Corlytics vs RequirementONE: how they compare in 2026

Machine learning does three jobs on every incoming document: it decides what the document is about, condenses it, and connects it to related material. Regulatory notices, rules and enforcement actions are classified against Corlytics' universal regulatory taxonomy, long texts are summarized, and similar items are matched across datasets to flag duplication and feed gap analysis. Obligations Management goes further. Semantic parsing strips introductory and suggestive text from a rule to leave a set of action items. Specialized models map those obligations to a firm's policies, controls and products and consolidate the overlaps, and large language models propose wording that would close a gap in a policy or control. Policy Management drafts new policy content with AI, and Regulatory Risk Analytics runs Corlytics' own risk models over enforcement data. The machine learning framework that tags handbook provisions in real time was first built with the FCA in 2016 and 2017. Without the models, the version tracking, change packages, approval workflows, controls mapping and monitoring plans would still run as a regulatory workflow system.

Two products sit in one: a regulatory data feed and a no code platform for building compliance workflows, with generative AI added across both. The data platform watches hundreds of regulator, industry body and standards websites. It converts web pages, Word files, spreadsheets and PDFs into one format and stores them in a data lake that users and other systems subscribe to. Customers log in to a live stream of indexed and tagged publications. Any app on the platform can call generative AI for drafting content, analyzing data and producing summaries and reports. AI translation renders publications into a team's own language, and an AI enhanced taxonomy routes new developments to the right people. On the price list, publication translation and AI extraction of insights appear only on the Enterprise tier. Monitoring, topic filters, task lists, automations and reporting run without the models, and the Try, Expand and Collaborate tiers are sold on those features.

Every alert, summary and obligation stays linked to the regulatory text it came from. The Regulation Library keeps laws, rules, handbooks and guidance in their original PDF, XML or HTML form, so second and third line teams read the documents they already know. It breaks each one down to obligation level. A version manager shows the current text of a rule beside the previous version, with changes lined in red and green, and keeps the full history. Obligations mapped to policies and controls point back to that source. Quality control is described as a process rather than a number. Subject matter experts at Corlytics validate the enriched content, and in Obligations Management the client's own experts review extracted and mapped obligations before gap reports go out. In the FCA handbook project, machine tagging ran with a review, approve or reject step and a full audit trail. No accuracy rate or test result is given for classification, summaries, extraction or mapping.

Each update is a publication from a source the team chose, so the regulator's or industry body's own document sits behind every item, and teams can reach both past and current publications from the platform. The AI layer adds summaries, translations and, on Enterprise, extracted insights on top of that source text. No accuracy figures are given for those outputs. The one regulatory case study claims efficiency and accuracy gains of up to 80% for an international financial services firm, without a baseline. No warranty covers the accuracy, completeness or reliability of third party content such as data feeds, and RequirementONE does not promise error free service.

The platform automates the reading and routing of regulation and leaves decisions to people. Content is collected, classified and sent to the right business lines and teams without manual triage. Extraction and mapping run automatically, then the client's subject matter experts validate the results before gap reports and attestations are produced. Gap analysis returns suggested wording for a policy or control rather than changing it, and users are prompted to revisit mappings when a rule changes. Change management turns a regulatory change into a change package with owners, tasks and alerts at each stage, and records offline gap analysis alongside it. Policies pass through configurable multistage approvals. For the FCA's handbook, machine tagging ran inside a four eyes workflow in which users could review, approve or reject each change. No confidence level is described at which the models hold back output, and nothing covers what happens once a wrong mapping has reached a policy or control.

People do the triage, and the platform organizes it. Updates are filtered to each team by topic and taxonomy, owners are assigned, and impact assessment and follow up actions run through a central task list with workflow automation, escalation and a full change history. Business power users can build their own apps with the same toolkit RequirementONE uses, so the workflow follows the customer's own process. The AI steps feed that workflow with summaries, translations, taxonomy routing and, on Enterprise, extracted insights. RequirementONE does not describe a review step for AI output before a team acts on it, or how a misrouted update is caught. Automations are fixed on Collaborate and fully configurable on Enterprise, so how far automation reaches is the customer's choice.

