CUBE

A saleable regulatory content library would survive without the models, staffed by specialists. The company employs roughly 250 in house regulatory subject matter experts who curate and validate output, and it acquired an established human curated regulatory content business in 2024. Machine learning and natural language processing still carry capture, classification, ontological mapping and translation across 750 jurisdictions and 80 languages, a footprint no human team could maintain. The RegAI framework is described as trained exclusively on regulatory data. Some newer regulatory intelligence vendors would have nothing sellable left without their models.

The human step is structural and published, not a claim of safety. Roughly 250 in house regulatory subject matter experts review and curate machine output before it reaches customers. The company calls this human in the loop assurance and positions it as a deliberate differentiator against pure automation. None of the mechanics are stated. There is no sampling rate or review threshold, no rule for which machine outputs reach a specialist and which pass through, and no escalation path. The recently added agentic capability inside the API widens the surface further, since a customer can apply the stack to its own content with no oversight model described for that path.

The central claim is measurable and unmeasured. Filtering out irrelevant updates, false positives and missed obligations is a classification claim. It can be tested against a known document set and reported as precision and recall. The platform also advertises regulatory change prediction, which is directly checkable against what regulators subsequently published. No accuracy figure or benchmark is published for any of it, and there is no error rate or validation method.

A product making predictive or classification claims to regulated buyers carries an obligation to publish a hit rate. The asymmetry is the sharp part: a false positive costs an analyst minutes, while a missed obligation surfaces as a supervisory finding at the customer.

Scale is clear and measured outcomes are not. CUBE reports around 1,000 customers across banking, insurance, asset and investment management and payments, including an 800 strong mid market community. It has roughly 700 employees across 20 countries and majority backing from a specialist software investor since 2024.

Five global banks are named publicly as supporters of a compliance and risk collaboration initiative the company leads: Barclays, BNP Paribas, Citi, JPMorganChase and Lloyds Banking Group. They appear as backers of an initiative, not as customers reporting a measured result. The strongest quantified outcome is a tier one bank restandardizing more than 20,000 controls in one week against an estimated 7,500 days of manual effort.

That story is published by a cloud partner with the bank unnamed, and it attaches to the acquired Acin tool rather than to the regulatory intelligence platform. An earlier account of a United States bank reporting a 50 percent efficiency gain is also unnamed.

Customers are direct competitors, and nothing published says whether content one of them submits informs anything served to another. The platform holds their internal control frameworks and policy libraries. The acquired Acin network is explicitly a cross institution benchmarking mechanism where peer comparison is the product, so the question is live rather than theoretical. Acin publishes an anonymization claim for its own network. Nothing equivalent covers content processed through the regulatory intelligence platform or the customer facing API.

Nothing is published on privacy posture, retention, or how customer content is handled and segregated. That matters because of what the product ingests. Mapping regulatory change to a customer's own policies, controls and teams requires holding that institution's internal control framework. The RegBrain interface also invites customers to run the vendor's stack over their own content. That is confidential institutional material rather than consumer financial data, so consumer privacy regimes bite less directly than they would for a retail facing vendor.

The absence is conspicuous at this scale. Tier one banks and roughly 1,000 regulated customers put this platform inside their compliance operations, yet no certification, audit report, trust center or report request route appears on the company site, the product pages or third party sources. Product and use case pages can carry compliance claims that security pages do not, so a claim may exist that is not reflected here. A competitor in the same category has published an independently audited ISO 42001 certification, which shows the disclosure is achievable in this market.

CUBE sells into supervised firms without being supervised itself, the ordinary position for a technology supplier in this market. There is no published license or registration, and no supervisory program or sandbox participation. At least one competitor has run a live test of its AI product under financial regulator oversight, and a vendor whose output feeds regulated firms' compliance records has an obvious route to the same evidence. The industry collaboration initiative the company leads is convened with banks, not with a supervisor.

The exposure is coverage tilt, not protected class discrimination. The platform markets its ability to filter out irrelevant updates so a compliance team sees only what matters. An obligation the filter suppresses is therefore invisible by construction to the team responsible for it. Coverage across 750 jurisdictions and 80 languages will not be uniform in quality.

The thinnest treatment will fall on smaller jurisdictions and less represented languages, where a firm is least able to check the machine independently. No precision or recall figures by jurisdiction or language are published. Six stated core principles underpin the proprietary AI, with a commitment to transparent and ethical technology, and that is assertion rather than testing.

Responsibility for identifying and meeting a regulatory obligation stays with the regulated firm, a structure common across compliance intelligence vendors. When a change is missed or misclassified, the supervisory finding, the remediation cost and the reputational damage land entirely on the customer, even though the vendor's output was the input the customer relied on. The firm cannot transfer the duty and, on what is public, cannot recover against the tool either. No accuracy warranty, service commitment or remedy is published.

The upstream provider is named, not left as a generic claim. The company publicly announced a partnership with a major cloud and model provider in September 2025, and its agentic control rewrite capability is documented as built on that provider's hosted models. Its own regulatory AI framework is described as proprietary and trained exclusively on regulatory data.

Naming the provider matters because a customer inheriting classifications of its own obligations is inheriting another firm's model behavior. The boundary is never drawn. Nothing states which functions run on the third party foundation models and which run on the proprietary framework, or which of those a customer's own submitted content passes through.

Integration is into the right system of record for this buyer. The platform maps external regulatory change onto internal policies and control frameworks and pushes into governance, risk and compliance systems. Third party market analysis lists the company among the regulatory content partners of a major enterprise GRC platform.

The stronger feature is that the AI engine is exposed through APIs, so a customer can run the same summarization, classification and enrichment over its own content. That makes the vendor's stack addressable by the buyer's systems rather than only through the vendor's screen. Only one named platform partnership is public, and it appears in third party material rather than the company's own integration documentation.

Cloud software as a service is the evident model and the hyperscaler is publicly identified through an announced partnership, which is more than many disclose. What is missing is everything a bank's third party risk function asks next: no region selection, no residency commitment, no tenancy model, no statement on where customer control frameworks are stored or processed.

For a vendor whose customer base spans Europe, North America, Asia and Australia and whose European customers sit under an operational resilience regime with explicit location requirements, the absence is material.

The mid market product has no published pricing shape, and its buyers, regional and community banks, are the segment least able to absorb a procurement cycle to discover a price. No product page publishes a rate card, a unit of consumption or a billing basis. Every route to a number runs through a demo request. Third party analysis of the regulatory change management market places bank tier contracts in the low six figures at the entry end, scaling substantially for multinationals. That is an outside estimate, not vendor disclosure.

Breadth is real on two dimensions, buyer type and geography. Buyer types run from tier one global institutions through regional and community banks and wealth managers. Asset and investment managers, insurers and payments firms are covered too. Operations span Europe, North America, Canada, Asia and Australia, and regulatory coverage is stated at 750 jurisdictions and 80 languages.

The company also reports expansion into adjacent regulated sectors including insurance, healthcare and energy. A separate named product line serves each end of the range, from a global systemically important bank to a community bank.