanction proves a regulatory breach, not liability to each victim. Bina never states a chance of success: it is forbidden in the prompts and filtered out of the answers in code.

See the code