Product and intended use
Define the configuration, people, information and tasks being assessed.
What is covered and how it is subscribed
Public claim only
The product is subscribed by module: the brochure states eight core modules for Australian businesses and over 90 industry modules, and the product page links separate core-module and industry-module pages. Protégé is presented as part of the platform under the heading 'Protégé in RegCompliance+' rather than as a separate purchase, but no document read states whether it is included in a module subscription, requires a separate entitlement, or carries an additional charge. Unlike Lexis Red, Capital Monitor, Clause Intelligence, Argument Analyser, Lexis+, Caselex and the Lexis+ AI Service, Regulatory Compliance has no product-specific clause in the Australian GTCs setting prerequisites or additional terms. Read 2026-09-27.
Ask: Does our order form license Protégé in RegCompliance+ as an included feature or a separate line item, which modules and jurisdictions does our subscription cover, and which contractual schedule governs the Regulatory Compliance service given the GTCs contain no clause specific to it?
Named functions of the platform and of the AI assistant
Public claim only
The product page describes obligation summaries with linked alerts and tools filterable by module, jurisdiction, compliance status and risk grading; a unified search across obligations and alerts; regulatory change triage with alerts filterable by impact rating and risk rating; a browsable alert library organised by module, jurisdiction and impact; task lists carrying risk ratings and status indicators; and dashboards covering compliance tracking, obligation management, alert volume, ownership and timelines. For the AI assistant it publishes exactly two functions: 'From asking a compliance question to summarising regulatory change that's relevant to you, Protégé in RegCompliance+ is your AI Assistant.' The brochure adds email alerts and a Community Portal self-support platform. Everything other than those two AI functions is described without any AI mechanism. Checked 2026-09-27.
Ask: Beyond asking a compliance question and summarising regulatory change, what else can Protégé in RegCompliance+ do, and which parts of the obligation registers, impact ratings and risk gradings are editorially authored rather than model-generated?
Deployment and hosting region
Public claim only
Browser-delivered software as a service, signed in at plus.lexis.com/regulatorycompliance; no on-premises, private-cloud or self-hosted option is described anywhere read. The subprocessor list dated 17 September 2026 publishes processing locations for this product as 'Australia, UK' for the software subprocessor, 'Australia, USA' for the host provider and 'Australia' for AI functionality. The Australian GTCs commit to an Australian primary hosting location only for the Lexis+ AI Service (clause 3.9(b)); there is no equivalent clause for Regulatory Compliance, and no page read states that an Australia-only configuration is available. Checked 2026-09-27.
Ask: For an Australian subscriber, in which country do the register, our task and status records, our search and prompt history, and the Protégé inference itself physically sit, and will you commit to Australian-only processing in the order form as clause 3.9(b) does for Lexis+ AI?
Australian and other jurisdictional coverage
Public claim only
A sample obligation reproduced in the brochure carries 'Jurisdiction: ACT NSW NT QLD SA TAS VIC WA COMMONWEALTH', 'Updated: 20/10/2025' and 'Status: Active', and a platform jurisdiction filter shown in the same brochure lists Australia, New Zealand, United Kingdom, European Union, Hong Kong and United States. The vendor states that obligations are reviewed, interpreted and translated from legislation, standards, codes and other authoritative sources by legal and subject-matter experts across jurisdictions, and that content is updated regularly. No per-module currency date, update frequency, or list of the statutes and instruments inside each module is published. Checked 2026-09-27.
Ask: Provide the per-module list of Australian statutes, regulations and codes tracked, the currency lag between an Australian legislative change and the obligation or alert being updated, and which of the six jurisdictions in the filter our subscription actually includes.
