Legal Intelligence & Assurance
Legal risk is not a research problem. Institutions rarely fail because nobody could find the rule; they fail because the rule was never compiled into an obligation with an owner, a control and evidence behind it. This layer does that compilation and holds the result where every other module can read it.
Cabier does not restate the law and does not replace the legal tools an institution already runs. It sits above them, turning authority into operable control.
Four stages, in order
Every source of authority passes through the same four stages. If it stalls at any stage, the obligation is not discharged — and the platform says so rather than showing a green position.
- 01
Source
Authority as published — instrument, section, guidance, judgment or executed clause. Cabier does not host the corpus; it cites the object and links to where the institution's research tools hold it.
- 02
Obligation
One statement of what must be true, with the applicability test that decides which entity and which activity it binds. Ambiguity is resolved once, recorded as an interpretation, and signed.
- 03
Control
The obligation resolves onto domains in the unified spine. Nothing new is created for a new instrument; the same control is tested once against the strictest ask.
- 04
Evidence
What has to exist for the position to be defensible, held with attribution and retention. If the evidence cannot be named at this stage, the obligation is not yet discharged.
AI authority, compiled into controls
AI obligations now arrive from multiple jurisdictions at once. The same system may be high-risk in the European Union, subject to federal impact assessment in Canada, governed by NIST guidance in the United States and expected to meet FEAT principles in Singapore. The graph turns that overlap into one operable register.
European Union
Risk management system for high-risk AI
Regulation (EU) 2024/1689, Article 9
United States — Federal
Federal AI safety, security and trust obligations
Executive Order 14110, Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence
United States — Federal
Voluntary risk-management framework for AI systems
NIST AI Risk Management Framework 1.0 and Trustworthy AI in Critical Infrastructure Profile
European Union
Classification rules for high-risk AI systems
Regulation (EU) 2024/1689, Article 6
European Union
Data and data governance for high-risk AI
Regulation (EU) 2024/1689, Article 10
United Kingdom
Principles-based AI regulation for UK financial services
UK AI White Paper and FCA/PRA/Bank of England AI updates
Canada
Canadian AI impact assessment and algorithmic transparency
Canada Artificial Intelligence and Data Act (AIDA) and Directive on Automated Decision-Making
Singapore
Fairness, ethics, accountability and transparency for AI in finance
Singapore FEAT Principles and IMAS 04-05 on technology risk
Graph traversal
A change to any authority node propagates to the obligations, systems, controls and evidence downstream. The legal tier of the Trust Graph stores the date each link was last verified, so drift is visible before it becomes a finding.
Compile a source
Select an instrument, a piece of guidance, a judgment or an executed clause to see the obligation, controls, evidence and accountable owner it produces.
ICT third-party risk — general principles
Regulation (EU) 2022/2554, Article 28
Financial entities must manage ICT third-party risk as an integral part of their ICT risk framework, maintain a register of all contractual arrangements, and assess before contracting whether the arrangement supports a critical or important function.
Every contractual arrangement for ICT services is registered, classified against the critical-or-important test, and re-assessed at renewal.
Applicability. Applies to each authorised EU entity for every ICT arrangement, including intra-group and subcontracted services reached through a material provider.
Recorded interpretation. The scoping test is applied at the level of the business service, not the application. An arrangement that supports settlement or payments is treated as critical even where the provider is nominally non-material by spend.
- — Register extract with classification rationale per arrangement
- — Pre-contract criticality assessment, signed by the service owner
- — Renewal diligence pack with concentration position
- Accountable
- Head of Third-Party Risk, with Group General Counsel on clause content
- Where the exposure sits
- Register completeness is examined directly. An omitted subcontracted material service is a finding on its own, before any incident.
Demonstration corpus drawn from public instruments. Client compilations run against that institution's own register, contract estate and graph inside the engagement environment, and legal readings remain the responsibility of the institution's counsel.
Why it is built this way
Above the research layer, not against it
Institutions have already bought legal research and drafting tools, and those tools are good at what they do. None of them tell an institution which control now has to change, who owns it, and what will be produced when a supervisor asks. That is the layer Cabier occupies.
Law enters the same graph as everything else
A statute, a section, a judgment, a piece of supervisory guidance and an executed clause are all typed objects in the Trust Graph. They sit above the obligations, controls, systems and evidence already held there, so a change in authority has a traceable downstream path.
One interpretation, recorded and signed
Ambiguity is resolved once, written down as an interpretation with an owner, and carried forward. The alternative — resolving the same ambiguity differently in three business units — is how institutions end up defending positions they never knowingly took.
Privilege is a property of the object
Legal advice, work product and supervisory confidential material are classified where they live, not at the point someone remembers to redact. A compiled interpretation that carries privilege is marked as privileged in the graph and stays inside the retained boundary.
What is live and what follows
Live — demonstration corpus
Legal Obligation Engine
Turns published authority into a registered obligation with an applicability test per entity and activity. The register is one register: regulatory and contractual obligations do not live apart.
Live — demonstration corpus
Law-to-Control Compiler
Resolves each obligation onto the unified control spine and names the evidence that discharges it. No new control is created for a new instrument.
Live — traversable in the Trust Graph
Legal Trust Graph tier
Laws, statutes, sections, courts, cases, judgments, enforcement actions, guidance, clauses, rights, restrictions, exceptions, interpretations and privilege classifications, with blast-radius traversal from any of them.
Live — demonstration corpus
Change Impact Engine
Given an amendment, a new judgment or a fresh enforcement action, returns the obligations that move, the controls that must be retested and the entities in scope.
Open the surfaceLive — demonstration corpus
Cross-border conflict view
Where two jurisdictions impose incompatible duties on the same object, states the conflict and the binding position taken, rather than leaving it to be discovered in an examination.
Open the surfaceLive — demonstration corpus
Contract-to-control intelligence
Reads the executed estate clause by clause, maps each clause to the control it makes enforceable, and flags the controls resting on no clause at all.
Open the surface