Fresh Takes & Updates

Normain has reached a new milestone in information security.

We have successfully completed a SOC 2 Type 2 examination and received a SOC 2 Type 2 report.

This is one of the most widely recognized ways to evaluate information security controls. It’s earned through a rigorous third-party audit process that tests how well our security controls work over time in real operating conditions.

Understanding SOC 2

SOC 2 is a compliance framework created by the AICPA (the American Institute of Certified Public Accountants) to assess an organization’s information security practices. It examines how well security controls protect customer data across both technical systems and day to day operations.

Becoming SOC 2 Type 2 assessed means our security controls have been examined over an extended period by an independent, AICPA-accredited auditor.

What Normain’s SOC 2 Type 2 report covers

Our SOC 2 Type 2 report focuses on the Security (Common Criteria) category. Security is the core of SOC 2 and centers on protecting systems and data against unauthorized access, misuse, and disclosure across both technical systems and everyday operations.

Here’s what the Security criteria covers:

• Control environment: We establish an organizational foundation that prioritizes integrity, accountability, and security.
  
  

• Communication and information: We document our security policies and communicate clear expectations for handling data internally and externally.
  
  

• Risk assessment: We identify, analyze, and assess security risks on an ongoing basis.
  
  

• Monitoring controls: We continuously monitor our systems and confirm that security controls operate effectively.
  
  

• Control activities: We implement processes and technologies that reduce security risk and enforce our policies.
  
  

• Logical and physical access controls: We prevent unauthorized access to data, devices, systems, and facilities.
  
  

• System operations: We maintain secure operations through monitoring, incident response readiness, and recovery planning.
  
  

• Change management: We review, test, and approve system changes before deployment to protect stability and security.
  
  

• Risk mitigation: We manage and reduce third party risk through vendor oversight and access controls.

Completing a Type 2 examination for Security shows that our core security controls are not only thoughtfully designed, but have been operating effectively throughout the audit period under real conditions.

Why this matters

In modern software, trust is everything.

A SOC 2 Type 2 report is not just a checkbox. It is one of the strongest signals a company can give about how seriously it treats security.

For you, this means:

• Your data is protected. Our protections have been tested over months and shown to operate effectively in real conditions.

  
  

• Your workflows are secure. We meet a widely accepted standard for handling sensitive data

  
  

• Your trust is verified. An independent, AICPA-accredited auditor has evaluated our controls against defined criteria.

This milestone reinforces the trust teams already place in Normain to handle sensitive, high stakes workflows.

Why we are proud

Strong security has always been non-negotiable at Normain.

This SOC 2 Type 2 report shows that our controls don’t just exist on paper, they work day in and day out under real conditions.  It also complements our ISO 27001 work and reinforces our continued dedication to protecting customer data.

Few companies earn this level of verification this early, and it’s a milestone that will matter for every customer choosing to trust us with their data.

For more on how we protect your data, visit our Trust Center: https://trust.normain.com/

Q: You could have joined many teams, what made Normain stand out?

A: For me, it came down to two things: the mission and the people.

Normain is solving a real problem experts feel every day: the inability to extract trusted, verifiable insights from messy documents. The vision of turning chaos into structured insights resonated with me immediately.

And just as important, the team felt different. Ambitious, high-caliber, extremely execution-driven and world-class. I wanted a place where I could contribute early, influence product direction, and work alongside people who care about doing things well. 

Q: How would you describe the problem Normain is solving?

A: Many expert teams rely on accurate and consistent information extraction, but conversational AI cannot deliver the precision, structure, or reliability they need. Because of this, they still spend hours validating, correcting, and re-extracting insights from messy and unstructured documents.

Normain solves this with Extractional AI, a category defining approach purpose-built for extracting insights from unstructured document chaos. It transforms messy inputs into structured insights that teams can trust and act on, even at scale.

Q: What kind of impact do you hope your work will have?

A: I want to help take Normain from early traction to becoming the default way experts extract precise, verifiable insights from complex documents.

My background is in building products that automate complex workflows, integrate with real-world systems, and move from pilot to production. I want to apply that here, shipping fast, building things right, and helping customers succeed at scale.

Q: What should someone know before joining Normain?

A: It’s early, and that’s the fun part.
Things move fast, ownership is real, and there are no “just build this ticket” kind of days. You’ll help shape product, architecture, and even how we work as a team.

The bar is incredibly high, and there’s a strong focus on building with intention: quality, security, and long-term thinking, even when we ship quickly. 

