4

4CRisk.ai

The language models drive the core functions of a compliance platform built around regulatory content and workflow. 4CRisk describes specialized language models trained on curated regulatory and governance content, and the products run on them: regulatory research that builds rulebooks and obligations from authoritative sources, regulatory change management that scans more than 2,400 sources and recommends which policies and controls to review, Compliance Map, which maps internal policies and controls to obligations and finds duplicates, HorizonScan, and Ask ARIA, a copilot answering compliance questions.

Around the models sit rulebooks, obligation registers, impact assessment workflows, exports to PDF and Excel and review by subject matter experts, which would still organize compliance work without them. CUBE, which acquired 4CRisk in February 2026, describes the business as compliance and risk mapping automation. The models are the engine of the core capabilities rather than the whole product.

Answers and obligations are tied to their sources, and accuracy is asserted rather than measured. The Ask ARIA page says each answer is supported by clickable links to the source documents, presents the source with the relevant section highlighted, and shows a confidence score. The regulatory research page says rulebooks and obligations carry an audit trail to the original sources, and the change management page gives a confidence rating on what is or is not mapped.

The SLM page says the specialized models are less prone to the errors of general language models, and the platform page claims tasks performed up to 50 times faster than a human, with no test set, error rate or method behind either statement. Nothing describes how the currency of a cited rule is shown in an answer or how often mapping misses an obligation. A compliance lawyer can open the source behind an answer, and cannot test the accuracy claims.

Human review is built into the workflows, short of a stated control structure. The platform page says subject matter experts can review and override model predictions; the regulatory research page describes collaborative work in which experts identify and create the requirements; the change management page says the product supports an expert's judgment of criticality, priority and due date in the AI generated impact analysis; and Ask ARIA lets users review and vote on responses.

Confidence scores are shown on answers and mappings. What is not published is the threshold at which the system defers to a person, what the AI may not do unreviewed, or what happens after a mapping or answer is shown to be wrong. Section 8.2 of the terms leaves the client solely responsible for conclusions drawn from use of the services.

Awards and unattributed figures stand in for customer evidence. The about page says 4CRisk serves leading organizations in financial services, insurance, retail, telecom and other regulated industries, without naming one, and lists recognitions: RegTech100 for a second year, AIFinTech100, a Globee award, a Banking Tech Awards shortlisting in 2025, a Bank Automation News list of AI start ups to watch in 2025 and a Chartis Research best of breed placing in 2026.

The platform page claims 75% effectiveness in risk reduction, 85% efficiency improvement and 60% faster deployment, and the who we serve page claims 90% research time savings, with no customer, period or method. CUBE's acquisition release names no 4CRisk customer. No case study with a named customer is published.

Confidentiality is in the agreement and a no training statement is published, alongside a broad improvement license. Section 7 of the terms of service binds the parties to protect each other's confidential information. The platform page says customer data is not used to train 4CRisk's language models, and Ask ARIA is described as a closed domain knowledge base with role based retrieval. The SLM page says the platform keeps sensitive data within the enterprise and can be deployed in a customer's infrastructure or private cloud.

Against that, the terms grant 4CRisk an irrevocable, transferable, sublicensable, royalty free license to use, copy, store, modify and display user content, including to provide, maintain and improve the services, and the no training commitment is not in the terms. Privilege and work product are not addressed.

A responsibility clause sits in the terms while the product is marketed as giving reliable answers to compliance questions. Section 8.2 of the terms of service says the client assumes sole responsibility for conclusions drawn from use of the services, and the services are provided as is. No statement that output is not legal advice, no eligibility rule and no supervision guidance is published. Ask ARIA is described as giving immediate, reliable answers to complex compliance questions and accurate, up to date information, and the product is addressed to regulatory affairs and legal professionals, compliance officers and front line staff.

