Regology

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

The models are the engine of a core capability layered on an asset that has value without them. The Smart Law Library is a curated, continuously updated corpus of United States federal law, all fifty states and international jurisdictions, and a law library with search and change tracking is a usable product in its own right; the vendor sells the ability to import a customer's existing library into it, which underlines that the corpus is a distinct asset. What the models drive is substantial rather than peripheral, which is why this is not a C: three named AI agents covering Regulatory Change, Compliance and Research determine which laws apply to an organisation, assess the impact of incoming changes, and generate obligations, risks, controls and policies mapped to source law. Applicability analysis at that scale is not achievable by search alone. Distinguished from Norm Ai in the same category, graded A, where the agents execute encoded regulations and no separable data asset stands behind them.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Grounding is real, architecturally enforced and stated as a design goal, short of published measurement. The vendor's central claim on this axis is traceability rather than accuracy: every alert, assignment, decision, approval, rejection and policy update is timestamped and traceable to a source law, which the vendor frames as producing defensible documentation for auditors. So an obligation or control generated by the platform can be followed back to the specific provision it derives from, and the corpus it derives from is the vendor's own maintained library rather than an open web retrieval. That is grounding by construction. Searched the platform pages, the company blog, the published llms-txt file and the news announcements on 29 Aug 2026 and located no accuracy figure, no error rate for applicability determination, no test set, no published evaluation methodology and no independent benchmark participation. For a product whose core function is deciding which laws apply to a business, an applicability error rate is the figure a buyer would most want and it is not published.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

A real published commitment with a documented decision record, short of thresholds. The oversight structure is visible in what the platform records: assignments, decisions, approvals and rejections are all captured and timestamped, which means a human accepts or rejects the agents' output and the acceptance is itself part of the record. Rejection being explicitly logged is notable, since it evidences that disagreeing with the system is an expected path rather than an exception. The agents are described as automating repetitive manual processes and anticipating changes, with compliance teams acting on the output. Not located as of 29 Aug 2026: any threshold at which an agent defers, what the system does when applicability is genuinely uncertain, what proportion of determinations are expected to be reviewed, and what the vendor commits to when an output is wrong.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Described deployments without named customers. The vendor publishes two customer situations with stated outcomes, a regional bank achieving automated impact analysis, faster assessment of regulatory changes and improved audit documentation, and a global social media and technology company managing compliance across multiple jurisdictions at scale. Those describe the shape of a deployment usefully but name no organisation, carry no figures and are undated. Founder credibility is published and relevant, the company having been founded by former PwC compliance professionals with seven years implementing regulatory programmes at large financial institutions, which speaks to domain competence rather than to deployment outcome. Searched the platform pages, the blog, the news section and the llms-txt file on 29 Aug 2026 and located no named customer paired with figures and a date, and no case study with an assessable method.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Confidentiality rests on certification with the specific commitments unaddressed. Published: SOC 2 Type II certification, with earlier announcements stating the examination covered security, availability and confidentiality and naming the auditing firm. That is a real attestation covering the confidentiality trust services criterion, which is more than a bare security claim. Searched the platform pages, the blog, the news announcements and the llms-txt file on 29 Aug 2026 and located no statement on whether customer content may be used to train or improve models, no retention or deletion terms, no segregation model between customers, and no treatment of privilege or work product. The material at issue is a customer's own obligations, controls, policies and compliance decisions, including records of what was rejected, which is sensitive in a different way from client documents but sensitive nonetheless. No trust centre or security page was located, so there was no obvious place these terms would sit.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

The audience is stated precisely and the position is not. The vendor names its users as compliance, legal and risk teams, which places lawyers among the buyers rather than as the only buyer, and the product identifies applicable law and generates obligations, which is analysis a lawyer would otherwise perform. Searched the platform pages, the blog, the news section and the llms-txt file on 29 Aug 2026 and located no published position on advice versus tooling, no treatment of competence or supervision duties, and no jurisdiction limits, notwithstanding that the platform spans United States federal law, fifty states and international jurisdictions where the rules governing who may advise on law differ materially. Recorded at C because the position is inferable from the buyer set rather than published.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