The longest running named deployment is the FCA. A pilot began in September 2016 and the Intelligent Handbook went live on 10 May 2017, with Corlytics' taxonomy and machine learning tagging covering more than 18,000 provisions. Other FCA functions use it too, including to speed up firm onboarding. Arbuthnot Latham, a London private and merchant bank, is named in a case study about centralizing group policies, with standard templates, single sign on and staff attestation among its requirements. The International Compliance Association launched an alert tool on Corlytics feeds in June 2025 for more than 30,000 members, and GRC Report began carrying its feeds in September 2026. Six more case studies are anonymous. Corlytics puts the efficiency gain at 25% for the compliance monitoring and risk insight teams of a European tier 1 bank. A crypto exchange went live in six weeks, and a United States investment manager with more than one trillion in assets replaced older third party tools with it. Client logos also include FINRA, ING, abrdn, Block, Natixis, Patria, SCOR, Swiss Re and Vontobel. The headline claims, 40% of the world's 30 largest banks as clients and policy approvals 50% faster, come without a named source.

The regulatory case study describes an international financial services firm whose central regulatory watch team tracks change across several jurisdictions, topics and languages. RequirementONE says the platform cut lead times from weeks to days and hours, translated regulatory texts in minutes, and delivered efficiency and accuracy gains of up to 80%. A second case study covers a midsize international organization that moved ten legacy business applications onto the platform in ten weeks, with a return on investment inside three months. Neither customer is named. Home page testimonials come from a chief compliance officer, a regulatory change management director and a principal consultant, without names or firms, and one describes auditors using the platform as a single point of truth. Recognition includes the RegTech 100, ESG FinTech 100 and AI FinTech 100 lists, Lloyd's Lab and a Grant Thornton RegTech award.

Each client's policies, obligation registers, impact assessments and control mappings sit in the platform, and the terms that govern that content are not public. No customer agreement, data processing agreement or confidentiality schedule is published. Nothing public says how client content is used, whether it trains the models, or how one client's data is kept apart from another's. The June 2026 privacy notice is the only data document. It covers personal data about people outside the customer relationship, such as website visitors, prospects and suppliers, though its reader list also names software users. It describes access controls, user authentication, encryption, staff confidentiality and regular security testing. ISO/IEC 42001 certifies how Corlytics governs its own AI, and ISO/IEC 27001 covers its information security management. Neither is a statement to clients about how their content may be used.

The terms of service, last updated April 2020, carry a mutual nondisclosure clause in which each party agrees to disclose the other's confidential information only as the agreement requires. The customer keeps ownership of all content it puts into the platform. A published data processing agreement makes RequirementONE a processor that handles personal information solely to provide the subscription, binds subprocessors to the same protection, and returns or securely deletes personal information when the subscription ends. Customers who need separation can buy a private cloud, a hosted instance configured to their chosen location, sizing, redundancy, security posture and regulatory jurisdiction, with a minimum term of one year. The terms predate the platform's generative AI. They say nothing about using customer content to train or improve models, or about what an AI provider may keep, and privilege and work product are not addressed.

The product sells interpretation as well as information. The platform extracts obligations, filters them to a firm's activities and jurisdictions, suggests how a policy or control should change, and drafts policy text. In one UK bank's case, a third party consultancy used rules supplied by Corlytics to complete a rules mapping exercise the bank had agreed with its conduct regulator. The website legal notice says site content is general guidance that does not replace regulatory, compliance, risk analytics or other professional advice, and supplies it as is. It governs the website rather than the platform. No public statement says how platform output relates to legal or compliance advice, or who is responsible for checking it before a firm relies on it. The client expert validation step in Obligations Management is the clearest description of who signs off.

