CUBE vs Vixio: how they compare in 2026

CUBE's regulatory content would stand without the models. Its 250 regulatory experts review and curate it, and Powered By licenses that content to other platforms on its own. The models do the processing at scale. Proprietary AI trained only on regulatory content classifies, extracts, maps and links publications from more than 10,000 issuing bodies into about 10 million structured obligations. Inside RegPlatform, agentic coworkers triage change for a firm, answer questions in natural language, rewrite and generate controls, and analyze enforcement actions.

The models sit on top of a twenty year content business rather than making it up, and Vixio says so, describing its offering as expert led data combined with AI tools and counting more than twenty specialist analysts among its assets. The content is written and validated by analysts: people validate and enrich high value updates before publication, and the regulatory intelligence graph holds more than 90,000 pieces of verified content. VIQ is a retrieval and drafting assistant over that material, described as a flagship rather than a foundation. Remove the models and the business that existed from 2006 remains saleable, with jurisdiction reports, analysis, an obligations library, horizon scanning and the task and audit workflow intact. Here the content is made by people and the AI queries it, rather than machine learning classifying and enriching the content itself.

Every coworker works from CUBE's own curated regulatory intelligence rather than the open web, and CUBE describes the output as sourced and auditable. The Analysis Coworker returns structured answers with their sources across applicable updates and the laws, rules and regulations in RegBook, and keeps the research record in the platform. Content is versioned, and each obligation keeps its lineage back to the regulatory text. No accuracy rate for classification, obligation extraction or coworker answers is published, and no test set or benchmark sits behind the AI.

Grounding is real, documented and enforced by the design, and no figure is attached to it. VIQ is described as working in a closed environment over Vixio's own analyst verified data and never the open web, drawing on more than 6,200 curated sources and 20,000 regulatory documents. Every claim carries a direct citation to the original source text or the Vixio analyst report behind it, with links into deeper analysis, which the company frames as full explainability to a regulator. The retrieval method is described: a regulatory intelligence graph that connects content by intent rather than keyword. No accuracy rate, benchmark, test set or error analysis is published. The page heading claims grounded research with zero hallucinations, while the body text says the design minimizes and reduces hallucination risk, the more defensible of the two claims.

The coworkers work inside RegPlatform beside compliance and risk teams, surfacing what is relevant and drafting the next step, and CUBE calls their output explainable. The Priorities Coworker ranks developments by certainty and applicability and keeps a full audit trail of its assessment decisions. Regulatory Inventory logs the reasoning when it maps a change to entities, jurisdictions and business lines, and workflow carries tasks, ownership and approvals through each stage. Intel pairs the AI with review by CUBE's regulatory experts. What a coworker may do without a person approving it, and what happens after a wrong assessment, are not described.

Three separate review mechanisms are published, and the control structure around them is incomplete. First, review of the content before it reaches a user: human in the loop is a named design pillar, with AI scanning about 8,000 daily sources and analysts validating and enriching high value updates before publication. Second, review of output at the point of use: the product carries a standing notice that VIQ uses AI across Vixio's own data only and that critical information should always be checked against official sources, and citations make that check possible. Third, behavior at the edge of coverage, covered under refusal. The rest is missing. Analyst validation applies to high value updates without defining them, so validation coverage is unknown. No confidence threshold is described for VIQ, and nothing says what happens after a wrong answer or how a correction reaches other users who relied on it.

CUBE says it serves many of the world's largest financial institutions, with operations across Europe, the United States, Canada, Asia and Australia. It puts its scale at about 10 million data points processed a year, 250 regulatory experts and around 1,000 staff in 10 offices. No customer is named. The one outcome figure comes from early customer testing of the Priorities Coworker, which cut noise by 80 to 90 percent, with no customer, date or method attached. IBM embedded CUBE's regulatory intelligence in a Regulatory Horizon Scanning capability for watsonx.governance, announced in September 2026, as a partnership with no deployment figures.

Two named customers, two named individuals with senior titles, and figures that describe the customer rather than the change. Inpay is named with a quote from Camila Witt, Chief Risk and Compliance Officer, describing daily use as part of the firm's risk management, alongside figures of more than 45 countries represented and a 99.6 percent transaction success rate. Bally's Corporation is named with a quote from Christine Scicluna, International Legal Director of Regulatory and Governance, alongside 17,700 slot machines and 20 casinos across the US and UK. Both link to full case studies. The limitation is precise: those numbers size the customer's business, not what using Vixio changed, and the testimony itself is qualitative. The only outcome figure located anywhere is a marketing claim that research time is cut by 90 percent, which carries no source or method. Neither case study was opened, and no date is published on either.

