Compliance Intelligence

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

A real AI layer performing the product's distinguishing work, on a content and workflow platform that predates it. What the models actually do is named rather than gestured at: AI-powered monitoring scans regulatory bodies for updates, a proprietary AI tool curates the change summaries and tags each event to produce an impact assessment, and obligation clustering identifies commonality across legal requirements and generates a suggested rationalised obligation. That clustering is the capability the product is sold on and it is machine-produced. What sits underneath is not AI: a library of laws, rules and regulations across the state and federal perimeter, continuously updated and tagged against a financial services taxonomy, plus the workflow engine, which is substantially what the OneSumX regulatory change management line already was. The vendor's own framing places the AI as one of three ingredients rather than the mechanism, stating that unlike solutions relying solely on automation it brings together structured regulatory data, human oversight, and AI-powered workflows. Recorded and not credited: the compliance risk management module using predictive analytics over proprietary enforcement data is marked **coming soon**, so it is intent rather than a shipped capability.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Grounding is real, architectural and documented, and no accuracy figure exists anywhere. The grounding is the strongest element of the record: changes are delivered as summaries with **red-lined changes against the source text**, so a reviewer can see what actually moved rather than trusting a paraphrase; obligations generated by clustering are **dynamically linked to source regulations**; the underlying library is described as comprehensive across the state and federal regulatory perimeter and continuously updated; and clustering output carries a **full audit trail for traceability**. Human subject matter experts are named as part of the applicability process. What is absent is measurement: no accuracy figure, no test set, no evaluation, no error rate and no hallucination disclosure under any name. A contradiction inside the vendor's own material is recorded because it is the evidence for this grade rather than an argument against it. Marketing asserts unparalleled accuracy and reliability and, in a launch post, guaranteeing accuracy, while the product FAQ describes the same functions far more carefully as AI-supported analysis that helps analyze obligations and **surface potentially relevant requirements, assisting teams with research and early impact assessment**. What the conflict reveals is that no measured figure stands behind the stronger claim, which is precisely the limb the top band asks for.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

Human oversight is published as a design commitment and the product's own language is consistently assistive. The vendor states directly that it combines structured regulatory data, human oversight and AI-powered workflows rather than relying solely on automation, and the mechanics bear that out: obligation clustering **generates a suggested obligation for you to manage to** rather than creating one, automated workflows ensure that necessary reviews are triggered rather than dispensing with them, and applicability determination is described as combining subject matter experts with the technology. The FAQ is more careful still, describing AI as assisting teams with research and early impact assessment and surfacing potentially relevant requirements. So the review point exists and the professional decides. What is missing is the structure around it: no threshold is published at which anything acts unattended, nothing states which workflow steps proceed without approval, no confidence signal is described against a suggested obligation or an impact tag, and nothing addresses what happens when a relevance tag is wrong and a change is not escalated.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

No production evidence for this product was located. There is no named customer, no logo, no testimonial, no case study and no figure attached to any deployment of Compliance Intelligence on any surface read. Two impressive numbers appear on the product page and neither belongs to the product. Wolters Kluwer states it serves **over 10,000 banks and credit unions globally**, which is the parent's book of business across its whole compliance portfolio, and the page carries a **Chartis RiskTech AI 50 2025 top five global ranking for excellence in artificial intelligence**, which is a corporate ranking of Wolters Kluwer rather than an assessment of this product. Credit follows scope, and neither artifact names Compliance Intelligence, so both are recorded as description material and credited to nothing here. Some allowance is owed to timing rather than to disclosure: the product launched in the fourth quarter of 2025 and was under a year old at this check, so a thin deployment record is expected. That explains the absence without changing what is published.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Nothing addressing customer data in this product was located. There is no product-level security page, no data processing addendum, no trust portal and no customer agreement anywhere in the site inventory for Compliance Intelligence. The only governing document published is the global Wolters Kluwer Privacy & Cookie Notice, which is current at June 2026 but is scoped to the personal information of individuals who interact with Wolters Kluwer as visitors, contacts and account holders, and which states expressly that additional or different privacy notices may be provided for a specific Service. Nothing published therefore addresses whether an institution's obligations, control mappings, risk posture or examination material is used to train or improve models, how long it is retained, whether it is segregated from other customers' data, or which model providers see it. The gap has weight here because the data a bank puts into this platform is its own compliance exposure, which is sensitive in a specific way: it is the material a regulator would ask for. Searched the product page, the AI principles page, the global privacy notice and the site footer on 4 September 2026.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