Vendor content directing how AI describes the product
Public claim only
Checked deliberately on 2026-09-27 across the product page, the Australian products index, the brochure PDF, the support and training page and the domain's llms.txt held in the project cache. No page or block instructing AI models, assistants or crawlers how to describe the product was found. What the domain does publish at lexisnexis.com/llms.txt is crawler access direction: it allows named search and discovery agents with comments '# --- Allow trusted LLM crawlers (search/discovery) ---' followed by 'User-agent: OAI-SearchBot / Allow: /', 'User-agent: ChatGPT-User / Allow: /' and 'User-agent: ClaudeBot / Allow: /', then '# --- Block Perplexity ---' with 'User-agent: PerplexityBot / Disallow: /', and '# --- Block known training/ingestion bots ---' listing GPTBot, CCBot, Meta-ExternalAgent, Meta-ExternalFetcher, FacebookBot, Amazonbot, Applebot-Extended, Microsoft-Extended and Google-Extended as Disallow. The file directs crawler access; it does not direct how the product is described.
Ask: Does LexisNexis publish, anywhere on its Australian sites, content addressed to AI models or assistants about how its products should be described, and if so where?
Release state of the platform and the assistant
Public claim only
The product page presents the RegCompliance+ platform and Protégé in RegCompliance+ as available, under headings including 'Welcome to a new era of compliance', and the support and training page publishes a tutorial headed 'The enhanced Regulatory Compliance platform and Protégé is here' describing 'an AI-enabled platform that seamlessly integrates our authoritative compliance content' with the assistant. No general availability date, no beta or preview label and no version or release history is published for either the platform or the assistant. Checked 2026-09-27.
Ask: When did the RegCompliance+ platform and Protégé in RegCompliance+ become generally available in Australia, is any part still in preview, and where are release notes published?
Who the vendor says it is for
Public claim only
The brochure states the product supports governance, risk and compliance professionals and delivers compliance registers and alerts. The Australian products index states that corporate and government legal teams gain solutions for legal research, drafting, in-house workflow, compliance and risk management. The product page addresses risk and compliance programmes and describes obligation ownership, task prioritisation and reporting. It is not presented as a law-firm practice tool, although law firms appear among LexisNexis customers for other products. Checked 2026-09-27.
Ask: Which users is Protégé in RegCompliance+ licensed for under our order form, and does the Legal Users definition in clause 2.3 govern the count for a compliance team that does not provide billable legal services?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Whose data may be put in, and who may use it
Public claim only
GTC 2.1 limits Authorised Users to natural persons who are the customer's Legal Users or Academic Users plus reasonable additional employees and support personnel authorised by both parties, and expressly excludes external professional service providers. GTC 2.3 defines Legal Users as all the customer's Australia-based employees, contractors performing dedicated work exclusively for the customer, partners and incoming secondees who provide legal or related services billed to clients, including compliance, conveyancing, migration and intellectual property services, or who are in a legal advisory role. GTC 2.5 and 2.6 make the customer responsible for ensuring every person with access is an Authorised User and for all use through its subscription. GTC 7.10 makes the customer responsible for the legality of the personal data it or its Authorised Users provide. Read 2026-09-27.
Ask: If our compliance team uses RegCompliance+ on behalf of subsidiaries or a managed client, do those users fall inside the clause 2.1 and 2.3 definitions, and does clause 7.10 leave us solely responsible for any third-party personal information typed into a Protégé prompt?
Who supplies the AI, and which models
Public claim only
The subprocessor list dated 17 September 2026 names, for 'Lexis® Regulatory Compliance', Microsoft Corporation in the category 'AI functionality' with the location of processing given as 'Australia', and Amazon Web Services, Inc. as 'Host Provider' with 'Australia, USA'. The product page states more generally that 'LexisNexis systems use commercial-grade cloud infrastructure from Microsoft Azure and Amazon Web Services Bedrock for secure deployment' and that 'Our generative AI applies a private model that does not share user interactions with third parties to improve their products'. No foundation model or model family is named for this product, and no model provider other than Microsoft is listed against it. The separate Protégé-in-Lexis+ product records OpenAI and Anthropic; neither is named for Regulatory Compliance and neither has been carried across. Checked 2026-09-27.
