R
RequirementONE
RequirementONE is a regulatory change platform for compliance teams. It monitors the websites of regulators, industry bodies and standards organizations worldwide, turns their publications into a standard format whatever the language, and delivers the updates a team has chosen by source and topic. Teams triage each update, assess its impact and track the actions it needs in shared task lists with a full change history.
Generative AI runs inside the platform for summaries, reports and translation of publications, and the top tier adds AI extraction of insights. The same no code toolkit lets customers build apps for policy management, risk management, ESG reporting and other processes, with workflow automation and reporting through their own reporting tool. Its published case study is a central regulatory watch team at an international financial services firm working across several languages.
Pricing is public, per user and per monitored source each month, from a free newsletter tier to Enterprise, in five currencies. The platform runs on Microsoft Azure, either in a shared public cloud near the customer's users or in a private cloud built to the customer's location and security needs. RequirementONE Group Limited is based in London and led by cofounders Martin Gorm Pedersen and Helen Dann. Its terms of service, data processing agreement and customer success agreement are published.
RequirementONE, head to head
Side by side on the same 15 capability axes and 12 legal signals: where the two part company, and what neither one publishes.
Alternatives to RequirementONE
Vendors in the same categories as RequirementONE whose graded profiles look most alike, with a line on what each product does.
Similar is not the same, so check that each one does the job you need. No vendor pays for placement.
- CCUBECUBE is a regulatory intelligence company for financial institutions and other regulated businesses, based in London.
- SSecuritiSecuriti sells what it calls the DataAI Command Platform, built on a knowledge graph that maps data and AI objects across hybrid multicloud, SaaS and on premises systems, in four pillars…
- SSingleFileSingleFile keeps US business entities in good standing and gives the people responsible for them one place to see everything.
- OOneTrustOneTrust is a governance platform for privacy, data and AI, sold to privacy, security and risk, data and marketing teams across five solution families.
- PPrivado AIPrivado AI is a privacy engineering company whose platform finds personal data wherever an organization processes it and turns that into privacy assessments and records of processing.
- TTranscendTranscend is a data permissioning and decision layer built to answer one question, whether a given piece of customer data can be used for a given purpose, and to enforce the answer inside…
Ordered by how closely the graded profiles match across the 15 capability axes, inside the same categories. See how each axis is graded in the methodology.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Two products sit in one: a regulatory data feed and a no code platform for building compliance workflows, with generative AI added across both. The data platform watches hundreds of regulator, industry body and standards websites. It converts web pages, Word files, spreadsheets and PDFs into one format and stores them in a data lake that users and other systems subscribe to. Customers log in to a live stream of indexed and tagged publications.
Any app on the platform can call generative AI for drafting content, analyzing data and producing summaries and reports. AI translation renders publications into a team's own language, and an AI enhanced taxonomy routes new developments to the right people. On the price list, publication translation and AI extraction of insights appear only on the Enterprise tier.
Monitoring, topic filters, task lists, automations and reporting run without the models, and the Try, Expand and Collaborate tiers are sold on those features.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Each update is a publication from a source the team chose, so the regulator's or industry body's own document sits behind every item, and teams can reach both past and current publications from the platform. The AI layer adds summaries, translations and, on Enterprise, extracted insights on top of that source text.
No accuracy figures are given for those outputs. The one regulatory case study claims efficiency and accuracy gains of up to 80% for an international financial services firm, without a baseline.
No warranty covers the accuracy, completeness or reliability of third party content such as data feeds, and RequirementONE does not promise error free service.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
People do the triage, and the platform organizes it. Updates are filtered to each team by topic and taxonomy, owners are assigned, and impact assessment and follow up actions run through a central task list with workflow automation, escalation and a full change history. Business power users can build their own apps with the same toolkit RequirementONE uses, so the workflow follows the customer's own process.
The AI steps feed that workflow with summaries, translations, taxonomy routing and, on Enterprise, extracted insights. RequirementONE does not describe a review step for AI output before a team acts on it, or how a misrouted update is caught.
Automations are fixed on Collaborate and fully configurable on Enterprise, so how far automation reaches is the customer's choice.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
The regulatory case study describes an international financial services firm whose central regulatory watch team tracks change across several jurisdictions, topics and languages. RequirementONE says the platform cut lead times from weeks to days and hours, translated regulatory texts in minutes, and delivered efficiency and accuracy gains of up to 80%. A second case study covers a midsize international organization that moved ten legacy business applications onto the platform in ten weeks, with a return on investment inside three months.
Neither customer is named. Home page testimonials come from a chief compliance officer, a regulatory change management director and a principal consultant, without names or firms, and one describes auditors using the platform as a single point of truth.
