Corlytics

Machine learning classification, a large language model that summarises regulatory text and extracts obligations, entities and dates, and analytics that rank obligations by criticality all carry real product weight, and an independent analyst evaluation singles out the sophistication of the language model engine. It lands at B rather than A on the removal test.

Strip the models and a very large regulatory content operation remains, spanning 120 countries and 2,500 authorities, staffed by legal and compliance analysts who can write summaries manually and a quality assurance team that checks completeness, plus an acquired policy management and attestation platform that was a standalone product until 2023. Peer anchored before grading: Ascent, Norm Ai, Hadrius and Acin all sit at A because nothing sellable survives removing their models. This is the second vendor in the same cohort to sit at B for the same structural reason, alongside CUBE.

The oversight chain is described with named roles rather than asserted as human in the loop, which is more than most of this cohort offers. A compliance analyst assesses a regulatory source, a content specialist identifies what will be automatically searched, discovered and ingested, the work returns to a compliance analyst, and a quality assurance team checks that content is complete and accurate before it reaches clients.

Language model summaries can also be replaced by summaries written manually by legal and compliance analysts, which is a named human override path on the most error prone output. Not an A because no sampling rate, threshold or escalation rule is published, the description comes from an analyst evaluation rather than the vendor's own documentation, and no oversight model is described for the obligation extraction that feeds directly into client control mappings.

The certified artificial intelligence management system carries this grade, because that standard requires documented risk assessment, control selection, monitoring and continual improvement across the model lifecycle, independently audited. Recorded plainly so it is not read as two independent pieces of evidence: this is the same certification credited on the governance axis, applied here to the lifecycle control half of it.

Users can also apply scoring algorithms to judge the relevance of a categorisation, which is a rare user facing confidence signal. Held at B and not higher because the transparency half is unmet: no precision, recall, extraction accuracy or benchmark figure is published for obligation extraction, classification or summarisation, and those are directly measurable against a known corpus of regulatory text. The consequence of a miss lands on a supervised firm's own obligation inventory.

Earned on the independent party with money at stake test rather than on testimonials, and it is met twice. A global bank divested its own regulatory monitoring platform, SparQ, to this vendor in January 2023, and a major professional services firm sold it their regulatory technology platform in November 2024, with that firm's risk advisory managing partner supporting the deal publicly.

An organisation handing over a product it built and could have kept competing with is a stronger signal than any logo. Named clients include ING, BNY Mellon, Scotiabank, Swiss Re, SCOR, Barclays through the acquired policy platform, and the United States broker dealer regulator FINRA as a customer.

Reported reach is 80 clients including 14 of the top 50 global banks, with the company separately claiming deployment at 40 percent of the world's 30 largest banks and processing of over 30 million pages of regulation annually. An independent analyst house rates it a category leader with scored capability dimensions. What is still missing, and it keeps the grade honest: no client publishes a quantified outcome in figures.

Earned on a specific architectural fact rather than a claim of care: client data is held in tenanted databases, which is a structural segregation answer to the question that most vendors in this index leave open, and the certified artificial intelligence management system covers data governance across the model lifecycle.

Held at B because nothing published states whether policy documents, control mappings or analyst assessments submitted by one institution can inform models, taxonomies or content served to another. The exposure is real and specific here: clients are direct competitors, several are among the largest banks in the world, and their internal policy libraries are among the more sensitive documents a compliance function holds. The tenancy detail was sourced from an analyst evaluation rather than from the vendor's own material.

No privacy statement, retention policy or data handling commitment was located in this pass. The material at stake is institutional rather than consumer: the platform ingests a client's own policy documents and maps obligations onto its internal controls, so it holds the compliance posture of named banks and insurers rather than customer financial records.

Consumer financial privacy law therefore bites less directly than it would for a retail facing vendor, but the absence of any published handling statement is still the finding, and it is more conspicuous for a vendor that also counts a regulator among its customers.

No information security certification, audit report, trust centre or report request route was located in this pass. Recorded as an absence found rather than a proven absence, and it should be rechecked, because a firm that has completed an audited artificial intelligence management system certification very likely holds an information security management certification as well, since the two standards share a structure and are commonly pursued together.

That inference is not evidence and is not graded as such. The point stands that a buyer looking for the security posture of a platform holding its policy library and control mappings cannot find it on the public record.