Q: Is there anything else you’d like to add?

A: That I’m genuinely excited about where Normain is headed.
The mission is meaningful, the timing is right, and the team is incredible. It’s rare to find a place where you can build ambitious tech, have direct customer impact, and shape something that could redefine how entire industries work. I’m here because I believe in that future and want to help make it real.

This week, Normain was in Helsinki, Finland for Slush 2025.

Normain pitched in the semi-finals of Europe’s most coveted startup competition: Slush 100. Out of over 1,000 startups that applied, we were selected among the top 20. Our CEO and co-founder, Sara Landfors, pitched on the main stage in front of judges from General Catalyst, and Cherry Ventures, and an audience packed with operators and investors building serious companies.

Sara also spoke on two panels during the event. The first, hosted by McKinsey, featured Henrik Landgren, Co-founder and CPTO at Gilion and Lukas Saari, Co-founder and CEO at Tandem Health. The panel was moderated by Sandra Hernvall, Associate Partner at McKinsey.

The second panel, titled Tales of Silicon Valhalla: From a two-time unicorn founder to bold builders, was a deep dive into what it takes to build a startup. Alongside Charles Maddock of Strawberry Browser, Willard Ahdritz 2-time unicorn founder, and Mattias Miksche, one of Sweden's most powerful angel investors, Sara spoke about building a team that’s radically transparent but also relentlessly driven. At Normain, we’re not optimizing for comfort, we’re optimizing for output and learning. That resonated with a lot of the founders and operators in the room.

Slush is a place where people building real products come to pressure-test ideas, sharpen stories, and connect with others doing the same. We left even more energized.

Thanks to the Slush team for creating the environment. We’ll be back next year!

The Precision Manifesto: Defining Extractional AI

Every professional knows this pain: drowning in files, chasing signal through noise, and carrying the pressure to deliver bullet-proof outputs.

It’s not glamorous, but it’s the backbone of real expertise, especially for consultants whose reputations depend on delivering rigorous, tailored insights. Human-led advice to clients always rests on structured analysis drawn from unstructured, messy file chaos.

Two years ago, we were finally promised a revolution for this grunt work.

We were told that AI would automate the hard and tedious stuff: digging through documents, extracting insights, structuring deliverables.

And in many ways, that promise was real.

Conversational AI like ChatGPT and Copilot delivered magically for ideation, rewording, and summarisation. The new tools redefined what was possible and became indispensable almost overnight.

But when deadlines hit and real insights needed to be extracted across 300 pages of client data, a silent truth stared us in the face: Conversational AI isn’t built for that.

Let’s be clear: conversational AI hasn’t failed. It was simply never designed for this kind of work.

And when you look closely, there are four dimensions where conversational AI inevitably breaks down:

• Unreliable: Looks right, often isn’t.
  
  

• Unpredictable: Same prompt, different answers.
  
  

• Unverifiable: No sources, no trust.
  
  

• Unrepeatable: Every output is a one-off.

In short, it feels like using a paintbrush when you actually need a sharpened pencil.

To fix this, we don’t need more clever chatbots or generalized agents. 

We need an entirely new class of AI. One built to do the work we’re actually trying to automate.

Introducing Extractional AI

Today, Normain is introducing Extractional AI.

A form of artificial intelligence that produces structured insights based on unstructured input data. It is designed to be reliable, predictable, verifiable, and repeatable, using specialized AI engines, purpose-built interfaces, and human-in-the-loop design to support high-stakes, judgment-heavy workflows.

It is built for experts who need to verify every output. For risk teams that can’t afford hallucinations. For compliance analysts who need every control grounded in real citations.

It’s AI that respects the stakes for work that firms bill for, and that experts are hired to do.

Some pioneering teams are are already piloting extractional AI today, with reported 50–80% time savings across tax, risk, compliance, governance, M&A, audit, and sustainability. But more importantly, these teams can unlock a new level of quality and depth in their deliverables, fuelling the next wave of expert work.

The philosophy behind Extractional AI

A new class of AI demands a new philosophy. We’re not launching a messaging tweak, but a fundamental rethinking of how AI should support expert work.

1. Purpose-built AI engine
   The AI engine of Extractional AI must perform high-precision data extraction and apply hallucination-proof analysis. It must have human-like abilities to interpret structure and patterns of any input format that can be considered "unstructured".
   
   

2. Specialized UI built for precision
   Extractional AI must feature an opinionated interface that constrains prompting, optimizes human-in- the-loop workflows, and ensures consistent, high-quality outputs.
   
