Corlytics vs Vixio: how they compare in 2026

Machine learning does three jobs on every incoming document: it decides what the document is about, condenses it, and connects it to related material. Regulatory notices, rules and enforcement actions are classified against Corlytics' universal regulatory taxonomy, long texts are summarized, and similar items are matched across datasets to flag duplication and feed gap analysis. Obligations Management goes further. Semantic parsing strips introductory and suggestive text from a rule to leave a set of action items. Specialized models map those obligations to a firm's policies, controls and products and consolidate the overlaps, and large language models propose wording that would close a gap in a policy or control. Policy Management drafts new policy content with AI, and Regulatory Risk Analytics runs Corlytics' own risk models over enforcement data. The machine learning framework that tags handbook provisions in real time was first built with the FCA in 2016 and 2017. Without the models, the version tracking, change packages, approval workflows, controls mapping and monitoring plans would still run as a regulatory workflow system.

The models sit on top of a twenty year content business rather than making it up, and Vixio says so, describing its offering as expert led data combined with AI tools and counting more than twenty specialist analysts among its assets. The content is written and validated by analysts: people validate and enrich high value updates before publication, and the regulatory intelligence graph holds more than 90,000 pieces of verified content. VIQ is a retrieval and drafting assistant over that material, described as a flagship rather than a foundation. Remove the models and the business that existed from 2006 remains saleable, with jurisdiction reports, analysis, an obligations library, horizon scanning and the task and audit workflow intact. Here the content is made by people and the AI queries it, rather than machine learning classifying and enriching the content itself.

Every alert, summary and obligation stays linked to the regulatory text it came from. The Regulation Library keeps laws, rules, handbooks and guidance in their original PDF, XML or HTML form, so second and third line teams read the documents they already know. It breaks each one down to obligation level. A version manager shows the current text of a rule beside the previous version, with changes lined in red and green, and keeps the full history. Obligations mapped to policies and controls point back to that source. Quality control is described as a process rather than a number. Subject matter experts at Corlytics validate the enriched content, and in Obligations Management the client's own experts review extracted and mapped obligations before gap reports go out. In the FCA handbook project, machine tagging ran with a review, approve or reject step and a full audit trail. No accuracy rate or test result is given for classification, summaries, extraction or mapping.

Grounding is real, documented and enforced by the design, and no figure is attached to it. VIQ is described as working in a closed environment over Vixio's own analyst verified data and never the open web, drawing on more than 6,200 curated sources and 20,000 regulatory documents. Every claim carries a direct citation to the original source text or the Vixio analyst report behind it, with links into deeper analysis, which the company frames as full explainability to a regulator. The retrieval method is described: a regulatory intelligence graph that connects content by intent rather than keyword. No accuracy rate, benchmark, test set or error analysis is published. The page heading claims grounded research with zero hallucinations, while the body text says the design minimizes and reduces hallucination risk, the more defensible of the two claims.

The platform automates the reading and routing of regulation and leaves decisions to people. Content is collected, classified and sent to the right business lines and teams without manual triage. Extraction and mapping run automatically, then the client's subject matter experts validate the results before gap reports and attestations are produced. Gap analysis returns suggested wording for a policy or control rather than changing it, and users are prompted to revisit mappings when a rule changes. Change management turns a regulatory change into a change package with owners, tasks and alerts at each stage, and records offline gap analysis alongside it. Policies pass through configurable multistage approvals. For the FCA's handbook, machine tagging ran inside a four eyes workflow in which users could review, approve or reject each change. No confidence level is described at which the models hold back output, and nothing covers what happens once a wrong mapping has reached a policy or control.

Three separate review mechanisms are published, and the control structure around them is incomplete. First, review of the content before it reaches a user: human in the loop is a named design pillar, with AI scanning about 8,000 daily sources and analysts validating and enriching high value updates before publication. Second, review of output at the point of use: the product carries a standing notice that VIQ uses AI across Vixio's own data only and that critical information should always be checked against official sources, and citations make that check possible. Third, behavior at the edge of coverage, covered under refusal. The rest is missing. Analyst validation applies to high value updates without defining them, so validation coverage is unknown. No confidence threshold is described for VIQ, and nothing says what happens after a wrong answer or how a correction reaches other users who relied on it.