No position on advice versus tooling was located, on a product that determines regulatory applicability. Nothing published states that the product's output is not legal advice, nothing addresses the boundary between a machine-suggested obligation and a compliance officer's or counsel's own determination, and nothing describes what a professional must verify before relying on an applicability assessment. The absence is pointed rather than formal, for two reasons drawn from the vendor's own material. The product's central function is telling an institution which legal requirements apply to it and rationalising them into obligations, which is an applicability judgement with regulatory consequences. And the named users include **legal and compliance decision makers** alongside chief compliance officers, so a professional is expressly in the loop. No rule of professional conduct, regulator expectation or supervisory guidance on the use of automated tools in a compliance programme is cited anywhere. Searched the product page, the AI principles page, the global privacy notice and the site footer on 4 September 2026.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

A published governance position exists at corporate level, with no mechanism, owner or testing behind it. Wolters Kluwer publishes AI Principles setting out five commitments: privacy and security in design and deployment, transparency and explainability sufficient for users to understand and use the system appropriately, governance and accountability through development standards addressing risk management and issue remediation both during design and after deployment, **fairness and non-discrimination**, and a human-focused approach. Two things make this creditable to the product rather than parent material that does not travel. The principles state on their face that they guide the design, development and deployment of advanced technologies across Wolters Kluwer's products and services, and the page sits in the same navigation and footer as the product page on the same domain, so a buyer can establish the connection. What the principles are worth is limited by what they are: five single-sentence aspirations. No named owner is accountable for this product's model behaviour, no evaluation or testing regime is described, no results are published, no governance certification such as ISO 42001 is held, and nothing product-specific addresses how a clustering model that rationalises legal obligations is validated. A self-published principles page carries less weight than an audited framework.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

A generic corporate notice covers the product nominally and addresses none of what happens to customer content. The global Privacy & Cookie Notice is current at June 2026, version 1.5, and does carry real machinery: a controller framework across Wolters Kluwer N.V. and its subsidiaries, transfer safeguards naming EU Model Clauses and binding corporate rules, access limited to a need-to-know basis, an internal framework of policies and reasonable security standards, a full set of data subject rights with a working request route, and a stated position on retention. But every one of those provisions is about the personal information of people who interact with Wolters Kluwer, not about the regulatory and compliance data an institution puts into this platform. Retention is stated without any period, resting on data retention policies that are not published. Third parties are given only as categories, with affiliates, service providers, business partners and advertisers named as classes and **no individual processor identified anywhere**. No incident or breach notification commitment was located, no encryption standard is stated, and no product-level security documentation exists.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

No agreement governing the product is published. The site inventory carries two legal links in the global footer, a corporate Terms of Use and the Privacy & Cookie Notice, and no product-level agreement, master services agreement, subscription terms, service level document or acceptable use policy appears anywhere on the Compliance Intelligence page, in the OneSumX section, or in the footer. Every route on the product page resolves to connecting with an expert, booking a demonstration or requesting a return-on-investment analysis, so the contract is negotiated rather than published, which is the ordinary enterprise pattern and is nonetheless an absence for a disclosure index. No indemnity, liability cap, warranty on output, uptime commitment or insurance position could be located. That matters in a specific way here: the product tells a bank which obligations apply to it, and a missed or mis-clustered obligation is a supervisory finding, so allocation of loss is the question a buyer most needs answered before signing and nothing published answers it. The corporate Terms of Use was not opened in this pass and is named as a limit; it is a website terms page by position and title.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

