Agiloft vs Leah: how they compare in 2026
On paper these two look alike. Agiloft and Leah both sell contract lifecycle platforms to legal and procurement teams, and both publish their customer agreements. Both cap liability at a year of fees and triple the cap for breaches of their security terms, and both commit to notice before a compelled disclosure. The differences are in where each draws its lines. Agiloft writes its AI limits into contract. Customer data trains no model without written consent, and the agreement states that Agiloft gives no legal advice. Its ConvoAI tool links every answer to the highlighted contract passage behind it. Leah puts its effort into agent governance. The customer sets which agents act and where they escalate, and every action is logged with its rationale, where Agiloft describes review screens but no thresholds. Leah names four model providers. Agiloft's terms name Microsoft Azure OpenAI Service and incorporate the Microsoft, OpenAI and AWS usage policies. Agiloft also lets customers train review models on their own documents with AI Trainer.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
AI Trainer, ConvoAI Document Q&A, the GenAI Prompt Lab, generative redlining and Screens are sold as AI Applications on top of Agiloft's contract lifecycle management platform. The platform's workflows, repository, approvals and integrations predate them. The Services Agreement defines AI Applications as functionality made available as part of the subscription and specified in the order. The Supplemental Terms govern them as a separate add on class. The models drive these features, and the CLM itself runs without them.
Leah sells AI agents and an orchestration layer that sit on top of a contract lifecycle platform, and that platform works without them. The vendor describes it the other way round. It says other vendors bolted AI onto systems built for manual workflows, while Leah was designed from scratch with orchestration as the foundation. ContractPod Technologies has sold contract lifecycle management since 2012. Leah launched in March 2023 as an AI services hub within that platform, went standalone in May 2023, and Leah Intelligence followed in October 2024. Without the agents, the product is still a working CLM with guided intake, approval routing, DocuSign and Adobe Sign execution and a contract repository. That CLM has its own market and its own Gartner category placement. The orchestration layer on top is model driven.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
ConvoAI Document Q&A ties each answer to the passage in the contract that supports it and lets the user jump to the highlighted text, which the vendor calls white box AI. Section 9.3(c) of the Services Agreement states that AI features exhibit varying degrees of accuracy. The Supplemental Terms require the customer to check output independently. Agiloft publishes no accuracy figure, test set, benchmark or evaluation. The tool reads the customer's own contracts rather than primary law, so questions of legal authority do not arise.
Leah returns to accuracy repeatedly in its materials, and the AI governance page says every action is measured against benchmarks for accuracy, bias and outcome. Neither that page nor the home page publishes a result from that measurement. They give no accuracy figure, no error or hallucination rate, no description of any benchmark or test set and no published evaluation. The product material describes a legal helpdesk that answers contract questions with sources attached, so a user can in principle check an answer against its source. Neither page says what the system does when the customer's own contracts do not support a position.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Agiloft's AI features are built so that a person reviews what the models produce. Generative redlining proposes insertions and deletions against approved clause language for a negotiator to accept. Agiloft's own product lead describes it as best used where the language differs in substance, not for minor edits. AI Trainer lets a firm decide what the review model looks for, and ConvoAI answers link to the source text so a user can verify them. Section 2.3(c) of the Services Agreement makes the customer solely responsible for evaluating output. Agiloft does not publish a threshold at which any AI Application acts without a person, or a route for correcting a wrong output beyond the customer's own review.
Leah's dedicated AI governance page sets out a three stage control loop. In the first stage, policy in, the customer defines which agents may act, on which data, within which thresholds and where escalation is required. Those policies are held as configuration rather than code. In the second, execution governed, every agent action runs through those policies in real time. Approvals, escalations and rejections are applied automatically, and the orchestrator enforces guardrails at each step. In the third, audit out, every decision is logged with the rationale, what the agent did, why, under which policy, on what data and to what outcome. The records are described as tamper resistant and immutable. The loop sets the thresholds, the review points and the route back to human judgment. Leah's home page puts the position in one line, that the workflow runs itself while the judgment stays human. The page does not say what happens after an output is found to be wrong. Default modes are not described, because the customer configures the guardrails rather than receiving them preset.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
The vendor states a 99.6 percent implementation success rate without saying how it is measured, and describes its customers as some of the largest companies. The pages carrying these claims name no customer deployment. The site navigation also links a customer stories page and the Pacesetter awards.
