Corlytics vs CUBE: how they compare in 2026

Machine learning does three jobs on every incoming document: it decides what the document is about, condenses it, and connects it to related material. Regulatory notices, rules and enforcement actions are classified against Corlytics' universal regulatory taxonomy, long texts are summarized, and similar items are matched across datasets to flag duplication and feed gap analysis. Obligations Management goes further. Semantic parsing strips introductory and suggestive text from a rule to leave a set of action items. Specialized models map those obligations to a firm's policies, controls and products and consolidate the overlaps, and large language models propose wording that would close a gap in a policy or control. Policy Management drafts new policy content with AI, and Regulatory Risk Analytics runs Corlytics' own risk models over enforcement data. The machine learning framework that tags handbook provisions in real time was first built with the FCA in 2016 and 2017. Without the models, the version tracking, change packages, approval workflows, controls mapping and monitoring plans would still run as a regulatory workflow system.

CUBE's regulatory content would stand without the models. Its 250 regulatory experts review and curate it, and Powered By licenses that content to other platforms on its own. The models do the processing at scale. Proprietary AI trained only on regulatory content classifies, extracts, maps and links publications from more than 10,000 issuing bodies into about 10 million structured obligations. Inside RegPlatform, agentic coworkers triage change for a firm, answer questions in natural language, rewrite and generate controls, and analyze enforcement actions.

Every alert, summary and obligation stays linked to the regulatory text it came from. The Regulation Library keeps laws, rules, handbooks and guidance in their original PDF, XML or HTML form, so second and third line teams read the documents they already know. It breaks each one down to obligation level. A version manager shows the current text of a rule beside the previous version, with changes lined in red and green, and keeps the full history. Obligations mapped to policies and controls point back to that source. Quality control is described as a process rather than a number. Subject matter experts at Corlytics validate the enriched content, and in Obligations Management the client's own experts review extracted and mapped obligations before gap reports go out. In the FCA handbook project, machine tagging ran with a review, approve or reject step and a full audit trail. No accuracy rate or test result is given for classification, summaries, extraction or mapping.

Every coworker works from CUBE's own curated regulatory intelligence rather than the open web, and CUBE describes the output as sourced and auditable. The Analysis Coworker returns structured answers with their sources across applicable updates and the laws, rules and regulations in RegBook, and keeps the research record in the platform. Content is versioned, and each obligation keeps its lineage back to the regulatory text. No accuracy rate for classification, obligation extraction or coworker answers is published, and no test set or benchmark sits behind the AI.

The platform automates the reading and routing of regulation and leaves decisions to people. Content is collected, classified and sent to the right business lines and teams without manual triage. Extraction and mapping run automatically, then the client's subject matter experts validate the results before gap reports and attestations are produced. Gap analysis returns suggested wording for a policy or control rather than changing it, and users are prompted to revisit mappings when a rule changes. Change management turns a regulatory change into a change package with owners, tasks and alerts at each stage, and records offline gap analysis alongside it. Policies pass through configurable multistage approvals. For the FCA's handbook, machine tagging ran inside a four eyes workflow in which users could review, approve or reject each change. No confidence level is described at which the models hold back output, and nothing covers what happens once a wrong mapping has reached a policy or control.

The coworkers work inside RegPlatform beside compliance and risk teams, surfacing what is relevant and drafting the next step, and CUBE calls their output explainable. The Priorities Coworker ranks developments by certainty and applicability and keeps a full audit trail of its assessment decisions. Regulatory Inventory logs the reasoning when it maps a change to entities, jurisdictions and business lines, and workflow carries tasks, ownership and approvals through each stage. Intel pairs the AI with review by CUBE's regulatory experts. What a coworker may do without a person approving it, and what happens after a wrong assessment, are not described.

The longest running named deployment is the FCA. A pilot began in September 2016 and the Intelligent Handbook went live on 10 May 2017, with Corlytics' taxonomy and machine learning tagging covering more than 18,000 provisions. Other FCA functions use it too, including to speed up firm onboarding. Arbuthnot Latham, a London private and merchant bank, is named in a case study about centralizing group policies, with standard templates, single sign on and staff attestation among its requirements. The International Compliance Association launched an alert tool on Corlytics feeds in June 2025 for more than 30,000 members, and GRC Report began carrying its feeds in September 2026. Six more case studies are anonymous. Corlytics puts the efficiency gain at 25% for the compliance monitoring and risk insight teams of a European tier 1 bank. A crypto exchange went live in six weeks, and a United States investment manager with more than one trillion in assets replaced older third party tools with it. Client logos also include FINRA, ING, abrdn, Block, Natixis, Patria, SCOR, Swiss Re and Vontobel. The headline claims, 40% of the world's 30 largest banks as clients and policy approvals 50% faster, come without a named source.

