Vixio

AI Centrality

How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.

The models sit on top of a twenty-year content business rather than constituting it, and Vixio says so in its own framing, describing the offering as expert-led data combined with AI-powered tools and counting more than twenty domain specialist analysts among its assets. The corpus is analyst-written and analyst-validated: humans validate and enrich high-value updates before publication, and the regulatory intelligence graph holds more than 90,000 pieces of verified content. VIQ is a retrieval and drafting assistant over that material, and it is described as flagship rather than foundational. Remove the models and the business that existed from 2006 remains entirely saleable, with jurisdiction reports, regulatory analysis, an obligations library, horizon scanning and the task and audit workflow all intact. This is a lower grade than the three regtech peers in this lane took, and the reason is structural rather than a matter of degree: at those vendors machine learning performs the classification and enrichment of the corpus itself, whereas here the corpus is human-made and the AI queries it.

Citation Accuracy and Hallucination Disclosure

Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.

Grounding is real, documented and architecturally enforced, and no figure is attached to any of it. VIQ is described as operating in a closed-box environment over Vixio's own analyst-verified data and never the open web, drawing on more than 6,200 curated sources and 20,000 regulatory documents. Traceability is the strongest in this lane: every claim carries a direct citation back to the original source text or to the Vixio analyst report behind it, with signposts into deeper analysis, and the company frames this as full explainability to a regulator. The retrieval method is described rather than gestured at, through a regulatory intelligence graph connecting content by intent rather than keyword. The gap is measurement: no accuracy rate, benchmark, test set or error analysis was located. **One internal tension belongs on the record**: the section heading claims grounded research with zero hallucinations, while the body copy on the same page says the design minimises and reduces hallucination risk, which is the more defensible of the two claims and the one the rest of the page supports.

Autonomy and Oversight Model

What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.

Three distinct review mechanisms are published, which is more than any other vendor in this lane, and the control structure around them is still incomplete. First, oversight of the corpus before it reaches a user: human-in-the-loop is named as a design pillar, with AI scanning roughly 8,000 daily sources for scale and analysts validating and enriching high-value updates before publishing. Second, oversight of the output at the point of use: the product carries a standing notice that VIQ uses AI across Vixio's proprietary data only and that critical information should always be verified against official sources, and citation traceability makes that verification actually possible. Third, behaviour at the boundary, addressed below on the refusal signal. What is missing is the rest of the structure. The analyst validation applies to high-value updates without defining which those are, so validation coverage is undisclosed; no confidence threshold is described for VIQ itself; and nothing states what happens after an answer is wrong or how a correction propagates to other users who relied on it.

Operational and Outcome Evidence

Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.

Two named customers, two named individuals with senior titles, and figures that describe the customer rather than the change. Inpay is named with a quote from Camila Witt, Chief Risk and Compliance Officer, describing daily use as part of the firm's risk management, alongside figures of more than 45 countries represented and a 99.6 per cent transaction success rate. Bally's Corporation is named with a quote from Christine Scicluna, International Legal Director of Regulatory and Governance, alongside 17,700 slot machines and 20 casinos across the US and UK. Both link to full case studies. The limitation is precise: those numbers size the customer's business, not what using Vixio changed, and the testimony itself is qualitative. The only outcome figure located anywhere is a marketing claim that research time is cut by 90 per cent, which carries no source or method. Neither case study was opened on 1 September 2026, and no date was located on either.

Privilege and Confidentiality Posture

How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.

Almost nothing addresses what happens to customer content, and the one structural fact that is published explains why. Clause 14 of the terms records that for data protection purposes **Vixio is the controller of personal data provided to it**, not a processor acting on customer instructions, and sets out its reasons including that it determines what data is required, how it is used and how long it is retained. That is an unusual position for a platform sold to compliance functions and it is the reason no data processing agreement exists anywhere on the property. Beyond it: no training position on VIQ queries, no retention or deletion commitment for customer content, no segregation description, and no security page. The single located term is narrow and sits in clause 6.3, covering only information submitted to the self-assessment tool, which Vixio may use in perpetuity **on an anonymous basis** to improve its business and services. The privacy policy was not opened on 1 September 2026 and is the remaining surface where a confidentiality position could sit.

UPL and Professional Responsibility Posture

Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.

