AscentAI vs Corlytics: how they compare in 2026

Beyond regulatory news, the platform derives a register of obligations specific to each firm from the rule corpus, then assesses automatically which incoming changes hit which obligation, with summaries of what changed generated automatically. The company describes itself as delivering fully processed information ready for action, unlike document based vendors, and a 2022 announcement describes patented AI and natural language processing technology as the mechanism. Without the models, a real product would remain: a global regulatory content database across a stated 98 countries and 1,000 sources, a manually maintained obligations register, collaborative workflows, audit trails and GRC integrations. The company rebranded from Ascent Technologies to AscentAI in March 2025.

Machine learning does three jobs on every incoming document: it decides what the document is about, condenses it, and connects it to related material. Regulatory notices, rules and enforcement actions are classified against Corlytics' universal regulatory taxonomy, long texts are summarized, and similar items are matched across datasets to flag duplication and feed gap analysis. Obligations Management goes further. Semantic parsing strips introductory and suggestive text from a rule to leave a set of action items. Specialized models map those obligations to a firm's policies, controls and products and consolidate the overlaps, and large language models propose wording that would close a gap in a policy or control. Policy Management drafts new policy content with AI, and Regulatory Risk Analytics runs Corlytics' own risk models over enforcement data. The machine learning framework that tags handbook provisions in real time was first built with the FCA in 2016 and 2017. Without the models, the version tracking, change packages, approval workflows, controls mapping and monitoring plans would still run as a regulatory workflow system.

Product pages promise a high confidence regulatory register, a rock solid inventory of obligations, a single source of regulatory truth, that users will never miss an update, and that AI powered change management eliminates human error. No benchmark, error rate, test set, precision or recall figure for obligation extraction or applicability is published. Rule Compare shows the new and former versions of a rule side by side with changes redlined, so a user can open the actual regulatory text. The terms say all Content is for information only, may not reflect the latest regulatory developments, and is not guaranteed to be correct, complete or up to date. The History Views clause calls the register Ascent's best guess of the rules that apply to the customer.

Every alert, summary and obligation stays linked to the regulatory text it came from. The Regulation Library keeps laws, rules, handbooks and guidance in their original PDF, XML or HTML form, so second and third line teams read the documents they already know. It breaks each one down to obligation level. A version manager shows the current text of a rule beside the previous version, with changes lined in red and green, and keeps the full history. Obligations mapped to policies and controls point back to that source. Quality control is described as a process rather than a number. Subject matter experts at Corlytics validate the enriched content, and in Obligations Management the client's own experts review extracted and mapped obligations before gap reports go out. In the FCA handbook project, machine tagging ran with a review, approve or reject step and a full audit trail. No accuracy rate or test result is given for classification, summaries, extraction or mapping.

The pitch is automation: changes are captured in real time, applicability against the obligations register is assessed automatically, and summaries are generated automatically, with the vendor saying every update is assessed and presented ready for action. Nothing describes a review point in the product, a confidence threshold at which the system defers, or what happens after an assessment is wrong. The audit trail records activity but does not control it. The one oversight statement is in the contract, not the product. The terms tell users to consult a Compliance Professional if a problem is too complex for Ascent, and make the user solely responsible for legal compliance and any use of the Solutions.

The platform automates the reading and routing of regulation and leaves decisions to people. Content is collected, classified and sent to the right business lines and teams without manual triage. Extraction and mapping run automatically, then the client's subject matter experts validate the results before gap reports and attestations are produced. Gap analysis returns suggested wording for a policy or control rather than changing it, and users are prompted to revisit mappings when a rule changes. Change management turns a regulatory change into a change package with owners, tasks and alerts at each stage, and records offline gap analysis alongside it. Policies pass through configurable multistage approvals. For the FCA's handbook, machine tagging ran inside a four eyes workflow in which users could review, approve or reject each change. No confidence level is described at which the models hold back output, and nothing covers what happens once a wrong mapping has reached a policy or control.