Ask: Which specific model or models does Protégé in RegCompliance+ call, is Microsoft the only AI provider for this product as the subprocessor entry implies, and will you notify us before the underlying model is changed?
Published subprocessor list and change rights
Public claim only
A per-service subprocessor list is published and was last updated 17 September 2026. The entry headed 'Lexis® Regulatory Compliance' names three third-party subprocessors: Squiz Australia Pty Ltd (Software, 'Australia, UK'), Amazon Web Services, Inc. (Host Provider, 'Australia, USA') and Microsoft Corporation ('AI functionality', 'Australia'). The same page names affiliates providing data centre operations, service maintenance and technical and customer support, including LexisNexis, a division of RELX Inc. (United States), LexisNexis South Africa Shared Services (Pty) Ltd, Reed Elsevier Shared Services (Philippines) Inc., Reed Elsevier Technology Services (United States), RELX Trading Australia Pty Ltd and RELX (UK) Limited. DPA 3.1 gives general authorisation to engage subprocessors from that list, requires the list to be updated at least 14 days in advance of a change, and gives the customer 14 days to object with reasons, after which LexisNexis will use reasonable endeavours to avoid processing by that new subprocessor. Read 2026-09-27.
Ask: Which of the named affiliates in South Africa, the Philippines, the United States and the United Kingdom can reach Australian RegCompliance+ data in support, and will you accept a contractual right to refuse rather than merely object to a new subprocessor under DPA 3.1?
Training on customer content
Public claim only
GTC 4.8 defines Customer Information as Prompts and Customer Documents together and provides that, except to the extent it contains LexisNexis content, LexisNexis does not claim ownership rights in it and will, and will ensure its third-party technology suppliers are obliged to, ensure that Customer Information remains within the controlled environment of LexisNexis or those suppliers, is not made public or provided to any other user except the originating Authorised User unless that user instructs otherwise, and 'is not used by LexisNexis to train any AI Technology'. The product page adds the marketing-page statement that 'Our generative AI applies a private model that does not share user interactions with third parties to improve their products'. Read 2026-09-27.
Ask: Does the clause 4.8 no-training commitment flow through to Microsoft as the named AI functionality subprocessor for this product, and is there a written zero-retention arrangement with that provider for prompts sent from RegCompliance+?
Use of feedback, ratings and telemetry
Not confirmed
Nothing in the documents read addresses feedback. GTC 4.8 covers Prompts and Customer Documents, and bars their use to train any AI Technology, but no document read says whether a rating, thumbs-up or thumbs-down, a reported answer, a support ticket or usage telemetry from Protégé in RegCompliance+ is retained, reviewed by staff, or used to improve the service, nor whether a firm can switch feedback collection off. Checked 2026-09-27.
Ask: If a user rates or reports a Protégé answer in RegCompliance+, what is captured, who reviews it, how long is it kept, is it excluded from the clause 4.8 no-training commitment, and can feedback collection be disabled for our tenancy?
Retention of prompts, uploads and platform records
Public claim only
GTC 4.7 provides that Customer Documents uploaded to the Services are processed in a non-persistent state, are secured in transit, and are purged automatically at the end of a user session or a period of inactivity, whichever occurs first, and that retention of Prompt history and its deletion is within the control of the Authorised User. GTC 4.8 states LexisNexis is not obliged to store, maintain, back up, retrieve or restore any Customer Information. No retention period is published for the register itself, for the task, ownership and status records the platform is described as holding, for dashboard data, for alert distribution lists or for system logs. Read 2026-09-27.
Ask: How long are our RegCompliance+ task, ownership, status and dashboard records, our search history and our Protégé prompt history retained, where are the backups held, and what is the retention period for logs?
Deletion on request and at the end of the agreement
Public claim only
DPA 2.3(g) requires LexisNexis, at the customer's choice, to delete or return all personal data after the end of the provision of services relating to processing and to delete existing copies, unless applicable law requires storage. GTC 4.7 places retention and deletion of Prompt history in the control of the Authorised User. No deletion timeframe, no certificate of destruction and no self-service tenancy-wide deletion function is published, and GTC 6.9 addresses only the ending of licences on termination. Read 2026-09-27.