No integration into practice or enterprise systems was located. The product page names no integration of any kind: no GRC platform, no core banking system, no document management system, no policy or control repository, no identity provider, and no API, developer documentation or connector catalogue. Nothing describes how obligations, controls or regulatory changes move between Compliance Intelligence and the systems a bank already runs, which is a live question because the wider OneSumX family includes separate products for policies and procedures, compliance risk and controls, compliance testing, complaint management and exam and inquiry management, and nothing published states how this product connects even to those. The one interoperability fact located is directional rather than technical: obligations are described as dynamically linked to source regulations inside the platform. Searched the product page, the OneSumX for Compliance Program Management navigation and the site footer on 4 September 2026.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Neither the tenancy model nor any region is stated, and cloud delivery is not even made explicit. Nothing published describes how the product is delivered, whether it is single or multi-tenant, where customer data is stored or processed, which cloud or data centre is used, or whether any regional or on-premise option exists. The only geographic statements located concern the subject matter rather than the infrastructure: the regulatory library covers the United States state and federal perimeter, and monitoring scans global regulatory bodies. Those describe what the product reads, not where it runs. The corporate privacy notice addresses international transfers of personal information under EU Model Clauses and binding corporate rules, which establishes that Wolters Kluwer moves data across borders without saying anything about where this platform's customer data sits. For a product sold to United States banks under prudential supervision, where data resides is a question examiners ask directly, and nothing published answers it.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

No independent security attestation was located and none is claimed. There is no trust centre, no security page for this product, no SOC 2, ISO 27001 or other framework named anywhere, no auditor identified, no report offered at any access tier including on request, and no penetration testing or vulnerability disclosure programme mentioned. The only security statement located is in the global privacy notice and is expressed at the level of intent rather than assurance: an internal framework of policies and **reasonable security standards** across the businesses, access limited to a need-to-know basis, and appropriate technical and organisational measures, followed by an express statement that Wolters Kluwer cannot guarantee information will be absolutely safe from intrusion. Because nothing is claimed there is also nothing unsupported on display, so this rests on absence rather than on overclaiming. The gap is conspicuous for a product sold to regulated financial institutions, whose own examiners will require third-party assurance over material service providers.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

Nothing about the model supply chain is published. No model is named, no version or family is given, no model provider is identified, no cloud or inference location is stated, and no commitment to notify customers when any of it changes was located. What the material offers instead are brand terms and adjectives: **Expert AI** as the portfolio name, a **proprietary AI tool** said to curate regulatory change summaries, cutting-edge AI, and advanced AI technology. Proprietary is the closest thing to a disclosure and it identifies ownership rather than architecture, saying nothing about whether third-party foundation models sit underneath. No subprocessor list exists at any level: the corporate privacy notice names only categories of recipient. A buyer in a supervised institution cannot establish from published material which models process its regulatory and obligation data, or whose they are. Searched the product page, the AI principles page, the corporate AI page, the global privacy notice and the site footer on 4 September 2026.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No pricing information is published at any level, including the unit of charge. No pricing page exists for the product or anywhere in the OneSumX for Compliance Program Management section, no figure, band or range appears, and nothing states whether charging runs per seat, per institution, per module, by asset size or by regulatory coverage. Every route on the page resolves to a sales conversation, and the calls to action are explicit about it: connect with our experts, schedule a personalized demo, or **connect with our team for a detailed ROI analysis**. The last is worth naming precisely because it inverts the disclosure: the vendor offers to model the buyer's return before telling the buyer the cost. Under the standing rule that pricing evidence must lift this axis off the floor before a pricing row is owed, no VendorPricing row is written. Checked the product page, the OneSumX navigation, the solutions directory entry and the global footer on 4 September 2026.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

The segment is defined narrowly and precisely, which is unusual and useful. The product is stated to be designed specifically for financial institutions and, in the launch material, purpose-built for United States banking compliance teams. Coverage of subject matter is equally specific: a library spanning the state and federal regulatory perimeter, tagged against a taxonomy built for financial services, with monitoring extending to global regulatory bodies for changes, guidance, speeches and enforcement actions. The users are named individually in the product FAQ rather than left to inference, covering compliance managers, chief compliance officers, legal and compliance decision makers, and risk officers. Placement within the wider OneSumX compliance programme family is documented, so a buyer can see what this product does and what its siblings cover. What is absent is the boundary from the other direction: nothing states institution size or type limits, nothing addresses whether credit unions, insurers or non-bank lenders are served, no non-United States regulatory coverage is claimed for obligations, and nothing says where the product stops.