The Global Terms and Conditions for CUBE Services, January 2026, leave customer data owned by the customer and license CUBE to use and store it only as far as needed to perform the agreement. Customer data counts as the customer's confidential information. Clause 10.3 limits a compelled disclosure to what a court or regulator orders, with written notice first where CUBE is able to give it. The data security exhibit commits CUBE to a written information security program aligned with a recognized standard. No term addresses privilege, work product or segregation between customers, and the license lets CUBE keep customer data after the agreement ends.

Almost nothing addresses what happens to customer content, and one published fact explains why. Clause 14 of the terms says Vixio is the controller of personal data provided to it, not a processor acting on customer instructions, because it decides what data is required, how it is used and how long it is kept. That position is why no data processing agreement exists. Beyond it, there is no training position on VIQ queries, no retention or deletion commitment for customer content, no separation description and no security page. The one data use term located is narrow: clause 6.3 covers only information submitted to the self assessment tool, which Vixio may use in perpetuity on an anonymous basis to improve its business and services. The privacy policy was not opened and may say more.

Clause 12.1.4 of the Intel subscription terms says the services are not financial, tax, accounting, legal, compliance or other professional advice, and CUBE disclaims damages from decisions made in reliance on them. The Global Terms behind RegPlatform exclude liability for decisions a customer makes on the services and content, without the same statement. The website terms call site content general information rather than advice. CUBE's own pitch is helping teams track, interpret and act on regulatory change, while its home page line is that CUBE brings the insights and the customer decides. Nothing addresses the supervision or competence of the lawyers and compliance staff relying on the output, and no jurisdiction limit is named.

The professional responsibility position is stated in three places that support each other. In the agreement, clause 11 says commentary and materials are not meant to be advice to rely on, are not a definitive or complete statement of the law, and are not legal or expert advice or recommendations. Clause 6.2 says the same of self assessment reports, which are for information only. In the product, VIQ carries a standing notice that it uses AI across Vixio's own data only and that critical information should always be checked against official sources, and citations to sources make that instruction workable. The published FAQ asks directly whether VIQ replaces a legal team or compliance officers and answers no: it is built to support them, handling research, summaries and drafting so experts can focus on high stakes judgment. Jurisdiction limits are named: clause 10.2 warrants nothing about whether the materials are permitted under laws outside the UK and puts that check on the user. The terms were last updated in October 2023, before VIQ, so the statements specific to AI rest on the product page and FAQ rather than the contract.

The AI is described as proprietary, trained only on regulatory content and native to the product rather than added on, with coworker output explainable, sourced and auditable. No AI policy, set of principles, framework, accountable owner or testing before release is published, and nothing covers uneven output across jurisdictions, languages or firm types. CUBE's intelligence feeds IBM's watsonx.governance, a tool enterprises use to govern their own AI, which says nothing about how CUBE governs its models.

Nothing published addresses governance of Vixio's own AI, which contrasts with what the company publishes on the subject. Vixio has published research, The State of AI Trust in Regulatory Compliance 2026, and a press release reporting that 65 percent of compliance leaders distrust generic AI for regulatory decisions, and markets VIQ as designed to satisfy strict internal AI governance committees. All of that concerns the market's expectations and how VIQ meets a buyer's, not Vixio's own framework. No responsible AI page, AI policy, ethics statement, governance committee, named accountable owner, testing regime before release or bias evaluation is published. The site navigation and full footer were read; the legal set covers terms, privacy, cookies, a disclaimer, anti slavery and accessibility. The design commitments that do exist, closed grounding, analyst validation and citation tracing, are product properties covered under accuracy and oversight.

The privacy exhibit, March 2026, has CUBE process personal data only as the agreement requires or on written instruction, amend, transfer or delete it on request, and keep it confidential. Either party reports a security breach within 72 hours, and CUBE tells no third party about a breach without the customer's consent unless the law requires it. An annex lists the material subprocessors, and the customer gets five days to object to a new one. Under the Global Terms, CUBE backs up customer data daily and keeps only the latest copy, and at the end of the agreement it deletes or returns personal data at the customer's option. Other customer data may be kept after termination, and no retention period is stated.