Ask: Within how many days of a written request or of termination will our personal data and compliance records be deleted from live systems and from backups, will you certify that deletion, and which records will you retain and on what legal basis?
Vendor staff access to customer content
Public claim only
GTC 3.6 states that work folders or work spaces created from research sessions are associated solely with the Authorised User's LN ID and that LexisNexis represents and warrants the Folders 'will be under the exclusive control of Authorised Users and we will not access or otherwise review the con...' (the published sentence continues beyond the text captured). GTC 4.8 requires Customer Information to remain within the controlled environment of LexisNexis or its third-party technology suppliers and not to be provided to any other user except the originating Authorised User unless that user instructs otherwise. DPA 6.3 requires reasonable steps so that natural persons acting under either party's authority process personal data only on the customer's instructions. The subprocessor list names affiliates in the United States, South Africa, the Philippines, Australia and the United Kingdom as providing service maintenance and technical and customer support. Read 2026-09-27.
Ask: Under what circumstances can LexisNexis or affiliate support staff view our obligations register, task records or Protégé prompts, is that access logged and available to us, and does the clause 3.6 warranty extend to the RegCompliance+ platform and not only to research folders?
Identity, access and administration
Public claim only
GTC 2.7 provides that access may be given via identification numbers and passwords (an LN ID) or other methods, that an LN ID is personal and confidential to the Authorised User it is issued to, and that a suspected shared or unauthorised LN ID may be cancelled with additional charges payable for the unauthorised use. GTC 2.8 states each LN ID or other access method is country specific to comply with local privacy and data protection laws. GTC 2.9 allows access to be restricted to subscribed Materials. The Trust Center lists access controls among its security measures. No single sign-on, multi-factor authentication, role-based permission model or administrator audit-log capability is published for this product. Checked 2026-09-27.
Ask: Does RegCompliance+ support SAML single sign-on and enforced multi-factor authentication, what roles and permissions control who can change an obligation's status or owner, and can an administrator export an access and activity log?
Encryption in transit and at rest
Public claim only
GTC 4.7(a) provides that Customer Documents will be processed in a non-persistent state and will be secured in transit. The Trust Center states under 'Our Security Measures Include' that 'Data is encrypted both in transit and at rest', and lists disk encryption and application penetration testing among its controls; these are security-page statements rather than contractual commitments. DPA 6.1 lists the pseudonymisation and encryption of personal data among the measures the parties will implement as appropriate to the risk, which is a qualified obligation rather than a fixed requirement. No cipher suite, key-management arrangement or customer-managed key option is published. Checked 2026-09-27.
Ask: Confirm in the order form the encryption standards applied to RegCompliance+ data in transit and at rest, who holds and rotates the keys, and whether customer-managed keys are available.
Certifications and attestations, and their scope
Public claim only
The Trust Center publishes a certification list including SOC 2 Type 2, SOC 2 Type 1, SOC 3, SOC 1 Type 2, ISO/IEC 27001 with a Statement of Applicability, ISO 9001:2015, ISO 22301:2019, ISO 14001:2015, ISAE 3402, NIST CSF, Cyber Essentials and HIPAA, with the reports available only after registration. The Trust Center update of 4 May 2026 states the newly published SOC 2 Type 2, SOC 3 and HIPAA/HITECH reports cover 'Lexis, Lexis+ AI, Lexis+ with Protege and CaseMap+'; Regulatory Compliance is not named in that scope statement. The Australian products index separately states that data is protected through encryption, access controls and 'compliance with global privacy and security standards, including ISO 27001 and GDPR where applicable'. No ISO/IEC 42001 or AI-specific certification is listed. Checked 2026-09-27.
