N

Norm Ai

The AI is the product, and the company is organized around building it. Regulations are converted into executable AI agents through a proprietary domain specific language. Agents traverse decision trees to reach compliance determinations, and the entire platform, LEAP, exists to build, evaluate and deploy those agents. The vendor describes itself as the Regulatory AI agent company. Remove the models and what remains is a representation of regulations with no ability to apply them.

The company also created a job function, Legal Engineer, to build AI agents, staffed by former attorneys given intensive language model training.

Grounding is real, enforced by the architecture and documented, but no measurement is published. Regulations are encoded through a proprietary domain specific language into decision trees that a person can read and a machine can execute. An agent follows that tree step by step to reach a determination rather than generating an answer from model memory. The vendor states every determination carries an explanation identifying what may be problematic and under which regulation.

A compliance team can therefore see the legal basis for the outcome and what would need to change. Because the reasoning path is the encoded regulation itself, the output traces to a provision rather than to a retrieved passage. LEAP is stated to include automated evaluation pipelines, so evaluation is built into deployment. Searches of the platform pages, the resources section, the company blog and the trust center found no accuracy figure, error rate, test set, published evaluation method or independent benchmark participation. The founder co authored a widely used legal reasoning benchmark.

A real published commitment with a described division of labor, short of thresholds. The vendor states the operating model plainly: an agent conducts the initial compliance review of, for example, marketing communications against SEC or FINRA rules, and a human professional then reviews the findings and completes the determination. That allocates the decision rather than asserting human involvement. Supporting surfaces are described: explanations attached to every determination, and collaboration tooling through which teams tag each other, review AI judgments and centralize decision history.

Oversight is also a staffing structure, with Legal Engineers building and supervising the agents and adjusting them to client specific guidelines. The vendor is separately building supervisory agents that monitor other AI systems for compliance, which is an oversight product rather than an oversight policy. Not located: any threshold at which an agent defers, what it does when a determination is genuinely ambiguous, and what the vendor commits to when a determination is wrong.

Institutional signals stand in for deployment evidence. Published material describing a Legal Engineer's working day refers to a client meeting with a top ten global asset manager, and the vendor states a focus on Fortune 100 customers, but no customer is named. Vanguard, Blackstone, Citi and TIAA are strategic investors from the regulated industries the product serves; this is context, not evidence of a deployment. Searches of the platform pages, the resources section, the company blog and the news announcements found no named customer with figures and a date, no case study with an assessable method, and no adoption count.

Confidentiality is asserted through a trust program without specific commitments. The trust center states a commitment to rigorous security practices including SOC 2 compliance, continuous monitoring, and a company wide culture of data protection. That is a general assurance rather than a set of terms. Searches of the trust center, the platform pages, the resources section and the company blog found no statement on whether customer content may be used to train or improve models, no retention or deletion terms, no segregation model between customers, and no treatment of privilege or work product.

The platform reviews internal communications, draft marketing and investor materials, and agreements before they are issued. It sees regulated firms' content at the point where a compliance problem would still be undisclosed. The trust center renders client side, its control detail was not read, and it may say more.

Norm Ai answers the advice question through structure rather than a written position. It builds on both sides of the boundary between software and legal advice: the platform performs compliance analysis for enterprises, and in 2026 the company launched Norm Law, which it describes as the first fully AI native law firm for institutional clients. Norm Law is chaired by the former chairman of Sidley Austin and is recruiting partners.

Legal advice is therefore delivered by a law firm with admitted attorneys while the software delivers analysis, which is a real separation rather than a disclaimer. In the operating model, an agent performs initial review and a human professional completes the determination, and in the law firm an experienced attorney decides what happens next. The team includes former regulators, among them a former SEC Commissioner.

Searches of the platform pages, the resources section and the company site found no statement on advice versus tooling, no treatment of competence or supervision duties, and no jurisdiction limits.