The home page quotes a compliance executive at a large financial services firm on how hard it is to find vendors that identify a firm's obligations rather than just stating the rules; no organization, name or date is given. No customer logos appear on the home page. The partner logos there, MCO, LogicGate, Onspring, Resolver and Corestream, are GRC integrations, not customers. Claims of scale concern the content, not the customer base. Vendor announcements describe partnerships with Halo Ai and Diligent, not deployments at named customers.

The longest running named deployment is the FCA. A pilot began in September 2016 and the Intelligent Handbook went live on 10 May 2017, with Corlytics' taxonomy and machine learning tagging covering more than 18,000 provisions. Other FCA functions use it too, including to speed up firm onboarding. Arbuthnot Latham, a London private and merchant bank, is named in a case study about centralizing group policies, with standard templates, single sign on and staff attestation among its requirements. The International Compliance Association launched an alert tool on Corlytics feeds in June 2025 for more than 30,000 members, and GRC Report began carrying its feeds in September 2026. Six more case studies are anonymous. Corlytics puts the efficiency gain at 25% for the compliance monitoring and risk insight teams of a European tier 1 bank. A crypto exchange went live in six weeks, and a United States investment manager with more than one trillion in assets replaced older third party tools with it. Client logos also include FINRA, ING, abrdn, Block, Natixis, Patria, SCOR, Swiss Re and Vontobel. The headline claims, 40% of the world's 30 largest banks as clients and policy approvals 50% faster, come without a named source.

The security page describes the perimeter in detail: AES-256 at rest with FIPS 140-2 validated hardware security modules and automatic key rotation, TLS 1.2 or 1.3 in transit, secrets injected at runtime rather than hardcoded, single sign on with phishing resistant WebAuthn factors, role based staff access and automatic removal of access on termination. No position on training is published. No retention or deletion commitment for customer content, data processing agreement, or description of separation between customers, users or matters is published either. The terms advise against sending confidential information in response to the Site, and say Ascent cannot guarantee the confidentiality of anything sent through the Site or by email, disclaiming liability for interception. Those cover communications rather than platform data, and they are the only confidentiality statements in the terms.

Each client's policies, obligation registers, impact assessments and control mappings sit in the platform, and the terms that govern that content are not public. No customer agreement, data processing agreement or confidentiality schedule is published. Nothing public says how client content is used, whether it trains the models, or how one client's data is kept apart from another's. The June 2026 privacy notice is the only data document. It covers personal data about people outside the customer relationship, such as website visitors, prospects and suppliers, though its reader list also names software users. It describes access controls, user authentication, encryption, staff confidentiality and regular security testing. ISO/IEC 42001 certifies how Corlytics governs its own AI, and ISO/IEC 27001 covers its information security management. Neither is a statement to clients about how their content may be used.

The terms deal with professional responsibility in four separate headed sections. Ascent says it is not a law firm or attorney and does not give legal advice, and that a user who needs legal advice agrees to contact their attorney. A section headed that the Site and Solutions are not legal services says no attorney client relationship is created or implied. It addresses privilege directly: any such relationship and related privileges can only be formed between the user and their own attorney under that attorney's engagement and conflict procedures. Another section says Ascent is not a law or compliance firm, may not perform the services of a Compliance Professional, and that its Solutions, forms and templates do not replace one. Jurisdiction limits are named. The subject matter varies by jurisdiction and regulator and is open to differing interpretation by courts and regulators, no general tool fits every case, and users should consult a Compliance Professional in their area. Nothing addresses supervision, competence or how the product supports a practitioner's own duties, and no bar or ethics guidance is named.

