Moody's Analytics

The Clearwater precedent in its largest instance, and consistent with the ruling already taken on the nearest peer in the data majors pocket. A business built over more than a century on ratings, data and quantitative risk models, with a genuine and broad shipped inference line layered over it: a conversational research product in market since December 2023, five distinct agentic workflow solutions launched in late 2025, and an acquired loan origination system.

Strip the models and an enormous data, analytics and workflow business remains fully operational, which is what puts this at C rather than higher. It is not the rejected shape either: the AI here is sold as named products rather than used internally, and it spans five workflows rather than sitting around the edges of one research tool.

The agents are scoped to analytical production rather than to executing transactions: they assemble a credit memo, a monitoring signal or a screening result and hand it to a person who makes the decision. Human oversight is stated explicitly for the private credit assessment workflow alongside privacy controls.

Held off A because auditability is asserted as a property rather than demonstrated, no approval gate is published, no confidence threshold for routing a case to a person is described, and nothing states what the agents are prevented from doing.

No accuracy rate, validation approach, benchmark, error rate or drift policy is published for any generative or agentic product. What is offered instead are adjectives: outputs described as auditable, decision grade, transparent and explainable, and analytical logic described as methodology aligned. Asserting explainability as a property is precisely what this axis declines to credit, as against a demonstrable trace from an output back to a record.

Sharpened considerably by context: this company sells a Model Risk and Governance solution as one of its ten named solution lines, so the capability it markets to others is the one it does not exercise publicly on its own newest models.

Quantified outcomes are published and they are striking: credit memo preparation reduced from roughly 40 hours to about two minutes, Research Assistant users consuming 60 percent more research while cutting task completion time by 30 percent, and more than 115 clients adopting the research product within weeks of launch. A named executive, the general manager heading digital content and innovation, is quoted on the record in independent trade press. That is the B bar met exactly.

Held off A because every figure is self reported and no named customer institution with a quantified outcome was located in this pass, which for a vendor of this size is a gap worth revisiting rather than a settled absence.

A dedicated published position on the approach to AI sits in the trust centre alongside customer guidance on the European Union AI Act, which is more than an assertion of responsibility in marketing copy and more than most of this index publishes. The approved sub processor list bears directly on where customer data travels once inference is involved.

Held off A because no statement was located on whether customer data is used to train or improve any model, no retention terms for the agentic products were found, and no tenancy or isolation position was published.

The strongest privacy disclosure this sweep has found. Privacy practices are certified under the Global Privacy Recognition for Processors system, the certification is verifiable by any reader in a public directory rather than asserted on the vendor's own page, and an independent accountability agent is named with a public complaints portal through which an individual can raise a privacy issue.

Product level privacy notices are published separately, and a data processing schedule forms part of the published standard contract. The rare combination here is an externally verifiable credential paired with an external complaint route, which is what separates this from the usual privacy policy and assertion.

A genuine trust centre hub rather than a marketing security page, with a dedicated information security and cybersecurity programme page, a third party risk management programme, and information security schedules published as part of the standard customer contract. Held off A because no specific certification was named at the level reached in this pass, so nothing is credited for one. This is the least verified of the disclosure grades on this record and the queued check is the information security programme page, which would move it in either direction.

Graded C deliberately and against the obvious temptation. The corporate parent contains one of the most heavily supervised entities in finance, a registered credit rating agency subject to methodology publication and disclosure obligations, but this record is scoped at division level to the data, analytics and decision solutions business, and that supervision does not read across to unregulated analytics software.

This is the second application in two sessions of the principle that a parent's supervision does not transfer to the product, following the same call on a global asset manager's technology arm, which makes it a settled rule rather than a one off. The company draws the same division boundary itself on every page.

The vendor publishes no fairness testing, disparate impact analysis, protected class monitoring or evaluation of model outputs for bias. The published European Union AI Act material is customer support about the regulation rather than disclosure of this vendor's own testing, and is credited under stewardship rather than here so the same page is not counted twice.

This is the fourth consecutive vendor in the sweep that sells governance or model risk capability and discloses nothing about its own models, after three specialist governance vendors did the same. It is the largest instance and the clearest: a company selling model risk governance as a product line, and a credit assessment agent whose output shapes lending decisions, with no published fairness position on either.

No liability position, indemnity or error remediation commitment for AI outputs was located in the material reviewed, and a global disclaimer states that all content is informational and does not constitute professional advice. Flagged as the highest value queued check on this record, and unusually so: because this vendor publishes its standard contract terms as a public document, its liability provisions covering AI outputs are actually readable by anyone, which is true of essentially nothing else in the index. Reading them could produce the first liability grade here evidenced from a commercial agreement rather than from a consumer protection statute.

Six technology partners are named on the AI product page itself, each with a dedicated page rather than an unattributed logo strip: two frontier model providers, two cloud platforms, a data platform and a customer relationship platform. Independent corroboration exists for at least one product, with the research assistant documented as built on a named cloud hosted model service over the proprietary data estate.

Held off A against the bar set earlier in this sweep, which requires each model family mapped to its host, administrator selectable and with failover disclosed. Here a buyer learns which suppliers are involved somewhere in the estate but not which model answers which question.

Meets the system of record test rather than the integration test. Through the Numerated acquisition the company now owns the loan origination system itself at its banking customers rather than feeding data into somebody else's, which was the explicit rationale given for the deal: an end to end origination and monitoring workflow rather than a data feed.

Beyond lending, entity reference data and screening content sit inside customer onboarding and regulatory reporting systems, and the context layer is positioned as the substrate other workflows draw on.

The trust centre carries a dedicated published page for customer data hosting locations and approved sub processors, alongside a third party risk management programme. Publishing an approved sub processor list is a real residency and supply disclosure and most of this index publishes nothing comparable. Recorded honestly: this grade rests on the existence and stated scope of that page rather than on the specific regions, which were not enumerated in this pass. The named check is queued and would confirm or reduce the grade.

A commercial disclosure shape the index has not recorded before, and it is not price. The company publishes its standard Core Terms for analytics products as a public document, and submits that contract to an independent contract rating service whose assessment is verifiable through a public certification link. Data processing and information security schedules are published alongside it.

So a prospective buyer can read the actual agreement, including its liability and data provisions, before any commercial conversation. Held at B and not A because no price, unit of charge or starting figure is published anywhere: terms disclosure is not price disclosure, on the same reasoning that revenue disclosure is not price disclosure.

Among the broadest coverage in the index. Five customer types addressed as separate segments with their own material: banking, buy side, insurance, corporates and public sector. Ten solution lines span lending, investment research, third party risk, regulatory reporting, balance sheet management, insurance underwriting, portfolio management, model risk governance, casualty insurance and ratings. Global rather than single jurisdiction, with a knowledge base of more than 600 million entities and lending customers holding a combined 3 trillion dollars in assets.