   

3. Human-first by design
   Extractional AI should be built to amplify, not replace, expert insight. It should deliver a seamless verification experience, recognizing that the most transformative AI empowers humans, not the other way around.

Extractional AI works in three steps

Extractional AI should be incredibly simple to understand. Here’s how it works in three steps.

1. Upload your documents: Word, Excel, PDF, web links, your entire knowledge base, whatever.

2. Define what insights you need: your structure, your logic, your analysis, your format.

3. Extract and verify: with citations, certainty scores, and human-in-the-loop refinement.

   
   

Experience a new type of AI

Extractional AI isn’t just more accurate. It’s the first AI you can actually trust with client-facing work.

Imagine every expert spending their time where it actually matters: driving change with clients and stakeholders, because insights extraction is taken care of.

Every deliverable traceable. Every insight defensible.

Rather than being an operational efficiency lever, Extractional AI is a paradigm shift. 

When insights extraction is no longer a bottleneck, a radically different future opens up: one where expert teams move beyond the drudgery of digging and formatting, and instead focus entirely on what makes them invaluable: understanding complex stakeholder realities and driving change through tailored, high-impact insights.

Human expertise and interaction becomes the premium layer, not buried under grunt work, but elevated by it. For the first time, AI takes its rightful role: in service of experts, not replacing them. 

This is the new operating model, and those who adopt it first will define the next era of professional services.

Book a live walkthrough of Normain and see the future of  work for yourself.

As AI Matures, AI Chatbots Show Their Limits

As failed pilots and unreliable outputs mount, companies are rethinking their use of AI. In high-stakes work, accuracy and traceability matter more than fluency. Early consulting firms are now leading a shift to a new paradigm: Extractional AI.

The shift is gaining urgency after public failures like Deloitte’s use of fabricated AI content in a government report, and MIT’s finding that 95% of AI pilots fail. Generic chatbots hit 83% adoption for trivial tasks but stall the moment workflows demand context and customization, highlighting a widening gap between what conversational AI can say and what professionals actually need. 

“The market sees the cracks,” says Sara Landfors, CEO of Normain. “Conversational AI cannot meet the reliability required for document analysis. That's why we built Extractional AI, and we’re already working with leading firms in the US and UK, including Big Fours.”

Extractional AI extracts structured, verifiable insights from unstructured data. It follows clear analysis logic to deliver consistent outputs, combining a purpose-built engine, guided interface, and human-in-the-loop design that keeps experts in control.

“Many of the concepts Normain has pioneered are truly innovative,” says Charles Forcey, CTO at Sustainability Roundtable. “It enhances auditability and trust because it is built from the ground up to be transparent and richly sourced.”

These limitations are especially critical in professional services, where Extractional AI helps teams extract values, trace conclusions, and meet regulatory demands with confidence. 

This shift extends beyond time-savings and efficiency. Extractional AI unlocks a greater movement for professional services, ensuring experts can dedicate more time to uniquely human activities like strategic thinking, client communication, and complex decision-making.

“The time we save using Normain goes directly to improving client delivery,” says Adam Turesson, Sustainability Consultant at 2050 Consulting. “It's a mission-critical tool for any expert.”

As chatbot AI falls short in complex environments, early adopters are turning to Extractional AI. This shift is transforming professional services, elevating human judgment, and making expert input more meaningful than ever.

Read the White Paper

To explore the technical and conceptual foundations of Extractional AI in more depth, we have written a full white paper on the topic.

Read the Extractional AI white paper here.

Let's Talk

If you would like to explore what Extractional AI can do for your team, you can reach us at:

📧 hello@normain.com
🌐 www.normain.com

We'd love to hear from you.

Sustainability Roundtable Inc. advises leaders inside some of the world’s largest companies, serving as a trusted partner to executives at Fortune 100 companies, helping them design their functions, deliver on decarbonization goals, and lead ESG strategy at the highest level. Headquartered in Boston with partners across the U.S. and Europe, the company has built a reputation for helping the world’s most influential businesses set and achieve new standards in sustainability.

For the past months, SR Inc. has turned to Normain to scale complex, knowledge-heavy tasks with a level of quality and auditability that meets their uncompromising standards. Normain has since become a trusted capability, embedded into key processes across the firm.

“Normain completely stood out in the market for their relevance and usability by my team.”