CUBE says it serves many of the world's largest financial institutions, with operations across Europe, the United States, Canada, Asia and Australia. It puts its scale at about 10 million data points processed a year, 250 regulatory experts and around 1,000 staff in 10 offices. No customer is named. The one outcome figure comes from early customer testing of the Priorities Coworker, which cut noise by 80 to 90 percent, with no customer, date or method attached. IBM embedded CUBE's regulatory intelligence in a Regulatory Horizon Scanning capability for watsonx.governance, announced in September 2026, as a partnership with no deployment figures.

Each client's policies, obligation registers, impact assessments and control mappings sit in the platform, and the terms that govern that content are not public. No customer agreement, data processing agreement or confidentiality schedule is published. Nothing public says how client content is used, whether it trains the models, or how one client's data is kept apart from another's. The June 2026 privacy notice is the only data document. It covers personal data about people outside the customer relationship, such as website visitors, prospects and suppliers, though its reader list also names software users. It describes access controls, user authentication, encryption, staff confidentiality and regular security testing. ISO/IEC 42001 certifies how Corlytics governs its own AI, and ISO/IEC 27001 covers its information security management. Neither is a statement to clients about how their content may be used.

The Global Terms and Conditions for CUBE Services, January 2026, leave customer data owned by the customer and license CUBE to use and store it only as far as needed to perform the agreement. Customer data counts as the customer's confidential information. Clause 10.3 limits a compelled disclosure to what a court or regulator orders, with written notice first where CUBE is able to give it. The data security exhibit commits CUBE to a written information security program aligned with a recognized standard. No term addresses privilege, work product or segregation between customers, and the license lets CUBE keep customer data after the agreement ends.

The product sells interpretation as well as information. The platform extracts obligations, filters them to a firm's activities and jurisdictions, suggests how a policy or control should change, and drafts policy text. In one UK bank's case, a third party consultancy used rules supplied by Corlytics to complete a rules mapping exercise the bank had agreed with its conduct regulator. The website legal notice says site content is general guidance that does not replace regulatory, compliance, risk analytics or other professional advice, and supplies it as is. It governs the website rather than the platform. No public statement says how platform output relates to legal or compliance advice, or who is responsible for checking it before a firm relies on it. The client expert validation step in Obligations Management is the clearest description of who signs off.

Clause 12.1.4 of the Intel subscription terms says the services are not financial, tax, accounting, legal, compliance or other professional advice, and CUBE disclaims damages from decisions made in reliance on them. The Global Terms behind RegPlatform exclude liability for decisions a customer makes on the services and content, without the same statement. The website terms call site content general information rather than advice. CUBE's own pitch is helping teams track, interpret and act on regulatory change, while its home page line is that CUBE brings the insights and the customer decides. Nothing addresses the supervision or competence of the lawyers and compliance staff relying on the output, and no jurisdiction limit is named.

An AI management system certified to ISO/IEC 42001:2023 covers the whole business. A-LIGN issued the certification in May 2025 after a two stage audit that found zero nonconformities, and Waystone Compliance Solutions advised on the program. The scope covers every product line. The program is framed around bias mitigation, risk and resilience controls across the AI lifecycle, and mapped to the EU AI Act and the UK National AI Strategy. Later releases add the NIST framework and OECD principles. Oisin Boydell, Chief Data Officer, speaks for the AI program, and founder John Byrne describes an AI by design strategy that reaches six competencies of the business. Product pages describe a science based method, ensemble models and expert validation at each stage. Test results are not published, so nothing shows how output quality varies across languages, jurisdictions or document types.

The AI is described as proprietary, trained only on regulatory content and native to the product rather than added on, with coworker output explainable, sourced and auditable. No AI policy, set of principles, framework, accountable owner or testing before release is published, and nothing covers uneven output across jurisdictions, languages or firm types. CUBE's intelligence feeds IBM's watsonx.governance, a tool enterprises use to govern their own AI, which says nothing about how CUBE governs its models.

