Healthcare was the costliest industry for data breaches for the 14th year running, averaging $7.42 million per breach, according to IBM’s Cost of a Data Breach Report 2025. Now picture a regulatory affairs manager pasting a draft clinical summary into a public chatbot for a quick German version. Nothing looks wrong on screen, yet patient data has left the building, terminology may have shifted, and no one can prove who checked the output. Law firms and finance teams fall into the same pasted-text habit. A custom AI translation setup is built to close those gaps, and a generic chatbot isn’t.
Why Generic LLMs Fall Short, and What Custom AI Translation Changes
What is custom AI translation?
Custom AI translation is a domain-trained translation engine built around a client’s own glossaries, translation memory and style rules, run on governed data, and paired with human review. It builds on neural machine translation but adds what regulated work demands: approved terminology, restricted data use and a record of who reviewed what.
Generic large language models (LLMs) are built to be broadly capable, not accountable. Regulated industries need controlled data handling, locked terminology, traceable output and named human sign-off, and a general-purpose chatbot can’t promise most of that by default. That’s why custom AI translation is the safer foundation for life sciences, legal and finance teams.
One mistranslated term, one compliance failure
The danger is rarely a dramatic blunder. It’s a quiet one: “adverse event” softened into “side effect,” a dosage unit dropped, or “impairment” left out of a financial statement. Fluent output earns trust, so the error travels downstream into a label, a contract or a filing.
Where generic LLMs still win
For an internal gist of a press release, low-risk marketing copy or a supplier email, a general LLM is perfectly reasonable. The WMT25 findings paper (November 2025) covered 60 systems across 30 language pairs, with human evaluation on 15 of them. Slator reported that preliminary results had Gemini-2.5-Pro and GPT-4.1 leading among general-purpose LLMs, though the organisers cautioned readers to take those numbers with “a pinch of salt.”
The Gap Nobody Fills: Mapping Regulations to Custom AI Translation Capabilities
Most articles say “compliance risk” and stop there. Regulators ask more pointed questions: where did the data go, who touched it, which terms were approved and who signed off? Each rule below becomes a pass/fail capability.
HHS proposed the Security Rule changes on 6 January 2025, and no final rule had been reported by mid-2026, so check the status before signing. And treating translation vendors as business associates is an inference from HHS’s 2016 cloud guidance, not a translation-specific rule.
The EU AI Act has no blanket risk class for machine translation. Its Article 50 transparency duties have applied since 2 August 2026. Under the simplification package the Council approved on 29 June 2026, stand-alone (Annex III) high-risk obligations apply from 2 December 2027, and those for high-risk systems embedded in products from 2 August 2028. Systems already on the market have until 2 December 2026 to meet the Article 50(2) machine-readable marking requirement. Confirm the final text in the Official Journal before planning around any of these dates.
What “compliant” must actually prove
Strip away the legal language and four proofs remain:
- Data residency: you can say where text was processed and stored.
- No training on client data: your content does not improve someone else’s model.
- Audit logs: every job, glossary version and reviewer is recorded.
- Human sign-off: a named, qualified person accepted the final text.
Deployment shapes the first two. Some providers offer on-premise machine translation, where, in Ulatus’s words, “your data never leaves your servers.” That’s a vendor statement, so confirm it in the contract language. Still, keeping the engine inside your own perimeter shrinks the data-transfer question.
Terminology and Hallucination Control: Where Accuracy Is Won
Accuracy in regulated text comes from constraints, not cleverness. Approved glossaries, translation memory and style rules stop a model from improvising, and domain tuning aims to lower the odds that it invents or drops content.
Glossaries, translation memory and style rules as guardrails
The glossary says a term like “myocardial infarction” always becomes the approved German equivalent. Translation memory reuses sentences a human already approved, so a repeated warning reads identically across forty documents. Style rules fix register, units and date formats.
A generic model can follow a pasted glossary, but only as far as the prompt allows. A custom setup applies the same constraints to every job.
Hallucination and silent-omission risk in dense technical text
Nigatu et al. (EMNLP 2025) tested machine translation for healthcare content in two low-resource languages, Amharic and Tigrinya, and found errors clustering around medical terminology, procedure descriptions and word-order differences. An earlier study, Uguet et al. (EAMT 2024), compared GPT-4, Claude 3 and Gemini on post-editing and error annotation of pharmaceutical text.
The words that carry regulatory weight are exactly where scrutiny belongs. And the worst errors are omissions: a wrong word is visible, but a missing sentence isn’t.
Evidence: error-rate and editing-effort data (2025-2026)
Here the evidence is thinner than vendors imply. Ulatus states on its 2026 site that its custom AI translation delivers “60% fewer hallucinations compared to standard models” and “up to 40% reduced editing effort.” Neither figure comes with a disclosed test set or methodology. Treat them as questions to put to any vendor, not industry benchmarks.
The WMT25 organisers set a better example, with multi-domain test sets and professional human error annotation. Demand the same on your own content.