—Charles Forcey, CTO

Where other tools stop, Normain delivers

SR Inc. conducts complex assessments and exhaustive diagnostic surveys that often span hundreds of data points and require rigorous research across a wide body of literature. These projects demand hours of recurring, manual work, and can introduce variability as new consultants join the team. It’s exactly the kind of work Normain was built for.

“Many of the products we tried were one-shot wonders. Normain stood out from the beginning as a flexible solution built to grow with our needs.”

—Charles Forcey, CTO

Scaling human expertise

Normain has helped SR Inc. transform knowledge-heavy tasks into repeatable and scalable workflows, without losing the depth of analysis that defines their work. Crucially, this is achieved without disrupting existing ways of working. Normain is designed to be embedded seamlessly into existing processes, not replace them. For SR Inc., that means consultants can continue working in familiar tools, while leveraging AI to accelerate recurring, complex analysis.

“Normain turned out to be a very intuitive, powerful, and human way of thinking about things. It’s usable and understandable by my team—engineering is not the bottleneck”

—Charles Forcey, CTO

A partnership rooted in trust

From the beginning, the collaboration has been about more than product deployment. SR Inc. found in Normain a partner that shares its dedication to accuracy, transparency, and continuous improvement. And for Normain, working alongside a firm recognized for their high standards and respected for their leadership in sustainability consulting has been an opportunity to sharpen the product in real-world, high-stakes projects.

“My team and I have changed how we work, we now start by saying ‘How can Normain help us?”

—Anna Whitney, Manager Strategic Advisory Services

Looking ahead

This collaboration illustrates how expert-led work can expand its reach without compromising rigor. By embedding Normain’s AI directly into established processes, SR Inc. is producing more consistent and transparent outputs at scale—freeing up consultants to focus on high-value insights clients rely on.

“Normain enhances the auditability and the assurance level of deliverables that we couldn't otherwise have budgeted for”

—Charles Forcey, CTO

Looking ahead, we are looking forward to continuing our partnership with SR Inc. and building even further on the impact we’ve already achieved together.

We're thrilled to announce that Normain is officially ISO 27001 certified.

This certification marks a huge milestone for us. More importantly, it strengthens the value we deliver to our customers.

Understanding ISO 27001

ISO 27001  is the world's leading standard for information security. It sets out a rigorous framework for how organizations manage and protect information, covering technology but also the processes, policies, and routines that keep data safe.

Being ISO 27001 certified means Normain has undergone a comprehensive, independent audit to prove that we have:

• Robust controls: From physical safeguards to technical protections and organizational policies, we've put in place comprehensive measures to protect your data.

• Structured risk management: We systematically identify, assess, and address security risks before they become issues.

• Continuous improvement: We regularly review, test, and refine our processes to keep pace with evolving threats and industry best practices.

In short, it's proof that our security measures meet one of the toughest benchmarks in the world.

Why this matters

For our customers in professional services, where client trust is everything, ISO 27001 means:

• Your data is safe: We operate under an internationally recognized security framework of the highest standards.

• We're serious about compliance: Our processes align with global regulations and established best practices, making it easier for you to meet your own obligations.

• We're proactive, not reactive: ISO 27001 is about prevention, by identifying and addressing risks before they become problems.

This means that every interaction with Normain, every file shared and every insight generated, happens in an environment designed to keep your information safe and secure. 

Why we're proud

Achieving ISO 27001 isn't just about ticking a box. It's about embedding security into every part of how we work—from the tools we choose, to the way our team thinks about and handles information every day—and having it independently verified.

This milestone reflects:

• Months of dedicated effort from our team to design, document, and test our security practices.

• A commitment to continuous improvement, so our defenses evolve with the changing landscape.

• Our dedication to your trust, because we know in professional services, confidentiality isn't optional, it's the foundation.

This achievement marks the successful completion of a long, detailed process that touched every part of our business.

Part of our philosophy from day one

ISO 27001 certification doesn't change how we operate, it validates it. 

Normain has been enterprise-grade in data security from the very start. It's a core part of our philosophy and the way we have built our product from the very beginning.

From our infrastructure to our daily workflows, we've always treated your data with the same level of protection as the most security-conscious enterprises.

You may not always see the work we do to keep your data secure, but it's there. With ISO 27001, you can be certain that behind every click, upload, and decision, we’re protecting your information like it's our own.

