Onspring vs Regology: how they compare in 2026
These two can sit in the same stack rather than compete for the same budget. Onspring is a no code governance, risk and compliance platform a team configures without developers. Regology is a regulatory intelligence layer that deliberately does not replace one: it names ServiceNow, Archer and Hyperproof as systems it sits beside and states that no rip and replace is required. The pair produces a neat symmetry. Onspring names the provider behind its AI outright, stating that Onspring AI runs on Anthropic's Claude family, but does not name the firm that audited its SOC 2. Regology names its auditor, BARR Advisory, and states the scope of the examination, but names no model or provider at all. Each publishes the fact the other withholds. Regology also publishes its Terms of Service, carrying an intellectual property indemnity, a twelve month fee cap and a statement that AI output must be independently verified. Onspring publishes no customer agreement and no liability position. Neither publishes a hosting region.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
AI here is an addition rather than a foundation, and the vendor says so. Onspring is a no code GRC platform that sold for years before any AI shipped. Onspring AI launched in October 2025 as an optional add on that customers enable and configure, and was extended in July 2026 into agentic operation. The vendor says customers have total control over when and how it is used, which also shows the product works without it. Removing the model layer would remove an efficiency layer over data entry, documentation drafting, duplicate detection and record linking, and leave the whole platform standing. The AI is real, shipped, documented and dated.
The Smart Law Library is a curated, continuously updated body of federal law, all fifty states and international jurisdictions. It works as a product without the models, since finding a law, following its changes and reading its version history all run on it directly. Customers can import their own law libraries into it from spreadsheets and PDFs. The models drive the work on top. Three named agents, for Regulatory Change, Compliance and Research, decide which laws apply to an organization, assess the impact of incoming changes, and generate obligations, risks, controls and policies mapped to source law. Reggi, the generative assistant, answers questions in plain language, rates incoming alerts for relevance and is free for individual use.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Nothing is published. Onspring AI drafts and revises long form content, creates records from prompts, completes text predictively, and reads and summarizes uploaded documents such as SOC 2 reports to fill fields. Each is a generation task where a wrong output lands in a compliance record. None carries a published grounding claim, citation behavior, accuracy figure, precision or recall for duplicate detection or field extraction, hallucination rate, evaluation, or statement of what the assistant does when it has no answer. The assistant is documented as able to answer from every record and application in a customer's GRC program, and nothing says how those answers are grounded in the underlying records.
Traceability is the design goal. Each alert, assignment, decision, approval, rejection and policy update carries a timestamp and a link to the law behind it, so an obligation or control the platform generates leads back to the provision it comes from. That provision sits in Regology's own maintained library rather than the open web, and Reggi answers carry citations to it on every plan, the free one included. No accuracy figure, error rate for applicability decisions, test set or benchmark is published for the agents or for Reggi.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The boundary on agent action is something the customer configures, not only a vendor assurance. The July 2026 release says administrators define the rules that prompt agent action, that automation works within boundaries the system administrator sets, and that the design aims at a governed assistant that keeps users in control. The module is opt in and configurable to organizational standards, and an internal AI governance council is named as the oversight body. A compliance function can show an examiner three things: whether the module is on, what rules trigger action, and who governs it. None of the mechanics are published. There is no rule syntax, scope limit or statement of what an agent may never do, nothing on escalation or human confirmation, and no description of what the audit trail records when an agent rather than a person acts.
People sign off on what the agents produce. Assignments, decisions, approvals and rejections are captured and timestamped, so a person accepts or rejects each output and that choice stays in the record, with rejection a logged path rather than an exception. The agents automate repetitive manual work and flag coming changes, and compliance teams act on what they produce. The Responsible AI Policy commits to human in the loop processes for critical decisions. No threshold at which an agent defers is described, nor what the system does when applicability is uncertain or how much of its output is expected to be reviewed.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Customers are named. American Family Insurance uses the platform for IT risk and GRC program management, Warner Bros. Discovery for GRC management, Memorial Hermann Health System for audit, and Northgate Resorts reports saving 200 compliance hours from a single integration. The vendor also publishes an annual GRC Benchmarking Report, including a finding that 70 percent of GRC practitioners see simplifying repeated administrative work as the biggest AI opportunity; that is dated, attributable industry research rather than product evidence. The named customers are described by use case without outcome methods, the 200 hours figure has no baseline or period, and none of the named accounts is a legal department. The evidence supports the GRC product rather than the Corporate Counsel solution.