No published statement says that the platform's updates, summaries or extracted insights are not legal or regulatory advice. The terms disclaim responsibility for the accuracy and reliability of third party content, such as regulatory feeds, and make the customer responsible for the content it adds. The pricing FAQ draws a commercial line instead. Customers who need organizational transformation or highly specialized advice are pointed to their existing advisors or to RequirementONE's partners. Nothing addresses the professional duties of the compliance officers and lawyers who act on the updates.

An AI management system certified to ISO/IEC 42001:2023 covers the whole business. A-LIGN issued the certification in May 2025 after a two stage audit that found zero nonconformities, and Waystone Compliance Solutions advised on the program. The scope covers every product line. The program is framed around bias mitigation, risk and resilience controls across the AI lifecycle, and mapped to the EU AI Act and the UK National AI Strategy. Later releases add the NIST framework and OECD principles. Oisin Boydell, Chief Data Officer, speaks for the AI program, and founder John Byrne describes an AI by design strategy that reaches six competencies of the business. Product pages describe a science based method, ensemble models and expert validation at each stage. Test results are not published, so nothing shows how output quality varies across languages, jurisdictions or document types.

Generative AI is presented as a core capability of the platform, with nothing on how it is governed. No responsible AI statement, accountable owner, testing practice or bias work is described, and the terms and data processing agreement predate the AI features and do not mention them. The only governance policy on the site is a quality statement from April 2020. It commits the company to a quality management system conforming to BS EN ISO 9001:2000, owned by the chief executive and senior managers.

Clients' regulatory content, obligation registers and policies live in Corlytics' cloud platform, and no published document sets retention, deletion or subprocessor terms for them. The privacy notice covers personal data only. Corlytics keeps that data for the life of an active contract, or as legal and business needs require, then deletes or anonymizes it, with the detail in an unpublished Data Retention Policy. Breaches are notified without undue delay and reported to the supervisory authority under an unpublished Data Breach Management Policy. Luca Dalla Giacoma is the named Data Protection Officer. The same notice lists access controls, authentication, encryption, IP anonymization, network security, business continuity and disaster recovery, and regular testing. It names recipients only by category: staff, technical service providers acting as processors or subprocessors, authorities such as HMRC, professional advisers and buyers of the business. The ISO/IEC 27001 certificate covers the information security management behind the service.

The data processing agreement sets the rules for personal information in the platform. Its security measures cover physical access, system access, data access, transmission and encryption across the subscription. RequirementONE keeps controls to detect and respond to incidents and notifies the customer of a confirmed breach without undue delay and at the latest within 24 hours. At the end of the subscription it returns or securely deletes personal information at the customer's choice, and customers may audit its compliance, including on site inspections. Subprocessors are held to the same protection. Their lists are available through the helpdesk, with a 14 day window to object to one. Under the terms, customer data may be deleted for good once an account is 30 or more days delinquent. The privacy statement, last modified October 2022, still relies on the retired Privacy Shield framework. There is no security page, and no retention period applies to customer content while the subscription runs.

The only public legal document is a website notice. It supplies site content as is, disclaims accuracy, timeliness and completeness, and excludes liability for direct, indirect, consequential and other damages arising from the site. The client application sits behind a sign in, and no customer agreement, order form or service terms is published, so the platform's warranties, indemnities and liability limits are not public. Clients use the output in front of regulators. Firms rely on Corlytics mappings to evidence compliance and attest to supervisors, and one UK bank used Corlytics rules in a rules mapping exercise agreed with its conduct regulator. No public term says who carries the loss if a mapping, summary or suggested policy change turns out to be wrong.

