Your data, your AI. Private.
Regulatory gap analysis, done by AI, without the bank's data ever leaving its perimeter.
REGOLA is the secure AI platform that amplifies the work of compliance specialists: it reads regulatory updates, finds which internal documents they affect and where, and proposes the changes. Your team reviews and decides, with the evidence already at hand.
- 1Filter the updatesWhich regulatory changes actually matter to the bank?
- 2Map the impactWhich internal documents, which sections, who owns them and by when.
- 3Support the changesWhat needs to change and how, with the regulation side by side.
Keeping internal rules aligned is mandatory. Doing it by hand in 2026 is a problem.
Italian supervisory rules (Bank of Italy Circular 285) require compliance to continuously identify applicable regulation and assess its impact on processes and procedures. The volume grows every year; teams do not.
The EBA cost refers to the prudential framework (2018-2020 data); the EBA itself estimates that reporting costs have fallen by about 20% since 2021. Understanding the regulation and transposing it into internal documents remains the bank's job.
REGOLA analyses and proposes. Your team decides.
Three steps that today take weeks of reading, turned into a reasoned review.
The updates that matter
Every new regulatory text is read paragraph by paragraph and classified as relevant or not for the bank. From the relevant updates REGOLA extracts the individual obligations.
- Italian Official Journal, EU Official Journal, Bank of Italy, EBA
- Obligations separated from descriptive text
- Works on the updates the bank already receives
Where they hit
Each obligation is compared with internal policies, regulations and procedures. For each one, a verdict: covered, partially covered, not covered, not applicable.
- Documents and sections involved
- Document owner
- Effective dates and deadlines
What to change
Where there is a gap, REGOLA suggests the action and explains why, with the chain of verbatim evidence between regulation and internal document. The decision stays with compliance.
- Suggested action and rationale
- Verbatim quotes checked against the source document
- Export for the team's workflow
Drop the time-consuming part. Keep every impact that matters.
One product, two modules.
REGOLA is an AI-native regulatory change management platform, co-designed with partners from the banking system.
REGOLA Compliance
Gap analysis between external regulation and internal rules: from the update to a verdict for every obligation, with evidence and a suggested action.
- Summary dashboard by update and by document
- Individual regulatory obligations
- In-depth, traceable gap analysis
REGOLA Policy
The second module, on the consistency of internal rules over time: it will find the inconsistencies that build up across policies, regulations and procedures.
- Contradictions and overlaps between documents
- Cross-references that are no longer valid
- Support for maintaining the internal corpus
REGOLA at work
What compliance gets, for every obligation
The risks of general-purpose AI tools.
Before handing a bank's internal documents to an AI, it is worth knowing where they end up. Four recurring risks, and how REGOLA handles them.
Exposure of confidential data
What you pass to a cloud AI model (files, questions, answers) can be stored and read by the provider's human reviewers when abuse-monitoring systems flag it.
Raw documents stay inside the bank's perimeter. Only anonymised text fragments are sent to external models.
Data used to train models
The use of data to train models has taken the major AI providers to court: The New York Times sued OpenAI and Microsoft in 2023, and Anthropic settled the authors' class action for 1.5 billion dollars, finally approved in July 2026. The issue is control: knowing which data goes into the models, and on what basis.
REGOLA is the safe tool to give your team: it sends external models only text that is already anonymised, and your team's corrections improve REGOLA for your bank, not the product sold to others.
Business continuity
A cloud provider can suspend the service or withdraw support. The European Commission's cloud sovereignty framework assesses precisely the ability to keep operating in that case, and DORA requires banks to have exit strategies for ICT services supporting critical or important functions.
REGOLA does not depend on a single provider: the language model is a configuration choice and can be changed without touching the code. Fully local deployment with on-premise models arrives during 2027.
Extraterritorial laws
In the framework it uses to assess cloud providers in its own tenders, the European Commission considers exposure to non-EU laws with cross-border reach, such as the US CLOUD Act and the Chinese Cybersecurity Law, through which non-EU authorities can compel access to data and systems.
Documents, critical processing and institutional memory stay inside the bank's perimeter, on-premise or in a private cloud. For clients requiring full isolation, fully local deployment during 2027.
Privacy-first, by design.
All critical processing, raw documents and institutional memory stay inside the bank's perimeter. Only anonymised text fragments are sent to external language models.
On-premise or private cloud (VPC) installation. Extraction from internal rules runs locally.
A proprietary anonymisation system processes everything sent to language-model APIs.
The language model is a configuration choice, not a code change. For clients requiring full isolation, fully local deployment with on-premise models during 2027.
Your team's corrections improve REGOLA for your bank, not the product sold to others.
Output that stands up to an inspection.
Every verdict can be retraced and defended before a supervisory inspector or an internal auditor: evidence, rationale and team decisions stay documented and available over time.
Every verdict carries the exact quotes from the regulation and the internal document, checked against the source text to rule out invented content.
Audit log of analyses and team decisions: who validated what, and when.
Same input texts, same result. Audit-readiness lives in the output, not in trusting the model.
REGOLA investigates and documents; compliance assesses and signs off. A tool that makes the team's work more defensible, not one that replaces it.
AI governance and the AI Act.
For many banks, AI compliance is a blocker to adoption today.
With REGOLA, the answers to the three questions that matter are already there.
Classification
REGOLA is a support tool: the decision stays with the Compliance function. It is not among the high-risk systems of Annex III, which in banking covers creditworthiness assessment; and Article 6 in any case excludes systems that perform a narrow procedural task or a task preparatory to a human assessment.
Role
Sophia AI is the provider of an AI system with a limited scope, not of a general-purpose model. REGOLA's proprietary models are classifiers specialised on a narrow task: they are not GPAI models and do not carry the obligations set for large general-purpose models.
Dataset
The proprietary models are trained on public regulation, so the training content can be disclosed in full. It is fine-tuning of small models, not the training of a large language model.
Built for compliance teams without an army.
Small banks (SNCIs) and financial intermediaries, where a few professionals must cover the same regulatory perimeter as a large bank.
From demo to adoption, in three steps.
We stay alongside you at every stage, from installation to everyday use.
Demo
We show you REGOLA on real regulatory updates and map your perimeter and internal documents together.
Proof of concept
REGOLA works on your internal rules, inside your perimeter (on-premise or VPC), on real regulatory updates chosen together with you.
Adoption
Integration with the tools you already use (SharePoint, corporate identity with AD/LDAP and SSO, open APIs), team training and ongoing support.
The networks we belong to.
Let's look at REGOLA on your cases.
Leave your details and we will get back to you to set up a session on the cases you care about.
- Demo on real regulatory updates
- A partner ready to listen
- No commitment