F

FinregE

AI RIG is named as a distinct engine and reaches across all seven modules rather than sitting in one: classification, tagging, prioritization, summarization, obligation extraction, obligation to control mapping, policy drafting assistance and question answering. The vendor states production AI since 2018 and holds an Innovate UK AI grant and an Imperial College NLP research collaboration, so the model work is evidenced rather than asserted.

The spine underneath is a regulatory registry and workflow system that would still function as a rules inventory, task tracker and control testing tool with the AI removed. The AI makes it fast; it is not the only thing being sold.

The claim is made plainly and the evidence behind it is not published. The vendor says every AI output is fully source cited for audit defensibility, and that governance documents stay traceable to regulatory requirements. Source citation on generated output is the right design for this use. But nothing public gives an accuracy figure, precision or recall for obligation extraction, a hallucination rate, an evaluation or test set, an independent benchmark, or a statement of what the system does when it cannot answer. Obligation extraction from regulatory text is a measurable task, and nothing measured is published.

The oversight model is documented in product terms rather than asserted as a principle. Output is framed throughout as AI assisted and AI guided rather than autonomous: the AI proposes obligations, suggests policy language and recommends control alignments, and FinregE Workflows routes every regulatory assessment to named stakeholders through defined approval chains with assigned ownership. The audit trail records who assessed, what changed, when, why it was actioned, the supporting evidence and the routing history, so a human decision point is recorded rather than implied.

No autonomy threshold is published: nothing states where the system acts without review, and no confidence score or escalation rule is described. The oversight is structural, from workflow design, rather than a stated policy a buyer could test.

The vendor was selected by the Financial Conduct Authority to redesign, host and manage the FCA Handbook website. A regulator adopting the product to publish its own rulebook is a different class of evidence from a customer logo, because the buyer is the body whose text the product structures. Also named: a strategic investment from Moody's Corporation, FSQS registration, and a published case study claiming a 60 percent reduction in cost and a 100 percent reduction in risk at a UK bank.

Two gaps remain. The case study figures have no method, baseline or measurement period, and a 100 percent risk reduction is an absolute claim that cannot be tested. Every customer testimonial is anonymized by tier and sector. The home page counters for jurisdictions covered, weekly change volume, uptime and user numbers load in the browser and showed zero on 29 Aug 2026, so those figures were not captured.

Nothing is published that a buyer could check. No confidentiality commitment, statement on how customer content is handled, data processing agreement or privacy policy is published. The only legal document on the site is a Terms of Use for the marketing website, not the platform, which disclaims the accuracy of site content and excludes liability for relying on it. Checked the site navigation, the full footer, the company page, the contact page, the sitemap page and the Terms of Use.

This is an absence of publication, not a finding about the product. The platform serves Tier 1 banks and a regulator, so contractual protections almost certainly exist in the paper a customer signs, but they are not public.

Not addressed in any located material. The product outputs regulatory interpretations, obligation extractions and drafted policy language, and the vendor markets to Legal and General Counsel as one of six named stakeholder audiences, so the question of whether output constitutes advice is live. Nothing states that output is not legal advice, nothing addresses the role of the qualified professional reviewing it, and no professional responsibility positioning of any kind is published.

The workflow design does require human assessment and sign off, which is the substance of the protection, but the vendor never says so in these terms.

Nothing is published about the vendor's own model governance. That stands out because the vendor writes at length about AI governance as a customer problem: blog material on AI governance frameworks for banks, coverage of the EU AI Act and AI governance regimes as tracked subject matter, and a public sector offering that helps agencies ensure AI governance. None of that discloses anything about FinregE's own system. Nothing is published on model evaluation, bias testing, human review of model behavior, drift monitoring, an AI policy or ISO 42001.

One answer could not be read: the home page FAQ asks whether the AI is suitable for regulated environments, but the answers load in the browser and did not appear, so that answer may say more.

No stewardship position is published for customer content passing through the AI. Nothing says whether customer documents, policies and control libraries uploaded to the platform are used to improve models, how long inputs and outputs persist, whether processing is segregated by tenant, or what happens to derived artifacts. Checked the home page, the horizon scanning page, the company page, the site footer and the Terms of Use; no privacy policy, data processing agreement or security page is published.