**The most complete professional responsibility posture located in this pull**, and it is stated in three places that reinforce each other. In the agreement, clause 11 provides that commentary and materials are not intended to amount to advice on which reliance should be placed, and specifically that they are not to be relied on as a definitive or complete statement of the law nor to constitute legal or expert advice or recommendations; clause 6.2 repeats it for self-assessment reports, which are for information only and not to be relied on as legal, financial or other advice. In the product, VIQ carries a standing notice that it uses AI across Vixio's proprietary data only and that critical information should always be verified against official sources, and citation-to-source traceability is what makes that instruction executable rather than decorative. And on the question this axis exists for, the published FAQ asks directly whether VIQ replaces a legal team or compliance officers and answers no, stating that it is built for augmentation rather than replacement and handles research, summaries and drafting so that human experts can focus on high-stakes judgment. **Jurisdiction limits are named**: clause 10.2 warrants nothing about whether the materials are permitted under the laws of any jurisdiction outside the UK and puts that check on the user. The one caveat worth recording is that the terms were last updated in October 2023 and therefore predate VIQ, so the AI-specific statements rest on the product page and FAQ rather than the contract.

AI Governance and Bias Disclosure

Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.

Nothing published addresses governance of Vixio's own AI, and the contrast with what the company publishes about the subject is sharp. Vixio has produced its own research on it, publishing The State of AI Trust in Regulatory Compliance 2026 and a press release reporting that 65 per cent of compliance leaders distrust generic AI for regulatory decisions, and it markets VIQ as designed to satisfy strict internal AI governance committees. All of that is about the market's governance expectations and how VIQ meets a buyer's, not about Vixio's own framework. No responsible-AI page, AI policy, ethics statement, governance committee, named accountable owner, pre-release testing regime or bias evaluation was located. The site navigation and the full footer were read on 1 September 2026 across platform, industries, resources, about and legal sections and contain no such surface, the legal set comprising terms, privacy, cookies, a disclaimer, anti-slavery and accessibility. The design commitments that do exist, closed-box grounding, analyst validation and citation traceability, are product properties and are credited on the accuracy and oversight rows rather than counted twice here.

AI Safety and Data Stewardship

Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.

Nothing is published on any limb this axis asks about, and one published fact explains the shape of the absence. **There is no security page anywhere in the navigation or footer**, which were read in full on 1 September 2026. No retention period, deletion route, subprocessor list, incident or breach notification commitment, or encryption statement was located for customer content. No data processing agreement exists, and clause 14 of the terms explains why: Vixio positions itself as the **controller** of personal data provided to it rather than as a processor, on the stated basis that it determines what data is required, how it is used within the platform, whether third parties process it and how long it is retained. A buyer therefore has no processor commitments to read, by design rather than by oversight. The privacy policy was not opened and is the one remaining surface that could carry retention or sharing detail, so this grade rests on the absence of a security or trust surface rather than on an exhaustive reading of every legal page.

AI Liability and Recourse

What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.

The allocation of loss is published and readable in advance, entirely through a standard limitation clause, and the agreement carrying it predates the AI product it now governs. The cap at clause 10.10 limits liability to the price paid for the particular services in the twelve months before the claim. Clause 10.4 is broader than most, excluding **direct** as well as indirect, special and consequential losses, along with lost profits, savings, business, opportunity, goodwill, data, contract, use and management time. Clause 10.3 preserves the mandatory carve-outs for death or personal injury caused by negligence, fraud and anything not lawfully excludable. Materials are supplied as-is with all other warranties excluded at clauses 10.1 and 10.9. One real protection runs the customer's way: clause 12.3 obliges Vixio, at its own expense, to defend third-party intellectual property infringement claims arising from the website or materials and to pay resulting judgments or settlements, subject to standard conduct conditions. There is no insurance position, no warranty on output, and nothing addressing an AI answer being wrong. **The terms were last updated 12 October 2023**, so the agreement governing VIQ was written before VIQ existed.

Practice Systems Integration Depth

How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.

Nothing published addresses connecting Vixio to anything else. The site navigation and full footer were read on 1 September 2026 and contain no integrations page, no API reference, no developer documentation and no connector directory, and no third-party system of any kind is named as an integration target. Every workflow tool listed is internal to the platform: task management, project tracking, reporting, the obligations library and the document store all operate inside Vixio rather than pushing obligations or tasks into a customer's GRC, policy or document management estate. The nearest thing to an outbound flow is the ability to generate reports and share them by URL, which is document distribution rather than integration. The architecture points the other way as well, with the two services delivered through separate login domains for gambling and payments rather than a single environment. For a product whose output is meant to end in changed controls and updated policies inside other systems, this is a substantive gap rather than a missing marketing page.

