AI development partner for a regulated industry

This page is for a company in a regulated industry that wants an AI product built. A regulated industry, here, is one where a law or a regulator sets rules for the software: health, finance, insurance, legal services and government. The rules can cover who may see a record, how long data is kept, how a decision about a customer is explained, and what proof the company must keep.

The firms below were matched to this situation by a sentence on their own pages that names a regulated sector. Reveneau is first and Fluxon second. The other eight follow in the order of the research notes, which gives no ranking. Each page was opened on 21 October 2026. For detail on the rules in each sector, read this site's guides to financial software compliance, healthcare software compliance, insurance software compliance and legal software compliance.

Rules that may apply to the AI itself

Some rules now name AI directly. Each one below is dated, because these rules change.

• The EU AI Act. The European Commission's page, read on 21 October 2026, says AI uses "that can pose serious risks to health, safety or fundamental rights are classified as high-risk" [22]. Its examples include "Certain AI use-cases utilised to give access to essential private and public services (e.g. credit scoring denying citizens opportunity to obtain a loan)". Credit scoring is a score that a lender uses to decide whether to give a loan. The page says, "Starting on 2 December 2027, high-risk AI systems will be subject to strict obligations before they can be put on the market", and that "The transparency rules of the AI Act will come into effect in August 2026." It also says the 2 December 2027 date is for AI used in certain high-risk areas, such as education and employment, and that for AI built into products such as lifts or toys the rules apply from 2 August 2028.
• US federal buying rules. The Office of Management and Budget's Memorandum M-25-22, dated 3 April 2025, tells federal agencies that when they buy AI, "they must pay careful attention to vendor sourcing, data portability, and long-term interoperability" [23]. It says that, in general, agencies should include in their requests for proposals provisions that reduce the risk of vendor lock-in, "such as requirements regarding knowledge transfer, clear data and model portability practices, clear licensing terms, and pricing transparency". Vendor lock-in means a buyer cannot easily move to another supplier. The memo applies to federal agencies, and a private buyer can ask for the same things.
• Medical devices in the US. The FDA keeps a list of AI-enabled medical devices that are "authorized for marketing in the United States" [21]. The table saved from that page on 21 October 2026 held 1,614 distinct FDA submission numbers, counted for this guide. FDA's page says, "The list is not a comprehensive resource of AI-enabled medical devices." A buyer whose product may count as a medical device should ask a firm whether it has built software that went through FDA review, and check the answer on that list, knowing the list is incomplete.

What a regulated buyer needs from a partner

1. Rules written down as tests. Each rule that applies should become a written requirement, and each requirement should be checked before every release.
2. Certificates with a scope you have read. A certificate covers only the part of a company its scope names. What a security certificate tells you about a firm explains how to check one.
3. Clear data handling. Where the data is stored, in which country, and who at the firm can read it.
4. Records. Who changed what, when, and who approved it, so the company can show a regulator.

Some terms appear in the entries below. HIPAA is the US law that protects health records. ISO/IEC 27001 is an international standard for how a company manages the security of information, and a certifier, an outside auditing body, checks a company against it and issues a certificate. SOC 2 is a report by an outside accounting firm on a service company's controls. The Journal of Accountancy, published by the accounting bodies AICPA and CIMA, says SOC 2 reports can cover controls for security, availability, processing integrity, confidentiality and privacy, and that they "are restricted to specified parties with sufficient knowledge and understanding of the service organization’s system" [24]. So a buyer has to ask the firm for the report.