For a platform taking in a regulated institution's internal policies, procedures and control libraries, this is the disclosure a buyer most needs, and it is absent from public material.

No product liability position is published. The only published legal document is a website Terms of Use, which excludes liability to any user for loss from using or relying on site content and makes no representation that content is complete, accurate or up to date. That is a marketing site disclaimer and says nothing about the platform, its output, or recourse when an obligation extraction or policy mapping is wrong.

Nothing is published on indemnity, warranty, service levels or a remedy for incorrect AI output. The operative terms are in a signed contract that is not public, so this is an absence of published product terms, not a limit the vendor has imposed.

The claim is made at architecture level and no integration is documented. The vendor describes an API first architecture, states that infrastructure is only valuable if it connects, and positions the platform as the brains of the compliance function feeding intelligence into tools teams already use. A customer testimonial from a global legal professional services firm specifically credits access to the regulatory data feed through customized APIs with filtering.

What does not exist in public: any named integration or connector, any GRC platform the product sits beside, any API documentation, any authentication or scope detail, and any statement of what moves in which direction.

The hosting platform is named and nothing beyond it is. The vendor states hosting on Microsoft Azure, single sign on, role based access control and a four to twelve week implementation. No region or data residency commitment is published, which is a live question for a London vendor selling to Tier 1 banks, insurers and regulators subject to UK and EU data localization expectations. No single tenant, private instance or in perimeter deployment option is described, and nothing states where regulatory data or customer policy libraries are physically processed. Naming the cloud provider is a real disclosure; residency is what is missing.

Three credentials are named and none is evidenced. The vendor names ISO/IEC 27001:2022, with the standard version and a dated announcement quoting its COO, plus Cyber Essentials Plus and FSQS registration. Naming the 2022 revision rather than the withdrawn 2013 one is a real signal. But nothing behind the claims can be reached: no auditor or certification body is named, no certificate number, scope or expiry date is published, no SOC 2 of any type is claimed, and there is no trust center, security page or route to request documents. The certifications appear on the home page as badge images rather than as text a reader can verify.

Nothing located. No foundation model provider is named anywhere in public material, no statement distinguishes proprietary models from third party models, and no subprocessor list exists. The vendor describes machine learning and natural language processing built since 2018 and an Imperial College research collaboration, which implies meaningful in house model work, but implication is not disclosure and the platform's generative and question answering features are not attributed to any named model.

For a buyer in a regulated institution, the identity of the model provider is a subprocessor question their own regulator may ask, and it cannot be answered from public sources.

No pricing at any level of abstraction. No price, no range, no tier structure, no unit of charge, and no statement of what drives cost, whether that is users, jurisdictions monitored, modules licensed or regulatory sources ingested. Every commercial route on the site is a demo request or a booking link to a calendar. The one adjacent figure published is a case study claiming a 60 percent cost reduction at a UK bank, which describes the customer's savings rather than the vendor's price and is not transparency about what the product costs. Common for enterprise RegTech and still an absence a buyer cannot work around.

Coverage is stated specifically, by named regulators and regimes rather than a jurisdiction count alone. Regulators named include the PRA, ECB, EBA, Basel Committee, SEC, FCA and CFPB. Regimes named include MiFID II, AIFMD, Solvency II, PSD2, MiCA, DORA, AMLD6 and Consumer Duty. Themes run across prudential regulation and conduct, AML, sanctions, data protection and information security, operational resilience, consumer protection, competition, health and safety, tax and reporting, and ESG.

Sectors listed include banking, payments, insurance, asset and wealth management, fintech and digital assets, lending and credit, accounting and tax, healthcare and pharma, public sector and development finance, energy, aerospace and defense, and automotive and transport. The ISO certification announcement gives the scale as more than three million regulatory data points from over 2,000 sources in more than 160 jurisdictions.

But the jurisdiction list itself is not published, so a buyer cannot check whether their own is covered, and no update lag or refresh frequency is given for any source.