C

Compliance Intelligence

A real AI layer performs the product's distinguishing work, on a content and workflow platform that predates it. The models' tasks are named. AI powered monitoring scans regulatory bodies for updates, a proprietary AI tool curates the change summaries and tags each event to produce an impact assessment, and obligation clustering identifies commonality across legal requirements and generates a suggested rationalized obligation.

That clustering is the capability the product is sold on, and it is machine produced. What sits underneath is not AI: a library of laws, rules and regulations across the state and federal perimeter, continuously updated and tagged against a financial services taxonomy, plus the workflow engine. That is substantially what the OneSumX regulatory change management line already was. The vendor places AI as one of three ingredients, stating that unlike solutions relying solely on automation it brings together structured regulatory data, human oversight, and AI powered workflows.

The compliance risk management module using predictive analytics over proprietary enforcement data is marked coming soon, so it is intent rather than a shipped capability.

Grounding is real, architectural and documented, and no accuracy figure exists anywhere. Changes are delivered as summaries with redlined changes against the source text, so a reviewer can see what actually moved rather than trusting a paraphrase. Obligations generated by clustering are dynamically linked to source regulations, and clustering output carries a full audit trail. The underlying library is described as comprehensive across the state and federal regulatory perimeter and continuously updated.

Human subject matter experts are named as part of the applicability process. What is absent is measurement: no accuracy figure, no test set, no evaluation, no error rate and no hallucination disclosure under any name. The vendor's own material also contradicts itself. Marketing asserts unparalleled accuracy and reliability and, in a launch post, guaranteeing accuracy. The product FAQ describes the same functions far more carefully, as AI supported analysis that helps analyze obligations and surface potentially relevant requirements, assisting teams with research and early impact assessment. No measured figure stands behind the stronger claim.

Human oversight is published as a design commitment, and the product's own language is consistently assistive. The vendor states that it combines structured regulatory data, human oversight and AI powered workflows rather than relying solely on automation. The mechanics bear that out. Obligation clustering generates a suggested obligation for the team to manage to rather than creating one, automated workflows trigger the necessary reviews rather than dispensing with them, and applicability determination combines subject matter experts with the technology.

The FAQ is more careful still, describing AI as assisting teams with research and early impact assessment and surfacing potentially relevant requirements. So the review point exists and the professional decides. What is missing is the structure around it. No threshold is published at which anything acts unattended, nothing states which workflow steps proceed without approval, and no confidence signal is described against a suggested obligation or an impact tag. Nothing addresses what happens when a relevance tag is wrong and a change is not escalated.

No production evidence for this product is published. There is no named customer, logo, testimonial, case study or figure attached to any deployment of Compliance Intelligence on any page read. Two numbers on the product page belong to the parent rather than the product. Wolters Kluwer states it serves over 10,000 banks and credit unions globally, which is its book of business across the whole compliance portfolio. The page also carries a Chartis RiskTech AI 50 2025 top five global ranking for excellence in artificial intelligence, which ranks Wolters Kluwer rather than assessing this product.

Neither names Compliance Intelligence. The product launched in the fourth quarter of 2025 and was under a year old at this check, which explains a thin deployment record without changing what is published.

Nothing addressing customer data in this product is published. There is no product level security page, data processing addendum, trust portal or customer agreement for Compliance Intelligence. The only governing document published is the global Wolters Kluwer Privacy & Cookie Notice, current at June 2026. It is scoped to the personal information of individuals who interact with Wolters Kluwer as visitors, contacts and account holders, and states that additional or different privacy notices may be provided for a specific Service.

Nothing published therefore addresses whether an institution's obligations, control mappings, risk posture or examination material is used to train or improve models, how long it is retained, whether it is segregated from other customers' data, or which model providers see it. This matters because the data a bank puts into this platform is its own compliance exposure, the material a regulator would ask for.

No position on advice versus tooling is published, on a product that determines regulatory applicability. Nothing published states that the product's output is not legal advice, nothing addresses the boundary between a machine-suggested obligation and a compliance officer's or counsel's own determination, and nothing describes what a professional must verify before relying on an applicability assessment. The absence is pointed rather than formal, for two reasons drawn from the vendor's own material.

The product's central function is telling an institution which legal requirements apply to it and rationalizing them into obligations, which is an applicability judgment with regulatory consequences. And the named users include legal and compliance decision makers alongside chief compliance officers, so a professional is expressly in the loop. No rule of professional conduct, regulator expectation or supervisory guidance on the use of automated tools in a compliance program is cited anywhere.

A published governance position exists at corporate level, with no mechanism, owner or testing behind it. Wolters Kluwer publishes AI Principles setting out five commitments. They cover privacy and security in design and deployment, transparency and explainability sufficient for users to understand and use the system appropriately, governance and accountability through development standards for risk management and issue remediation, fairness and nondiscrimination, and a human focused approach.

The principles state that they guide the design, development and deployment of advanced technologies across Wolters Kluwer's products and services. The page sits in the same navigation and footer as the product page on the same domain, so a buyer can connect the two. The principles are five aspirations of one sentence each. No named owner is accountable for this product's model behavior, no evaluation or testing regime is described, no results are published, and no governance certification such as ISO 42001 is held. Nothing specific to the product addresses how a clustering model that rationalizes legal obligations is validated.