The published terms set out a full allocation of loss. RequirementONE's aggregate liability is capped at the fees paid for the subscription in the 12 months before the event, less refunds or credits. Neither party is liable for indirect, consequential or punitive damages, lost profits or lost data. The cap and exclusions do not apply to indemnity obligations, gross negligence, willful misconduct or material breach of confidentiality, and liability for death, personal injury and deceit is not limited. RequirementONE indemnifies the customer against third party intellectual property infringement claims, with exclusions for customer materials, combinations with other products and third party content. It warrants that the subscription substantially conforms to its documentation, and the remedies for breach are exclusive. It does not warrant error free operation or that the service meets the customer's requirements. Nothing addresses the accuracy of AI output, and no insurance is stated.

The platform is built to sit beside a firm's GRC stack and feed it. The Regulation Library is described as fully API ready, with an Open API for major GRC platforms. Regulatory Monitoring, Obligations Management and Compliance Monitoring each send data or outcomes into a firm's GRC environment, and an investment manager client uses the data to feed its internal compliance newsletter. The FCA handbook project connected to the regulator's existing content repository, and Taxonomy Manager for Regulators links digital handbooks to online portals and obligation registers. The partners page shows logos for IBM, ServiceNow, Solidatus and Chainalysis among others. Inside the platform, controls mapping links obligations to a firm's policies, standards, procedures, controls and processes, and taxonomy routing sends content to the right business lines and teams. No connector is named, and there is no public API reference or integration guide that shows what syncs and in which direction.

Integration is described as part of the product, without named systems. RequirementONE says integrations run directly from the platform, through a bridge or through its API. API use is capped at 100 calls a day per user and 5,000 a day per account unless an order says otherwise, and integration is listed on the Collaborate tier. Reporting connects to whatever reporting tool the customer has standardized on, so any data in the platform can feed reports that refresh on a schedule or on demand. A suite of robotic process automations handles standard manual tasks, and the data lake lets other systems subscribe to regulatory updates as they arrive. No connector to a GRC, policy, document or collaboration system is named, and no API reference or integration guide is public. Nothing describes which objects sync or in which direction.

Delivery runs from Corlytics' own cloud, the environment named in its ISO/IEC 27001 scope. Implementations run remotely across time zones, led by a dedicated implementation team, and Corlytics says go lives can take a matter of weeks. The security page lists geo specific hosting among its principles. The hosting provider, regions and tenancy model are not named, and no choice of location is offered. The only geography in the privacy notice concerns personal data transfers outside the UK and EEA, which rely on adequacy decisions, approved contracts or other safeguards. Group companies in Ireland, England, Portugal and the United States describe where Corlytics operates rather than where client data sits.

The platform runs on Microsoft Azure. On the public cloud, a customer is placed on the Azure instance geographically closest to most of its users. A private cloud can be configured to any combination of location, sizing, redundancy, security posture and regulatory jurisdiction, with the data center set in the order and a minimum one year term. Under the data processing agreement, personal information may be processed globally as needed to deliver the service. Any data center restriction in the customer's order still applies, and cross border transfers are held to the agreement's security terms. Moving from the Expand tier to Collaborate involves migrating the customer to the most appropriate cloud. The regions in use today are not named, and where generative AI processing happens, or whether it stays in the customer's chosen region, is not stated.

Three certifications are named. ISO/IEC 27001 covers all activities of Corlytics Limited in delivering data and software for legislation, regulation and document management services from its cloud solutions. A SOC 2 Type 1 report from the independent CPA firm Thoropass tests control design against all five Trust Services Criteria at a point in time. ISO/IEC 42001:2023 came from A-LIGN in May 2025. An Information Security Manager runs the security program, whose principles include secure development, testing and quality assurance, continuous integration testing, infrastructure controls, geo specific hosting and incident response. One reinsurer cleared Corlytics through its own digital governance process as an approved third party supplier before rollout. No report or certificate is posted, and the security page invites readers to get in touch for more on its procedures.

No security certification or trust center is offered. Security commitments sit in the data processing agreement, which describes technical and organizational measures and incident detection and response without naming a framework, auditor or report. The one standard on the site is a 2020 quality statement. It commits the company to a quality management system conforming to BS EN ISO 9001:2000, a quality standard rather than a security one, and names no certification body or certificate. Private cloud customers can specify the security posture of their own instance.

