CUBE is a regulatory intelligence company for financial institutions and other regulated businesses, based in London. It sells four products. RegPlatform is an enterprise compliance and risk platform that turns regulatory change into obligations, maps them to controls and keeps an audit trail, with AI agents CUBE calls coworkers for triage, research, control quality and enforcement analysis. Intel pairs AI with expert review for growing regulated businesses, Oden generates state by state notices and guidance for American insurers, and Powered By licenses CUBE's regulatory content to other platforms through APIs.
CUBE captures regulatory publications from more than 10,000 issuing bodies in 250 countries and territories and 100 languages, which it counts as 750 jurisdictions, and processes about 10 million data points a year with 250 regulatory experts. The company has around 1,000 people in 10 offices. Since a strategic partnership with Hg in 2024 it has bought RegRoom, the Thomson Reuters Regulatory Intelligence and Oden businesses, Acin, Kodex AI and 4CRisk.ai, and in September 2026 IBM embedded CUBE's intelligence in watsonx.governance.
Side by side on the same 15 capability axes and 12 legal signals: where the two part company, and what neither one publishes.
Vendors in the same categories as CUBE whose graded profiles look most alike, with a line on what each product does.
Similar is not the same, so check that each one does the job you need. No vendor pays for placement.
Ordered by how closely the graded profiles match across the 15 capability axes, inside the same categories. See how each axis is graded in the methodology.
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
CUBE's regulatory content would stand without the models. Its 250 regulatory experts review and curate it, and Powered By licenses that content to other platforms on its own.
The models do the processing at scale. Proprietary AI trained only on regulatory content classifies, extracts, maps and links publications from more than 10,000 issuing bodies into about 10 million structured obligations. Inside RegPlatform, agentic coworkers triage change for a firm, answer questions in natural language, rewrite and generate controls, and analyze enforcement actions.
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Every coworker works from CUBE's own curated regulatory intelligence rather than the open web, and CUBE describes the output as sourced and auditable. The Analysis Coworker returns structured answers with their sources across applicable updates and the laws, rules and regulations in RegBook, and keeps the research record in the platform. Content is versioned, and each obligation keeps its lineage back to the regulatory text.
No accuracy rate for classification, obligation extraction or coworker answers is published, and no test set or benchmark sits behind the AI.
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The coworkers work inside RegPlatform beside compliance and risk teams, surfacing what is relevant and drafting the next step, and CUBE calls their output explainable. The Priorities Coworker ranks developments by certainty and applicability and keeps a full audit trail of its assessment decisions. Regulatory Inventory logs the reasoning when it maps a change to entities, jurisdictions and business lines, and workflow carries tasks, ownership and approvals through each stage.
Intel pairs the AI with review by CUBE's regulatory experts. What a coworker may do without a person approving it, and what happens after a wrong assessment, are not described.
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
CUBE says it serves many of the world's largest financial institutions, with operations across Europe, the United States, Canada, Asia and Australia. It puts its scale at about 10 million data points processed a year, 250 regulatory experts and around 1,000 staff in 10 offices.
No customer is named. The one outcome figure comes from early customer testing of the Priorities Coworker, which cut noise by 80 to 90 percent, with no customer, date or method attached. IBM embedded CUBE's regulatory intelligence in a Regulatory Horizon Scanning capability for watsonx.governance, announced in September 2026, as a partnership with no deployment figures.
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The Global Terms and Conditions for CUBE Services, January 2026, leave customer data owned by the customer and license CUBE to use and store it only as far as needed to perform the agreement. Customer data counts as the customer's confidential information. Clause 10.3 limits a compelled disclosure to what a court or regulator orders, with written notice first where CUBE is able to give it.
The data security exhibit commits CUBE to a written information security program aligned with a recognized standard. No term addresses privilege, work product or segregation between customers, and the license lets CUBE keep customer data after the agreement ends.
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Clause 12.1.4 of the Intel subscription terms says the services are not financial, tax, accounting, legal, compliance or other professional advice, and CUBE disclaims damages from decisions made in reliance on them. The Global Terms behind RegPlatform exclude liability for decisions a customer makes on the services and content, without the same statement. The website terms call site content general information rather than advice.
CUBE's own pitch is helping teams track, interpret and act on regulatory change, while its home page line is that CUBE brings the insights and the customer decides. Nothing addresses the supervision or competence of the lawyers and compliance staff relying on the output, and no jurisdiction limit is named.
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
The AI is described as proprietary, trained only on regulatory content and native to the product rather than added on, with coworker output explainable, sourced and auditable. No AI policy, set of principles, framework, accountable owner or testing before release is published, and nothing covers uneven output across jurisdictions, languages or firm types. CUBE's intelligence feeds IBM's watsonx.governance, a tool enterprises use to govern their own AI, which says nothing about how CUBE governs its models.
