Norm Ai: Initiation of Coverage

GAII Intelligence defines the Risk, Compliance & Surveillance market as software that applies AI to the supervisory obligations of investment firms, banks and trading venues: capturing and retaining communications and trading records, detecting misconduct and market abuse, reviewing regulated content, and evidencing those controls to regulators. Buyers are chief compliance officers, heads of surveillance and conduct risk, and the technology and records teams that support them.

Capabilities we treat as mandatory

• Complete, defensible capture: records of every in-scope channel or trading system, reconciled and retained to regulatory standards such as SEC 17a-4.
• Explainable detection: every alert or finding traceable to the policy, rule or signal that produced it, in a form a regulator can examine.
• Institutional data handling: a stated position on where client data goes, how long it is held, and whether it is used for model training.

Capabilities we treat as differentiating

• False-positive reduction: measurable cuts in alert volume without loss of true positives, with a disclosed method.
• Agentic triage: agents that disposition first-level alerts and assemble cases under human supervision.
• Holistic coverage: communications, trade and conduct data analysed together rather than in separate tools.
• AI-channel governance: capture and supervision of employees' use of AI assistants as a regulated channel.

Norm Ai competes in marketing and regulatory review with Saifr, Red Oak and Hadrius, and in regulatory change with Thomson Reuters and Ascent. It does not compete with Smarsh, Behavox or Theta Lake in surveillance or archiving.

The following are the capabilities and characteristics that, in our assessment, most distinguish Norm Ai within the Risk, Compliance & Surveillance market. Each is drawn from publicly documented product capability, published interviews with management, or independent review.

• Explainability: Each finding tied to the rule it represents, with suggested alternatives.
• Tier-one adoption: Live at New York Life and Prudential; Blackstone and Bain Capital use it internally.
• Capital: $256m raised, including a $120m Series C led by Khosla at a $1.2bn valuation.
• Regulatory bench: Former SEC, CFTC and NYDFS officials on its advisory committees.
• Policy encoding: Client-specific policy layer over a regulatory knowledge graph.
• Ecosystem: Microsoft 365 Copilot agent and a development partnership with the State of Delaware on AI-agent entities.

The following are factors that prospective clients should weigh, and areas where our public review did not find sufficient evidence to reach a settled view. Several are common across vendors at this stage of the market and are not specific to Norm Ai. We encourage prospective clients to raise each of them directly with the company; we have done the same, and will update this note as answers arrive.

• Evidence: No published evaluation; accuracy claims are anecdotal.
• Disclosure: Model providers, deployment, residency, no-training terms and subprocessors were not located; SOC 2 type is not stated.
• Coverage: No published list of rules or jurisdictions covered.
• Time to value: Agents are built per engagement by legal engineers.
• Related parties: Several investors are also clients, which blurs independent demand signals.
• Strategic focus: Investment is moving toward legal services through Norm Law.
• Scope: No surveillance, archive or public API.

Norm Ai is the trading name of Nomos Ai, Inc., founded in 2023 in Brooklyn by John Nay, a Stanford CodeX fellow, co-author of the LegalBench benchmark and founder of an AI investment adviser acquired by Nuveen. Norm Law, LLP, an affiliated New York law firm chaired by former Sidley Austin executive committee chair Mike Schmidtberger, launched in November 2025.

Norm Ai raised an $11.1m seed and $27m Series A led by Coatue (2024), $48m in March 2025, $50m from Blackstone in November 2025 and a $120m Series C led by Khosla Ventures at a $1.2bn valuation in July 2026 — about $256m in total. Revenue is not disclosed.

Company-reported figures are shown as such and are not independently verified. Verification is carried into the vendor questionnaire.

Norm Ai offers compliance agents built around encoded regulation. Figure 2 sets out our assessment of how it maps onto the compliance workflow.

Regulated content review

Marketing and communications review with rule-linked comments and alternatives.

Policy mapping

Firm policies encoded alongside regulations and updated as rules change.

DDQ and RFP completion

Cited answers from approved sources with version history (January 2026).

Copilot agent

Compliance agent for Microsoft 365 Copilot (May 2026).

Scope of the product today

We did not locate surveillance, archiving, a public API or a published rule catalogue.

Norm Ai encodes regulations and policies as decision trees in a proprietary language; language-model agents work through them, with a base analysis layer per rule and a client-specific layer, over a continuously updated regulatory knowledge graph.

Legal engineers evaluate agents across frontier models, but providers are not named and no evaluation is published.

Norm Ai's content is regulation and firm policy rather than communications: rules for asset managers, broker-dealers and insurers, plus client policies, product language and approved answers.

Traceability from each judgement to rule text is strong; the list of covered rules and jurisdictions is not published.

Norm Ai fits pre-use review: marketing and regulated content, disclosures and questionnaires, where it can cut review cycles.

Surveillance, archiving and exam reporting are outside its scope.

Norm Ai states SOC 2 compliance through a Vanta trust centre and keeps audit trails of reviews. Figure 3 sets out what our public review located.

We would encourage buyers to request the SOC 2 report, model providers, deployment and residency options, no-training terms and rule coverage.

The offsetting factors are capital and backers: $256m raised from investors who also use the product.

Pricing is not published; deployments are services-heavy.

Buyers should price legal-engineering time and confirm what is standard versus bespoke.

Norm Ai sits in the Emerging quadrant of the segment matrix, with strong momentum and limited enterprise documentation.

GAII Risk, Compliance & Surveillance coverage, 20 October 2026, scored on the segment variant of Data & Content and Workflow Fit; not directly comparable with Research & Intelligence scores.

11.1 Where Norm Ai is strongest relative to peers

• Against workflow tools, on rule-level reasoning and citations.
• Against surveillance vendors, on pre-use review.
• Against peers, on capital and backers.

11.2 Areas of narrower functional focus

Norm Ai has built depth in reasoning and services rather than documentation or breadth.

• Evidence: no evaluation.
• Disclosure: models, deployment, training.
• Scope: no surveillance or archive.
• Commercial: no pricing.

Scores are on a 0–10 scale. Each dimension score is the mean of its sub-criteria, and the GAII Overall Score is the weighted mean of the six dimensions. The detailed sub-criteria scores that build each dimension are set out in Appendix A.

These are the areas where our public review did not find sufficient evidence to form a settled view. We have put them to the company and will update this note when they are answered. Prospective clients may find them a useful agenda for their own evaluation call.

• Model providers and terms.
• SOC 2 report type and period.
• Deployment and residency options.
• No-training commitment.
• Rules and jurisdictions covered.
• Standard agent catalogue.
• Evaluation results.
• Pricing.
• Revenue.
• Relationship between Norm Ai and Norm Law.
• Integrations beyond Copilot.
• Retention of review records.

This note is an assessment of a vendor against a defined framework, not a recommendation to buy or to decline. The following are the considerations we would put at the centre of an evaluation of Norm Ai specifically.

If you run compliance or surveillance

• Pilot on marketing review.
• Check rule citations against your policies.
• Estimate legal-engineering time.

If you are responsible for technology or vendor risk

• Open with Figure 3; request documentation.
• Confirm model providers.
• Plan integrations.

If you are assessing the category rather than the company

• Explainable compliance agents are attracting large rounds.
• Compliance and legal services are converging.
• Investor-clients are common in regtech.

Each dimension score in Section 12 is the mean of the sub-criteria below. Data & Content and Investment Workflow Fit use the Risk, Compliance & Surveillance segment variant.