Not itself licensed or supervised, which is the ordinary position here, but the relationship with supervisors is unusually direct and checkable. A national securities regulator is a named customer, and the company has worked with a conduct regulator on developing intelligent regulations and machine readable regulatory taxonomies. A supervisor choosing to run its own work on a vendor's platform is a meaningful signal about that platform's treatment of regulatory text.

Held at B rather than A on the bar set by CleverChain: no financial regulator has examined this vendor's AI system itself for transparency, explainability or bias in a supervised test. Being bought by a regulator is not the same as being examined by one.

Reported as the first dedicated regulatory technology firm certified to ISO/IEC 42001:2023 for its business wide artificial intelligence management system, awarded in May 2025 after an independent two stage audit by a named external assessor that found zero non conformities, with the standard mandating bias mitigation, risk and resilience controls across the whole AI lifecycle and mapping to the European AI Act.

This is the strongest governance instrument any vendor in this index has produced on this axis. The reasoning for the grade follows the index's own stated logic: BlueOnion was held at B expressly because its conformance document was self attested with no independent assurance, and CleverChain was held at B because its regulator supervised testing published no methodology or findings. Independent third party assurance is the thing both were missing and it is present here.

The reservation belongs in the record: a management system certification attests that governance processes exist and are audited, not that outputs are unbiased, and no error analysis by jurisdiction, language or regulator is published, so the bias half of this axis remains undemonstrated. Sourced from the certification announcement and its trade press coverage; the certificate itself was not inspected and should be confirmed on a later pass.

No accuracy warranty, service commitment or remedy was located. The consequence structure is the one common to every compliance intelligence vendor in this index and is worth restating because this vendor sits closer to the regulatory record than most: the platform is explicitly sold on the ability to show a supervisor how a regulatory change was assessed, implemented and communicated, so its output becomes the firm's evidence of compliance.

If an obligation is missed or misclassified, the supervisory finding, the remediation and any penalty land on the regulated firm, whose defence rests on a record the vendor generated. The duty is not transferable and, on the published record, nothing is recoverable from the tool either.

The engine is referred to only as the company's own large language model and an LLM based analytical model. No model provider, base architecture, hosting arrangement or version policy is named anywhere located, and nothing states whether client policy documents pass through a third party model during summarisation or obligation extraction.

The in category contrast is direct and worth keeping: CUBE names its cloud and model provider through an announced partnership and earns a B on this axis, while the vendor holding the stronger AI governance certification discloses less about what its AI is built on. A certified management system governs how models are managed; it does not tell a buyer whose models they are.

Integration targets the right systems for this buyer. Industry standard rest based application programming interfaces support flows across risk, compliance and operational domains, the platform integrates with governance, risk and compliance workflows, and third party market analysis lists the company among the regulatory content partners of a major enterprise governance, risk and compliance platform.

It ingests client policy documents directly, which is the deeper form of integration for this category because it reaches the artefacts a compliance function actually maintains, and a no code workflow configuration tool lets clients route regulatory events through their own process without engineering. Held at B because the only named platform partnership was found in third party material and no integration catalogue, connector list or documentation set was located from the vendor.

Half the axis is answered and half is silent. The tenancy model is disclosed, a no code architecture running as a public cloud service with tenanted databases holding client data, which is more specificity than most vendors here offer. Nothing states which cloud, which regions are available, whether a client can require processing and storage in a named jurisdiction, or how residency is handled for a client base spread across the Americas, Europe, the Middle East and Asia Pacific. That gap matters for a vendor selling into European financial entities subject to an operational resilience regime with explicit location and subcontracting requirements.

No rate card, unit of consumption or billing basis is published, and third party market analysis states plainly that pricing is not published, placing bank tier contracts in the low six figures at the entry end and scaling substantially for multinationals. That is an outside estimate and cannot be graded as vendor disclosure.

The pattern across this category is now consistent: every established regulatory intelligence platform screened so far sits at C on this axis, so a buyer cannot compare cost between them without entering a sales process with each.

Broad on every dimension the axis measures. Regulatory coverage spans more than 120 countries and over 2,500 regulatory authorities, strong across North America, South America, Europe, the Middle East and Asia Pacific with growing African coverage, and includes global standard setting bodies alongside central banks, financial and insurance regulators and market regulators.

Buyer types run across banking, insurance, asset management, wealth management, payment service providers, hedge funds, fintechs and regulators themselves, with additional content lines for technology sector regulation covering payments, privacy, cybersecurity and content moderation. Selling the same platform to supervised firms and to their supervisors is an unusual breadth claim and it is externally corroborated.