Ask: Is the Regulatory Compliance service and its RegCompliance+ platform inside the scope of your current SOC 2 Type 2 report and ISO/IEC 27001 certificate, and will you provide the certificate, Statement of Applicability and report scope sections naming it?
Contracting entity and governing terms
Public claim only
The Australian Global Platform General Terms and Conditions state that they form part of the agreement between RELX Trading Australia Pty Limited trading as LexisNexis, ABN 70 001 002 357, and the customer entity named on the Order Form, and that the Agreement comprises those terms plus Additional Terms including the Order Form, the LexisNexis Terms of Trade and Supplemental Terms, with the Additional Terms prevailing in the order listed (clauses 1.5 and 1.6). Clause 7.6 applies the law of New South Wales and its exclusive jurisdiction. Clause 5.7 caps each party's aggregate liability at the greatest amount payable by the customer in any rolling 12-month period, subject to the Australian Consumer Law carve-outs in 5.1, 5.2 and the exclusions in 5.8. Clause 7.10 incorporates the LexisNexis Privacy Policy and Data Processing Addendum. No ACN appears in the document. Read 2026-09-27.
Ask: Confirm that RELX Trading Australia Pty Limited (ABN 70 001 002 357) is our counterparty for Regulatory Compliance, provide its ACN, and identify the schedule or Additional Terms that govern this service given the General Terms contain no product-specific clause for it.
Cross-border transfers
Public claim only
The subprocessor list dated 17 September 2026 publishes, for this product, processing in 'Australia, UK' by the software subprocessor, 'Australia, USA' by the host provider and 'Australia' for AI functionality, and names support affiliates in the United States, South Africa, the Philippines and the United Kingdom. DPA 5.1 states only that where personal data originating from the customer's country is transferred to another country, the transfer will be subject to appropriate safeguards in accordance with data protection laws; the DPA's jurisdiction-specific annex covers the EEA, United Kingdom, Switzerland, Latin America, the Middle East and Africa and the United States, and contains no Australian terms and no Australian Privacy Principle 8 mechanism. GTC 4.8 requires Customer Information to remain within the controlled environment of LexisNexis or its third-party technology suppliers. Read 2026-09-27.
Ask: Which safeguards under Australian Privacy Principle 8 apply to the United States and United Kingdom processing named against Regulatory Compliance, and will you add an Australian annex to the DPA identifying them?
Incident notification and history
Public claim only
DPA 7.1 provides that where LexisNexis processes personal data on the customer's behalf it will notify the customer without undue delay after becoming aware of a personal data breach and will reasonably respond to requests for further information. No fixed notification period, contact route or content requirement is published, and no reference to the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) appears in the documents read. The Trust Center update of 4 March 2026, headed 'LexisNexis Security Matter', states that an unauthorized party accessed a limited number of servers containing mostly legacy, deprecated data from prior to 2020, including customer names, user IDs, business contact information, products used, customer surveys with respondent IP addresses and support tickets, and that the impacted information did not contain customer client or matter information or customer contracts. Checked 2026-09-27.
Ask: Will you commit to a notification deadline in hours for an incident affecting our RegCompliance+ data, and confirm whether any Australian Regulatory Compliance customer data was within the March 2026 security matter?
Change notice for terms, features and models
Public claim only
GTC 7.1 allows typographical or non-substantive changes to the Agreement without notice by publishing amended terms, substantive changes on at least 7 days' notice, notice by email to the nominated account contact where a change is considered detrimental, and termination with immediate effect within 30 days of such a notice with a pro rata refund. GTC 2.10 provides that Materials and features may be added to or withdrawn from the Services and the Services otherwise changed without notice, with a 30-day termination right if the change materially affects the value of the Agreement. DPA 3.1 requires 14 days' advance notice of subprocessor changes via the published list. Nothing published addresses notice of a change to the AI model, prompt behaviour or the scope of Protégé in RegCompliance+. Checked 2026-09-27.
Ask: Will you give us advance written notice of a change to the model or behaviour of Protégé in RegCompliance+, or of withdrawal of a module we rely on, rather than relying on clause 2.10's no-notice position?