Recognition includes the RegTech 100, ESG FinTech 100 and AI FinTech 100 lists, Lloyd's Lab and a Grant Thornton RegTech award.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The terms of service, last updated April 2020, carry a mutual nondisclosure clause in which each party agrees to disclose the other's confidential information only as the agreement requires. The customer keeps ownership of all content it puts into the platform. A published data processing agreement makes RequirementONE a processor that handles personal information solely to provide the subscription, binds subprocessors to the same protection, and returns or securely deletes personal information when the subscription ends.
Customers who need separation can buy a private cloud, a hosted instance configured to their chosen location, sizing, redundancy, security posture and regulatory jurisdiction, with a minimum term of one year.
The terms predate the platform's generative AI. They say nothing about using customer content to train or improve models, or about what an AI provider may keep, and privilege and work product are not addressed.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
No published statement says that the platform's updates, summaries or extracted insights are not legal or regulatory advice. The terms disclaim responsibility for the accuracy and reliability of third party content, such as regulatory feeds, and make the customer responsible for the content it adds.
The pricing FAQ draws a commercial line instead. Customers who need organizational transformation or highly specialized advice are pointed to their existing advisors or to RequirementONE's partners.
Nothing addresses the professional duties of the compliance officers and lawyers who act on the updates.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Generative AI is presented as a core capability of the platform, with nothing on how it is governed. No responsible AI statement, accountable owner, testing practice or bias work is described, and the terms and data processing agreement predate the AI features and do not mention them.
The only governance policy on the site is a quality statement from April 2020. It commits the company to a quality management system conforming to BS EN ISO 9001:2000, owned by the chief executive and senior managers.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The data processing agreement sets the rules for personal information in the platform. Its security measures cover physical access, system access, data access, transmission and encryption across the subscription. RequirementONE keeps controls to detect and respond to incidents and notifies the customer of a confirmed breach without undue delay and at the latest within 24 hours. At the end of the subscription it returns or securely deletes personal information at the customer's choice, and customers may audit its compliance, including on site inspections.
Subprocessors are held to the same protection. Their lists are available through the helpdesk, with a 14 day window to object to one.
Under the terms, customer data may be deleted for good once an account is 30 or more days delinquent. The privacy statement, last modified October 2022, still relies on the retired Privacy Shield framework. There is no security page, and no retention period applies to customer content while the subscription runs.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The published terms set out a full allocation of loss. RequirementONE's aggregate liability is capped at the fees paid for the subscription in the 12 months before the event, less refunds or credits. Neither party is liable for indirect, consequential or punitive damages, lost profits or lost data. The cap and exclusions do not apply to indemnity obligations, gross negligence, willful misconduct or material breach of confidentiality, and liability for death, personal injury and deceit is not limited.
RequirementONE indemnifies the customer against third party intellectual property infringement claims, with exclusions for customer materials, combinations with other products and third party content. It warrants that the subscription substantially conforms to its documentation, and the remedies for breach are exclusive.
It does not warrant error free operation or that the service meets the customer's requirements. Nothing addresses the accuracy of AI output, and no insurance is stated.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Integration is described as part of the product, without named systems. RequirementONE says integrations run directly from the platform, through a bridge or through its API. API use is capped at 100 calls a day per user and 5,000 a day per account unless an order says otherwise, and integration is listed on the Collaborate tier.
Reporting connects to whatever reporting tool the customer has standardized on, so any data in the platform can feed reports that refresh on a schedule or on demand. A suite of robotic process automations handles standard manual tasks, and the data lake lets other systems subscribe to regulatory updates as they arrive.
No connector to a GRC, policy, document or collaboration system is named, and no API reference or integration guide is public. Nothing describes which objects sync or in which direction.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The platform runs on Microsoft Azure. On the public cloud, a customer is placed on the Azure instance geographically closest to most of its users. A private cloud can be configured to any combination of location, sizing, redundancy, security posture and regulatory jurisdiction, with the data center set in the order and a minimum one year term.
Under the data processing agreement, personal information may be processed globally as needed to deliver the service. Any data center restriction in the customer's order still applies, and cross border transfers are held to the agreement's security terms. Moving from the Expand tier to Collaborate involves migrating the customer to the most appropriate cloud.
The regions in use today are not named, and where generative AI processing happens, or whether it stays in the customer's chosen region, is not stated.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
No security certification or trust center is offered. Security commitments sit in the data processing agreement, which describes technical and organizational measures and incident detection and response without naming a framework, auditor or report.
The one standard on the site is a 2020 quality statement. It commits the company to a quality management system conforming to BS EN ISO 9001:2000, a quality standard rather than a security one, and names no certification body or certificate. Private cloud customers can specify the security posture of their own instance.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Generative AI is presented as a core capability of the platform, with no model, model family or provider named. Nothing says whether summaries, translations and extracted insights run on a third party foundation model or on RequirementONE's own models, where inference runs, or whether customer content leaves the Azure instance for processing.