The longest running named deployment is the FCA. A pilot began in September 2016 and the Intelligent Handbook went live on 10 May 2017, with Corlytics' taxonomy and machine learning tagging covering more than 18,000 provisions. Other FCA functions use it too, including to speed up firm onboarding. Arbuthnot Latham, a London private and merchant bank, is named in a case study about centralizing group policies, with standard templates, single sign on and staff attestation among its requirements. The International Compliance Association launched an alert tool on Corlytics feeds in June 2025 for more than 30,000 members, and GRC Report began carrying its feeds in September 2026. Six more case studies are anonymous. Corlytics puts the efficiency gain at 25% for the compliance monitoring and risk insight teams of a European tier 1 bank. A crypto exchange went live in six weeks, and a United States investment manager with more than one trillion in assets replaced older third party tools with it. Client logos also include FINRA, ING, abrdn, Block, Natixis, Patria, SCOR, Swiss Re and Vontobel. The headline claims, 40% of the world's 30 largest banks as clients and policy approvals 50% faster, come without a named source.

Two named customers, two named individuals with senior titles, and figures that describe the customer rather than the change. Inpay is named with a quote from Camila Witt, Chief Risk and Compliance Officer, describing daily use as part of the firm's risk management, alongside figures of more than 45 countries represented and a 99.6 percent transaction success rate. Bally's Corporation is named with a quote from Christine Scicluna, International Legal Director of Regulatory and Governance, alongside 17,700 slot machines and 20 casinos across the US and UK. Both link to full case studies. The limitation is precise: those numbers size the customer's business, not what using Vixio changed, and the testimony itself is qualitative. The only outcome figure located anywhere is a marketing claim that research time is cut by 90 percent, which carries no source or method. Neither case study was opened, and no date is published on either.

Each client's policies, obligation registers, impact assessments and control mappings sit in the platform, and the terms that govern that content are not public. No customer agreement, data processing agreement or confidentiality schedule is published. Nothing public says how client content is used, whether it trains the models, or how one client's data is kept apart from another's. The June 2026 privacy notice is the only data document. It covers personal data about people outside the customer relationship, such as website visitors, prospects and suppliers, though its reader list also names software users. It describes access controls, user authentication, encryption, staff confidentiality and regular security testing. ISO/IEC 42001 certifies how Corlytics governs its own AI, and ISO/IEC 27001 covers its information security management. Neither is a statement to clients about how their content may be used.

Almost nothing addresses what happens to customer content, and one published fact explains why. Clause 14 of the terms says Vixio is the controller of personal data provided to it, not a processor acting on customer instructions, because it decides what data is required, how it is used and how long it is kept. That position is why no data processing agreement exists. Beyond it, there is no training position on VIQ queries, no retention or deletion commitment for customer content, no separation description and no security page. The one data use term located is narrow: clause 6.3 covers only information submitted to the self assessment tool, which Vixio may use in perpetuity on an anonymous basis to improve its business and services. The privacy policy was not opened and may say more.

The product sells interpretation as well as information. The platform extracts obligations, filters them to a firm's activities and jurisdictions, suggests how a policy or control should change, and drafts policy text. In one UK bank's case, a third party consultancy used rules supplied by Corlytics to complete a rules mapping exercise the bank had agreed with its conduct regulator. The website legal notice says site content is general guidance that does not replace regulatory, compliance, risk analytics or other professional advice, and supplies it as is. It governs the website rather than the platform. No public statement says how platform output relates to legal or compliance advice, or who is responsible for checking it before a firm relies on it. The client expert validation step in Obligations Management is the clearest description of who signs off.

The professional responsibility position is stated in three places that support each other. In the agreement, clause 11 says commentary and materials are not meant to be advice to rely on, are not a definitive or complete statement of the law, and are not legal or expert advice or recommendations. Clause 6.2 says the same of self assessment reports, which are for information only. In the product, VIQ carries a standing notice that it uses AI across Vixio's own data only and that critical information should always be checked against official sources, and citations to sources make that instruction workable. The published FAQ asks directly whether VIQ replaces a legal team or compliance officers and answers no: it is built to support them, handling research, summaries and drafting so experts can focus on high stakes judgment. Jurisdiction limits are named: clause 10.2 warrants nothing about whether the materials are permitted under laws outside the UK and puts that check on the user. The terms were last updated in October 2023, before VIQ, so the statements specific to AI rest on the product page and FAQ rather than the contract.