Seven case studies describe deployments without naming the customer. They cover a sports betting platform, a large financial regulator, a global social media and technology company, a currency exchange provider, a regional bank, a cryptocurrency exchange and one of the largest American banks. The regional bank gained automated impact analysis, faster assessment of regulatory changes and better audit documentation, and the study of the large bank covers regulatory exemptions handled with AI. None of the studies gives a figure or a date. Regology was founded by former PwC compliance professionals with seven years implementing regulatory programs at large financial institutions. No named customer is paired with a measured outcome.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
General confidentiality is claimed and evidenced; legal specific confidentiality is not addressed at all. The vendor publishes a SOC 2 Type II attestation covering security, availability and confidentiality, and states that information privacy, security and risk management policies are documented with defined roles, responsibilities, policies and procedures protecting stored data. That is a real confidentiality position for a platform generally. What does not exist: any treatment of legal privilege or attorney work product, any statement about the confidentiality of matter records held in the Corporate Counsel solution, and any acknowledgment that a legal department's records on the platform differ in kind from an IT risk register. Checked the security page, the corporate counsel solution page, the platform pages and the AI announcements. This matters more than usual here because the same platform holds both the legal department's matters and the business units those matters concern.
Customer data stays the customer's property, and section 6.A of the terms licenses Regology to use it only as needed to provide the services. Section 11 binds Regology to keep customer confidential information secret, to give prompt notice of legal process and to return or destroy that information on request. SOC 2 Type II covers security, availability and confidentiality, with BARR Advisory named as auditor in earlier announcements. Nothing covers segregation between customers, privilege or work product. The material in the platform is a customer's own obligations, controls, policies and compliance decisions, including what it rejected.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Not addressed. The Corporate Counsel solution holds legal opinions, legal research and a clause library whose clauses are selected automatically by contract type, and Onspring AI can draft and revise long form field content across the platform. Generated or automatically selected contract language can reach a business user without a lawyer in between, and nothing addresses that risk. There is no statement that output is not legal advice, no position on the reviewing lawyer's role and no professional responsibility material.
Section 17 of the terms says Reggi AI uses generative AI and a large language model to answer legal and regulatory questions, and that the accuracy, completeness and timeliness of its answers cannot be guaranteed. Customers are told to verify every response independently, no attorney client relationship arises, and Reggi is no substitute for legal advice, so a customer consults its own lawyer. Section 18 says the platform, services and content give no legal, tax or other professional advice. The buyers are compliance, legal and risk teams. No bar guidance is named, and nothing describes how the product supports a supervising lawyer.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
A governance body is named, and nothing it produces is published. Onspring AI is stated to operate under the oversight of the company's AI governance council, and customers can configure the module to their own organizational standards and compliance requirements. Nothing the council would produce is published: no AI policy, model evaluation, bias testing or fairness assessment, accuracy monitoring, drift or regression statement, model card or ISO 42001, and no description of what the council reviews or when. A named committee with no published output is a claim rather than evidence.