Industry Snapshots: Life Sciences, Legal and Finance
Risk differs by sector, but the requirement is the same. Each one needs terminology fixed in advance, data under control and a qualified human accountable for the final text.
Life sciences: clinical, labelling and regulatory submissions
The risk: labelling and submission documents must match the source in every language, under fixed review windows. Under the EU MDR, notified bodies review labelling and instructions for use as part of technical documentation assessment.
The requirement: an engine fed with approved product terminology and prior submissions, plus qualified reviewers. Specialists in life science localization build workflows around that combination. If protected health information is involved, confirm a business associate agreement before any file moves.
Legal: contracts, litigation and certified output
The risk: a contract is only as reliable as its defined terms. If a defined party name or the distinction between “shall” and “may” drifts across a 200-page agreement, someone may eventually litigate the ambiguity. Many jurisdictions also require certified translations, which an AI engine can’t issue alone.
The requirement: consistent defined-term handling, strict confidentiality and a certified human step where needed. Teams often pair engines with specialist legal translation reviewers for that reason. One caution: back in January 2024, Stanford researchers found general-purpose chatbots hallucinated on 58% to 82% of legal research queries. That study covered question answering, not translation, and dates from 2024, but legal-sounding text can still be wrong.
Finance: disclosures, reports and turnaround
The risk: reports run on tight deadlines and exact terminology, and a dropped qualifier such as “impairment” changes what a disclosure says. IBM’s 2025 report put the average breach in financial services at $5.56 million, second only to healthcare, so the pasted-chatbot habit from our opening is a real exposure here too.
The requirement: a private engine with fixed financial glossaries and fast turnaround, so teams aren’t tempted to bypass policy to hit a deadline.
Why Custom AI Translation Still Needs Human Review
Custom AI translation is the first layer of a governed workflow, not a replacement for qualified linguists.
Custom AI plus MTPE: light vs full post-editing
Machine translation post-editing, or MTPE, is the human step after the engine. ISO 18587:2017 defines two levels. Light post-editing fixes content errors such as wrong numbers to give accurate, understandable text, while full post-editing aims for quality equal to a human translation.
Internal reference material may need only light editing, but anything patient-facing, filed with a regulator or signed by a client belongs in full post-editing.
Who signs off when regulators ask?
ISO 17100:2015 gives the clearest answer. It requires qualified translators, revision by a second qualified person, archived materials and confidentiality. Since that sign-off chain already exists on paper, your AI setup should plug into it, not bypass it.
Translated, a language-services vendor, also frames human oversight as an EU AI Act design expectation. Formally, that duty attaches to high-risk systems, so treat it as the vendor’s interpretation.
A 7-Point Scorecard for Evaluating AI Translation Solutions
Short answer: use the 7-Point Regulated Translation Scorecard to rate AI translation solutions from 0 to 2 on each question below: 0 means no, 1 means partial, and 2 means documented in writing. Ask for evidence, not sales-call reassurance.
The scorecard
- Data use. Is client content excluded from model training and deleted after the project? Get it in the contract.
- Deployment options. Can the engine run privately or on-premise if policy demands it?
- Glossary and translation memory control. Can you upload, lock and version your terminology?
- Audit logs. Can you export a record of jobs, versions and reviewers?
- Only ISO/IEC 27001:2022 is valid after 31 October 2025, so a 2013 reference is a warning sign. There’s no such thing as “HIPAA certified,” so ask whether a business associate agreement will be signed.
- Human review. Is qualified post-editing built in, aligned with ISO 18587 and ISO 17100?
- Measurable quality. Will they report Time to Edit (TTE, how long editors spend fixing the output) and Errors Per Thousand (EPT, errors per 1,000 words) on your own difficult samples, not a vendor-chosen test set?
Reading the total: 0-7 signals high risk, 8-11 means pilot only with written conditions, and 12-14 means proceed. A zero on data use or human review is a stop at any score. Providers of AI translation services vary widely on these points, which is why a scorecard beats a brochure.
Red flags in vendor answers
Be wary of “we meet all global privacy standards” with no named attestation, quality claims with no baseline, and any promise of zero errors.
What to ask for in a pilot quote
Credible 2025-2026 cost benchmarks for building a custom engine in a regulated enterprise are scarce, so we won’t quote one. Ask instead for a pilot quote on one content type, with glossary build time, review hours and turnaround priced separately. That way you can see where the money goes and whether costs fall as translation memory grows.
Conclusion: Choose Control Where the Rules Are Strict
Custom AI translation wins wherever data control, terminology and auditability are regulated. Generic LLMs stay useful for low-risk drafts, and enterprise tiers can tighten data handling, but on their own they can’t reliably prove which terms were approved or who signed off.
Your next step: run the seven-point scorecard against your current AI translation solutions this week and note every question your vendor can’t answer in writing. Then bring your three weakest scores and one real document type (a label, a contract or a quarterly report) to a pilot conversation with a specialist such as Ulatus. Ask for results on that sample with TTE and EPT reported. A small, governed test will tell you more than any benchmark claim, including the ones in this article.