Nothing is published on retention, deletion, subprocessors, incident notice or encryption, and one published fact explains why. There is no security page in the navigation or footer, both read in full. No retention period, deletion route, subprocessor list, breach notification commitment or encryption statement is published for customer content. No data processing agreement exists, and clause 14 of the terms explains why: Vixio treats itself as the controller of personal data provided to it rather than a processor, because it decides what data is required, how it is used, whether third parties process it and how long it is kept. A buyer therefore has no processor commitments to read, by design. The privacy policy was not opened and may say more about retention or sharing.

Clause 11.2 of the Global Terms has CUBE defend and indemnify the customer against third party claims that the services infringe intellectual property. The remedies are to procure a right, modify or replace the services, or terminate and refund unused fees, with exclusions for freely available content, modification by others, misuse and unapproved combinations. Clause 12.4 excludes lost profits, lost data and consequential loss and caps CUBE at the fees for the contract year, rising to three times those fees for breach of confidentiality and for indemnity claims. Clause 4.1 warrants that the services are performed with the skill and care of the industry and in line with the documentation, with correction or reperformance as the remedy. Accuracy, completeness and timeliness of content are disclaimed, CUBE carries no liability for decisions the customer makes on it, and no insurance is stated.

The allocation of loss can be read in advance, through a standard limitation clause, in an agreement older than the AI product it now governs. Clause 10.10 caps liability at the price paid for the particular services in the twelve months before the claim. Clause 10.4 excludes direct as well as indirect, special and consequential losses, along with lost profits, savings, business, opportunity, goodwill, data, contract, use and management time. Clause 10.3 keeps the mandatory carve outs for death or personal injury caused by negligence, fraud and anything that cannot lawfully be excluded. Materials are supplied as is, with all other warranties excluded in clauses 10.1 and 10.9. One protection favors the customer: clause 12.3 requires Vixio, at its own expense, to defend third party intellectual property claims arising from the website or materials and pay resulting judgments or settlements, on standard conditions. There is no insurance position, no warranty on output, and nothing on a wrong AI answer. The terms were last updated 12 October 2023, before VIQ existed.

RegConnect, CUBE's API module, connects RegPlatform with GRC platforms, policy tools and internal systems in both directions. Authorized applications pull regulatory intelligence, trigger platform functions and push data back, under role based authentication with every access logged. Links between regulatory content and downstream policies, processes and controls stay live, so connected items are flagged for review when a rule changes. Intel content reaches other systems through a REST API with a developer portal, and Powered By licenses content to platform builders. IBM's watsonx.governance is the one named destination. The developer documentation is not public, and no GRC platform is named.

Nothing published addresses connecting Vixio to other systems. The site navigation and full footer, read, have no integrations page, API reference, developer documentation or connector directory, and no third party system is named as an integration target. Every workflow tool is internal: task management, project tracking, reporting, the obligations library and the document store all work inside Vixio rather than pushing obligations or tasks into a customer's GRC, policy or document management systems. The nearest outbound flow is generating reports and sharing them by URL, which is document distribution, not integration. The two services also use separate login domains for gambling and payments rather than one environment. The product's output is meant to end in changed controls and updated policies inside other systems, so this is a real gap.

Annex A of the privacy exhibit sets out where CUBE runs. Enterprise services sit in two data centers in Great Britain, Datum in Farnborough and Vantage in Newport. Microsoft Azure hosts Intel and Hub AI in the United Kingdom and EU North, RegRoom in the United States and Oden in an eastern United States region. Group companies give technical and operational support under an intragroup agreement carrying EU standard contractual clauses and the UK transfer addendum. No customer choice of region is described, and where processing happens is not separated from where data is stored.

Nothing published addresses deployment or residency. No hosting provider, data center location, region option, tenancy model or processing location is published on any surface read, and there is no security page in which such detail would ordinarily sit. What can be established is limited to the delivery shape and the corporate footing: the services are browser-delivered through two hosted environments at gc.vixio.com and pc.vixio.com, a status page is published at status.vixio.com, and the contracting entity is Compliance Online Limited, registered in England and Wales with company number 05706431 at St Clare House, 30 Minories, London, with the terms governed by English law and subject to the exclusive jurisdiction of the English courts. That tells a buyer which legal system applies and nothing about where its data sits or who runs the infrastructure. The privacy policy was not opened and is the remaining surface that might address international transfers.