The Responsible AI Policy, effective 1 December 2024, sets out an AI risk management framework grounded in principles from the National Institute of Standards and Technology. It covers every AI system Regology develops, deploys or uses. An AI Ethics and Risk Committee approves AI projects, and an AI Risk Management Lead runs day to day risk assessment, mitigation and staff education. Each AI system is assessed for safety, security, privacy, fairness and accountability. The policy commits to regular bias audits and fairness tests, explainability techniques, human in the loop processes for critical decisions, continuous monitoring and staff training. No audit result is published, the lead is not named, and nothing covers uneven output across jurisdictions, industries or organization types.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Platform stewardship is evidenced, and stewardship specific to the AI is not. The SOC 2 Type II attestation covers security, availability and confidentiality, documented privacy, security and risk management policies are stated, and SecurityScorecard is cited as giving a score of 100 out of 100. Nothing addresses what happens to customer content once it reaches the AI layer: whether customer records, policies or uploaded documents train or improve any model, how long prompts or generated output are kept, or how data flows to the model provider and back. That gap stands out because the provider is named, so the vendor has disclosed the harder fact and stopped short of the easier one.
Section 11.E of the terms has Regology return or destroy customer confidential information at the customer's option on written request, then certify it in writing, and section 10 confines personal data to performing the services. SOC 2 Type II covers security, availability and confidentiality, and Regology states a continuing commitment to keeping it. The Responsible AI Policy names data security measures, responsible data sourcing and consent mechanisms in a line each. No default retention period, encryption detail, access control description, named subprocessor list, hosting provider or incident notice practice is published.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
No published position. Nothing is published on liability for AI output, indemnity, warranty, service levels, or remedy where a generated field value, an auto populated record or an agent action is wrong. The agentic release makes this a live question rather than a theoretical one, since an agent acting on administrator defined rules can write to compliance records that an examiner later reads. The vendor's answer to that risk is architectural, in the form of administrator boundaries and opt in configuration, rather than contractual, and no contractual position is public.
Section 22.A of the terms, last updated 9 January 2025, has Regology defend and indemnify the customer against third party claims that the platform or services infringe intellectual property. Combination and refusal of replacement exclusions apply, and the remedies are to procure a right, modify, replace, or terminate and refund unused fees. Section 21 excludes consequential loss and caps each party at the fees paid or payable in the twelve months before the claim, with indemnification, gross negligence and willful misconduct outside the cap. Section 19 provides the platform and content as is, section 17 says Reggi answers cannot be guaranteed and must be verified, and section 20 disclaims third party content. No insurance is stated.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Integrations are named, and an open API is documented as the way to extend them. DocuSign, Microsoft 365, Google Drive and Slack are named, and the vendor says other systems connect through the Onspring API. A published customer account credits one integration with saving 200 compliance hours, which is evidence of use rather than a list. None of the named integrations is a legal practice system. There is no iManage, NetDocuments, SharePoint matter workspace, electronic billing or matter management connector, and nothing that would let the Corporate Counsel solution sit inside a legal department's existing document systems. The integrations are the business software a GRC platform needs.
Regology sits beside governance, risk and compliance systems as a regulatory intelligence and data layer rather than replacing them. Direct integrations with GRC platforms, ServiceNow, Archer and Diligent among them, sync authority documents, citations and regulatory content into the GRC tool, with change alerts, impact assessments and a backlink to the full document in Regology. A GRC tool without a direct connector, or a homegrown system, connects through an open API that takes REST and JSON, XML, CSV and flat files over SFTP. Customers can upload existing law libraries from spreadsheets and PDFs. GRC and custom API integrations come with the Enterprise plan. What an administrator configures for each integration is not described.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Nothing is published from the vendor. Third party software directories describe the platform as cloud deployed, supporting Windows and macOS, with no mobile app; that is directory material, not vendor disclosure. Onspring's own pages say nothing about hosting provider, region, data residency, single tenant or dedicated instances, or where customer data is processed and stored. The security page could not be read in full, so a residency statement lower on that page may have been missed.