An AI management system certified to ISO/IEC 42001:2023 covers the whole business. A-LIGN issued the certification in May 2025 after a two stage audit that found zero nonconformities, and Waystone Compliance Solutions advised on the program. The scope covers every product line. The program is framed around bias mitigation, risk and resilience controls across the AI lifecycle, and mapped to the EU AI Act and the UK National AI Strategy. Later releases add the NIST framework and OECD principles. Oisin Boydell, Chief Data Officer, speaks for the AI program, and founder John Byrne describes an AI by design strategy that reaches six competencies of the business. Product pages describe a science based method, ensemble models and expert validation at each stage. Test results are not published, so nothing shows how output quality varies across languages, jurisdictions or document types.

Nothing published addresses governance of Vixio's own AI, which contrasts with what the company publishes on the subject. Vixio has published research, The State of AI Trust in Regulatory Compliance 2026, and a press release reporting that 65 percent of compliance leaders distrust generic AI for regulatory decisions, and markets VIQ as designed to satisfy strict internal AI governance committees. All of that concerns the market's expectations and how VIQ meets a buyer's, not Vixio's own framework. No responsible AI page, AI policy, ethics statement, governance committee, named accountable owner, testing regime before release or bias evaluation is published. The site navigation and full footer were read; the legal set covers terms, privacy, cookies, a disclaimer, anti slavery and accessibility. The design commitments that do exist, closed grounding, analyst validation and citation tracing, are product properties covered under accuracy and oversight.

Clients' regulatory content, obligation registers and policies live in Corlytics' cloud platform, and no published document sets retention, deletion or subprocessor terms for them. The privacy notice covers personal data only. Corlytics keeps that data for the life of an active contract, or as legal and business needs require, then deletes or anonymizes it, with the detail in an unpublished Data Retention Policy. Breaches are notified without undue delay and reported to the supervisory authority under an unpublished Data Breach Management Policy. Luca Dalla Giacoma is the named Data Protection Officer. The same notice lists access controls, authentication, encryption, IP anonymization, network security, business continuity and disaster recovery, and regular testing. It names recipients only by category: staff, technical service providers acting as processors or subprocessors, authorities such as HMRC, professional advisers and buyers of the business. The ISO/IEC 27001 certificate covers the information security management behind the service.

Nothing is published on retention, deletion, subprocessors, incident notice or encryption, and one published fact explains why. There is no security page in the navigation or footer, both read in full. No retention period, deletion route, subprocessor list, breach notification commitment or encryption statement is published for customer content. No data processing agreement exists, and clause 14 of the terms explains why: Vixio treats itself as the controller of personal data provided to it rather than a processor, because it decides what data is required, how it is used, whether third parties process it and how long it is kept. A buyer therefore has no processor commitments to read, by design. The privacy policy was not opened and may say more about retention or sharing.

The only public legal document is a website notice. It supplies site content as is, disclaims accuracy, timeliness and completeness, and excludes liability for direct, indirect, consequential and other damages arising from the site. The client application sits behind a sign in, and no customer agreement, order form or service terms is published, so the platform's warranties, indemnities and liability limits are not public. Clients use the output in front of regulators. Firms rely on Corlytics mappings to evidence compliance and attest to supervisors, and one UK bank used Corlytics rules in a rules mapping exercise agreed with its conduct regulator. No public term says who carries the loss if a mapping, summary or suggested policy change turns out to be wrong.

The allocation of loss can be read in advance, through a standard limitation clause, in an agreement older than the AI product it now governs. Clause 10.10 caps liability at the price paid for the particular services in the twelve months before the claim. Clause 10.4 excludes direct as well as indirect, special and consequential losses, along with lost profits, savings, business, opportunity, goodwill, data, contract, use and management time. Clause 10.3 keeps the mandatory carve outs for death or personal injury caused by negligence, fraud and anything that cannot lawfully be excluded. Materials are supplied as is, with all other warranties excluded in clauses 10.1 and 10.9. One protection favors the customer: clause 12.3 requires Vixio, at its own expense, to defend third party intellectual property claims arising from the website or materials and pay resulting judgments or settlements, on standard conditions. There is no insurance position, no warranty on output, and nothing on a wrong AI answer. The terms were last updated 12 October 2023, before VIQ existed.