The firms at a glance

Firm	Regulated sector named on its own pages	Certificate claim, and what was checked	Main office, and who says so	Anthropic tier
Reveneau	None named	None stated in this guide	San Francisco and Vancouver (own site)	Not listed (searched 20 October 2026)
Fluxon	Health (Agilon Health case page)	None claimed on the pages opened	San Francisco (Stripe listing, address from Fluxon)	Not listed
thoughtbot	Health, and products built to HIPAA and SOC 2 requirements	Wording is about client products	No address published	Not listed
Booz Allen Hamilton	US federal government	None read on its AI page	McLean, Virginia (Form 10-K)	Not listed
ScienceSoft	Health, finance	Four ISO certificates claimed; no certifier named; not found in two registers	McKinney, Texas (own homepage)	Not listed
10Clouds	Banks, insurers, fintech	None found on the pages opened	Warsaw (Polish VAT register)	Select
Netcompany	Government and regulated companies	ISO 27001 wording in its annual report; no certifier named	Copenhagen (own contact page)	Not listed
HatchWorks AI	Health	SOC 2 examination claimed; report shared only with specified parties	Atlanta, Chicago, Dallas (own footer, cities only, read 20 October 2026)	Not listed
Accenture	US federal government	Accenture LLP, ISO/IEC 27001:2022, found in Schellman's register; scope names two Accenture services	US offices named in its Form 10-K	Global Premier
Sidebench	Health	None of its own claimed	No address found	Not listed

The firms

1. Reveneau

Reveneau works from two offices: 435 Utah Street in San Francisco, and Floor 33, 909 Mainland Street, in Vancouver. Reveneau says it writes 100 percent of its code with AI and that every change has to pass a large eval suite before release. It says the suite is a set of automated tests written from the specification, the document that states what the software must do, and that Jev grades the suite and makes it run ten times faster than its previous grader. Reveneau says it uses AI instead of hiring more engineers and puts that saving into its clients' prices, and that it takes responsibility for the whole project through production, the live system, and after release. Its AI development page describes how it builds AI features, such as agents, with evaluation and safety checks. Reveneau has no entry in Anthropic's directory: all 321 entries were searched on 20 October 2026 [1].

This guide states no certificate and no compliance status for Reveneau. Ask Reveneau the same questions this page tells you to ask every firm: which certificates or audit reports it holds, which company holds each one, and what each scope covers; how each rule your regulator sets would be written into the specification its tests are built from; where your data would be stored and who could read it; and what record of each change you would receive.

Fits: a regulated company that is ready to write each rule it must meet into a specification, and wants to see, before it signs, how Reveneau's tests would check those rules. You can contact Reveneau with your list of rules.

Pick someone else if: your rules require a supplier to show a certificate or an audit report before the first meeting. This guide states none for Reveneau.

2. Fluxon

The only regulated-industry wording found on Fluxon's pages is on its case page for Agilon Health, which the page places in healthcare. It says Fluxon "Delivered reporting across markets, pods, and clinics, with access controls designed for HIPAA requirements." [2] Access controls decide who may see which records. Fluxon's pages give two counts of Agilon's clinics. The case page says, "Agilon’s physicians and operators needed a clear view of performance across 53+ clinic sites." [2] Fluxon's enterprise page says "Nationwide across 50+ clinics" [3]. The two figures come from two Fluxon pages. No Fluxon page opened claims a certificate of any kind. Fluxon has no entry in Anthropic's directory as read on 21 October 2026 [1].

Fits: a US health company that wants reporting software whose access controls are designed around HIPAA.

Pick someone else if: you need a supplier that names a certificate or an audit report. No Fluxon page opened claims one.

3. thoughtbot

thoughtbot says on its MVP development page, "thoughtbot has deep experience delivering products in regulated industries. We build with HIPAA, SOC 2, and your industry's specific requirements as part of the foundation." [4] The same page says, "Work with us to build HIPAA compliant products that improve outcomes for patients, providers, and payers." Payers are the insurers and health plans that pay for care. Both sentences describe the products thoughtbot builds for clients. No office address appeared on the pages read. thoughtbot also appears on the startup page. thoughtbot has no entry in Anthropic's directory as read on 21 October 2026 [1].

Fits: a health startup building a product that must meet HIPAA, which wants the same team for the first version and for the rules.

Pick someone else if: you need the supplier itself to hold a SOC 2 report. Ask thoughtbot, because its page speaks about client products.