Regology runs as a cloud service, and the Enterprise plan includes round the clock cloud IT support. No hosting provider, region, customer selectable residency or tenancy model is published, and nothing separates where processing happens from where data is stored. Coverage reaches more than 135 countries and the buyers include multinational compliance teams.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
A named attestation, with its scope and currency stated, is published on the vendor's security page. Onspring states an annual SOC 2 Type II attestation prepared under AICPA standards and names the trust services criteria covered: security, availability and confidentiality. Naming the criteria matters, since a SOC 2 covering security alone is a much narrower report, and annual renewal addresses currency. A SecurityScorecard rating of 100 out of 100 is also cited; that is an external scanner score, not an audit. The auditing firm is not named, the examination period is not stated, and no trust center or self serve request route for the report is published, so the report itself needs a sales conversation.
Regology holds SOC 2 Type II. Its announcements name BARR Advisory as auditor and give the scope as security and availability, later security, confidentiality and availability, and Regology states a continuing commitment to maintaining the certification. No current report date, coverage period or renewal is published. No trust center or security page carries the report, and interested customers are invited to get in touch for it.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The provider is named outright, and nothing beyond the model family is. Onspring states in dated announcements that Onspring AI is powered by Anthropic's Claude family of generative AI models, in both the October 2025 launch and the July 2026 agentic release, and trade coverage of both repeats it. That is the fact a regulated buyer's own supervisor is most likely to ask for. No specific model or version is identified and no subprocessor list exists. Nothing states whether the provider is engaged through an enterprise agreement, what terms govern data sent to it, how data flows, or what happens if the provider changes.
Under section 17 of the terms, Reggi runs on generative AI and a large language model, and Regology describes the platform as using the industry's most advanced AI and agents. Reggi is presented as a generative AI model built on top of Bloomberg Regology that draws on more than 16 million laws and regulations and tailors its answers to a company's business activities. No model, model provider, processing location or subprocessor is named, and no notice of supply chain changes is committed.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The pricing structure can be found, and no figure can. Subscription pricing scales by number of users and modules selected, with annual and multiyear options; extra modules cost more, and implementation services are included with the GRC Suite under some licensing models. Onspring AI is licensed separately as an add on. A buyer can see how the bill will grow. No price, range or entry point is published at any level, every route is a quote request, and third parties describe the licensing model as complex. The structural detail comes from an independent review platform's product summary, not from an Onspring pricing page, and no vendor pricing page is published.
Bloomberg Regology sells three plans. Reggi, the generative assistant, is free for individual use and covers summaries of regulatory material, questions on American laws and regulations and general compliance questions, with citations on every answer. Professional is $1,700 per user a month on a three year contract. It adds the Smart Law Library for federal law and all 50 states, regulatory change alerts with impact assessments, Reggi across the library and alerts, full text lookup across American content, and dashboards and reports. Enterprise is quoted on request and adds global jurisdictions, customizable topics, lookup across more than 16 million documents, group workflows, compliance, risk, task and policy management, controls testing and GRC integrations. No implementation fee is published.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Coverage is broad across compliance and thin across legal work. ISO, NIST and CMMC frameworks are named, the platform spans risk, audit, vendor and third party risk, IT risk, policy, ESG and business continuity, and named deployments cover insurance, media and healthcare. Legal coverage is a single Corporate Counsel solution, positioned within business operations, describing matter tracking, requests, opinions, research, a clause library and cost tracking. That is one in house legal use case, not practice coverage. Nothing addresses practice areas, jurisdictions or matter types, or separates a legal department's work from the compliance work the platform was built for. The Corporate Counsel material shows no recent update, while the GRC and AI material is refreshed often.
Coverage spans federal law, all fifty states and international jurisdictions in more than 135 countries, and the library is continuously updated. Professional stops at federal and state content from the United States, and global coverage comes with Enterprise. One platform serves every industry rather than splitting by sector, with dedicated pages for banking, crypto and digital assets, energy and utilities, gaming and sports betting, government and regulatory authorities, healthcare and life sciences, manufacturing and software. Buyers are compliance, legal and risk teams at organizations from startups to large corporations. No list of the international jurisdictions, no completeness or lag statement for each, and no statement of what the platform is not built for is published.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Terms are silent. The security page describes what the SOC 2 attestation validates, quoted here, and that scope is about safeguarding data rather than about model training. No statement was located anywhere addressing whether customer records, uploaded documents or prompts are used to train or improve any model, in either direction. The gap is pointed because the vendor already names Anthropic's Claude as the model provider, so it has disclosed the harder fact and left the simpler one unanswered.