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The privacy exhibit, March 2026, has CUBE process personal data only as the agreement requires or on written instruction, amend, transfer or delete it on request, and keep it confidential. Either party reports a security breach within 72 hours, and CUBE tells no third party about a breach without the customer's consent unless the law requires it. An annex lists the material subprocessors, and the customer gets five days to object to a new one.
Under the Global Terms, CUBE backs up customer data daily and keeps only the latest copy, and at the end of the agreement it deletes or returns personal data at the customer's option. Other customer data may be kept after termination, and no retention period is stated.
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Clause 11.2 of the Global Terms has CUBE defend and indemnify the customer against third party claims that the services infringe intellectual property. The remedies are to procure a right, modify or replace the services, or terminate and refund unused fees, with exclusions for freely available content, modification by others, misuse and unapproved combinations. Clause 12.4 excludes lost profits, lost data and consequential loss and caps CUBE at the fees for the contract year, rising to three times those fees for breach of confidentiality and for indemnity claims.
Clause 4.1 warrants that the services are performed with the skill and care of the industry and in line with the documentation, with correction or reperformance as the remedy. Accuracy, completeness and timeliness of content are disclaimed, CUBE carries no liability for decisions the customer makes on it, and no insurance is stated.
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
RegConnect, CUBE's API module, connects RegPlatform with GRC platforms, policy tools and internal systems in both directions. Authorized applications pull regulatory intelligence, trigger platform functions and push data back, under role based authentication with every access logged. Links between regulatory content and downstream policies, processes and controls stay live, so connected items are flagged for review when a rule changes.
Intel content reaches other systems through a REST API with a developer portal, and Powered By licenses content to platform builders. IBM's watsonx.governance is the one named destination. The developer documentation is not public, and no GRC platform is named.
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Annex A of the privacy exhibit sets out where CUBE runs. Enterprise services sit in two data centers in Great Britain, Datum in Farnborough and Vantage in Newport. Microsoft Azure hosts Intel and Hub AI in the United Kingdom and EU North, RegRoom in the United States and Oden in an eastern United States region.
Group companies give technical and operational support under an intragroup agreement carrying EU standard contractual clauses and the UK transfer addendum. No customer choice of region is described, and where processing happens is not separated from where data is stored.
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
No ISO 27001, SOC 2 or other certification is claimed on CUBE's site or in its agreements, and no auditor or report is named. The data security exhibit commits it to a written information security program that adopts or aligns with an industry standard, with the ISO 27000 family, SOC 2 Type 2 and CIS benchmarks given as examples. The privacy exhibit mentions a trust center portal as one possible route for subprocessor updates, and no trust center is linked from the site.
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
CUBE describes its AI as proprietary and trained only on regulatory content, classifying, extracting, mapping and linking publications in 100 languages. Its coworkers draw on regulatory and network intelligence that, in CUBE's words, generic AI models are not trained on.
No model, model family or outside model provider is named, and nothing says whether a general purpose model sits behind the coworkers' natural language answers. Microsoft Azure appears as a hosting subprocessor, and no notice of model changes is committed.
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
No price is published, and every product page routes to a demo or a conversation with a CUBE expert. Its Global Terms set the commercial shape. Fees are set for each contract year in an order form that names the number of authorized users, and invoices follow the order form's payment terms.
Unless the order form fixes the fees, they rise 5 percent at the start of each contract year, late amounts carry 1.5 percent a month, and the agreement renews unless either side gives 60 days' notice. Intel has its own subscription terms, version 1.1 of June 2026. Nothing states what implementation adds.
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Highly regulated industries are CUBE's focus, with solution pages for banking, financial services, insurance, corporates and partners. RegPlatform serves enterprise compliance and risk teams across the first and second lines, and Intel targets fast growing regulated businesses. Oden covers state by state notices and guidance for American insurers writing commercial or personal lines, and Powered By serves platform builders, information businesses and technology providers.
Coverage spans regulatory publications, guidance and enforcement actions from more than 10,000 issuing bodies in 250 countries and territories and 100 languages. No practice area or obligation type is named as out of scope.
The public pages on file for CUBE, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
Client Data in Training, Prompt and Output Retention, Third Party Request and Subpoena Notice
Read Oct 13, 2026
Outside Counsel Guideline Readiness
Read Oct 13, 2026
CUBE's regulatory intelligence now powers a new Regulatory Horizon Scanning capability inside IBM watsonx.governance. It monitors AI related developments from regulators, legislators and standards bodies and surfaces them in the governance workflow, where teams can map a change to an AI use case and keep a record of how it was assessed.
CUBE added three agentic coworkers to RegPlatform: a Priorities Coworker that scores regulatory updates for relevance, an Analysis Coworker that answers natural language questions against laws and rules, and an Enforcements Coworker that consolidates global enforcement actions. The agents run on Microsoft Azure and are listed on the Microsoft marketplace.
A signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Can material a lawyer puts into this product be used to train a model?