Risk assessments are essential for organizations to identify, evaluate, and mitigate potential threats across compliance, operations, cybersecurity, and more. For internal audit teams, enterprise risk functions, consulting firms, and others tasked with managing risk, the process is often time-consuming, fragmented—spread across disconnected systems, inconsistent templates, and siloed teams—and reliant on expert judgment, requiring teams to sift through unstructured data, apply nuanced frameworks, and deliver polished, standardized outputs under tight deadlines.

Normain removes the frictions entirely. Our AI agents help professional services teams accelerate risk assessments by up to 80%, while improving consistency, scalability, and quality—all without losing the expertise and rigor that define this work.

Since Normain applies your team’s existing structured frameworks consistently, firms can build internal benchmarking libraries over time. This allows for trend tracking, continuous refinement of risk frameworks, and richer, data-driven insights across industries or client portfolios.

Why risk assessments and Normain are a perfect fit

Risk assessment processes align closely with where Normain’s AI agents excel:

• Recurring work: Risk assessments involve  applying similar evaluation models across different contexts—cybersecurity risks, operational risks, compliance checks, and more.

• Judgement-based analysis: Assessing risk severity and prioritization depends on expert insight, guided by structured frameworks but nuanced interpretation.

• Clear standards of quality: Teams know what a “good” risk report looks like.  While these standards are consistent in principle, they often vary by firm or sector, calling for AI that’s bespoke, not generic.

• Deep domain expertise: Risk evaluation demands specialized knowledge of regulatory, technical, or industry-specific issues, which is difficult to replicate or embed within generic AI tools.

• Unstructured inputs: Risk assessments require combing through a wide range of documentation—like policies, control reports, incident logs, prior audits and other fragmented documentation.

• Structured outputs: The goal is to produce clear deliverables—risk registers, risk matrices and heatmaps, prioritized action lists, and executive summaries—tailored to stakeholders and decision-makers.

Risk assessments blend repeatable frameworks with expert judgment—the sweet spot where Normain’s AI agents deliver the most value, transforming the work to be faster, more consistent, scalable, and insight-driven.

How Normain supports risk assessments

1. Work with existing frameworks

Normain allows your team to bring their own risk assessment frameworks—whether that’s a standard scoring model, a compliance checklist, or a mitigation plan format—and embed them directly into the platform. No need to reinvent your process.

2. Embed your unique expertise

With Normain, your team’s proprietary knowledge and judgment criteria can be built into AI agents. You can fine-tune instructions to reflect your firm's unique approach to criteria for risk scoring, escalation thresholds, or mitigation strategies and easily give feedback on AI-generated outputs. Normain learns continuously, even auto-suggesting improvements to align better with your standards.

3. Evaluate and optimize output quality

Normain makes it incredibly easy to evaluate the quality of AI-generated outputs through its interface, letting you score and compare different versions across runs. The ideal settings can then be saved and reused. Unlike chat-based AI tools, where comparing outputs between runs is nearly impossible, Normain enables a structured, repeatable evaluation process that ensures transparency, quality control, and continuous improvement across clients or assessments.

4. Re-use with new data

Once your framework is in Normain, it can be instantly re-used on new assessments. Select your data for a new client or project directly from the file system—policies, prior audit or risk reports, control documentation—and your team can quickly first-draft risk assessments in hours, not weeks.

The benefits of using Normain for risk assessments

⚫ Speed: Efficiently process large volumes of documents and reduce time spent on recurring and routine tasks.

⚫ Consistency: Ensure risk assessment follows your firm’s process know-how and standardized, expert-approved risk frameworks, regardless of who is staffed on it.

⚫ Scalability: Reuse frameworks across clients and sectors, scaling your firm’s capacity for a fully scalable workflow.

⚫ Benchmarking: Build internal data sets over time to to spot patterns, track improvements, and deliver richer insights across assessments, clients, or industries.

⚫ Team enablement: Free up senior team members to focus on high-value judgement, while junior staff work faster within expert-guided frameworks. Share AI agents across teams to scale internal expertise.

⚫ Seamless integration: Work within familiar environments (e.g., Excel, Word), with no disruption to existing workflows.

⚫ Data protection: Enterprise-grade security ensures sensitive client and operational data is protected at every stage.

Example deliverables

• Comprehensive risk assessment reports

• Prioritized mitigation and action plans

• Compliance gap analyses

• Executive summaries for boards and stakeholders

• Continuous risk monitoring templates

Whether you’re in internal audit, risk management, consulting, or adjacent areas like cybersecurity or legal, Normain adapts to the way your team works.

👉 Get in touch to see how Normain can help your team move faster, scale smarter, and deliver world-class risk assessments.