Corlytics

Models carry real product weight, but a large business would survive without them. Machine learning classification, an LLM that summarizes regulatory text and extracts obligations, entities and dates, and analytics that rank obligations by criticality all matter, and an independent analyst evaluation singles out the sophistication of the language model engine. Remove the models and a very large regulatory content operation remains, spanning 120 countries and 2,500 authorities.

It is staffed by legal and compliance analysts who can write summaries manually and a quality assurance team that checks completeness. An acquired policy management and attestation platform, a standalone product until 2023, would remain as well.

The oversight chain is described with named roles rather than asserted as human in the loop. A compliance analyst assesses a regulatory source, and a content specialist identifies what will be automatically searched, discovered and ingested. The work returns to a compliance analyst, and a quality assurance team checks that content is complete and accurate before it reaches clients.

Legal and compliance analysts can also replace language model summaries with summaries written manually, a named human override path on the most error prone output. Three things are missing. No sampling rate, threshold or escalation rule is published. The description comes from an analyst evaluation rather than the vendor's own documentation. And no oversight model is described for the obligation extraction that feeds directly into client control mappings.

The ISO 42001 certified AI management system is the main evidence, because that standard requires documented risk assessment, control selection, monitoring and continual improvement across the model lifecycle, independently audited. It is the same certification that supports governance, applied here to its lifecycle control half, not a second piece of evidence. Users can also apply scoring algorithms to judge the relevance of a categorization, a user facing confidence signal.

The transparency half is unmet. No precision, recall, extraction accuracy or benchmark figure is published for obligation extraction, classification or summarization, and those are directly measurable against a known body of regulatory text. The consequence of a miss lands on a supervised firm's own obligation inventory.

The strongest evidence comes from independent parties with money at stake, and there are two. A global bank divested its own regulatory monitoring platform, SparQ, to Corlytics in January 2023. A major professional services firm sold it their regulatory technology platform in November 2024, with that firm's risk advisory managing partner supporting the deal publicly. An organization handing over a product it built and could have kept competing with is a stronger signal than any logo.

Named clients include ING, BNY Mellon, Scotiabank, Swiss Re and SCOR, Barclays through the acquired policy platform, and the United States broker dealer regulator FINRA as a customer. Reported reach is 80 clients including 14 of the top 50 global banks. The company separately claims deployment at 40 percent of the world's 30 largest banks and processing of over 30 million pages of regulation annually. An independent analyst house rates it a category leader with scored capability dimensions. What is still missing is a quantified outcome: no client publishes one in figures.

Client data sits in tenanted databases, a structural segregation answer rather than a claim of care. The ISO 42001 certified AI management system also covers data governance across the model lifecycle. Nothing published states whether policy documents, control mappings or analyst assessments submitted by one institution can inform models, taxonomies or content served to another. The exposure is real and specific.

Clients are direct competitors, several are among the largest banks in the world, and their internal policy libraries are among the more sensitive documents a compliance function holds. The tenancy detail comes from an analyst evaluation rather than from the vendor's own material.

No privacy statement, retention policy or data handling commitment is published. The material at stake is institutional rather than consumer. The platform ingests a client's own policy documents and maps obligations onto its internal controls, so it holds the compliance posture of named banks and insurers rather than customer financial records. Consumer financial privacy law therefore bites less directly than it would for a retail facing vendor. The absence of any published handling statement is still the finding, and it stands out more for a vendor that also counts a regulator among its customers.

No information security certification, audit report, trust center or report request route is public. A firm that has completed an audited ISO 42001 certification very likely holds ISO 27001 as well, since the two standards share a structure and are commonly pursued together. That is an inference, not evidence. A buyer looking for the security posture of a platform holding its policy library and control mappings cannot find it publicly.

Corlytics is not itself licensed or supervised, which is the ordinary position for a software vendor, but its relationship with supervisors is direct and checkable. A national securities regulator is a named customer, and the company has worked with a conduct regulator on developing intelligent regulations and machine readable regulatory taxonomies. A supervisor choosing to run its own work on a vendor's platform is a meaningful signal about that platform's treatment of regulatory text. No financial regulator has examined the vendor's AI system itself for transparency, explainability or bias in a supervised test. Being bought by a regulator is not the same as being examined by one.

Corlytics is reported as the first dedicated regulatory technology firm certified to ISO/IEC 42001:2023 for its business wide AI management system. The certificate was awarded in May 2025 after an independent two stage audit by a named external assessor that found zero non conformities. The standard mandates bias mitigation, risk and resilience controls across the whole AI lifecycle and maps to the EU AI Act. The assurance comes from an independent third party rather than self attestation.

One reservation: a management system certification attests that governance processes exist and are audited, not that outputs are unbiased. No error analysis by jurisdiction, language or regulator is published, so the bias half remains undemonstrated. The source is the certification announcement and its trade press coverage rather than the certificate itself.

No accuracy warranty, service commitment or remedy is published. The consequence structure is common to compliance intelligence vendors, and this platform sits close to the regulatory evidence itself. It is explicitly sold on the ability to show a supervisor how a regulatory change was assessed, implemented and communicated, so its output becomes the firm's evidence of compliance.

If an obligation is missed or misclassified, the supervisory finding, the remediation and any penalty land on the regulated firm, whose defense rests on a record the vendor generated. The duty is not transferable, and on what is published, nothing is recoverable from the tool either.

The engine is referred to only as the company's own LLM and an LLM based analytical model. No model provider, base architecture, hosting arrangement or version policy is named anywhere, and nothing states whether client policy documents pass through a third party model during summarization or obligation extraction. The audited AI governance certification does not fill this gap: a certified management system governs how models are managed, not whose models they are.

Integration targets the right systems for this buyer. Industry standard REST based APIs support flows across risk, compliance and operational domains, and the platform integrates with governance, risk and compliance workflows. Third party market analysis lists the company among the regulatory content partners of a major enterprise governance, risk and compliance platform.

It ingests client policy documents directly, the deeper form of integration for this category, because it reaches the artifacts a compliance function actually maintains. A no code workflow configuration tool lets clients route regulatory events through their own process without engineering. The only named platform partnership appears in third party material, and the vendor publishes no integration catalog, connector list or documentation set.

Tenancy is disclosed and residency is not. The platform is a no code architecture running as a public cloud service, with tenanted databases holding client data. Nothing states which cloud, which regions are available, or whether a client can require processing and storage in a named jurisdiction. Nor is there anything on how residency is handled for a client base spread across the Americas, Europe, the Middle East and Asia Pacific. That gap matters for a vendor selling into European financial entities subject to DORA, with its explicit location and subcontracting requirements.

No rate card, unit of consumption or billing basis is published. Third party market analysis states plainly that pricing is not published, and places bank tier contracts in the low six figures at the entry end, scaling substantially for multinationals. That is an outside estimate, not vendor disclosure. The pattern across this category is consistent: established regulatory intelligence platforms do not publish prices, so comparing cost between them means entering a sales process with each.

Coverage is broad on every dimension. Regulatory content spans more than 120 countries and over 2,500 regulatory authorities. It is strong across North America, South America, Europe, the Middle East and Asia Pacific, with growing African coverage, and includes global standard setting bodies alongside central banks, financial and insurance regulators and market regulators.

Buyers include banks, insurers and asset managers, along with wealth managers, payment service providers, hedge funds and fintechs. Additional content lines cover technology sector regulation: payments, privacy, cybersecurity and content moderation. The same platform is also sold to regulators themselves, so it serves supervised firms and their supervisors alike, and that breadth is externally corroborated.