No governance position on the AI is published. Checked the home, platform, SLM, Ask ARIA, regulatory research, change management, who we serve and about pages and the terms: none names a person accountable for model behavior, describes testing before release, publishes evaluation results, or sets out principles. The SLM page explains why specialized models are chosen and claims fewer errors than general models, which is a design rationale rather than governance.

Uneven output is a live question for models mapping obligations across federal, state and international regimes and several industries, and nothing published addresses it.

Security practices are described in general terms, and retention, deletion and subprocessors are not. The SLM page describes zero trust principles, penetration testing and SOC 2 for 4CRisk's private cloud deployments, the platform page says the cloud environments are certified for SOC 2, and Ask ARIA uses role based retrieval in a closed domain knowledge base. The terms require the client to stop use and return materials on termination and say nothing about deletion of customer data.

The privacy policy covers the website and keeps personal data as long as needed. No retention period for uploaded policies, prompts or outputs, no subprocessor list and no breach notice commitment is published.

A vendor indemnity and a mutual cap are published, and output risk sits with the client. The terms of service provide in section 10.2 that 4CRisk defends the client against third party claims that the services infringe intellectual property rights and pays resulting costs and attorneys' fees, and in section 11 cap either party's aggregate liability at the fees paid in the twelve months before the claim. Section 8.1 provides the services as is without warranty, section 8.2 makes the client solely responsible for conclusions drawn from use, and section 10.1 has the client indemnify 4CRisk for third party claims.

California law governs. Nothing allocates the loss when a missed obligation or a wrong answer leads to a compliance failure.

Integration capability is described without naming a system. The platform page says the platform supports integration with business systems, content providers and third parties through a REST API architecture, and supports standard exports to PDF and Excel. No GRC platform, document management system, policy management tool or other named connection is published on the home, platform, products, regulatory research, change management or Ask ARIA pages read, and no API documentation is public.

The tenancy options are stated and no region is. The platform page says the platform can run in a multi tenant environment, in a dedicated environment or in the customer's private cloud, and names AWS and Google Cloud among the clouds it says it is certified on. The SLM page says the specialized models can be deployed within a company's infrastructure or a private cloud. The privacy policy says personal data may be transferred to and kept in the United States.

What is not stated is the region of the multi tenant service, where the models run in that service, or whether customers can choose a country.

SOC 2 is stated without type, auditor, date or a route to the report. The home page lists AICPA SOC 2 certification, the platform page says 4CRisk's cloud environments are certified for SOC 2, and the SLM page mentions SOC 2, penetration testing and zero trust principles for private cloud deployments. No report type, period, auditor or request route is published, and no trust center is published on the home, platform, SLM or about pages read. A buyer has a named standard to ask about and must ask for the evidence.

The models are described as 4CRisk's own and nothing is said about what sits underneath. The SLM page describes specialized language models trained on curated regulatory content and governance data from the public domain, deployable within a customer's infrastructure, and the platform page says customer data is not used to train them. No base model, model provider, version or change notice is named on the SLM, platform, Ask ARIA or about pages, and no third party model provider is mentioned on any page read. A firm cannot tell whether a foundation model from another provider underlies the specialized models.

No pricing information is published at any level. Checked the home, free evaluation, holiday offer and products pages and the terms: no price, plan, tier or unit of charge appears. The terms say fees are paid in advance monthly, quarterly or yearly, which describes billing frequency rather than what is charged. The free evaluation covers Regulatory Research, Compliance Map and Regulatory Change Management after a registration review, with no stated length or price after it.

Who 4CRisk serves is described with substance, and the boundaries are not. The who we serve page addresses chief compliance officers, regulatory affairs and legal professionals, chief risk officers, security and IT risk teams and front line staff, in banking, insurance, fintech, retail and high tech and telecom. Regulatory research covers US state and federal bodies, including the Federal Register, and international bodies, and change management scans more than 2,400 sources across more than 50 document types.

CUBE's release adds corporate compliance areas including cyber, AI, privacy, labor law and ESG. What is not stated is which countries and regulators outside the United States are covered, and which regulatory domains are deep and which are thin.