Checked the security page, the October 2025 and July 2026 AI announcements, the platform pages and the site footer on 29 Aug 2026. Recorded as silent, not as a negative commitment.
Section 6.A of the terms, last updated 9 January 2025, gives Regology a license to use customer data only as necessary to provide the services, and the customer keeps every other right in it. Regology owns Service Data, defined as anonymized, aggregated, statistical or benchmark data generated from a customer's use, with personal data excluded, and the terms give it no stated purpose. Neither the terms nor the Responsible AI Policy mention model training, and no model provider is named.
Customers upload their own law libraries and record obligations, control mappings, policy decisions and rejections in the platform.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Assistant conversations and agent actions persist for no stated period. No retention period is published for prompts, assistant conversations, generated field content or agent actions, and nothing indicates whether retention is configurable or can be set to zero. The platform is explicitly a system of record that retains GRC data by design, but that is record retention rather than AI interaction retention, and the two are not the same question.
Nothing states whether an administrator can see or purge what users asked the assistant. Checked the security page, both AI announcements and the platform pages on 29 Aug 2026.
A customer can have its data returned or destroyed at any time. Section 11.E of the terms has Regology, on written request and subject to contrary legal obligations, return or destroy all customer confidential information at the customer's option and certify it in writing. Section 10 confines personal data to performing the services. No default retention period applies to Reggi prompts and answers during the term, and the Responsible AI Policy does not address retention.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Claimed and not documented, and the AI release raises the stakes on it. The vendor states clearly defined roles, responsibilities, policies and procedures protecting stored data, so an access model exists and is asserted. Nothing documents its granularity or whether it constrains the AI layer: the July 2026 assistant is described as living on every screen and answering from every record and application in the GRC program, and no published statement says those answers respect the asking user's record permissions.
For a platform holding both a legal department's matters and the business units those matters concern, that is the segregation question, and it is unanswered. No document management system exists to inherit permissions from, so the second model shape is the only applicable one. Checked the security page and both AI announcements on 29 Aug 2026.
Work is assigned to named people, approvals and rejections are recorded, and Enterprise adds group workflows with reports at company, team and individual level. How access is separated between customers, between users or between business units with different regulatory perimeters is not described, and no document management integration supplies permissions to inherit.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Compelled disclosure has no stated process. No government or law enforcement request clause, no commitment to notify a customer before producing their data, and no transparency report were located. Checked the security page, the platform pages and the site footer on 29 Aug 2026.
Section 11.C of the terms commits Regology to give the customer prompt notice when legal process requests or requires disclosure of its confidential information, so the customer can seek a protective order first. If none is obtained, Regology discloses only what its counsel advises the law requires and works with the customer to limit the effect. Confidential information includes personal data and customer information understood to be confidential. No transparency report is published.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Customer records, not published law, feed the AI, so the usual question mostly falls away. This product has no primary law corpus: the AI operates over the customer's own GRC records, policies, controls and uploaded documents rather than over published legislation or case law. The one adjacent disclosure is that governance frameworks including ISO, NIST and CMMC are supported and mapped to controls, which names standards bodies rather than a regulatory corpus with sources, jurisdictions and update lag.
Regulatory change management is sold as a module, and nothing published names which regulatory sources feed it, which jurisdictions are covered, how current the feed is, or on what license basis any of it is obtained. That last part is a real gap rather than an inapplicable one. Checked the regulatory change management product page and the platform pages on 29 Aug 2026.
