Who offers AI to help fill in complex compliance forms? Three answers, three different products.

The category is three categories

Strip away the vendor marketing and there are three distinct surfaces to fill. The vendors split along these surfaces. Most of them only touch one. A small number reach two. None of them, including Mediar, covers all three with a single primitive, and a buyer who tries to force a single-vendor answer ends up with a beautifully filled questionnaire and an empty Epic registration screen, or vice versa.

The rest of this page walks each bucket. Inside each one I name the vendors a buyer is most likely to evaluate, what they actually fill, and what artifact each one produces when the auditor asks. The third bucket is where Mediar lives, so that section is denser and grounded in the product source.

Layer 1. AI for the web questionnaire

This is the loudest bucket. A prospect or regulator sends a structured template (SIG Lite, SIG Core, CAIQ v4, NIST 800-171 attestation, an ISO 27001 questionnaire, a custom RFP). A model with access to the customer's trust evidence drafts text answers, a security analyst reviews them, and the platform writes them back into the questionnaire portal or exports them to Excel. The audit artifact is the submitted questionnaire plus, on the better products, a per-answer source citation pointing at the policy or evidence row the model drew from.

The good ones (Vanta AI, Drata, Sprinto, Scytale, Centraleyes, Inventive, Responsive) are mature products. They genuinely shrink a two-week SIG turnaround into something a small team can do in days. What they do not do is type into the screen inside Epic where the patient record actually lives. That is not a criticism, it is a surface limitation: their tool stack is HTML and JSON, and the regulated screen they would otherwise have to fill is not.

Audit artifact in this layer: a questionnaire export (XLSX, PDF, or portal submission) plus an answer-source log for each answer the model drafted. Compliance signs off on the answer text and the citation. The runtime that wrote the answer back is rarely audited because the surface (a web form) is well-understood.

Layer 2. AI for the scanned document

A claim arrives by fax. A PDF first-notice-of-loss lands in an inbox. A KYC packet shows up as a multi-page TIFF. Layer 2 vendors classify the document, find the fields, extract values with confidence scores, and pass the structured result downstream. They are not primarily form-fillers; they are field extractors that feed forms. When a buyer asks “does AI fill this claim form?” the honest answer is that AI extracts the fields, and a separate downstream system writes them into the actual record.

The mature ones (Hyperscience, Rossum, ABBYY, Instabase) carry years of regulated-industry deployments. The newer entrants (Klarity, Docupanda) are easier to set up but less battle-tested in production back offices. The pairing question that matters: once the fields are extracted, what writes them into the system of record? That is where this layer hands off to the next.

Audit artifact in this layer: a structured extraction record with a confidence score per field, a copy of the original document, and the model version that produced the extraction. Reviewers care about field-level confidence and the human review queue, not about the downstream write.

Layer 3. AI for the system-of-record screen

This is the bucket the published lists usually skip. A patient access coordinator types a registration into Epic. A bank associate opens a new commercial account through 17 screens of Fiserv DNA. A claims adjuster files a first notice of loss across three tabs in Guidewire. A finance clerk posts a journal entry through F-02 in SAP GUI. None of these screens is a web form. None has a documented public API that covers the full screen flow. None is reachable by a tool whose surface is HTML and JSON. Filling these forms is a desktop-automation problem with a regulated audit overlay on top.

Inside layer 3 the meaningful split is between agentic runtimes (a model decides the next click each run, which is fast to deploy but harder for a compliance reviewer to sign) and recording-and-replay runtimes (a model authors a workflow once during recording, then a deterministic process executes it). Mediar sits firmly in the recording-and-replay camp. UiPath and Automation Anywhere have both shipped agentic surfaces in the last two years; their classic studios remain selector-driven RPA. Power Automate covers all of this from inside the Microsoft stack with the trade-offs that implies. Sola is a newer entrant with an AI-first recording flow.

Audit artifact in this layer: the workflow definition (a TypeScript file in Mediar's case, a XAML file in UiPath's, a JSON flow definition in Power Automate's) plus a per-run trace. Compliance signs off on the workflow definition the same way they would sign off on a stored procedure, then samples the trace to confirm the runtime did what the definition said.

The artifact most buyers forget to ask for

When a regulator asks “show me how this record was filled” six months after the fact, every vendor in this directory has to produce something. Layer 1 produces a question-answer log. Layer 2 produces an extraction record. Layer 3 produces a workflow file plus a trace. The shape of that workflow file is the part most buyers do not interrogate, and it is where the layer-3 vendors actually differ.

Inside Mediar, every recorded step lands as a structured record defined by the StepAnalysis struct in apps/desktop/src-tauri/src/recording_processor.rs (lines 31 to 49). The struct names eight fields per step: step_title, step_summary, events_that_happened, how_content_changed, results_if_any, what_was_clicked, what_was_typed, and user_intent. Those eight fields are serialized into a TypeScript file the runtime executes. The file is the audit artifact.

UiPath records the same intent into XAML, an XML dialect designed for Workflow Foundation. Power Automate records it into a Microsoft-proprietary flow definition. Both are inspectable, but inspection requires the vendor's studio. A TypeScript file with named semantic fields is the same shape a software team already reviews on every pull request, which is the integration point that actually matters for a compliance program staffed by software engineers and risk officers in the same room.

Where the typing actually happens

One layer below the workflow file, the runtime emits a single MCP tool call to fill a field: type_into_element, defined in apps/desktop/src-tauri/src/mcp_converter.rs. The tool takes a structured locator and a string. The locator resolver tries the recorded automation id first, then the window handle plus bounds, then the visible text content, then the parent window as a last fallback. Three of those four strategies are position-independent, so a routine UI tweak (a button shifts a row, a panel reorders, a form gets a new tab) usually resolves through one of the first three. None of this involves a model call at runtime. The same primitive types into Epic, Cerner, Fiserv, Jack Henry, Guidewire, Oracle EBS, SAP GUI, and any AS/400 emulator that exposes a Windows accessibility tree.

The buyer's mental model usually flips once

A common arc on first calls: a buyer arrives convinced they need “an AI for our compliance forms,” meaning the SIG queue. Twenty minutes in they realize that piece is solved by Vanta AI or Drata, and the painful one was always the Epic registration flow or the Fiserv onboarding screen. The mental model swaps from “one AI for forms” to “a stack of three layers, with the hardest one being the screen inside the legacy app.”

A short answer when someone asks at the dinner table

If you are filling a vendor questionnaire, look at Vanta AI, Drata, Sprinto, Scytale, Centraleyes, Inventive, Responsive, or Spellbook. They are all in the same market and a head-to-head comparison is fair.

If you are extracting fields from a scanned document, look at Hyperscience, Rossum, Klarity, Docupanda, Instabase, or ABBYY. The right pick depends on volume, document complexity, and which downstream system you are feeding.

If you are filling the form inside the legacy desktop app where the regulated record actually lives, look at Mediar, UiPath, Automation Anywhere, Power Automate, Blue Prism, or Sola. Inside this layer the decision is mostly about runtime determinism and what the audit artifact looks like when it is checked into source control. That is the part most flat lists never tell you.

Frequently asked questions