Term, termination and getting data out
Public claim only
GTC 6.1 sets the term by the Order Form; 6.2 bars cancellation during the term; 6.3 auto-renews for 12-month periods with an annual increase or a usage adjustment, notified at least 45 days before renewal; 6.5 allows the customer to terminate on at least 30 days' written notice expiring the day before the next renewal; 6.6 gives additional termination rights during a renewal period for consumer and small business contracts; 6.7 allows LexisNexis to terminate on 60 days' notice; 6.8 limits the vendor's obligation on termination to a pro rata refund of prepaid charges; and 6.9 ends all non-perpetual licences. GTC 1.3(b) bars storing Materials for more than ninety days except where incorporated into work product or required for legal or regulatory compliance. No export format, export window or post-termination read-only access is published. Read 2026-09-27.
Ask: On exit, in what format and within what window can we export our obligations register, task history, ownership records and alert history, and does clause 1.3(b) require us to delete retained obligation text after ninety days?
Integrations, APIs and where the product can reach
Not confirmed
No integration, API, document-management connector or single sign-on arrangement is described for this product on any page read. The Australian products index states that integration capabilities vary by product and names Microsoft Word, Outlook and SharePoint for other LexisNexis products, not for Regulatory Compliance. The support and training page publishes only video tutorials, including one on a Community Portal and one on SourceData, with no API or administrator documentation. The brochure describes alerts delivered to the inbox but names no integration. Checked 2026-09-27.
Ask: Does RegCompliance+ expose an API or supported connectors to a GRC platform, ticketing system or document management system, can obligations and alerts be pushed into our own register, and what is SourceData?
Whether the assistant can reach outside the subscribed corpus
Not confirmed
The two published functions of Protégé in RegCompliance+ are asking a compliance question and summarising regulatory change relevant to the user. No page read states whether the assistant is confined to the modules and alerts the customer subscribes to, whether it can reach other LexisNexis content, or whether it can perform an open web search. GTC 2.9 allows access to be restricted to subscribed Materials but does not address the corpus a model may draw on, and no grounding or citation behaviour is described for this product. Checked 2026-09-27.
Ask: Is Protégé in RegCompliance+ restricted to the modules we subscribe to, does it retrieve from any other corpus or the open web, and does every answer carry a citation to the obligation or alert it came from?
Whether the AI can act rather than answer
Not confirmed
The platform is described as holding task lists with risk ratings and status indicators, obligation ownership and dashboards. Nothing read states whether Protégé in RegCompliance+ can create or close a task, change an obligation's compliance status or owner, send an alert, or take any other action in the platform, or whether a user confirmation step sits in front of any such action. The published description is limited to answering questions and summarising change. Checked 2026-09-27.
Ask: Can Protégé in RegCompliance+ write to the register or task list, change a compliance status or owner, or send anything to a person, and if so what approval step and audit record sits in front of each action?
Verification of AI output
Public claim only
GTC 4.3(e) records that some Services and Materials use artificial intelligence including generative AI to collate and organise, create summaries, provide analysis and otherwise provide functionality. GTC 4.4 then provides that 'AI systems may not always be accurate or error free, which means Authorised Users are responsible for verifying and cross-referencing any information provided in AI Services', that the Services and Materials are provided on an 'as is', 'as available' basis with implied warranties excluded to the extent permitted by law and subject to the Australian Consumer Law, and that LexisNexis is not a law firm and is not bound by the professional responsibilities and duties of a practising lawyer. GTC 4.3(d) states the Services and Materials are for reference only and are not a substitute for professional advice or judgement. The product page separately claims that LexisNexis follows the RELX Responsible AI Principles 'to ensure that AI solutions are developed with human oversight and accountability'. Read 2026-09-27.
Ask: What in-product controls support the clause 4.4 verification duty for Protégé in RegCompliance+, such as a citation to the source obligation, a confidence indication or a supervisor review step, and can we require them for our users?