Leah publishes qualitative quotes from four named people. Noelle Perkins is EVP and Chief Legal Officer at Cushman and Wakefield, and Lidia Kamleh is Chief Legal Officer at Dubai Future Foundation. Frances Bain-Cumberbatch is Chief Legal and External Affairs Officer at Ansa McAL, and Zillia Knight is Senior Legal Officer at Terumo Europe. Three results are published with the customer unnamed. A major American logistics company cut contract review time by 91 percent. A global manufacturer protected more than $18 million of revenue, and an American retail REIT tracked more than $2 million of savings. About 54 enterprise logos appear, including Philips, MUFG, Sandoz, Pernod Ricard, Alaska Airlines and Wood PLC. PwC and KPMG appear among them. PwC entered a commercial alliance in March 2024, and Epiq resells Leah in its Service Cloud. Integreon is quoted as an early adopter that resells it, and Pinsent Masons adopted it for managed legal services in July 2025. Partners and customers are shown together without distinction, and the Chief Product Officer of Execo, another services partner, is among the testimonials.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Section 2.3 of the Services Agreement and section 1 of the Supplemental Terms provide that customer data is not used to train AI Applications or AI Models without the customer's explicit prior written consent. Section 4.3 extends that consent requirement to developing or improving the services at all. The platform is offered single tenant or multitenant by order, and section 2.2 confines Agiloft's use of customer data to providing and maintaining the services. Section 14.3 deletes customer data within thirty days of termination, and section 4.2 allows export at any time. Microsoft Azure OpenAI is named as a subprocessor, and its temporary storage of input and output for abuse monitoring is disclosed. AI service providers are defined as those on the published subprocessor list. The agreement does not address attorney client privilege or work product.
Leah says customer contract data is never used to train models. The AI governance page treats data leaking into models the customer does not own as a failure it engineered out. It says zero data retention is the only acceptable answer, and that Leah enforces zero retention with OpenAI and Anthropic so they process data but never store it. Encryption is AES-256 at rest and TLS in transit, with keys in Azure Key Vault, rotated and reachable only through controlled service accounts. Role based access control is said to apply at every layer, and single tenant deployment is offered for customers with strict isolation needs. Leah sells to Fortune 500 legal departments, and none of this material addresses privilege or work product.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Section 9.3(b) of the Services Agreement states that Agiloft is not an attorney or law firm or a substitute for one. It adds that Agiloft does not provide advice, explanation, opinion or recommendation about legal rights, remedies, defenses, options, selection of forms or strategies. Section 9.3(c) and the Supplemental Terms state that AI output may be inaccurate and must be verified independently. The product is sold to legal and procurement teams. Agiloft's published terms do not describe how the product supports a supervising lawyer's duties, and name no jurisdiction limit beyond export control.
Leah publishes nothing on the line between a tool and legal advice. Its site carries no disclaimer of any kind and no ethics or professional responsibility page, and it names no bar or ethics guidance, including ABA Formal Opinion 512. The platform is sold to run legal work end to end across legal, procurement and finance teams. In the vendor's own framing, agents carry out commercial work in several steps without routing every decision through a person.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
The vendor markets white box AI that shows its reasoning by linking answers to source text. The Supplemental Terms bind customers to the Microsoft AI Code of Conduct, OpenAI usage policies and the AWS responsible AI policy, and section 3 warrants that insights from usage data are anonymized. Agiloft's terms and product pages set out no responsible AI framework of its own, no ISO 42001 or equivalent standard, no description of testing before release and no statement about uneven output. They name no accountable owner for AI governance. Agiloft also runs a trust portal at trustportal.agiloft.com.
A dedicated AI governance page names six failure modes the vendor says it engineered out. They include black box decisions that cannot be defended to a regulator or board, and compliance frameworks retrofitted after the fact. Against them the page sets three pillars and a loop of policy, execution and audit. Each action is logged with its rationale and governing policy, in records described as tamper resistant and immutable. The page also says every action is measured against benchmarks for accuracy, bias and outcome, and that accountability is structural rather than aspirational. It names no person or role accountable for model behavior and describes no testing before release. It gives no benchmark method or schedule and discloses no bias measurement result.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Section 14.3 of the Services Agreement deletes customer data within thirty days of termination unless law requires longer, and section 4.2 allows export at any time. A subprocessor list is published at a stated URL, and AI service providers are defined by reference to it. Section 16.2 commits to emailed notice of updates to the list. The Supplemental Terms disclose Microsoft's temporary storage of AI content for abuse monitoring. Section 5.1 commits to organizational, physical and technical precautions against access by employees and subcontractors. Agiloft also publishes a security page and a trust portal. Section 5.3 gives the customer a route for reporting incidents, and an incident notification commitment sits in the DPA.
