Kore.ai

Kore.ai for FCA-regulated firms: an assessment

Kore.ai calls itself an enterprise agentic AI platform¹⁰, offering AI agents and workflows for service, work and process¹¹. Its about page describes it as a leading agentic AI company¹² that started before conversational AI had a name¹³. The company traces its roots to the early days of conversational AI¹³, and its homepage lists banking and wealth management among the industries it serves¹⁴. That makes it a natural candidate for an FCA-regulated firm looking at customer facing agents.

Kore.ai is placed seventh in this ranking. Several of its published design choices fit regulated work well, notably policy enforcement outside the language model, deployment options that include on premises, and Forward Deployed Engineers. It sits last here because much of its trust material appears on the pages we opened as list entries and document titles without the supporting detail, because pricing and product limits are not publicly stated, and because the company's own website was being rebuilt when the facts were gathered.

The profile draws on Kore.ai's public pages, its trust centre and documentation home, as checked on 8 November 2026. Most statements below are the company's own claims, as the source notes record. Each carries a source number.

Market standing

The homepage cites a Leader placement in the Gartner Magic Quadrant for Conversational AI Platforms¹⁵ and a Leader placement in The Forrester Wave for Conversational AI Platforms for Employee Services, Q3 2026¹⁶. It claims the product is proven in production with billions in value delivered¹⁷. The about page lists hubs in San Francisco, New York, Orlando, Seoul, London, Paris, Frankfurt, Dubai, Hyderabad and Tokyo¹⁸.

For a UK firm, the London hub¹⁸ is worth asking about, since local support and account management can matter during an incident or a regulatory review.

How the platform is built

Kore.ai describes several named components. Autoloop is an optimisation engine that improves agents against defined goals from first build through production¹. ABL is a typed, schema driven language built for agentic AI¹⁹. Arch is described as a built in AI solution architect²⁰, and Arch creates ABL so that every agent is structured, validated, governed and observable²¹. StateTrace captures the full execution path across handoffs, state, tool calls and context³.

Two design statements stand out for a regulated buyer. First, policies are enforced outside the LLM, so agents can reason while staying within approved business, security and compliance boundaries². The customer experience page repeats that compliance rules are enforced at the engine level, outside the LLM²². Second, the application definition does not depend on the model; models can be swapped and the ABL still executes²³.

The first point matters because it moves compliance logic out of a prompt and into code that can be reviewed, tested and versioned like any other control. A compliance function can review a rule written in a structured language more easily than a set of instructions given to a model. The second point gives the firm room to change model provider without rewriting its controls.

Kore.ai also says every agent is defined, tested and validated before deployment²⁴, and that agents run in parallel, each with a bounded context²⁵. Bounded context limits what each agent can see, which supports the principle that an agent should only access the information its task requires.

Governance, tracing and release control

Kore.ai's agent platform says it traces every agent run across reasoning, tools, guardrails, handoffs and outcomes⁴. It supports management of agent versions, experiments, rollouts and rollbacks²⁶. The employee experience page sums the approach up as configure and govern²⁷.

For an FCA-regulated firm, run level tracing and rollback are among the most useful controls a platform can offer. If a customer complaint arrives about an agent's answer, the firm needs to reconstruct the path the agent took, and if a fault is found it needs to return to a known good version. StateTrace³ and version management²⁶ address both needs on paper. A firm should ask to see a trace from a real run during evaluation.

Permissions are stated in general terms. Answers draw on chat history, connected apps and the user's role²⁸. Search returns permissioned, real time answers from every system the customer runs⁵. Agents use the right data, permissions and context²⁹. The trust centre lists an enterprise service level agreement as a document³⁰.

Kore.ai also makes a point about quality review. It says fewer than 8 percent of interactions are ever reviewed, because of cost and time³¹. A firm that monitors customer outcomes through sampling will recognise the problem. The figure is a company statement³¹, and a firm should ask what review coverage Kore.ai's own tools achieve in practice.

Delivery model

Kore.ai describes hands on delivery. The homepage promises to get customers to results in weeks³² and to take them from proof to production in weeks³³. Forward Deployed Engineers are part of the offer⁶. Kore.ai says it proves the platform on the customer's own use case before the customer commits⁷.

That model is closer to Nexus than most contenders on this site. The difference is in what is stated. Nexus gives a specific time to first agent, 4 weeks inside a 3 month proof of concept, and a pricing basis per role automated³⁴. Kore.ai's pages give weeks without a number and do not state a price³³.

Industry packages shorten the build. The healthcare payer solution claims production ready apps so that firms go live in weeks³⁵, and the customer experience page describes ready to deploy workflows with no building from scratch³⁶. Studio supports visual and code based authoring in one workspace³⁷, and the platform supports other AI build tools, including Claude Code, Cursor and Codex³⁸.

Security and certifications

The trust centre lists ISO/IEC 27001:2022³⁹, SOC 2 Type II⁴⁰ and PCI DSS⁴¹. PCI DSS is relevant to any firm whose agents might handle card data. Product security entries include SSO support⁴² and multi factor authentication⁴³. Data security entries include encryption at rest and in transit⁴⁴. Infrastructure entries include anti DDoS protection⁴⁵ and endpoint detection and response⁴⁶. An AI section lists monitoring and testing of AI generated output for bias, hallucination and incorrect output⁴⁷.