No ISO 27001, SOC 2 or other certification is claimed on CUBE's site or in its agreements, and no auditor or report is named. The data security exhibit commits it to a written information security program that adopts or aligns with an industry standard, with the ISO 27000 family, SOC 2 Type 2 and CIS benchmarks given as examples. The privacy exhibit mentions a trust center portal as one possible route for subprocessor updates, and no trust center is linked from the site.

No independent security attestation is claimed anywhere. No SOC 2, ISO 27001, ISO 27701 or equivalent appears on the home page, the VIQ page, the terms or the footer, and there is no security page, trust center or compliance page; all were read in full. No auditor, certification body, penetration test, scope statement or report request route is published, and no certification mark appears on the site. The only assurance related items are a service status page and two industry awards in the footer, neither a security attestation. The platform is sold to banks, payment institutions, licensed gambling operators and regulators, all of which run third party assurance as routine. This records what the public pages show, not what Vixio holds internally.

CUBE describes its AI as proprietary and trained only on regulatory content, classifying, extracting, mapping and linking publications in 100 languages. Its coworkers draw on regulatory and network intelligence that, in CUBE's words, generic AI models are not trained on. No model, model family or outside model provider is named, and nothing says whether a general purpose model sits behind the coworkers' natural language answers. Microsoft Azure appears as a hosting subprocessor, and no notice of model changes is committed.

The data boundary is described precisely, and the model behind it is never named. Vixio publishes a retrieval design rather than a model stack: a regulatory intelligence graph of more than 90,000 verified content items connected by intent rather than keyword, drawing on more than 6,200 curated sources, with VIQ working only across Vixio's own data and never the open web. That answers where the knowledge comes from, a compliance buyer's first question, and leaves the vendor risk question open. No model, model family, provider or hosting arrangement is named, nothing says whether a third party foundation model generates the answers, and nothing rules one out. No commitment to notify customers when the models change is published. A customer quote on the same page praises VIQ for never touching the open web, which concerns the content rather than whose model reads it.

No price is published, and every product page routes to a demo or a conversation with a CUBE expert. Its Global Terms set the commercial shape. Fees are set for each contract year in an order form that names the number of authorized users, and invoices follow the order form's payment terms. Unless the order form fixes the fees, they rise 5 percent at the start of each contract year, late amounts carry 1.5 percent a month, and the agreement renews unless either side gives 60 days' notice. Intel has its own subscription terms, version 1.1 of June 2026. Nothing states what implementation adds.

No rate is published, but much of the commercial shape can be read from the terms, since there is no pricing page. The unit of charge is stated: a subscriber license covers either a fixed number of users or unlimited users, with login details issued to each user and Vixio reserving the right to audit password sharing. Payment for bespoke work is published: 50 percent up front as a deposit and the rest on delivery, with extra fees agreed in advance for research beyond the agreed scope. Renewal favors the customer. A reminder setting out the price goes out a month before expiry, and renewal needs written confirmation rather than happening by default; unlimited user licenses are likely to be repriced upward after a merger or acquisition. Late payment carries interest at 5 percent above the Bank of England base rate. Clause 8.1 implies some prices for one off reports are on the website, but no figure is published on any page read.

Highly regulated industries are CUBE's focus, with solution pages for banking, financial services, insurance, corporates and partners. RegPlatform serves enterprise compliance and risk teams across the first and second lines, and Intel targets fast growing regulated businesses. Oden covers state by state notices and guidance for American insurers writing commercial or personal lines, and Powered By serves platform builders, information businesses and technology providers. Coverage spans regulatory publications, guidance and enforcement actions from more than 10,000 issuing bodies in 250 countries and territories and 100 languages. No practice area or obligation type is named as out of scope.

The buyer picture is precisely segmented, and the coverage figures conflict. Two industries are covered, each with a hub and five named buyer segments. In financial services: payment services, retail banking, digital assets, regulators and law firms. In gambling: online operators, suppliers, payment service providers, regulators and law firms. Regulators and law firms are addressed as buyers alongside regulated firms, with their own pages. The boundary is stated: the platform is described as built for financial services and gambling. Named regimes include AML, GDPR, MiFID II, MiCA, PSD2, FATF, UKGC, MGA and AGCO. The figures do not match. The home page states more than 200 jurisdictions and more than 1,400 regulatory authorities, while the VIQ page states over 1,600 regulators across more than 246 jurisdictions. Nothing reconciles them or shows which jurisdictions get analyst depth rather than monitoring alone.