Industry Vocabulary Reference

Legal & Regulatory Technology (RegTech / LegalTech)

Legal and regulatory technology fields describe contracts, filings, discovery, research, privacy requests, and compliance work. The catalog supplies workflow metadata, not legal conclusions.

Back to industry coverage library

This page shows selected examples and categories. Download the JSON for the complete vocabulary, including every field, permitted value, and policy pattern in this catalog.

How to use this reference

1. Start with the core file if you need the cross-industry governance baseline.
2. Choose an industry file for its workflow fields and permitted values.
3. Match the OTel attributes to the policy paths your rules use, then verify the recorded fields in a test session.

Catalog context

Select fields that explain the document or decision under review. Preserve source references and distinguish a draft recommendation from an approved filing or legal action.

Risk note: Protect confidential and privileged information throughout the workflow. A recorded policy result does not determine privilege, filing validity, or authority to provide legal advice.

Vocabulary file

• Download filename: 10_vertical_legal_regtech_legaltech.json
• Kind: vertical

OTel namespaces

Referenced standards

These references explain the catalog's context. A listed standard does not establish that a configured application meets its requirements.

• Akoma Ntoso (AKN) 1.0, Architecture for Knowledge-Oriented Management of African Normative Texts; adopted as OASIS Standard for legal documents (2018)
• LegalXML / OASIS LegalDocML, XML standards for legal document interchange
• XBRL International, eXtensible Business Reporting Language for financial and regulatory filings
• EDGAR XBRL US GAAP Taxonomy 2024, SEC filing taxonomy
• ESMA ESEF Regulation, European Single Electronic Format (XBRL iXBRL) for EU annual reports
• FINRA CAT, Consolidated Audit Trail reporting specifications
• SEC EDGAR, Electronic Data Gathering, Analysis, and Retrieval system
• EDRM, Electronic Discovery Reference Model (e-discovery lifecycle)
• WorldCC / IACCM, Contract Management Framework (contract lifecycle standard)
• ISSB IFRS S1, General Requirements for Disclosure of Sustainability-related Financial Information (2023)
• ISSB IFRS S2, Climate-related Disclosures (2023)
• EU CSRD (2022/2464), Corporate Sustainability Reporting Directive
• EU ESRS, European Sustainability Reporting Standards (ESRS 1, ESRS 2, ESRS E1–E5, ESRS S1–S4, ESRS G1)
• SEC Climate-Related Disclosures Rule (2024), 17 CFR Parts 210, 229, 232, 239, 240
• SEC Cybersecurity Disclosure Rule (2023), 17 CFR Parts 229 and 249
• FATF Recommendations (2023 update), Financial Action Task Force AML/CFT standards
• EU AMLD6 (2024/1640), Sixth Anti-Money Laundering Directive (in force July 2024; transposition by July 2027)
• EU AML Regulation (2024/1624), AML/CFT directly applicable regulation (in force July 2024)
• EU AMLA, Anti-Money Laundering Authority (established 2024, operational 2025)
• FinCEN AML/CFT Programme Rule (2024), Updated beneficial ownership and SAR requirements
• OFAC SDN List, US Office of Foreign Assets Control Specially Designated Nationals
• EU Sanctions Regulation, EU Consolidated Sanctions List
• UN Security Council Sanctions Lists, Consolidated List
• EU AI Act (2024/1689), AI systems used in legal assistance, adjudication support, and regulatory compliance
• EU GDPR (2016/679), Data privacy compliance programme management
• CCPA/CPRA (California), Consumer Privacy Rights Act
• DORA (EU) 2022/2554, Digital Operational Resilience Act for financial entities (in force Jan 2025)
• Basel Committee BCBS 239, Principles for Effective Risk Data Aggregation and Risk Reporting
• ISO/IEC 27701:2019, Privacy Information Management System (PIMS)