The product sells interpretation as well as information. The platform extracts obligations, filters them to a firm's activities and jurisdictions, suggests how a policy or control should change, and drafts policy text. In one UK bank's case, a third party consultancy used rules supplied by Corlytics to complete a rules mapping exercise the bank had agreed with its conduct regulator. The website legal notice says site content is general guidance that does not replace regulatory, compliance, risk analytics or other professional advice, and supplies it as is. It governs the website rather than the platform. No public statement says how platform output relates to legal or compliance advice, or who is responsible for checking it before a firm relies on it. The client expert validation step in Obligations Management is the clearest description of who signs off.

Nothing on the AI capability page, the security page, the platform, AscentHorizon and AscentFocus pages or the company section addresses how the AI itself is governed. There are no responsible AI principles, no model governance framework, nothing on what is tested before a model ships, and no named owner for AI decisions. Nothing addresses uneven output across jurisdictions, regulators or obligation types, although the platform decides which of a stated 400,000 obligations across 98 countries apply to an institution. The security page covers infrastructure: AES-256 at rest with FIPS 140-2 validated hardware security modules, TLS 1.2 and 1.3 in transit, yearly penetration testing, and a program aligned to the NIST Cybersecurity Framework. The AI page says in house compliance experts verify all regulatory data. The Vanta trust center at trust.ascentregtech.com holds the SOC 2 Type I attestation.

An AI management system certified to ISO/IEC 42001:2023 covers the whole business. A-LIGN issued the certification in May 2025 after a two stage audit that found zero nonconformities, and Waystone Compliance Solutions advised on the program. The scope covers every product line. The program is framed around bias mitigation, risk and resilience controls across the AI lifecycle, and mapped to the EU AI Act and the UK National AI Strategy. Later releases add the NIST framework and OECD principles. Oisin Boydell, Chief Data Officer, speaks for the AI program, and founder John Byrne describes an AI by design strategy that reaches six competencies of the business. Product pages describe a science based method, ensemble models and expert validation at each stage. Test results are not published, so nothing shows how output quality varies across languages, jurisdictions or document types.

The security page lists AES-256 at rest with FIPS 140-2 validated hardware security modules and automatic key rotation, RSA-2048 and SHA-256 as accepted algorithms, TLS 1.2 or 1.3 in transit, and secrets injected at runtime with keys held in hardware modules. Testing includes yearly penetration tests and regular vulnerability scans. Devices are centrally managed with enforced disk encryption and screen lock and round the clock alerting, remote access runs through Tailscale on WireGuard, DNS blocks malware, and staff take Vanta security training at onboarding and yearly after. No retention period for customer content, deletion commitment or route, subprocessor list, or incident or breach notification practice is published. The privacy policy covers website visitors and says customer data is mainly stored in the United States but may be moved and accessed worldwide.

Clients' regulatory content, obligation registers and policies live in Corlytics' cloud platform, and no published document sets retention, deletion or subprocessor terms for them. The privacy notice covers personal data only. Corlytics keeps that data for the life of an active contract, or as legal and business needs require, then deletes or anonymizes it, with the detail in an unpublished Data Retention Policy. Breaches are notified without undue delay and reported to the supervisory authority under an unpublished Data Breach Management Policy. Luca Dalla Giacoma is the named Data Protection Officer. The same notice lists access controls, authentication, encryption, IP anonymization, network security, business continuity and disaster recovery, and regular testing. It names recipients only by category: staff, technical service providers acting as processors or subprocessors, authorities such as HMRC, professional advisers and buyers of the business. The ISO/IEC 27001 certificate covers the information security management behind the service.

Liability is capped twice. The limitation clause caps it at the previous six months of customer payments where outright exclusion is not allowed, and a separate Liability Cap section caps total liability at the annual fee paid, expressly including indirect and consequential damages in any jurisdiction. Warranties are disclaimed in full: Ascent does not guarantee the accuracy, completeness, timeliness, reliability, suitability or usefulness of any part of the Site, and puts the whole risk of accuracy on the user. The limitation clause opens by saying Ascent is not liable for any loss caused by reliance on information from the Site. The only indemnity runs from customer to vendor. There is no vendor indemnity, warranty on output or insurance position. The History Views clause adds a disclaimer of all liability for the obligations history the platform shows.