Searched the platform pages, the company blog, the news announcements and the published llms-txt file on 29 Aug 2026. No governance position for model behaviour was located: no AI principles or framework, no named owner of model governance, no pre release testing regime, no AI management certification such as ISO 42001, and nothing on uneven output across jurisdictions, industries or organisation types. The full audit trail is a governance artifact in the compliance sense, recording what was decided and by whom, but it governs the customer's compliance process rather than the model's behaviour, and the two were not conflated. The absence has a specific edge here: applicability determination decides which laws a business is told it must follow, and differential performance across jurisdictions or business types would be invisible to a customer who has no independent view of what should have been flagged.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Certification is published and the operational detail is not. Real and stated: SOC 2 Type II certification, described in company announcements as an examination by an accredited third party auditor covering security, availability and confidentiality, with the vendor stating a continuing commitment to maintaining it. Searched the platform pages, the blog, the news announcements and the llms-txt file on 29 Aug 2026 and located no retention period, no deletion control, no encryption specifics, no access control detail, no named subprocessor list, no hosting provider or region, and no incident or breach notification practice. No trust centre or dedicated security page was reached. Recorded at C on the strength of the attestation alone.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

Searched the platform pages, the company blog, the news announcements and the published llms-txt file on 29 Aug 2026. No published indemnity, liability cap, carve out, warranty on output or insurance position was located, and no customer terms of service was located as published on the property. Recorded as a pure absence on the surfaces reached. The exposure shape matches Norm Ai in the same category and is worth restating: this product tells an organisation which laws apply to it and what obligations follow, so a missed applicability determination surfaces as a regulatory breach by the customer rather than as a bad draft. Nothing published addresses who carries that.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Real integrations exist, are named individually, and the positioning around them is unusually clear. The vendor states it works alongside existing governance risk and compliance investments rather than replacing them, naming ServiceNow, Archer and Hyperproof specifically, and describes itself as a regulatory intelligence and data layer on top of that infrastructure. Explicitly stating that no rip and replace is required, and naming the incumbent systems it sits beside, is a positioning choice that tells a buyer where the product fits in an existing stack. Migration in is also addressed: customers can upload existing law libraries from spreadsheets and PDFs so the platform is operational without rebuilding from scratch. Not located as of 29 Aug 2026: an integrations index page, per integration documentation describing what moves in which direction and what an administrator configures, and any API documentation.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Searched the platform pages, the company blog, the news announcements and the published llms-txt file on 29 Aug 2026. Nothing was located on the deployment model: no hosting provider, no named regions, no customer selectable residency, no tenancy model, and no statement of where processing happens as distinct from where data is stored. Earlier company material describes the product as a cloud based regulatory intelligence solution, which establishes cloud delivery and nothing further. The absence carries weight given the vendor's own coverage claim: a platform serving international jurisdictions and marketed to multinational organisations will meet customers for whom data location is a supervisory requirement.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

Certification is real, named, scoped and attributed to a named auditor, short of a current date and an evidence route. SOC 2 Type II certification is stated by the vendor, and its announcements identify the auditing firm as BARR Advisory and describe the examination scope as covering security and availability, later stated as security, confidentiality and availability. Naming the audit firm is something only a handful of records on this index do, and the vendor also states a continuing commitment to maintaining the certification rather than treating it as a one time achievement. Two things hold this at B. The announcements naming the auditor and scope date from earlier certification cycles, and no current report date, coverage period or renewal announcement was located, so currency rests on the standing claim rather than on a dated artifact. And no trust centre, security page or published request route for the report was located, the vendor's material inviting interested customers to get in touch.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

Searched the platform pages, the company blog, the news announcements and the published llms-txt file on 29 Aug 2026. No model, model provider, hosting location for model processing, or subprocessor was located, and no commitment to notify customers of supply chain changes. The vendor names its three AI agents individually and describes using the industry's most advanced AI without identifying what any of it is. A buyer cannot determine from published material whether their regulatory obligations, control mappings and policy documents are processed by a third party model provider, which is the first question a security review of an AI platform would ask.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

Checked the platform pages, the company blog, the news section and the published llms-txt file on 29 Aug 2026. No pricing page was located, no rate is published, no unit of charge is stated and no tier structure appears. Commercial paths located terminate in a demo request or a published telephone number. No free trial or self serve entry point was located, and no third party pricing figure was located either. Consistent with the enterprise sales model implied by a buyer set of multinational compliance functions.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

Jurisdictional coverage is enumerated precisely and the industry position is stated as a deliberate choice. Coverage spans United States federal law, all fifty states and international jurisdictions, with earlier material citing regulations across twenty countries, and the corpus is described as continuously updated rather than periodically refreshed. Industry scope is stated as an explicit differentiator: one platform covering all industries and jurisdictions, not siloed by vertical or geography, which is a positioning claim against competitors that specialise. Buyer functions are named as compliance, legal and risk teams. Not located as of 29 Aug 2026: a current enumerated list of the international jurisdictions covered, any completeness or lag statement per jurisdiction, organisation size segmentation, and any statement of what the platform is not built for. Naming twenty countries in older material without a current list is the gap between this and an A.