A generic corporate notice covers the product nominally and addresses none of what happens to customer content. The global Privacy & Cookie Notice is current at June 2026, version 1.5, and does carry real machinery: a controller framework across Wolters Kluwer N.V. and its subsidiaries, transfer safeguards naming EU Model Clauses and binding corporate rules, access limited to a need-to-know basis, an internal framework of policies and reasonable security standards, a full set of data subject rights with a working request route, and a stated position on retention.

But every one of those provisions is about the personal information of people who interact with Wolters Kluwer, not about the regulatory and compliance data an institution puts into this platform. Retention is stated without any period, resting on data retention policies that are not published. Third parties are given only as categories, with affiliates, service providers, business partners and advertisers named as classes and no individual processor identified anywhere.

No incident or breach notification commitment is published, no encryption standard is stated, and no product-level security documentation exists.

No agreement governing the product is published. The global footer carries two legal links, a corporate Terms of Use and the Privacy & Cookie Notice. No product level agreement, master services agreement, subscription terms, service level document or acceptable use policy appears on the Compliance Intelligence page, in the OneSumX section, or in the footer. Every route on the product page leads to connecting with an expert, booking a demonstration or requesting a return on investment analysis, so the contract is negotiated rather than published.

No indemnity, liability cap, warranty on output, uptime commitment or insurance position could be located. This matters here because the product tells a bank which obligations apply to it, and a missed or wrongly clustered obligation is a supervisory finding. Allocation of loss is the question a buyer most needs answered before signing, and nothing published answers it. The corporate Terms of Use was not opened and may say more; by position and title it is a website terms page.

No integration into practice or enterprise systems is published. The product page names no integration of any kind: no GRC platform, no core banking system, no document management system, no policy or control repository, no identity provider, and no API, developer documentation or connector catalog. Nothing describes how obligations, controls or regulatory changes move between Compliance Intelligence and the systems a bank already runs, which is a live question because the wider OneSumX family includes separate products for policies and procedures, compliance risk and controls, compliance testing, complaint management and exam and inquiry management, and nothing published states how this product connects even to those.

The one interoperability fact located is directional rather than technical: obligations are described as dynamically linked to source regulations inside the platform.

Neither the tenancy model nor any region is stated, and cloud delivery is not even made explicit. Nothing published describes how the product is delivered, whether it is single or multi-tenant, where customer data is stored or processed, which cloud or data center is used, or whether any regional or on-premise option exists. The only geographic statements located concern the subject matter rather than the infrastructure: the regulatory library covers the United States state and federal perimeter, and monitoring scans global regulatory bodies.

Those describe what the product reads, not where it runs. The corporate privacy notice addresses international transfers of personal information under EU Model Clauses and binding corporate rules, which establishes that Wolters Kluwer moves data across borders without saying anything about where this platform's customer data sits. For a product sold to United States banks under prudential supervision, where data resides is a question examiners ask directly, and nothing published answers it.

No independent security attestation is published and none is claimed. There is no trust center, no security page for this product, no SOC 2, ISO 27001 or other framework named, no auditor identified, and no report offered at any access tier, including on request. No penetration testing or vulnerability disclosure program is mentioned. The only security statement located is in the global privacy notice and is expressed as intent rather than assurance.

It describes an internal framework of policies and reasonable security standards across the businesses, access limited on a need to know basis, and appropriate technical and organizational measures. It then states that Wolters Kluwer cannot guarantee information will be absolutely safe from intrusion. Nothing unsupported is on display, so this rests on absence rather than overclaiming. The gap is conspicuous for a product sold to regulated financial institutions, whose examiners will require third party assurance over material service providers.

Nothing about the model supply chain is published. No model is named, no version or family is given, no model provider is identified, no cloud or inference location is stated, and no commitment to notify customers when any of it changes is published. What the material offers instead are brand terms and adjectives: Expert AI as the portfolio name, a proprietary AI tool said to curate regulatory change summaries, cutting-edge AI, and advanced AI technology.

Proprietary is the closest thing to a disclosure and it identifies ownership rather than architecture, saying nothing about whether third-party foundation models sit underneath. No subprocessor list exists at any level: the corporate privacy notice names only categories of recipient. A buyer in a supervised institution cannot establish from published material which models process its regulatory and obligation data, or whose they are.

No pricing information is published at any level, including the unit of charge. No pricing page exists for the product or anywhere in the OneSumX for Compliance Program Management section, and no figure or range appears. Nothing states whether charging runs per seat, per institution, per module, by asset size or by regulatory coverage. Every route on the page leads to a sales conversation, and the calls to action say so: connect with our experts, schedule a personalized demo, or connect with our team for a detailed ROI analysis. The last offers to model the buyer's return before telling the buyer the cost.

The segment is defined narrowly and precisely. The product is stated to be designed specifically for financial institutions and, in the launch material, purpose built for United States banking compliance teams. Subject matter coverage is equally specific: a library spanning the state and federal regulatory perimeter, tagged against a taxonomy built for financial services, with monitoring extending to global regulatory bodies for changes, guidance, speeches and enforcement actions.

The product FAQ names the users: compliance managers, chief compliance officers, legal and compliance decision makers, and risk officers. Placement within the wider OneSumX compliance program family is documented, so a buyer can see what this product does and what its siblings cover. What is absent is the outer boundary. Nothing states institution size or type limits, nothing addresses whether credit unions, insurers or lenders other than banks are served, and no regulatory coverage outside the United States is claimed for obligations. Nothing says where the product stops.