The Smart Law Library is Regology's proprietary library of primary law from legislatures and agencies, covering federal law, all fifty states and international jurisdictions, with lookup across more than 16 million documents on the Enterprise plan. It tracks bills, laws, regulations and agency updates in real time and keeps version history for each law. No license or sourcing statement, completeness statement for each jurisdiction or list of the international jurisdictions is published.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Superseded regulations behind a control get no described flag. The regulatory change management module monitors regulatory changes and aligns controls with evolving requirements, and Onspring AI can surface related regulatory controls and suggest which analyst to assign a new control to. That is change routing rather than a currency signal: nothing indicates whether the product flags that a regulation a control relies on has been superseded, withdrawn or amended, and no citator or treatment source is named. Checked the regulatory change management page, both AI announcements and the platform pages on 29 Aug 2026.
The library holds legislation and regulation rather than case law, so currency here means whether a rule in the library is the rule in force. Real time tracking of bills, laws, regulations and agency updates, version history and links from proposed rules to their final versions keep it current. No treatment signal on cited authority, check of later history or citator license is part of the product.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Neither the assistant nor the agents has a described way to abstain. No explicit no answer path, abstention behavior, confidence score or uncertainty signal is documented for either the assistant or the agentic features. The July 2026 release describes an assistant making contextualized decisions across workflows and answering from every record in the program, and says nothing about what it does when the records do not support an answer.
The published control is the administrator defined boundary on what an agent may act on, which limits scope rather than describing behavior under uncertainty. Checked both AI announcements, the platform pages and the security page on 29 Aug 2026.
The agents decide whether a law applies and map each change to obligations, and no path is described for an uncertain applicability call or a change that fits no existing obligation. No confidence signal or no answer path reaches the user. Rejections are logged, which records a person's disagreement rather than the system flagging doubt, and section 17 of the terms tells customers to verify every Reggi answer.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
None located, with the method stated. General web searches combining the vendor and product names with court, opinion, sanction, enforcement and disciplinary terms returned nothing on 29 Aug 2026, and no named docket database or court record tracker was searched. The exposure is low compared with a research or drafting product, since the AI writes internal compliance documentation and fills records rather than citing authority for filings. This records what was found and is not a clearance.
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming Regology or its Reggi assistant. Regology's agents work out which regulations apply to a business and map them to obligations and controls for corporate compliance teams.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
The Corporate Counsel solution carries no professional responsibility framing. No named ethics opinion, no ABA Formal Opinion 512, no state bar guidance and no engagement with professional responsibility material of any kind was located, including on the Corporate Counsel solution page where it would be most expected. The vendor publishes extensively on compliance obligations owed by its customers' organizations and nothing on the professional duties of lawyers using the legal solution.
Checked the corporate counsel solution page, the resource and report material, both AI announcements and the platform pages on 29 Aug 2026.
No Regology material engages ABA Formal Opinion 512, a state bar opinion or other professional responsibility guidance. Its research includes an annual state of regulatory compliance survey on practitioner sentiment and compliance operations, written for compliance, legal and risk teams.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Outside the fee relationship: the buyer is an in house compliance or legal function that bills no client. Customer material reports 200 compliance hours saved from one integration, and the AI positioning rests on reducing repetitive administrative work, supported by a benchmarking finding that 70 percent of GRC practitioners see simplifying repeated administrative work as the biggest AI opportunity. All of that is the customer's internal time.
The Corporate Counsel solution tracks legal costs and budgets, but nothing addresses billing for AI assisted time or producing a record a department could disclose. Checked the Corporate Counsel page, the customer stories and both AI announcements on 29 Aug 2026.
Regology sells to corporate compliance, legal and risk teams. Its AI and agents are pitched as automating the repetitive, labor intensive manual work that swamps compliance teams, and the regional bank case study reports faster assessment of regulatory changes without a figure. No record of AI assisted work by matter is kept for fee purposes, and no billing or client disclosure guidance is offered.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
One element of a disclosure pack exists, and the rest is missing. The model provider is named outright, Anthropic's Claude family, in dated announcements, which is usually the hardest part of such a pack to obtain. Everything else is missing: no subprocessor list, data processing agreement or trust center, and no self serve route to the SOC 2 report, which is stated to exist but needs a sales conversation. A department could forward the model provider's name and nothing more. Checked the security page, both AI announcements, the platform pages and the site footer on 29 Aug 2026.