The only public legal document is a website notice. It supplies site content as is, disclaims accuracy, timeliness and completeness, and excludes liability for direct, indirect, consequential and other damages arising from the site. The client application sits behind a sign in, and no customer agreement, order form or service terms is published, so the platform's warranties, indemnities and liability limits are not public. Clients use the output in front of regulators. Firms rely on Corlytics mappings to evidence compliance and attest to supervisors, and one UK bank used Corlytics rules in a rules mapping exercise agreed with its conduct regulator. No public term says who carries the loss if a mapping, summary or suggested policy change turns out to be wrong.

The platform integrates with GRC platforms so that obligations, policies and controls reflect current requirements: obligations flow from the register into policy and control records held elsewhere. Five GRC partners are named on the home page (MCO, LogicGate, Onspring, Resolver and Corestream), and a policy and control engine is described for pushing changes through and overseeing them in GRC. Vendor announcements describe two more integrations in substance. Diligent's regulatory compliance product takes in Ascent's monitoring and interpretation so obligations update automatically and alert the user to assess impact. Halo Ai takes Ascent's enriched regulatory data through named endpoints into its own workflow engine. The site navigation lists no public API reference, developer portal or integration documentation, and the endpoints in the Halo Ai announcement are not publicly documented.

The platform is built to sit beside a firm's GRC stack and feed it. The Regulation Library is described as fully API ready, with an Open API for major GRC platforms. Regulatory Monitoring, Obligations Management and Compliance Monitoring each send data or outcomes into a firm's GRC environment, and an investment manager client uses the data to feed its internal compliance newsletter. The FCA handbook project connected to the regulator's existing content repository, and Taxonomy Manager for Regulators links digital handbooks to online portals and obligation registers. The partners page shows logos for IBM, ServiceNow, Solidatus and Chainalysis among others. Inside the platform, controls mapping links obligations to a firm's policies, standards, procedures, controls and processes, and taxonomy routing sends content to the right business lines and teams. No connector is named, and there is no public API reference or integration guide that shows what syncs and in which direction.

A hosted application runs at app.ascentregtech.com, and the terms describe Ascent hosting its Solutions as a backend service. Nothing names a hosting provider or data center region, or says whether customers get a dedicated or shared environment. The privacy policy is the only place a location is published: the company mainly stores customer data in the United States and may transfer and access it worldwide. The policy makes no residency commitment, offers no choice, and concerns personal data rather than the obligations registers and policy mappings the platform holds. Processing location is not addressed separately from storage.

Delivery runs from Corlytics' own cloud, the environment named in its ISO/IEC 27001 scope. Implementations run remotely across time zones, led by a dedicated implementation team, and Corlytics says go lives can take a matter of weeks. The security page lists geo specific hosting among its principles. The hosting provider, regions and tenancy model are not named, and no choice of location is offered. The only geography in the privacy notice concerns personal data transfers outside the UK and EEA, which rely on adequacy decisions, approved contracts or other safeguards. Group companies in Ireland, England, Portugal and the United States describe where Corlytics operates rather than where client data sits.

AscentAI says it holds a SOC 2 Type I attestation, the report on design at a point in time, rather than a Type II examination of how controls operate over a period. A trust center runs at trust.ascentregtech.com, and the security page says the attestation is available there, so a route to the report is published. The security program is also described as aligned to the NIST Cybersecurity Framework, and the security page was last modified in April 2026. The security page names no auditor and gives no examination date or period, and no scope statement says which entities or systems are covered.

Three certifications are named. ISO/IEC 27001 covers all activities of Corlytics Limited in delivering data and software for legislation, regulation and document management services from its cloud solutions. A SOC 2 Type 1 report from the independent CPA firm Thoropass tests control design against all five Trust Services Criteria at a point in time. ISO/IEC 42001:2023 came from A-LIGN in May 2025. An Information Security Manager runs the security program, whose principles include secure development, testing and quality assurance, continuous integration testing, infrastructure controls, geo specific hosting and incident response. One reinsurer cleared Corlytics through its own digital governance process as an approved third party supplier before rollout. No report or certificate is posted, and the security page invites readers to get in touch for more on its procedures.