Source references

• https://www.oasis-open.org/committees/legalDocML/ 
• https://www.xbrl.org/ 
• https://www.sec.gov/edgar 
• https://www.edrm.net/frameworks-and-standards/edrm-model/ 
• https://www.worldcc.com/ 
• https://www.ifrs.org/issued-standards/ifrs-sustainability-standards-navigator/ 
• https://www.fatf-gafi.org/ 
• https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-information 
• https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1624 

Subdomains

Implementation examples

• Contract Lifecycle Management: Contract Lifecycle Stage. AI CLM agent tracks every contract through its lifecycle. OPA policy enforces that transitions from 'approved' to 'executed' and any change to an 'active' or 'executed' contract require human authorisation, AI may not autonomously bind the organisation or modify binding terms. (Eu AI Act Art13: EU AI Act Article 13, If AI CLM is used in contracts with consumers, transparency about AI involvement in drafting must be provided)
• Contract Lifecycle Management: Contract Obligation Category. AI contract analysis agent extracts obligations at execution and populates the obligation register. 'Data_processing_obligation' and 'regulatory_compliance_obligation' categories trigger automatic cross-referencing against the compliance obligation register. 'Payment_obligation' deadlines are surfaced to accounts payable.
• Contract Lifecycle Management: Contract Risk Flag. AI redlining agent flags non-standard clauses against the organisation's contract playbook. 'Unlimited_liability_exposure' and 'data_processing_non_gdpr_compliant' flags block automated contract advancement, attorney review is mandatory before escalation. (Dora Art30: DORA Article 30, 'missing_dora_ict_clause' flag required for all ICT service provider contracts in EU financial sector)
• Legal Document Classification & Management: Legal Document Classification. AI legal document classification agent ingests documents and assigns type before routing. 'Legal_opinion_memorandum' documents trigger privilege protection workflow, AI may not disclose or summarise these documents to unauthorised parties. 'Evidence_exhibit' documents in litigation context trigger EDRM chain-of-custody logging.

Control ideas

These patterns describe possible controls, not active rules. Confirm applicability, implement the control, and test its effect on the application.

Enforce before the action

Pass the request and your business action to this function. The core SDK checks policy before the action runs and again before its result is released. A deny or review decision means the action never runs.

import { Veriproof } from '@veriproof/sdk-core';
import type { GovernedResult, IndustryFact, JsonValue } from '@veriproof/sdk-core';

const veriproof = Veriproof.fromEnv();

export async function runProtectedAction<TInput extends JsonValue, TValue>(
  request: TInput,
  action: (input: TInput, signal: AbortSignal) => Promise<TValue>,
): Promise<GovernedResult<TValue, TInput>> {
  // Catalog values for this vertical. Replace them with facts from the current workflow.
  const industry: IndustryFact[] = [
    { attribute: "legaltech.contract.lifecycle_stage", policyInput: "legaltech_contract_lifecycle_stage", value: "intake" },
    { attribute: "legaltech.contract.obligation_category", policyInput: "legaltech_contract_obligation_category", value: "payment_obligation" },
    { attribute: "legaltech.contract.risk_flag", policyInput: "legaltech_contract_risk_flag", value: "unlimited_liability_exposure" },
  ];

  // Policy runs before action() and again before the result is released.
  // A deny or review decision means action() never runs.
  return veriproof.govern(
    "legal.regtech.legaltech.evaluate",
    request,
    ({ input, signal }) => action(input, signal),
    { industry },
  );
}

• Replace the sample values with facts from the current workflow. Rules read them under input.snapshot.industry.
• Test both permitted and blocked actions. Confirm that a blocked action never reaches your business function.
• Only completed, completed_with_warning, and transformed results carry a released value.

For review decisions, follow the Human Review guide to configure continuation. Observe remains available when you need to record activity without enforcing a decision.

Set up the Legal & Regulatory Technology (RegTech / LegalTech) example. See the API reference for TypeScript, Python, or .NET.

Selected vocabulary categories

This page uses the vocabulary JSON distributed with the documentation. Check its version when comparing it with an installed SDK.

Download the vocabulary JSON for offline review or automated comparisons.

Use the SDK reference for configuration and supported APIs. Keep vocabulary selection separate from the compliance team's assessment of applicable requirements.