No subprocessor list, data processing agreement, statement of which model providers see customer content, or client consent and notice material is published. SOC 2 Type II comes with its auditor and scope in earlier announcements, and customers ask Regology directly for the report.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Partial record. The platform is built to evidence compliance to auditors and examiners: control authoring, attestations and documentation, evidence capture, task tracking with automated notifications, real time reporting, and framework to control mapping across ISO, NIST and CMMC. A customer can produce what was required, who was assigned, what was done and when. The AI dimension is where it stops short. Nothing indicates that a record carries which fields were AI generated, which model produced them, what sources the assistant drew on, or whether a human confirmed the output before it was saved.
With agentic action now writing into records under administrator rules, the distinction between a human entry and an agent entry is exactly what an examiner would probe, and no published export or audit view addresses it. Checked both AI announcements, the regulatory change management page and the platform pages on 29 Aug 2026.
Regology keeps a defensibility record built for auditors. Every alert, assignment, decision, approval, rejection and policy update is timestamped and tied to the source law, covering what was decided, by whom, when, on what basis and what was rejected. No export for each document joins that trail to the model used, and no model is named. The record is shaped for a regulatory examination or internal audit rather than a court.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
- Refusal and Uncertainty Behavior
- Bar Guidance Alignment
- Outside Counsel Guideline Readiness
Which one fits
Choose Onspring if
- You want to build the program rather than buy someone else's shape. Onspring is a no code platform where business users configure applications, workflows, surveys, dashboards and reports through the interface. It spans risk, regulatory change, internal audit, policy authoring, control and framework mapping, third party risk, IT risk, ESG and business continuity, with ISO, NIST and CMMC frameworks mapped to controls. A separate corporate counsel solution covers request intake, matter tracking, a clause library and legal cost tracking.
- You want to know whose model it is and where it stops. Onspring states that Onspring AI runs on Anthropic's Claude family, and its July 2026 agentic release provides that administrators define the rules that prompt agent action and that automation operates within the boundaries the administrator sets, with the module opt in and an internal AI governance council named as the oversight body.
- You want an attestation whose scope is stated and customers you can name. Onspring publishes an annual SOC 2 Type II attestation and names the trust services criteria covered as security, availability and confidentiality, and names American Family Insurance, Warner Bros. Discovery and Memorial Hermann Health System among its customers, with one published account crediting a single integration with saving 200 compliance hours.
Choose Regology if
- The question is which laws apply to you. Regology identifies applicable law rather than serving a library of it, monitoring bills, laws, regulations and agency updates in real time across United States federal law, all fifty states and international jurisdictions, and generating obligations, risks, controls and policies mapped back to the source law.
- Your auditor will ask you to show your work. Regology timestamps every alert, assignment, decision, approval, rejection and policy update and makes each traceable to the source law it derives from, which the vendor frames as defensible documentation. Rejection is logged as explicitly as approval, so disagreeing with the system is a recorded path rather than an exception.
- You are not replacing your GRC investment. Regology positions itself as an intelligence and data layer working alongside existing systems and names ServiceNow, Archer and Hyperproof specifically, states that no rip and replace is required, lets customers import existing law libraries from spreadsheets and PDFs, and publishes its SOC 2 Type II with the auditing firm named as BARR Advisory and the examination scope stated.
In summary
Onspring
Onspring is a no code governance, risk and compliance platform used to build and run programs without developer involvement. It spans risk, regulatory change, internal audit, policy authoring, control and framework mapping, third party and IT risk, ESG and business continuity, with a separate corporate counsel solution for in house legal departments. Onspring AI is an optional add on module, extended into agentic operation in July 2026 under administrator defined rules. According to the AI Legal Index, Onspring names Anthropic's Claude family as the models behind its AI. No customer agreement, liability position or residency statement is published.