4. Booz Allen Hamilton

Booz Allen Hamilton gives its corporate headquarters as 8283 Greensboro Drive in McLean, Virginia, in its annual report on Form 10-K for the year to 31 March 2026, which also says it plans to move its headquarters to Reston, Virginia, in the fall of 2027 [6]. The same filing gives 31,500 people at 31 March 2026, stated as an approximate figure, with 28,800 of them customer staff. Its AI page describes aiSSEMBLE as its method for "designing, developing, and fielding AI specifically for the U.S. federal government and commercial sectors" [5]. The page also says, "200 active AI engagements across more than 160 federal clients." Those figures are its own, and the "" is on the page. No certificate claim was read on its AI page. Booz Allen has no entry in Anthropic's directory as read on 21 October 2026 [1].

Fits: a US federal agency, or a company that sells to one, that wants AI built for government work.

Pick someone else if: you need a team outside the United States. The offices named in the sources for this guide are all in the US.

5. ScienceSoft

ScienceSoft gives an office at 5900 S. Lake Forest Drive, Suite 300, in McKinney, in the Dallas area of Texas, on its homepage. Its healthcare page says it helps "healthcare organizations redesign high-impact processes and build secure, interoperable, compliant healthcare IT systems" [7]. Interoperable systems can exchange data with each other. Its certifications page says, "ScienceSoft’s ISO 9001, ISO/IEC 27001, ISO/IEC 27701, and ISO 13485 certifications reflect independently audited practices for quality, information security, privacy management, and medical software development." [8] ISO 9001 is a standard for quality management, ISO/IEC 27701 for managing private data, and ISO 13485 for quality management in making medical devices. The page names no certification body and no certificate number, and says ScienceSoft "can provide additional certification details or supporting documentation upon request". A search of TÜV Rheinland's Certipedia register returned no result for ScienceSoft [9], and a search of Schellman's register returned none either. Neither result proves anything, because the page does not say which body certified it. ScienceSoft has no entry in Anthropic's directory as read on 21 October 2026 [1].

Fits: a health organisation that wants a supplier which states ISO 13485 and ISO/IEC 27001 certificates and offers to share the details.

Pick someone else if: you need certificate numbers before the first call. Ask ScienceSoft for them, because its page names none.

6. 10Clouds

10Clouds gives its office as Chmielna 73 in Warsaw, and Poland's Ministry of Finance VAT register returns the same address [25]. Poland's KRS register lists the company named in its footer as 10Clouds Financial Institutions sp. z o.o., a Polish limited company registered in 2022 [12]. Its homepage says, "From credit automation to agentic commerce, we deliver production-ready AI for banks, insurers and fintechs." [10] Fintechs are companies that build financial software. Its banking page describes "Digital banking platforms and process automation improving onboarding, lending, compliance, and customer engagement in highly regulated environments." [11] Its text in Anthropic's directory, written by the firm, says "team of 100+ AI, banking, and technology experts" [1]. No certificate claim was found on the pages opened, and Certipedia returned no result for 10Clouds. Anthropic's directory places it, as 10Clouds Financial Institutions, at the Select tier [1].

Fits: a bank, insurer or fintech in Europe that wants AI for lending, onboarding or compliance work.

Pick someone else if: you work in health or government. Its pages name banks, insurers and fintechs.

7. Netcompany

Netcompany gives its headquarters as Strandgade 3 in Copenhagen and names offices in Aarhus, London, Oslo, Warsaw, Athens and Brussels on its contact page. Its Annual Report 2025 gives an average of 7,960 full-time employees in 2025 and lists the company on Nasdaq Copenhagen [14]. Its homepage says, "Netcompany is already applying it in complex, regulated enterprise and government environments on top of Netcompany’s products and platforms." [13] "It" in that sentence is agentic AI, meaning AI that takes steps by itself. A news headline on the same homepage reads, "NHS appoints Netcompany to deliver new NHS-owned technology for life-saving UK screening services". The NHS is the UK's public health service, and no NHS source was read for this guide. The annual report mentions "our ISO 27001 information security" and does not name the certifier in that passage. Certipedia returned no result for Netcompany, and that register covers one certifier only. Netcompany has no entry in Anthropic's directory as read on 21 October 2026 [1].