Deployment Model and Data Residency

Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.

Nothing published addresses deployment or residency. No hosting provider, data centre location, region option, tenancy model or processing location was located on any surface read on 1 September 2026, and there is no security page in which such detail would ordinarily sit. What can be established is limited to the delivery shape and the corporate footing: the services are browser-delivered through two hosted environments at gc.vixio.com and pc.vixio.com, a status page is published at status.vixio.com, and the contracting entity is Compliance Online Limited, registered in England and Wales with company number 05706431 at St Clare House, 30 Minories, London, with the terms governed by English law and subject to the exclusive jurisdiction of the English courts. That tells a buyer which legal system applies and nothing about where its data sits or who runs the infrastructure. The privacy policy was not opened and is the remaining surface that might address international transfers.

Security Certifications and Trust Center

Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.

No independent security attestation is claimed anywhere. No SOC 2, ISO 27001, ISO 27701 or equivalent appears on the home page, the VIQ product page, the terms or the footer, and there is no security page, trust centre or compliance page in the navigation, all of which were read in full on 1 September 2026. No auditor, certification body, penetration test, scope statement or report request route was located, and no badge or certification mark appears anywhere on the property. The only assurance-adjacent artifacts published are a service status page and the two industry awards displayed in the footer, neither of which is a security attestation. This is a notable absence rather than a routine one for a subscription platform sold to banks, payment institutions, licensed gambling operators and regulators, all of which run third-party assurance processes as a matter of course, and it is recorded as what the public surfaces show rather than as a claim about what Vixio holds internally.

Model Supply Chain Disclosure

Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.

The data boundary is described with unusual precision and the model behind it is never identified. What Vixio publishes is a retrieval architecture rather than a model stack: a regulatory intelligence graph of more than 90,000 verified content items connected by intent rather than keyword, drawing on more than 6,200 curated sources, with VIQ described as operating in a closed-box environment across Vixio's proprietary data only and explicitly never the open web. That answers where the knowledge comes from, which is the question a compliance buyer asks first, and leaves the vendor risk question open. No model, model family, provider or hosting arrangement is named anywhere, nothing states whether a third-party foundation model performs the generation, and nothing excludes one. No commitment to notify customers when the model set changes was located. A customer quote on the same page underlines what the disclosure is doing, praising VIQ for never touching the open web, which is a statement about the corpus rather than about whose model reads it.

Commercial Transparency

Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.

No rate is published and more of the commercial shape is readable than at most vendors in this lane, all of it from the terms rather than from a pricing page, which does not exist. The unit of charge is stated: a subscriber licence is either for a fixed number of users or for an unlimited number of users, with login details issued per user and Vixio reserving audit rights over whether passwords have been shared. Payment structure for bespoke work is published in full, with 50 per cent of the price due up front as a deposit and the balance on delivery, and additional fees agreed in advance where research goes beyond the agreed scope. Renewal is customer-favourable and specified: a renewal reminder issues one month before expiry setting out the price, and renewal requires positive written confirmation rather than defaulting on, with the caveat that unlimited-user licences are likely to reprice upward after a merger or acquisition. Late payment carries interest at 5 per cent above the Bank of England base rate. Clause 8.1 implies some prices are set out on the website for one-off reports, and no figure was located on any page read on 1 September 2026.

Firm and Practice Coverage

Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.

The buyer picture is the most precisely segmented in this lane and the coverage figures contradict each other. Two industries are addressed, each with a hub and five named buyer segments: in financial services, payment services, retail banking, digital assets, regulators and **law firms**; in gambling, online operators, suppliers, payment service providers, regulators and **law firms**. Addressing regulators and law firms as distinct buyers alongside the regulated firms themselves is unusual and is backed by separate pages rather than a mention. The boundary is stated rather than left open, with the platform described as purpose-built for financial services and gambling, which most vendors in this corpus decline to do. Regulatory scope is illustrated with named regimes including AML, GDPR, MiFID II, MiCA, PSD2, FATF, UKGC, MGA and AGCO. **What keeps this below the top band is precision**: the home page states more than 200 jurisdictions and more than 1,400 regulatory authorities, while the VIQ page states over 1,600 regulators across more than 246 jurisdictions, and nothing reconciles the two or indicates which jurisdictions receive analyst depth rather than monitoring alone.