No commitment to tell customers when the models change is published. The subprocessor lists available through the helpdesk under the data processing agreement are the only route to learning which outside services handle customer data.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Prices are published in GBP, EUR, USD, CAD and AUD, charged per user and per monitored source each month. Try is free forever for one user and three sources from a shortlist, delivered as a personalized newsletter. Expand costs $12 per user and $40 per source a month, with two users free. Collaborate costs $24 per user and $81 per source, and Enterprise $24 per user and $121 per source. Volume pricing applies automatically, and a card is enough to move from Try to Expand.
A source is one regulator or industry body website, and read only users are offered beside full users. Customer success services come as part of the subscription under a published customer success agreement, which sets out a standard and a premier support tier with different support hours, training and call allowances.
A private cloud is priced on request with a one year minimum, and storage beyond 1 GB on monthly plans is charged at current rates.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Buyers are compliance teams that track regulation, and the company says the product suits any size of customer, from one person to many teams across countries, and any jurisdiction. Sources span regulators, industry bodies and best practice sites worldwide, with hundreds already covered and new ones added on request. The interface and documentation can be provided in a team's own language.
The platform also reaches past regulatory change. Customers have deployed apps for regulatory monitoring, regulatory change, policy management and risk management, and the home page sells ESG reporting, including CSRD data gathering and XBRL submission, and general business process digitalization. The one regulatory case study is an international financial services firm, and its awards come from fintech, regtech and insurance programs.
No page breaks coverage down by industry, firm type or jurisdiction.
3 public documents
The public pages on file for RequirementONE, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
-
Client Data in Training, Prompt and Output Retention, Third Party Request and Subpoena Notice
Read Oct 12, 2026
-
Fabricated Citation Record
Read Oct 12, 2026
-
requirementone.com/pricing1 signal
Ethical Walls and Matter Segregation
Read Oct 12, 2026
From $12 per user and $40 per source a month
- There is a free plan that sends one person a daily email of updates from three sources.
- Paid plans charge for each person and for each regulator or industry website you follow.
- The cheapest paid plan is $12 a month per person and $40 a month per website, and two people are free.
- The top plan costs $24 per person and $121 per website each month and adds AI translation and AI insights.
- A private cloud just for your company is priced by quote.
Published on the pricing page in GBP, EUR, USD, CAD and AUD, charged per user and per monitored source each month. Try is free forever: one user, three sources from a shortlist, a predefined topic filter and a personalized newsletter. Expand is $12 per user and $40 per source a month, with two users free, added sources and topic filters, and dashboards. Collaborate is $24 per user and $81 per source, adding a central task list, shared taxonomy, fixed automations and fixed reporting.
Enterprise is $24 per user and $121 per source, adding any automation, any report, publication translation and AI extraction of insights. The same tiers in pounds start at £9 per user and £29 per source. Volume pricing applies automatically.
Implementation: Customer success services are part of the subscription under the published customer success agreement, with a premier support tier described there. A private cloud is priced on request with a one year minimum term. Storage beyond 1 GB on monthly subscriptions is charged at current storage fees.
Note: Orders are non cancelable and fees non refundable except as the terms or the order provide. Subscriptions renew automatically at current pricing unless notice is given. A source is one regulator or industry body website, and read only users are available beside full users.
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The customer agreement or data processing addendum contractually limits use of Customer Data to providing the contracted service, and no surface names training either way. The limit is bound, which a policy page is not, but it is not an express training prohibition. If any surface names training in either direction, one of the other values is true and this one is not.
The data processing agreement limits RequirementONE's processing of personal information to providing the subscription, as the customer's processor acting on the customer's instructions. The terms of service, last updated April 2020, leave the customer owning all content it adds and give RequirementONE no stated right to use that content to improve its products. RequirementONE owns the suggestions and enhancement ideas a customer offers.
No surface names model training either way. Generative AI now runs across the platform for summaries, translation and extraction of insights, and the purpose limit is the only bound term on how customer data is used. It reaches personal information rather than every publication, note and assessment a team keeps in the platform.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Retention is acknowledged in public materials with no stated period.
Retention is addressed at the ends of the relationship, with no period while it runs. At the end of the subscription, RequirementONE returns or securely deletes personal information at the customer's choice, unless law or the order requires otherwise. It has no obligation to retain customer data, which may be deleted for good once an account is 30 or more days delinquent.
Monthly subscriptions hold up to 1 GB, with storage beyond that charged and a warning at about 90% of the limit. Private cloud customers set the data center in their order, so their retained content stays where they chose. Nothing states how long AI summaries, translations, extracted insights or task histories are kept during the subscription, or whether a customer can set that period.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Segregation is asserted in public materials with no published detail on how it is enforced.