There is a governance framework with real substance built into the product, without certification, published results or bias disclosure. Several elements are mechanisms rather than principles. LEAP is stated to include automated evaluation pipelines as part of taking agents into production, so evaluation is a gate. Every determination carries an explanation, and the decision tree is readable by a person, so a lawyer can audit an agent's reasoning without reading code.

Legal Engineers build and supervise agents and maintain them as regulations change. The company also builds supervisory agents to monitor other AI systems against laws and policies, and convenes a forum on AI, law and policy involving legislators and regulators. Not found: an AI management certification such as ISO 42001, a named owner accountable for model governance, published evaluation results as distinct from the existence of pipelines, and any disclosure about uneven output across firms, content types or populations.

A general security posture is stated without operational detail. The trust center states SOC 2 compliance, continuous monitoring, and a company wide culture of data protection and integrity. The trust center sits at a stable URL on a recognized compliance platform, which gives a self serve route. Searches of the trust center, the platform pages and the company site found no retention period, deletion control, encryption specifics, access control detail, named subprocessor list, hosting provider or region, or incident or breach notification practice. The trust center renders its contents client side; they were not read and may say more.

No published indemnity, liability cap, carve out, warranty on output or insurance position was found, and no customer terms of service is published on the site. This product makes compliance determinations about content a regulated firm is about to publish. A wrong determination can therefore lead to a regulatory finding against the customer rather than merely a bad draft, and nothing published addresses who carries that exposure.

The law firm entity, Norm Law, would carry professional liability of its own, which the software vendor's silence does not cover.

Integration is described at workflow level without named connectors. The vendor's stated design is compliant by design, embedding compliance checks into business activities rather than running them separately. It covers content generated by AI, internal communications, agreements, marketing content and sales materials, and the platform is described as monitoring workflows and alerting when something drifts out of compliance.

Searches of the platform pages, the resources section and the company site found no integrations page, no named connector for content management, communications archiving, document management or customer relationship systems, and no API documentation. The product's value depends on intercepting content before it is published, and no integration surface is named.

Nothing was found on the deployment model. No hosting provider, named region, residency choice for customers or tenancy model is published, and nothing states where processing happens as distinct from where data is stored. The customer base is regulated financial institutions, for whom data location is often a supervisory requirement.

A trust center exists, and the certification is claimed without scope or evidence. The trust center sits at a stable URL on a recognized compliance automation platform and states a commitment to rigorous security practices including SOC 2 compliance and continuous monitoring. The portal is a real self serve route. Not found: whether the SOC 2 is Type 1 or Type 2, any coverage period, audit scope, report date, named auditing firm, other certification, or published request flow for the report.

The trust center renders its contents client side, and they were not read. That is a limit of the research, not a finding about the vendor, and the portal may say more.

The architecture is described in detail, and the model layer is not identified. Agents are described as driven by language models, traversing decision trees encoded in the vendor's proprietary domain specific language, with proprietary prompt optimization and structured reasoning frameworks in LEAP. A buyer can see that the regulatory logic is the vendor's own and that a general purpose model executes against it. Searches of the platform pages, the resources section, the company blog and the trust center found no named model or model provider, no statement of where models run, no subprocessor list, and no commitment to notify customers when the model supply chain changes.

No pricing page was found, no rate is published, no unit of charge is stated and no tier structure appears. Every commercial path found ends in a request for a personalized demo. No free trial or self serve entry point was found, and no third party pricing figure either. The customer base is large regulated institutions.

Coverage is described with substance, and the regulatory focus is named at the level of sources. Regulatory scope is stated through the regimes the Legal Engineers track and encode: SEC, FINRA and CFPB, with GDPR referenced in comparison material. The vendor states the approach extends to anything a company is subject to rather than being limited to those regimes. The buyer is the large regulated enterprise, with chief compliance officers named as the main role and financial services the focus of the named regimes and investors.

Functional coverage is listed by workflow: review of regulated content across marketing, investor relations and internal communications, questionnaire and information request completion, contract review, and supervision of other AI systems. Not found: an industry list beyond financial services, segmentation by organization size, jurisdictional coverage outside the United States, and any statement of what the platform is not built for.