Moody's Analytics

Ratings data, research and quantitative risk models long predate the AI line, which is real and broad: Research Assistant since December 2023, five agentic workflow solutions from late 2025 and an acquired origination system. The data, analytics and workflow business would run fully without those models.

Customers keep decision making responsibility at all times under the AI principles, and the agents assemble a credit memo, monitoring signal or screening result for a person to act on. Core Terms also bar customers from making wholly automated decisions with the products without legal authorization.

Outputs are called auditable, decision grade and explainable, with no accuracy rate, validation approach or drift policy published for the generative or agentic products. Such a gap stands out at a firm that sells model risk governance as a solution line.

Credit memo preparation cut from roughly 40 hours to about two minutes, and Research Assistant users reading 60 percent more research in 30 percent less task time, are the published figures. Neither is attached to a named institution.

De identified customer data may be kept perpetually to improve and commercialize products under the federal Core Terms, but never shared with unrelated third parties in a way that identifies the customer. That boundary still lets de identified data improve models served to other customers.

Privacy practices are certified under the Global Privacy Recognition for Processors system, checkable in a public directory, with product level privacy notices and a data processing schedule in the standard contract. Customers can obtain product specific transfer impact assessments.

Anyone can view the linked ISO 27001:2022 certificate for Moody's Analytics, and customers download product SOC 2 reports from the portal. Vulnerability assessments, penetration testing and red teaming sit in the program, with a security standards schedule in the published contract.

Supervision of the registered credit rating agency in the corporate parent does not attach to analytics software, and the firm draws that division line on its own pages. For the analytics division itself, no regulatory position is stated.

An AI Governance Committee under the Enterprise Risk Committee oversees the AI principles, which name bias as a risk to mitigate. Fairness testing, disparate impact analysis and adverse action guidance are unpublished for a credit assessment agent whose memo shapes lending and for the origination system.

Outcomes fall to the customer under the February 2026 federal Core Terms: accuracy warranties are disclaimed, liability is capped at twelve months of fees, and the customer indemnifies the firm for decisions based on output. GRID risk summaries come with an instruction to verify them independently.

Anthropic, OpenAI and Microsoft are among six AI partners named on the AI product page, and Research Assistant is built on Microsoft Azure OpenAI. Which model answers in each agent workflow is not mapped.

The November 2024 Numerated acquisition made the lending workflow a system of record at banking customers, not a feed into someone else's. Entity reference and screening content also sits inside customer onboarding and regulatory reporting systems.

A trust center page on hosting locations and approved subprocessors links a descriptions of processing data document with the regions by product. On premises and private deployment are not stated for the agentic products.

Standard Core Terms, rated by TermScout, are public with their data processing and security schedules, but no price, unit of charge or tier is published for any product. Fees are set per order, so the terms can be read in advance while the cost cannot.

Banking, insurance and the public sector are among separate segments with their own material, over a knowledge base of more than 600 million entities. Solution lines run from lending and investment research to regulatory reporting and balance sheet management.