A 2022 vendor announcement describes patented AI and natural language processing, and the product pages refer to AI powered automation, AI summaries and AI impact assessment without naming a model, model family, provider or architecture. Nothing says whether any third party foundation model is used at any point. Where inference runs is not stated, and no commitment to notify customers of model changes is published.

Its AI is presented as the company's own work. Ensemble models with expert oversight handle classification and summaries, and specialized machine learning models handle obligation mapping. Gap remediation suggestions come from what Corlytics calls expert LLMs, and handbook tagging runs on a machine learning framework first built with the FCA. No model, model family or provider is named for any of them, and whether a third party foundation model is called, or where inference runs, is not stated. The ISO/IEC 42001 management system covers every product line, with no list of the models it governs and no commitment to tell clients when they change.

No pricing information is published at any level, including the unit of charge. The site navigation, which covers the platform, difference, buyer, partner, resource and company sections, has no pricing page or entry. Every commercial route on the property is a contact form or a request to talk. The terms of service describe a priced self service route without publishing any part of it: a user signs up for a duration of their choice ranging from one month to three years and pays by credit card, with pricing terms and procedures deferred entirely to a separate Individual Service Agreement, and recurring ACH debit authorized against charges described in that agreement. The only figure published anywhere is a 25 dollar fee for a transaction returned for insufficient funds, which is a penalty rather than a price. No rate, range, tier name, unit per seat or per obligation, or statement of what implementation adds is published.

Buying Corlytics starts with a demo and a sales conversation, and no prices, plan names or units of charge are published. The platform is modular. In its case studies, clients start with Regulatory Monitoring and add Risk Analytics, Compliance Management or Clausematch policy management, and one payments provider added two modules within a month of going live. Implementation is run by a dedicated team, with an implementation manager for each client, in sprints. A crypto exchange went live in six weeks, while one reinsurer's rollout ran through requirements and design, a proof of concept and approval as a third party supplier. Modules and configuration can be added after go live. No figure is published for licenses, implementation or the work of building a firm's taxonomy and obligation register.

Segments are described as regulatory scope rather than a logo wall: banks and credit unions; mortgage services, consumer finance and fintech platforms; electronic payments and money services; investment advisers, broker dealers and funds; crypto and digital asset businesses; and market infrastructure such as exchanges, clearing and settlement organizations and repositories. Topics include consumer protection, consumer privacy, anti money laundering, countering the financing of terrorism and ESG, across a stated 98 countries and 1,000 data sources. Every segment is in financial services, and nothing states firm size, obligation volume or where the product stops. The Who We Serve section has pages for Compliance, Risk and Digital Transformation but none for Legal, though the platform page and the rebrand announcement both position the product for legal teams.

Buyers are regulated financial firms and the regulators that oversee them, with a second line of business in health and life sciences. Sector pages cover global and private banks, hedge fund and investment managers, global insurers, payments and big tech, and regulators. Case studies add a reinsurer, a crypto exchange, a UK retail and commercial bank, a London merchant bank and a United States investment manager. Regulators buy a Taxonomy Manager edition that turns handbooks into machine readable, searchable databases with visual maps by theme, product and business line. Health and life sciences clients get regulatory sensing, guidance assessment, digital call for comments assessments and a repository that supports submissions. Financial services modules cover horizon scanning, the regulation library, obligations, change management, controls mapping, policy management, compliance monitoring, regulatory risk analytics and nonfinancial risk across operational, conduct, third party, cyber, AI and governance risk. Product pages speak to compliance, risk and audit teams and their chief officers, and case studies show legal teams working alongside them. No limit by firm size, jurisdiction or language is stated.