Its AI is presented as the company's own work. Ensemble models with expert oversight handle classification and summaries, and specialized machine learning models handle obligation mapping. Gap remediation suggestions come from what Corlytics calls expert LLMs, and handbook tagging runs on a machine learning framework first built with the FCA. No model, model family or provider is named for any of them, and whether a third party foundation model is called, or where inference runs, is not stated. The ISO/IEC 42001 management system covers every product line, with no list of the models it governs and no commitment to tell clients when they change.

Generative AI is presented as a core capability of the platform, with no model, model family or provider named. Nothing says whether summaries, translations and extracted insights run on a third party foundation model or on RequirementONE's own models, where inference runs, or whether customer content leaves the Azure instance for processing. No commitment to tell customers when the models change is published. The subprocessor lists available through the helpdesk under the data processing agreement are the only route to learning which outside services handle customer data.

Buying Corlytics starts with a demo and a sales conversation, and no prices, plan names or units of charge are published. The platform is modular. In its case studies, clients start with Regulatory Monitoring and add Risk Analytics, Compliance Management or Clausematch policy management, and one payments provider added two modules within a month of going live. Implementation is run by a dedicated team, with an implementation manager for each client, in sprints. A crypto exchange went live in six weeks, while one reinsurer's rollout ran through requirements and design, a proof of concept and approval as a third party supplier. Modules and configuration can be added after go live. No figure is published for licenses, implementation or the work of building a firm's taxonomy and obligation register.

Prices are published in GBP, EUR, USD, CAD and AUD, charged per user and per monitored source each month. Try is free forever for one user and three sources from a shortlist, delivered as a personalized newsletter. Expand costs $12 per user and $40 per source a month, with two users free. Collaborate costs $24 per user and $81 per source, and Enterprise $24 per user and $121 per source. Volume pricing applies automatically, and a card is enough to move from Try to Expand. A source is one regulator or industry body website, and read only users are offered beside full users. Customer success services come as part of the subscription under a published customer success agreement, which sets out a standard and a premier support tier with different support hours, training and call allowances. A private cloud is priced on request with a one year minimum, and storage beyond 1 GB on monthly plans is charged at current rates.

Buyers are regulated financial firms and the regulators that oversee them, with a second line of business in health and life sciences. Sector pages cover global and private banks, hedge fund and investment managers, global insurers, payments and big tech, and regulators. Case studies add a reinsurer, a crypto exchange, a UK retail and commercial bank, a London merchant bank and a United States investment manager. Regulators buy a Taxonomy Manager edition that turns handbooks into machine readable, searchable databases with visual maps by theme, product and business line. Health and life sciences clients get regulatory sensing, guidance assessment, digital call for comments assessments and a repository that supports submissions. Financial services modules cover horizon scanning, the regulation library, obligations, change management, controls mapping, policy management, compliance monitoring, regulatory risk analytics and nonfinancial risk across operational, conduct, third party, cyber, AI and governance risk. Product pages speak to compliance, risk and audit teams and their chief officers, and case studies show legal teams working alongside them. No limit by firm size, jurisdiction or language is stated.

Buyers are compliance teams that track regulation, and the company says the product suits any size of customer, from one person to many teams across countries, and any jurisdiction. Sources span regulators, industry bodies and best practice sites worldwide, with hundreds already covered and new ones added on request. The interface and documentation can be provided in a team's own language. The platform also reaches past regulatory change. Customers have deployed apps for regulatory monitoring, regulatory change, policy management and risk management, and the home page sells ESG reporting, including CSRD data gathering and XBRL submission, and general business process digitalization. The one regulatory case study is an international financial services firm, and its awards come from fintech, regtech and insurance programs. No page breaks coverage down by industry, firm type or jurisdiction.