The customer agreement or data processing addendum contractually limits use of Customer Data to providing the contracted service, and no surface names training either way. The limit is bound, which a policy page is not, but it is not an express training prohibition. If any surface names training in either direction, one of the other values is true and this one is not.
Clause 3.1 of the Global Terms for CUBE Services, January 2026, leaves customer data owned by the customer. CUBE, its affiliates and subcontractors may use and store it only to the extent needed to carry out the agreement, including keeping it after termination. Clause 8.1 lets CUBE use aggregated service usage data to improve the services, and that data excludes customer data, personal data and confidential information.
The terms bar customers from training AI on CUBE's services or content and say nothing about CUBE training on customer data.
How long does the product keep what a lawyer typed, and can that be set to zero?
Retention is acknowledged in public materials with no stated period.
Under clause 3.1 of the Global Terms, CUBE may retain customer data after the agreement ends. Clause 3.2 has it back up customer data daily and keep only the latest copy during the term. At termination, clause 13.3.3 has CUBE delete or return personal data at the customer's option, and the privacy exhibit has it delete personal data on a reasonable request at any time. No retention period is stated for customer data or for what the coworkers produce.
Does retrieval respect the firm’s ethical walls, or can the model read across them?
No located public material addresses walls or matter level segregation.
RegConnect gives connected applications role based authentication, so only applications with the right permissions reach RegPlatform data, and each access is logged. Regulatory Inventory and Groups map change to a firm's entities, jurisdictions and business lines, and workflow assigns ownership and approvals. How access is separated between users, teams or business units inside a customer is not described.
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Terms commit to notice where lawfully permitted. No transparency report located.
Clause 10.3 of the Global Terms lets either party disclose confidential information only as far as a court or regulator orders. Where it is able to, the disclosing party informs the other in writing first so the other can seek a protective order, and customer data counts as the customer's confidential information. The privacy exhibit adds notice of any law requiring CUBE to process or disclose personal data, unless the law forbids notice. No transparency report is published.
Where does the law in this product come from, and does the vendor have the right to use it?
Coverage is described by jurisdiction with no identification of the underlying corpus.
CUBE captures regulatory publications, guidance and enforcement actions from more than 10,000 issuing bodies across 250 countries and territories in 100 languages, follows about 150,000 sources, and counts its coverage as 750 jurisdictions. Under its Global Terms the content comes from freely and publicly available sources and third party providers, which CUBE compiles, translates, tags and processes. Beside it sits a dataset of more than 300,000 real bank controls contributed by financial institutions. No issuing body, supplier or license is named.
Does the product tell you when the authority it just cited has been overruled?
The vendor computes and surfaces subsequent history itself, with the method described.
Tracking a rule's later state is the core of the product. Horizon Scanning follows change in every country, territory and published language, content is structured and versioned, and Regulatory Inventory maps each change to the entities, jurisdictions and business lines it affects. When a regulation changes, RegConnect flags the policies, processes and controls linked to it in connected systems. No lag between a regulator publishing and the platform reflecting it is stated.
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
The Priorities Coworker ranks regulatory developments by certainty and applicability for a firm, and coworker answers come back with their sources. No path is described for a classification, mapping or answer the system cannot support, and no abstention behavior or confidence value is described.
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming CUBE, RegPlatform or Oden. CUBE's products turn regulatory change into obligations and mapped controls for compliance and risk teams at regulated businesses.
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
No CUBE material engages ABA Formal Opinion 512, Law Society or SRA guidance, or a regulator's statement on AI use inside a compliance or legal function. The website terms tell readers to take professional advice before acting on site content, and Intel's terms say the service is not professional advice.
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.
CUBE sells to compliance and risk teams at banks, insurers and other regulated businesses, and to platform builders that embed its content. Its pitch is the buyer's own effort: one source of truth across the first and second lines, duplicate work removed, and automated triage in place of manual monitoring. No record of AI assisted work by matter is kept for fee purposes.
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A current subprocessor or model provider list is published.
Annex A of the privacy exhibit lists the material subprocessors with their locations and transfer mechanisms. They are Datum and Vantage data centers in Great Britain, Microsoft Azure for cloud hosting by product, and CUBE group companies under an intragroup transfer agreement. A new subprocessor comes with five days for the customer to object, and updates go to a mailing list or trust center the customer subscribes to. No model provider is named and no client facing disclosure material is published.
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
RegPlatform keeps an audit trail from the first sign of a rule change through obligations, control mapping and reporting, built to give the board, auditors and regulators traceable evidence. The Priorities Coworker records its assessment decisions, the Analysis Coworker keeps each research record, and Regulatory Inventory logs the reasoning behind each mapping. No export for each document identifies the model used or the person who reviewed the output, and the record is built for supervisors rather than courts.
Every grade and every signal on this index is drawn from public sources and dated. If a record is wrong, out of date, or missing an artifact the index did not locate, send the source and it will be reviewed and the record redated. Vendors are welcome to submit documentation. Nothing on this index is for sale, including a listing, a placement, or a grade.