Fits: a European government body or a large regulated company that wants agentic AI built on Netcompany's own products and platforms.

Pick someone else if: you are a small company with a small first project. Netcompany's annual report counts an average of 7,960 full-time staff.

8. HatchWorks AI

HatchWorks AI lists Atlanta, Chicago and Dallas in its footer, with San Jose in Costa Rica, Medellín in Colombia and Lima in Peru, and gives no street address. Its healthcare page says, "Evolving AI systems ensure ongoing compliance with HIPAA, CMS, and other changing healthcare regulations." [15] CMS is the US Centers for Medicare and Medicaid Services, the agency that runs those two public health programmes. That claim is broad, and it is HatchWorks' own. The page says it is "Specializing in claims management, clinical workflow, and asset management." Its homepage says, "HatchWorks AI has completed a SOC 2 ® examination" [16]. Its trust centre page, where a firm shares security documents, returned no readable text when opened. HatchWorks has no entry in Anthropic's directory as read on 21 October 2026 [1].

Fits: a US health payer or provider that wants AI for claims or clinical workflow.

Pick someone else if: you need a certificate you can look up in a public register. A SOC 2 report is shared only with specified parties, so ask HatchWorks for the report itself.

9. Accenture

Accenture is Accenture plc, an Irish company listed on the New York Stock Exchange, and its annual report on Form 10-K names Boston, Chicago, New York and San Francisco among its major offices [19]. The same filing gives 814,000 people at 31 August 2026, stated as an approximate figure. Its federal services page says, "Experience FedGenius, a feature-complete GenAI platform that enables government to employ large language models safely and securely." [17] GenAI means generative AI, and a large language model is the type of AI model that reads and writes text.

Schellman, a firm that audits and certifies companies, lists in its public register a certificate held by Accenture LLP: ISO/IEC 27001:2022, number 1336855-9, issued on 6 October 2025 and valid until 27 September 2028 [18]. Its scope covers the information security management system for the offerings, locations and components "where customer data is located and used to deliver" two Accenture services: Managed Extended Detection and Response and Adaptive Managed Extended Detection and Response. So the certificate is real, and its scope names those two services only. Anthropic's directory places Accenture at the Global Premier tier [1].

Fits: a US federal agency that wants a generative AI platform for government from a firm that publishes its filings.

Pick someone else if: you need a certificate that covers software or AI development work. The scope of the Accenture LLP certificate found names two other Accenture services.

10. Sidebench

Sidebench gives no office address on its homepage. The homepage lists articles titled "Where HIPAA Meets AI: What Changes When Your Model Touches PHI" and "Generative and Agentic AI in Healthcare: What Actually Ships in 2026" [20]. PHI, protected health information, is the US term for the health records that HIPAA protects. Neither article was opened for this guide. The homepage also says "60+ Healthcare Implementations (14 Years)", which is its own count. "HIPAA Compliance" appears as a service in its menu, and the page claims no certificate for Sidebench itself. Sidebench has no entry in Anthropic's directory as read on 21 October 2026 [1].

Fits: a health company that wants AI built around patient data by a firm whose pages are about healthcare.

Pick someone else if: you need an office address before you sign. None was found on the pages read.

Questions for a regulated project

Send every firm the same questions, in writing, with one date for answers:

• Which rules apply to this product, in your view, and how will each one be tested before every release?
• Which certificates or audit reports do you hold, which company in your group holds each one, and what does each scope cover? Send the certificate numbers and the name of each certifier.
• If you have a SOC 2 report, may we read it, for which period, and which systems does it cover?
• Where will our data be stored, in which country, and who at your firm can read it?
• What record of each change, its tests and its approval will we receive?
• If the product may count as a medical device, which of your earlier products went through FDA review, and under which submission number? Then check the number on FDA's list, which FDA says is not complete.
• If we sell to the US federal government, how do you meet the lock-in, data portability and licensing points in OMB Memorandum M-25-22?

Print these with the rest of the AI partner situation checklist. For the method behind this page, read how firms were matched to situations.