FinregE

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

AI RIG is named as a distinct engine and reaches across all seven modules rather than sitting in one: classification, tagging, prioritisation, summarisation, obligation extraction, obligation to control mapping, policy drafting assistance and question answering. The vendor states production AI since 2018 and holds an Innovate UK AI grant and an Imperial College NLP research collaboration, so the model work is evidenced rather than asserted. Held at B rather than A because the spine underneath is a regulatory registry and workflow system that would still function as a rules inventory, task tracker and control testing tool with the AI removed. The AI makes it fast; it is not the only thing being sold. Compare Reveal at A, where removing the models removes most of the product.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

The claim is squarely made and the documentation behind it is not published. The vendor states that every AI output is fully source cited for audit defensibility, and separately that governance documents remain traceable back to regulatory requirements. Source citation on generated output is the right architecture for this use case and is more than most of the category claims. What does not exist anywhere in public: any accuracy figure, any extraction precision or recall number for obligation extraction, any hallucination rate, any published evaluation or test set, any independent benchmark, and any statement of what the system does when it cannot answer. Searched the home page, the AI Regulatory Expert page, the horizon scanning page, the RIG MAPS page, the news and blog index and the Terms of Use on 29 Aug 2026. Obligation extraction against regulatory text is a measurable task and nothing measured is published.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

The oversight model is documented in product terms rather than asserted as a principle. Output is framed throughout as AI assisted and AI guided rather than autonomous: the AI proposes obligations, suggests policy language and recommends control alignments, and FinregE Workflows routes every regulatory assessment to named stakeholders through defined approval chains with assigned ownership. The audit trail records who assessed, what changed, when, why it was actioned, the supporting evidence and the routing history, so a human decision point is recorded rather than implied. Held at B because no autonomy threshold is published: nothing states where the system acts without review, and no confidence score or escalation rule is described. The oversight is structural, from workflow design, rather than a stated policy a buyer could test.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

The strongest evidence on this record and the most unusual on the index so far: the vendor was selected by the Financial Conduct Authority to redesign, host and manage the FCA Handbook website. A regulator adopting the product to publish its own rulebook is a materially different class of evidence from a customer logo, because the buyer is the body whose text the product structures. Also named: a strategic investment from Moody's Corporation, FSQS registration, and a published case study claiming a 60 percent reduction in cost and a 100 percent reduction in risk at a UK bank. Held at B on two gaps. The case study figures carry no methodology, no baseline and no measurement period, and a 100 percent risk reduction is the unfalsifiable absolute shape this index does not credit. Every customer testimonial is anonymised by tier and sector rather than named. Note for a later reader: the home page counters for jurisdictions covered, weekly change volume, uptime and user numbers render client side and returned zero when fetched on 29 Aug 2026, so those figures were not captured and are not relied on here.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Nothing published that a buyer could check. No confidentiality commitment, no statement on how customer content is handled, no data processing agreement and no privacy policy were located. The only legal document published on the site is a Terms of Use that governs the marketing website rather than the platform, disclaiming the accuracy of site content and excluding liability for reliance on it. A buyer who clicked Terms of Use expecting product terms would find a website disclaimer. Checked the site navigation, the full site footer, the company page, the contact page, the sitemap page and the Terms of Use on 29 Aug 2026. This is an absence of publication rather than a finding about the product, and the platform serves Tier 1 banks and a regulator, so contractual protections almost certainly exist in the paper a customer signs. They are not public, and this index grades what is public.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

Not addressed in any located material. The product outputs regulatory interpretations, obligation extractions and drafted policy language, and the vendor markets to Legal and General Counsel as one of six named stakeholder audiences, so the question of whether output constitutes advice is live. Nothing states that output is not legal advice, nothing addresses the role of the qualified professional reviewing it, and no professional responsibility positioning of any kind was located. Checked the home page, the company page, the AI Regulatory Expert page, the stakeholder sections addressed to Legal and General Counsel, and the Terms of Use on 29 Aug 2026. The workflow design does require human assessment and sign off, which is the substance of the protection, but the vendor never says so in these terms.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

Nothing published about this vendor's own model governance. The gap is worth naming precisely because the vendor publishes extensively about AI governance as a customer problem: blog material on AI governance frameworks for banks, coverage of the EU AI Act and AI governance regimes as tracked subject matter, and a public sector offering that helps agencies ensure AI governance. None of that is disclosure about FinregE's own system. Located nothing on model evaluation, bias testing, human review of model behaviour, drift monitoring, an AI policy, or ISO 42001. Checked the home page, the AI Regulatory Expert page, the company page and the blog index on 29 Aug 2026. Research limitation recorded rather than assumed: the home page FAQ includes an entry asking whether the AI is suitable for regulated environments, and the answers render client side and did not load, so that answer is unread. If it contains governance disclosure this grade is a correction candidate.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

No stewardship position located for customer content passing through the AI. Nothing states whether customer documents, policies and control libraries uploaded to the platform are used to improve models, how long inputs and outputs persist, whether processing is segregated by tenant, or what happens to derived artifacts. Security controls exist and are graded separately under Security Certifications, and are not double counted here. Checked the home page, the horizon scanning page, the company page, the site footer and the Terms of Use on 29 Aug 2026 and located no privacy policy, no data processing agreement and no security page. For a platform ingesting a regulated institution's internal policies, procedures and control libraries, this is the disclosure a buyer most needs and it is entirely absent from public material.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