The platform is built to sit beside a firm's GRC stack and feed it. The Regulation Library is described as fully API ready, with an Open API for major GRC platforms. Regulatory Monitoring, Obligations Management and Compliance Monitoring each send data or outcomes into a firm's GRC environment, and an investment manager client uses the data to feed its internal compliance newsletter. The FCA handbook project connected to the regulator's existing content repository, and Taxonomy Manager for Regulators links digital handbooks to online portals and obligation registers. The partners page shows logos for IBM, ServiceNow, Solidatus and Chainalysis among others. Inside the platform, controls mapping links obligations to a firm's policies, standards, procedures, controls and processes, and taxonomy routing sends content to the right business lines and teams. No connector is named, and there is no public API reference or integration guide that shows what syncs and in which direction.

Nothing published addresses connecting Vixio to other systems. The site navigation and full footer, read, have no integrations page, API reference, developer documentation or connector directory, and no third party system is named as an integration target. Every workflow tool is internal: task management, project tracking, reporting, the obligations library and the document store all work inside Vixio rather than pushing obligations or tasks into a customer's GRC, policy or document management systems. The nearest outbound flow is generating reports and sharing them by URL, which is document distribution, not integration. The two services also use separate login domains for gambling and payments rather than one environment. The product's output is meant to end in changed controls and updated policies inside other systems, so this is a real gap.

Delivery runs from Corlytics' own cloud, the environment named in its ISO/IEC 27001 scope. Implementations run remotely across time zones, led by a dedicated implementation team, and Corlytics says go lives can take a matter of weeks. The security page lists geo specific hosting among its principles. The hosting provider, regions and tenancy model are not named, and no choice of location is offered. The only geography in the privacy notice concerns personal data transfers outside the UK and EEA, which rely on adequacy decisions, approved contracts or other safeguards. Group companies in Ireland, England, Portugal and the United States describe where Corlytics operates rather than where client data sits.

Nothing published addresses deployment or residency. No hosting provider, data center location, region option, tenancy model or processing location is published on any surface read, and there is no security page in which such detail would ordinarily sit. What can be established is limited to the delivery shape and the corporate footing: the services are browser-delivered through two hosted environments at gc.vixio.com and pc.vixio.com, a status page is published at status.vixio.com, and the contracting entity is Compliance Online Limited, registered in England and Wales with company number 05706431 at St Clare House, 30 Minories, London, with the terms governed by English law and subject to the exclusive jurisdiction of the English courts. That tells a buyer which legal system applies and nothing about where its data sits or who runs the infrastructure. The privacy policy was not opened and is the remaining surface that might address international transfers.

Three certifications are named. ISO/IEC 27001 covers all activities of Corlytics Limited in delivering data and software for legislation, regulation and document management services from its cloud solutions. A SOC 2 Type 1 report from the independent CPA firm Thoropass tests control design against all five Trust Services Criteria at a point in time. ISO/IEC 42001:2023 came from A-LIGN in May 2025. An Information Security Manager runs the security program, whose principles include secure development, testing and quality assurance, continuous integration testing, infrastructure controls, geo specific hosting and incident response. One reinsurer cleared Corlytics through its own digital governance process as an approved third party supplier before rollout. No report or certificate is posted, and the security page invites readers to get in touch for more on its procedures.

No independent security attestation is claimed anywhere. No SOC 2, ISO 27001, ISO 27701 or equivalent appears on the home page, the VIQ page, the terms or the footer, and there is no security page, trust center or compliance page; all were read in full. No auditor, certification body, penetration test, scope statement or report request route is published, and no certification mark appears on the site. The only assurance related items are a service status page and two industry awards in the footer, neither a security attestation. The platform is sold to banks, payment institutions, licensed gambling operators and regulators, all of which run third party assurance as routine. This records what the public pages show, not what Vixio holds internally.