Regology
Regology is an AI powered regulatory intelligence platform for compliance, legal and risk teams, built around a proprietary law library and three named agents covering regulatory change, compliance and research. It identifies which laws apply to an organization and monitors bills, laws and agency updates in real time. It then generates obligations, risks, controls and policies mapped to the source law across United States federal, all fifty states and international jurisdictions. According to the AI Legal Index, Regology publishes Terms of Service carrying an intellectual property indemnity, a twelve month fee cap and an explicit statement that AI responses must be independently verified. Every alert, decision, approval and rejection is timestamped and traceable to source, and its SOC 2 Type II names BARR Advisory as auditor. No model provider or residency statement is published.
Questions buyers ask
Do you need one of these or both?
Possibly both. Onspring is the system of record a team configures for its own program, and Regology is deliberately not one, positioning itself as an intelligence layer that sits alongside existing GRC investments and naming ServiceNow, Archer and Hyperproof as systems it works with. The two are more naturally read as layers in one stack than as alternatives. From the AI Legal Index, based on each vendor's own published materials as of September 14, 2026. No vendor pays for placement.
Who names what?
Each names what the other withholds. Onspring states that its AI runs on Anthropic's Claude family, and does not name the firm behind its SOC 2. Regology names BARR Advisory as its auditor and states the examination scope, and names no model, provider or hosting arrangement anywhere. A buyer running a vendor risk process will get half its answers from each. From the AI Legal Index, based on each vendor's own published materials as of September 14, 2026. No vendor pays for placement.
What can you read before signing?
On Onspring, very little. It publishes no terms of service, master agreement or data processing agreement, so no liability cap, indemnity, warranty or training commitment is readable in advance, and the entire allocation of risk sits in a signed contract. Regology publishes its Terms of Service, with an intellectual property indemnity, a twelve month fee cap and a statement that AI responses must be independently verified. Both publish a SOC 2 Type II attestation, and on neither is the report itself downloadable or offered through a stated request route. From the AI Legal Index, based on each vendor's own published materials as of September 14, 2026. No vendor pays for placement.
What happens if a law is missed?
Nothing published on either record says. Both products decide which laws and obligations apply to an organization, and the consequence of a miss falls on the customer as a regulatory breach rather than appearing as a visible error in a document. Neither publishes an applicability error rate, an evaluation or a test set, and neither publishes a liability position addressing who carries the loss. From the AI Legal Index, based on each vendor's own published materials as of September 14, 2026. No vendor pays for placement.
What do Onspring and Regology both leave unpublished?
Neither publishes a residency or tenancy statement. Neither publishes results from bias testing or an evaluation of uneven performance across jurisdictions, industries or organization types, which on an applicability engine decides whether a gap is systematic or random. Pricing splits them: Regology publishes Professional at $1,700 per user a month on a three year contract, while Onspring publishes no figure. From the AI Legal Index, based on each vendor's own published materials as of September 14, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
The pair produces a symmetry worth naming: Onspring names the provider behind its AI and not the firm that audited it, while Regology names its auditor and its examination scope and no model or provider at all. Beyond that the gaps largely match. Onspring publishes no customer agreement, so its liability position, indemnity, warranty on output and training commitment cannot be read before signing. Regology's Terms of Service carry an intellectual property indemnity and a twelve month fee cap, and stand behind nothing on AI output. Neither states a hosting provider, a region, a residency option or a tenancy model. Neither publishes an error rate for the task each is bought to perform, which on these products is applicability. The failure that matters is a law or an obligation that never surfaces, and a customer with no independent view of what should have been flagged cannot detect it. Onspring names an internal AI governance council and publishes nothing it produces. Regology publishes a Responsible AI Policy with an ethics and risk committee and a commitment to bias audits, and no audit result. Neither vendor reviewed this page.