No product liability position published. The only published legal document is a website Terms of Use, which excludes liability to any user for loss arising out of the use of, or reliance on, content on the site, and excludes representations that content is complete, accurate or up to date. That is a marketing site disclaimer and it says nothing about the platform, its output, or recourse when an obligation extraction or a policy mapping is wrong. Nothing was located on indemnity, warranty, service levels, or a remedy where AI output is incorrect. Checked the site footer, the Terms of Use and the sitemap page on 29 Aug 2026. Recorded as an absence of published product terms rather than as a limitation the vendor has imposed, since the operative terms are in a signed contract this index cannot see.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

The claim is made at architecture level and no integration is documented. The vendor describes an API first architecture, states that infrastructure is only valuable if it connects, and positions the platform as the brains of the compliance function feeding intelligence into tools teams already use. A customer testimonial from a global legal professional services firm specifically credits access to the regulatory data feed through customised APIs with filtering. What does not exist in public: any named integration or connector, any GRC platform the product sits beside, any API documentation, any authentication or scope detail, and any statement of what moves in which direction. Checked the home page, the ecosystem integration section, the automated compliance solutions page and the platform footer links on 29 Aug 2026. Compare Regology at B, which names ServiceNow, Archer and Hyperproof and states that no rip and replace is required.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

The hosting platform is named and nothing beyond it is. The vendor states hosting on Microsoft Azure, single sign on, role based access control and a four to twelve week implementation. No region or data residency commitment was located, which is a live question for a London vendor selling to Tier 1 banks, insurers and regulators subject to UK and EU data localisation expectations. No single tenant, private instance or in perimeter deployment option is described, and nothing states where regulatory data or customer policy libraries are physically processed. Checked the home page, the horizon scanning page, the automated compliance solutions page and the company page on 29 Aug 2026. Naming the cloud provider is a real disclosure and earns the C; residency is the artifact that would move it.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

Three credentials are named and none is evidenced. Named: ISO/IEC 27001:2022 with the standard version stated and a dated announcement carrying a quote from the named COO, Cyber Essentials Plus, and FSQS registration. Naming the 2022 revision rather than the withdrawn 2013 one is a real signal and better than several records on this index. Held at C rather than B because nothing behind the claims is reachable: no auditor or certification body is named, no certificate number, scope statement or expiry date is published, no SOC 2 of any type is claimed, and there is no trust centre, security page or documentation request route of any kind. Under the three tier test the artifact is neither open nor self serve request; it is absent. The certifications appear on the home page as badge images rather than as text a reader can verify. Checked the home page badge row, the ISO certification announcement, the company page and the full site footer on 29 Aug 2026. Compare Regology at B in this same category, which names BARR Advisory as the auditing firm and states the examination scope; FinregE names neither, so B here would sit inconsistently against a record already on the roster.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

Nothing located. No foundation model provider is named anywhere in public material, no statement distinguishes proprietary models from third party models, and no subprocessor list exists. The vendor describes machine learning and natural language processing built since 2018 and an Imperial College research collaboration, which implies meaningful in house model work, but implication is not disclosure and the platform's generative and question answering features are not attributed to any named model. Checked the home page, the AI Regulatory Expert page, the company page, the site footer and the Terms of Use on 29 Aug 2026. For a buyer in a regulated institution, the identity of the model provider is a subprocessor question their own regulator may ask, and it cannot be answered from public sources.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No pricing at any level of abstraction. No price, no range, no tier structure, no unit of charge, and no statement of what drives cost, whether that is users, jurisdictions monitored, modules licensed or regulatory sources ingested. Every commercial route on the site is a demo request or a booking link to a calendar. The one adjacent figure published is a case study claiming a 60 percent cost reduction at a UK bank, which describes the customer's savings rather than the vendor's price and is not transparency about what the product costs. Checked the home page, the sign up page, the contact page and the company page on 29 Aug 2026. Common for enterprise RegTech and still an absence a buyer cannot work around.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Coverage is stated with unusual specificity for this category, at the level of named regulators and named regimes rather than a jurisdiction count alone. Regulators named include the PRA, ECB, EBA, Basel Committee, SEC, FCA and CFPB. Regimes named include MiFID II, AIFMD, Solvency II, PSD2, MiCA, DORA, AMLD6 and Consumer Duty. Regulatory themes are enumerated across prudential regulation and conduct, AML, sanctions, data protection and information security, operational resilience, consumer protection, competition, health and safety, tax and reporting, and ESG. Sector coverage is set out for banking, payments, insurance, asset and wealth management, fintech and digital assets, lending and credit, accounting and tax, healthcare and pharma, public sector and development finance, energy, aerospace and defence, and automotive and transport. Scale is stated in the ISO certification announcement as more than three million regulatory data points from over 2,000 sources across more than 160 jurisdictions. Held at B rather than A because the jurisdiction list itself is not published: a buyer can read that 160 plus jurisdictions are covered and cannot check whether their own is among them, and no update lag or refresh frequency is stated for any source.