Its AI is presented as the company's own work. Ensemble models with expert oversight handle classification and summaries, and specialized machine learning models handle obligation mapping. Gap remediation suggestions come from what Corlytics calls expert LLMs, and handbook tagging runs on a machine learning framework first built with the FCA. No model, model family or provider is named for any of them, and whether a third party foundation model is called, or where inference runs, is not stated. The ISO/IEC 42001 management system covers every product line, with no list of the models it governs and no commitment to tell clients when they change.

The data boundary is described precisely, and the model behind it is never named. Vixio publishes a retrieval design rather than a model stack: a regulatory intelligence graph of more than 90,000 verified content items connected by intent rather than keyword, drawing on more than 6,200 curated sources, with VIQ working only across Vixio's own data and never the open web. That answers where the knowledge comes from, a compliance buyer's first question, and leaves the vendor risk question open. No model, model family, provider or hosting arrangement is named, nothing says whether a third party foundation model generates the answers, and nothing rules one out. No commitment to notify customers when the models change is published. A customer quote on the same page praises VIQ for never touching the open web, which concerns the content rather than whose model reads it.

Buying Corlytics starts with a demo and a sales conversation, and no prices, plan names or units of charge are published. The platform is modular. In its case studies, clients start with Regulatory Monitoring and add Risk Analytics, Compliance Management or Clausematch policy management, and one payments provider added two modules within a month of going live. Implementation is run by a dedicated team, with an implementation manager for each client, in sprints. A crypto exchange went live in six weeks, while one reinsurer's rollout ran through requirements and design, a proof of concept and approval as a third party supplier. Modules and configuration can be added after go live. No figure is published for licenses, implementation or the work of building a firm's taxonomy and obligation register.

No rate is published, but much of the commercial shape can be read from the terms, since there is no pricing page. The unit of charge is stated: a subscriber license covers either a fixed number of users or unlimited users, with login details issued to each user and Vixio reserving the right to audit password sharing. Payment for bespoke work is published: 50 percent up front as a deposit and the rest on delivery, with extra fees agreed in advance for research beyond the agreed scope. Renewal favors the customer. A reminder setting out the price goes out a month before expiry, and renewal needs written confirmation rather than happening by default; unlimited user licenses are likely to be repriced upward after a merger or acquisition. Late payment carries interest at 5 percent above the Bank of England base rate. Clause 8.1 implies some prices for one off reports are on the website, but no figure is published on any page read.

Buyers are regulated financial firms and the regulators that oversee them, with a second line of business in health and life sciences. Sector pages cover global and private banks, hedge fund and investment managers, global insurers, payments and big tech, and regulators. Case studies add a reinsurer, a crypto exchange, a UK retail and commercial bank, a London merchant bank and a United States investment manager. Regulators buy a Taxonomy Manager edition that turns handbooks into machine readable, searchable databases with visual maps by theme, product and business line. Health and life sciences clients get regulatory sensing, guidance assessment, digital call for comments assessments and a repository that supports submissions. Financial services modules cover horizon scanning, the regulation library, obligations, change management, controls mapping, policy management, compliance monitoring, regulatory risk analytics and nonfinancial risk across operational, conduct, third party, cyber, AI and governance risk. Product pages speak to compliance, risk and audit teams and their chief officers, and case studies show legal teams working alongside them. No limit by firm size, jurisdiction or language is stated.

The buyer picture is precisely segmented, and the coverage figures conflict. Two industries are covered, each with a hub and five named buyer segments. In financial services: payment services, retail banking, digital assets, regulators and law firms. In gambling: online operators, suppliers, payment service providers, regulators and law firms. Regulators and law firms are addressed as buyers alongside regulated firms, with their own pages. The boundary is stated: the platform is described as built for financial services and gambling. Named regimes include AML, GDPR, MiFID II, MiCA, PSD2, FATF, UKGC, MGA and AGCO. The figures do not match. The home page states more than 200 jurisdictions and more than 1,400 regulatory authorities, while the VIQ page states over 1,600 regulators across more than 246 jurisdictions. Nothing reconciles them or shows which jurisdictions get analyst depth rather than monitoring alone.