Separation is offered through deployment. A private cloud customer gets a hosted instance configured to its own location, sizing, redundancy, security posture and regulatory jurisdiction. Inside the platform, users hold read and write or read only access, and apps track responsibilities for users and teams. The customer approves each user's access, manages user accounts and guards against unauthorized access. Partners and contractors can be added as users, and outside parties who use an app to work with the customer count as users under the same terms.
How customers on the shared public cloud are kept apart is not described, and no permission model separates one team's or one matter's content from another's within a customer. Nothing says whether AI features draw only on a customer's own content.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Terms commit to notice where lawfully permitted. No transparency report located.
Under the data processing agreement, RequirementONE may be required by law to give access to personal information under a subpoena or other legal process or in answer to government requests. Those requests include national security and law enforcement purposes. RequirementONE commits to inform the customer promptly of such requests unless the law forbids it.
The privacy statement adds that account holders' information may go to law enforcement under a valid subpoena, court order or warrant, and that RequirementONE strives for transparency where it is permitted. The commitment in the agreement covers personal information held in the service on the customer's behalf. No transparency report is published, and nothing extends the notice promise to other content a team keeps in the platform.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Coverage is described by jurisdiction with no identification of the underlying corpus.
Sources are described by type and reach. RequirementONE monitors regulators, industry bodies, standards organizations and best practice sites in any jurisdiction, with hundreds already covered and new ones added when a customer asks. Each source is a website, and customers pick theirs, starting from a shortlist on the free tier.
The data platform converts web pages, Word documents, spreadsheets and PDFs into a standard format and stores them in a data lake that users and systems subscribe to. RequirementONE estimates typical volume at around a thousand updates a month, depending on geography.
No public list names the sources, and no license basis or update schedule is stated. Data feeds count as third party content governed by their owners' terms, with no warranty from RequirementONE on accuracy or completeness.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
Tracking follows new publications as they appear, rather than the status of the rules behind them. Every update keeps a full change history inside the platform, teams set topic filters and taxonomy terms to decide what reaches them, and a central task list records the actions each update triggers. Past and current publications from each source stay available in the platform.
Nothing describes comparing versions of a rule, marking a rule as amended, superseded or repealed, or linking an update to the provision it changes. Currency is left to the publications themselves and to the team reading them.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
What the generative AI does when a publication cannot be summarized, translated or mined reliably is not described. No confidence value, warning or fallback to the original text is mentioned for AI summaries, translations, taxonomy routing or extracted insights. The Enterprise tier sells publication translation and AI extraction of insights as listed features, with no stated limits.
The one regulatory case study describes AI powered translation and concise visual highlights that let users take in a publication quickly. The source publication remains available beside each update, so a reader can return to the original, though the platform does not say when it flags an output for that check.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming RequirementONE. Its platform delivers and summarizes regulatory updates for compliance teams rather than drafting court filings.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
No public material engages with professional conduct or ethics guidance on AI use. ABA Formal Opinion 512, Solicitors Regulation Authority guidance and regulator statements on AI in compliance work are not mentioned.
The legal pages address data protection law, including the GDPR, the UK Data Protection Act 2018 and PIPEDA, and a quality standard. Customers are bound to an acceptable use policy and are responsible for the legality of their own content. None of these documents speaks to the duties of the compliance officers and lawyers who act on the platform's updates.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.
Compliance and regulatory change teams buy the product for their own organization, and the terms limit use to the customer's internal business operations. The customer success agreement goes further and treats support used on behalf of a party outside the agreement as a material breach. Platform use is not billed to a client by the hour, and the price follows the number of users and monitored sources rather than time spent.
Marketing claims savings of up to 80% in cost and effort on regulatory tracking and 20% to 50% of staff time returned through digitized collaboration. A principal consultant appears among the testimonials, and nothing addresses how an advisory firm would disclose AI assisted work to its own clients.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The material exists behind a sales conversation or an executed agreement.
Lists of the third party subprocessors that may process personal information are available to customers through the helpdesk under the data processing agreement. Customers may object to a subprocessor within 14 days of receiving a list, on grounds tied to its ability to protect personal information. The same agreement gives customers a right to audit RequirementONE's compliance, including on site inspections, and promises reasonable help with data protection impact assessments.
The terms, data processing agreement, customer success agreement and privacy statement are all public. No model provider, hosting detail beyond Microsoft Azure, security attestation or disclosure pack is published.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
The platform keeps a working record of regulatory change. Each update carries a full change history, responsibilities are tracked by user and team, and the status of collaborative work is visible in real time. Reports can be built once from any data in the platform and refreshed on a schedule through the customer's own reporting tool, which gives a repeatable view of how each update was handled.
Auditors can be pointed at that record, and one testimonial describes auditors using the platform as a single point of truth for compliance mapped to internal policies and controls. Nothing marks which summaries, translations or insights came from the AI, or exports that information for a regulator or court.