The homepage says trust is engineered into every layer, from security and governance to compliance, observability and responsible AI controls⁴⁸. Healthcare pages mention full audit trails for CMS and HIPAA compliance⁴⁹ and pre built use cases with HIPAA compliance built in⁵⁰. Those are US healthcare frameworks; a UK financial firm should ask for the equivalent evidence for its own obligations.

Monitoring of AI output for bias and incorrect answers⁴⁷ is the trust centre entry most relevant to fair treatment of customers. The pages we opened list it as an item, and a firm should ask how it works, how often it runs and what the firm can see.

Deployment and data handling

Kore.ai's deployment options are wide. The trust centre lists multi tenant SaaS⁵¹, on premises deployment⁸ and a private cloud on a dedicated, single tenant VPC⁹. For a firm whose risk appetite or outsourcing arrangements favour keeping processing inside its own environment, the on premises option⁸ is a significant point in Kore.ai's favour. Nexus and WRITER, by contrast, do not state an on premises option on the pages we opened.

The privacy policy says Kore.ai does not use customer data for internal training or to train general AI models⁵². Where a customer configures a third party model or service, data may be sent to that third party⁵³. Personal information may be transferred to, stored in or processed in a country other than the one where it was collected⁵⁴. Kore.ai says it uses reasonable technical and organisational measures to protect personal information⁵⁵. Data backups and retention appear in the trust centre as a document⁵⁶.

The cross border transfer clause⁵⁴ is the point a UK firm's data protection officer will want to examine, alongside the hosting options. A firm choosing SaaS should ask where its data will be processed and under what transfer mechanism.

The documentation home describes Artemis as the next generation Kore.ai Agent Platform for building, deploying and governing programmable agent systems at enterprise scale⁵⁷.

Integrations and channels

Employee search covers more than 100 prebuilt connectors⁵⁸. Live systems are queried through API and MCP based tool calls⁵⁹. The customer experience page says the product connects to existing systems out of the box⁶⁰, and the platform page says agents connect to the systems where work happens⁶¹. Agents deploy across voice, web, Slack, Teams, mobile and other channels⁶². The telco page lists real time OSS and BSS integration⁶³, and the employee experience page links to an article on the Kore.ai and AWS partnership⁶⁴.

Voice channels matter to any firm that still serves customers by phone, and Kore.ai's homepage cites treasury and trade banking operations remodelled with AI voice agents, human AI assistance and automation⁶⁵.

Customers and use cases

The homepage lists banking, wealth management, healthcare across payer, provider and life sciences, retail, telco, and travel and hospitality¹⁴. Use cases include the treasury and trade banking example above⁶⁵, global HR support with AI agents⁶⁶ and IT service desk operations with compliant AI agent assistants⁶⁷. Customer stories include a leading US fibre and broadband provider⁶⁸ and a Fortune 100 investment management company⁶⁹. The telco page says Kore.ai helps telcos with subscriber, business and employee experience⁷⁰.

The investment management and banking references^65,69 are the closest to this site's audience. Neither is named, so a firm should ask for a reference it can speak to.

Pricing

Kore.ai's pricing is not publicly stated. The pages fetched show no price, plan, per user, subscription, free trial or quote terms for Kore.ai's product. A firm will need a proposal that states the basis of charge.

Limits to weigh

The homepage notes a split brand experience while the website is being rebuilt^71,72. On the pages we opened, quotas, maximums and unsupported features are not publicly stated, so a firm will find the product's limits only by testing it. No price is publicly stated either. Many trust centre entries appear as list items or document titles^30,56, so the evidence behind them needs to be requested. Most of the capability statements are the company's own claims.

Questions an FCA-regulated firm should put to Kore.ai

The open points above lead to a practical set of questions for a proposal.

1. What is the basis of charge, and what does the proof on the firm's own use case cost⁷? 2. What quotas, maximums and unsupported features apply to the product? 3. For SaaS customers, where will data be processed, and under what transfer mechanism⁵⁴? 4. Can the firm see the trust centre documents on service levels and on backups and retention^30,56 before contract? 5. How does monitoring of AI output for bias, hallucination and incorrect answers⁴⁷ work, and what reports does the firm receive? 6. How long does the Forward Deployed Engineer team stay⁶, and who owns the agents after go live? 7. Can the firm speak to the investment management or banking customers referenced on the site^65,69?

Verdict

Kore.ai brings several features an FCA-regulated firm will value: compliance rules enforced outside the model^2,22, run level tracing and rollback^3,4,26, on premises and single tenant deployment^8,9, PCI DSS and SOC 2 Type II^40,41, banking and wealth management focus¹⁴ and Forward Deployed Engineers⁶.

Seventh place reflects the depth of public evidence. Neither the price nor the product's limits is publicly stated on the pages we opened. Trust centre entries appear without supporting detail^30,56. And the website itself was being rebuilt⁷². Nexus is placed first because it states a specific time to first agent inside a proof of concept the firm can walk away from, a release gate tied to sign off and a price per role automated^34,73,74. Request the missing trust material and a written quote, then test both vendors on the same approval and escalation scenario.