Clients' regulatory content, obligation registers and policies live in Corlytics' cloud platform, and no published document sets retention, deletion or subprocessor terms for them. The privacy notice covers personal data only. Corlytics keeps that data for the life of an active contract, or as legal and business needs require, then deletes or anonymizes it, with the detail in an unpublished Data Retention Policy. Breaches are notified without undue delay and reported to the supervisory authority under an unpublished Data Breach Management Policy. Luca Dalla Giacoma is the named Data Protection Officer. The same notice lists access controls, authentication, encryption, IP anonymization, network security, business continuity and disaster recovery, and regular testing. It names recipients only by category: staff, technical service providers acting as processors or subprocessors, authorities such as HMRC, professional advisers and buyers of the business. The ISO/IEC 27001 certificate covers the information security management behind the service.

The privacy exhibit, March 2026, has CUBE process personal data only as the agreement requires or on written instruction, amend, transfer or delete it on request, and keep it confidential. Either party reports a security breach within 72 hours, and CUBE tells no third party about a breach without the customer's consent unless the law requires it. An annex lists the material subprocessors, and the customer gets five days to object to a new one. Under the Global Terms, CUBE backs up customer data daily and keeps only the latest copy, and at the end of the agreement it deletes or returns personal data at the customer's option. Other customer data may be kept after termination, and no retention period is stated.

The only public legal document is a website notice. It supplies site content as is, disclaims accuracy, timeliness and completeness, and excludes liability for direct, indirect, consequential and other damages arising from the site. The client application sits behind a sign in, and no customer agreement, order form or service terms is published, so the platform's warranties, indemnities and liability limits are not public. Clients use the output in front of regulators. Firms rely on Corlytics mappings to evidence compliance and attest to supervisors, and one UK bank used Corlytics rules in a rules mapping exercise agreed with its conduct regulator. No public term says who carries the loss if a mapping, summary or suggested policy change turns out to be wrong.

Clause 11.2 of the Global Terms has CUBE defend and indemnify the customer against third party claims that the services infringe intellectual property. The remedies are to procure a right, modify or replace the services, or terminate and refund unused fees, with exclusions for freely available content, modification by others, misuse and unapproved combinations. Clause 12.4 excludes lost profits, lost data and consequential loss and caps CUBE at the fees for the contract year, rising to three times those fees for breach of confidentiality and for indemnity claims. Clause 4.1 warrants that the services are performed with the skill and care of the industry and in line with the documentation, with correction or reperformance as the remedy. Accuracy, completeness and timeliness of content are disclaimed, CUBE carries no liability for decisions the customer makes on it, and no insurance is stated.

The platform is built to sit beside a firm's GRC stack and feed it. The Regulation Library is described as fully API ready, with an Open API for major GRC platforms. Regulatory Monitoring, Obligations Management and Compliance Monitoring each send data or outcomes into a firm's GRC environment, and an investment manager client uses the data to feed its internal compliance newsletter. The FCA handbook project connected to the regulator's existing content repository, and Taxonomy Manager for Regulators links digital handbooks to online portals and obligation registers. The partners page shows logos for IBM, ServiceNow, Solidatus and Chainalysis among others. Inside the platform, controls mapping links obligations to a firm's policies, standards, procedures, controls and processes, and taxonomy routing sends content to the right business lines and teams. No connector is named, and there is no public API reference or integration guide that shows what syncs and in which direction.

RegConnect, CUBE's API module, connects RegPlatform with GRC platforms, policy tools and internal systems in both directions. Authorized applications pull regulatory intelligence, trigger platform functions and push data back, under role based authentication with every access logged. Links between regulatory content and downstream policies, processes and controls stay live, so connected items are flagged for review when a rule changes. Intel content reaches other systems through a REST API with a developer portal, and Powered By licenses content to platform builders. IBM's watsonx.governance is the one named destination. The developer documentation is not public, and no GRC platform is named.

Delivery runs from Corlytics' own cloud, the environment named in its ISO/IEC 27001 scope. Implementations run remotely across time zones, led by a dedicated implementation team, and Corlytics says go lives can take a matter of weeks. The security page lists geo specific hosting among its principles. The hosting provider, regions and tenancy model are not named, and no choice of location is offered. The only geography in the privacy notice concerns personal data transfers outside the UK and EEA, which rely on adequacy decisions, approved contracts or other safeguards. Group companies in Ireland, England, Portugal and the United States describe where Corlytics operates rather than where client data sits.

Annex A of the privacy exhibit sets out where CUBE runs. Enterprise services sit in two data centers in Great Britain, Datum in Farnborough and Vantage in Newport. Microsoft Azure hosts Intel and Hub AI in the United Kingdom and EU North, RegRoom in the United States and Oden in an eastern United States region. Group companies give technical and operational support under an intragroup agreement carrying EU standard contractual clauses and the UK transfer addendum. No customer choice of region is described, and where processing happens is not separated from where data is stored.