The AI governance page describes TLS in transit and AES-256 at rest. Encryption keys are managed in Azure Key Vault, rotated regularly and reachable only through tightly controlled service accounts. The page also lists multifactor authentication, secure API gateways, network segmentation, real time monitoring and a documented incident response plan. Audit logs are described as comprehensive, tamper resistant and immutable. For outside assurance, the vendor says an independent Managed Security Service Provider audits it every year and that it is penetration tested regularly.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Section 10.1 of the Services Agreement, version 1.2 of 22 July 2026, gives an indemnity for intellectual property infringement. A second indemnity covers unauthorized disclosure or misuse of customer data resulting from a breach of the data use or security obligations. Section 10.2 sets out exclusions, and the mitigation remedies include a pro rata refund. Section 11 caps each party at twelve months' fees and raises the cap to three times that for breaches of the security, confidentiality and compliance sections. Gross negligence, willful misconduct, fraud and the indemnities sit outside any cap. Section 9.2 warrants material conformity, with a remedy of repair or refund. The Supplemental Terms state that AI output is provided as is and that Agiloft has no liability for any damages arising from use of output. Neither document mentions insurance.
Section 16.5 of the Master Terms and Annexes sets a General Cap equal to fees paid or payable in the twelve months before the first incident. An Enhanced Cap of three times that applies to breaches of its security or data protection terms, meaning the security clause and the data processing addendum. Indemnities, intellectual property claims, breach of confidentiality and anything that cannot legally be limited are uncapped. Section 17.1 gives the customer an indemnity against third party intellectual property claims. Section 8.2 warrants that the service will perform materially as documented, with a thirty day fix period under 8.3 and termination with a refund if the fix fails. Annex A publishes uptime tiers of 99.00, 99.5 and 99.9 percent by support plan. A tier missed in three consecutive months, or in four months out of six, allows termination with a refund. Three limits apply. Breaches of confidentiality involving Customer Data fall outside the uncapped claim, so they stay capped and rise to the Enhanced Cap only where the security or data protection terms are also breached. The agreement gives no indemnity for AI output, such as inaccurate output, hallucination or training data provenance. Section 9.2 bars the customer from submitting Sensitive Data, including GDPR Article 9 categories, and the provider disclaims liability for it. These terms are version 3.0c. Version 4.0, dated 4 January 2026, changes only the trading name, according to the vendor.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
The Integration Hub is an embedded integration platform powered by Workato. Agiloft states that the hub connects its platform to hundreds of other systems through connectors and recipes. Public help documentation sits on the Agiloft wiki, and the Services Agreement addresses Third Party Services. The pages describing the hub cover its depth in general terms and do not say what a firm must configure or which systems sync in which direction. Agiloft also publishes an integrations page.
Leah names its integrations and describes each by function. They cover ERP platforms including SAP and NetSuite, procurement systems including Coupa, financial systems, identity providers including Okta, and existing contract lifecycle tools. DocuSign and Adobe Sign are built in for signing, and a Microsoft Word add in handles redlining. The vendor also describes how the integrations work. It says Leah connects and executes rather than copying data passively, and carries out work across connected systems through the orchestration layer. Leah has a dedicated integrations page, but publishes nothing on what syncs in which direction or what a customer must configure. No document management integration such as iManage or NetDocuments appears, which fits a product built for in house teams rather than law firms.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The Services Agreement defines the core platform as available on a single tenant basis, meaning a dedicated cloud environment for one customer, or on a multitenant basis. The order selects between them. An EU Data Act addendum exists for EU customers. The published terms state no region list, hosting provider or processing location for the AI providers. Agiloft also publishes a security page and a trust portal.
The standard deployment is shared. Single tenant deployment is available for customers with strict isolation requirements. The vendor also offers what it calls a dedicated zero trust private environment in Azure OpenAI Studio, described as fully isolating data from all other customers. Leah runs on Azure, with keys held in Azure Key Vault. On data residency the vendor says only that it supports the residency and regulatory needs typical of large multinational enterprises. It names no region or jurisdiction and describes no customer choice.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Section 5.2 of the Services Agreement states that Agiloft has completed audits by an independent auditor of the design and effectiveness of its security controls. Customers may obtain the reports through the trust portal at trustportal.agiloft.com, where they are treated as confidential information. The agreement does not name the audit standard, the auditor or the coverage period, or say whether a prospect can obtain a report without asking.
The AI governance page claims SOC 1 Type I and II, SOC 2 Type I and II, GDPR compliance, CCPA compliance, HIPAA readiness and ISO 27001 alignment. The home page FAQ, on the same site, says only that Leah is SOC 2 Type II certified, so the two pages disagree on what is held. For ISO 27001 and HIPAA the governance page says aligned and ready rather than certified. The auditor is described only as an independent Managed Security Service Provider, a category rather than a named firm. No coverage period, report date or audit scope is given. Penetration testing is said to be regular, with no partner named and no summary published. Leah has no trust center or portal, so there is no published route to request a report.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The Supplemental Terms name Microsoft Azure OpenAI Service as the provider behind certain AI Applications. They disclose that Microsoft temporarily stores input and output for abuse monitoring, with human review of flagged content. The incorporated acceptable use policies are Microsoft's, OpenAI's and AWS's, which identifies the set of providers. AI service providers are defined as those on the published subprocessor list, and section 16.2 commits to emailed notice of changes to that list. The terms name no model and state no inference location.
