The sources our reports cite, and the models and software our reporting is built on.
InquilionGRC assurance reports cite primary sources. They are drafted and checked by open-weight language models that we run on our own hardware. The models are tested before they are used, their verdicts are checked by code, and every report is signed off by a person. This page acknowledges the sources our reports cite, names the models and the open-source software behind that work, and carries the notices their owners ask us to display.
Our reports cite primary sources: legislation, regulators' rules and guidance, and published standards. Where the licence on a source asks for an acknowledgement, it is given below. Naming a source describes what we cite; it does not imply that its publisher endorses Inquilion or Bentlebury.
Contains public sector information licensed under the Open Government Licence v3.0.
This covers UK legislation and its explanatory notes, published by The National Archives at legislation.gov.uk, including the Data Protection Act 2018, the UK GDPR and the Financial Services and Markets Act 2000. It also covers material from the Financial Conduct Authority, the Information Commissioner's Office (text only), the National Cyber Security Centre, NHS England (the Data Security and Protection Toolkit), The Pensions Regulator, the Department for Science, Innovation and Technology, HM Treasury and the Ministry of Justice.
Source: © FCA. Used under the terms of the Open Government Licence v3.0.
Texts of the European Union, including the General Data Protection Regulation, the Digital Operational Resilience Act, MiFID II and the NIS2 and CER directives with their implementing regulations, are reproduced from EUR-Lex under Commission Decision 2011/833/EU on the reuse of Commission documents. Source: EUR-Lex, Publications Office of the European Union. © European Union.
Publications of the US Securities and Exchange Commission, the Commodity Futures Trading Commission, the Cybersecurity and Infrastructure Security Agency, the Federal Trade Commission, the Federal Financial Institutions Examination Council, the National Institute of Standards and Technology and the United States Congress are works of the US Government and are in the public domain under 17 U.S.C. 105. We acknowledge each as the source. Third-party material reproduced inside a federal document is not covered by that status and stays with its owner.
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Content from the Financial Services Agency of Japan is used under the Public Data License, Version 1.0 (PDL1.0). Content from the Personal Information Protection Commission of Japan is not subject to copyright under article 13 of the Copyright Act of Japan.
Our reports also refer by name to standards and frameworks that we do not reproduce, such as ISO/IEC 27001, PCI DSS, SOC 2, the CIS Controls and Cyber Essentials. Their names and marks belong to their owners, and naming them does not imply endorsement.
Llama 3.3 is licensed under the Llama 3.3 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved.
Llama 3.2 is licensed under the Llama 3.2 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved.
Llama 3.1 is licensed under the Llama 3.1 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved.
Licensed by NVIDIA Corporation under the NVIDIA Open Model License.
Gemma is provided under and subject to the Gemma Terms of Use found at ai.google.dev/gemma/terms.
gpt-oss-120b (OpenAI), Qwen3-30B-A3B (Alibaba Cloud), Mistral-Small-24B-Instruct (Mistral AI) and nomic-embed-text (Nomic AI) are licensed under the Apache License, Version 2.0.
MiniCheck-Flan-T5-Large is licensed under the MIT License by Liyan Tang, Philippe Laban and Greg Durrett (MiniCheck: Efficient Fact-Checking of LLMs on Grounding Documents, EMNLP 2024). It is fine-tuned from Google's Flan-T5-Large, licensed under the Apache License, Version 2.0.
Our reporting runs on ollama and vLLM for model serving, LiteLLM for routing, Hugging Face Transformers and Python, each used under its own open-source licence.
Llama is a trade mark of Meta Platforms, Inc. Gemma is a trade mark of Google LLC. NVIDIA is a trade mark of NVIDIA Corporation. Other names are the property of their respective owners. Naming a model here describes what we use; it does not imply any endorsement of Inquilion or Bentlebury by its author.
This page was last updated in September 2026.