Three certifications are named. ISO/IEC 27001 covers all activities of Corlytics Limited in delivering data and software for legislation, regulation and document management services from its cloud solutions. A SOC 2 Type 1 report from the independent CPA firm Thoropass tests control design against all five Trust Services Criteria at a point in time. ISO/IEC 42001:2023 came from A-LIGN in May 2025. An Information Security Manager runs the security program, whose principles include secure development, testing and quality assurance, continuous integration testing, infrastructure controls, geo specific hosting and incident response. One reinsurer cleared Corlytics through its own digital governance process as an approved third party supplier before rollout. No report or certificate is posted, and the security page invites readers to get in touch for more on its procedures.

No ISO 27001, SOC 2 or other certification is claimed on CUBE's site or in its agreements, and no auditor or report is named. The data security exhibit commits it to a written information security program that adopts or aligns with an industry standard, with the ISO 27000 family, SOC 2 Type 2 and CIS benchmarks given as examples. The privacy exhibit mentions a trust center portal as one possible route for subprocessor updates, and no trust center is linked from the site.

The AI is presented as the company's own work. Ensemble models with expert oversight handle classification and summaries, and specialized machine learning models handle obligation mapping. Gap remediation suggestions come from what Corlytics calls expert LLMs, and handbook tagging runs on a machine learning framework first built with the FCA. No model, model family or provider is named for any of them, and whether a third party foundation model is called, or where inference runs, is not stated. The ISO/IEC 42001 management system covers every product line, with no list of the models it governs and no commitment to tell clients when they change.

CUBE describes its AI as proprietary and trained only on regulatory content, classifying, extracting, mapping and linking publications in 100 languages. Its coworkers draw on regulatory and network intelligence that, in CUBE's words, generic AI models are not trained on. No model, model family or outside model provider is named, and nothing says whether a general purpose model sits behind the coworkers' natural language answers. Microsoft Azure appears as a hosting subprocessor, and no notice of model changes is committed.

Buying Corlytics starts with a demo and a sales conversation, and no prices, plan names or units of charge are published. The platform is modular. In its case studies, clients start with Regulatory Monitoring and add Risk Analytics, Compliance Management or Clausematch policy management, and one payments provider added two modules within a month of going live. Implementation is run by a dedicated team, with an implementation manager for each client, in sprints. A crypto exchange went live in six weeks, while one reinsurer's rollout ran through requirements and design, a proof of concept and approval as a third party supplier. Modules and configuration can be added after go live. No figure is published for licenses, implementation or the work of building a firm's taxonomy and obligation register.

No price is published, and every product page routes to a demo or a conversation with a CUBE expert. Its Global Terms set the commercial shape. Fees are set for each contract year in an order form that names the number of authorized users, and invoices follow the order form's payment terms. Unless the order form fixes the fees, they rise 5 percent at the start of each contract year, late amounts carry 1.5 percent a month, and the agreement renews unless either side gives 60 days' notice. Intel has its own subscription terms, version 1.1 of June 2026. Nothing states what implementation adds.

Buyers are regulated financial firms and the regulators that oversee them, with a second line of business in health and life sciences. Sector pages cover global and private banks, hedge fund and investment managers, global insurers, payments and big tech, and regulators. Case studies add a reinsurer, a crypto exchange, a UK retail and commercial bank, a London merchant bank and a United States investment manager. Regulators buy a Taxonomy Manager edition that turns handbooks into machine readable, searchable databases with visual maps by theme, product and business line. Health and life sciences clients get regulatory sensing, guidance assessment, digital call for comments assessments and a repository that supports submissions. Financial services modules cover horizon scanning, the regulation library, obligations, change management, controls mapping, policy management, compliance monitoring, regulatory risk analytics and nonfinancial risk across operational, conduct, third party, cyber, AI and governance risk. Product pages speak to compliance, risk and audit teams and their chief officers, and case studies show legal teams working alongside them. No limit by firm size, jurisdiction or language is stated.

Highly regulated industries are CUBE's focus, with solution pages for banking, financial services, insurance, corporates and partners. RegPlatform serves enterprise compliance and risk teams across the first and second lines, and Intel targets fast growing regulated businesses. Oden covers state by state notices and guidance for American insurers writing commercial or personal lines, and Powered By serves platform builders, information businesses and technology providers. Coverage spans regulatory publications, guidance and enforcement actions from more than 10,000 issuing bodies in 250 countries and territories and 100 languages. No practice area or obligation type is named as out of scope.