The DPA Setup Page lists four model providers against Leah Functionality, each noted as storing or retaining no customer data and each with named jurisdictions. Anthropic PBC is listed for the USA, Japan, and the EU or UK, and OpenAI LLC for the USA, Japan, and the EU or Switzerland. Cohere Inc. is listed for Canada, the USA, the EU or UK, and Japan. Google AI/ML with Google Cloud is listed for the USA, Japan, and the EU, Switzerland or UK. Microsoft Azure Services is listed for hosting and translation, and the private deployment option runs in Azure OpenAI Studio. DPA clause 4.3 requires any new subprocessor to be added to the published list with at least thirty days' notice before it processes customer personal data. Clause 4.4 gives a thirty day objection right on reasonable data protection grounds. If the objection is not resolved, the affected order can be terminated with a refund of prepaid unused fees. No model or version is named for any provider. The platform is described as choosing among several language models for each task and letting customers extend or customize models. Nothing published shows which provider handled a given piece of work.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The Services Agreement prices by order, with use limits by type and number of users and prorated increases during the term. Additional services are priced separately, payment terms are thirty days, and the customer chooses a single tenant or multitenant platform. The agreement states no price figure. Agiloft also links a pricing page from its site navigation.
Leah publishes no pricing at any level, including the unit of charge. The primary navigation covers platform, solutions, resources and company, and neither it nor the footer sitemap has a pricing page. There is no tier structure, no unit per seat, contract or agent, no volume banding and no indication of what implementation adds. Every call to action across the site is to request a demo. An implementation FAQ says timelines vary with scope and integrations and that a detailed plan is built during evaluation. It says nothing about cost. No published page gives a view of price before a sales process.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Solution pages address legal and procurement functions and seven industries, and the product is sold to enterprises. The platform is offered single tenant or multitenant, with an EU addendum. The Services Agreement bars use for high risk activities. Agiloft's pages name no contract type or practice area as unsupported and describe no law firm use.
Leah publishes dedicated industry pages for CPG and manufacturing, energy and utilities, financial services, healthcare, and pharma and medical devices. It describes its customers as Fortune 500 enterprises in regulated industries. By function it publishes pages for legal leadership, legal operations, sales and revenue, procurement, and finance. The pages carry distinct propositions written for the General Counsel, the contract operations team, the Chief Procurement Officer and the finance leader. The customer roster spans banking, airlines, pharmaceuticals, consumer goods and engineering. No published page says which practice areas, contract types or matters the platform does not support, and none addresses smaller organizations. Law firms appear only indirectly, through managed service partners, rather than as a served segment.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Training on customer data happens only if the customer affirmatively enables it, and the switch is written consent under the agreement. Section 2.3 of the Services Agreement and section 1 of the Supplemental Terms provide that customer data is not used to train AI Applications or AI Models without the customer's explicit prior written consent. Section 4.3 provides that Agiloft does not use customer data to develop or improve the services without the same consent. Usage data, defined to exclude the contents of customer data, may be used to improve the AI Applications.
Leah's security FAQ, on its home page, says customer contract data is never used to train models. The AI governance page treats data leaking into models the customer does not own as a failure it engineered out. It says zero data retention is enforced so that OpenAI and Anthropic process data but never store it. No term in the Master Terms and Annexes v3.0c names training, model training, machine learning or model improvement for customer content, either way.
Two clauses come close. Clause 5.1 limits the provider's use of Customer Data to providing and maintaining the Cloud Service, Support and Professional Services. Clause 5.4 allows use of Usage Data, the provider's technical logs, data and learnings about the customer's use, to run, improve and support the service. Usage Data excludes Customer Data, so the improvement right covers telemetry, not content. Together the clauses fit a ban on training without stating one.
They leave open whether model improvement counts as maintaining the service. The commitment rests on the published policy, not a contract term. Version 4.0 of January 2026 changes only the trading name, according to the vendor.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Section 14.3 of the Services Agreement deletes all customer data, which includes input and output, within thirty days of termination unless law requires longer. Section 4.2 allows export at any time during the term. The Supplemental Terms disclose that Microsoft temporarily stores AI input and output for debugging and abuse monitoring. The terms set no shorter or configurable window for prompts and outputs during the term, and the customer cannot change the published period.
Section 14.4 allows export during the subscription and deletion of Customer Data within sixty days of a request after termination. That is subject to standard backup or record retention policies and legal requirements, and the customer cannot change the period. The data processing addendum adds secure deletion to industry standards at clause 8.2, with a certificate of deletion on request. Schedule 1 commits to export in CSV or a similar format within thirty calendar days and to physical destruction of media by a recognized provider.
Prompts and outputs have no separate window. The agreement treats Customer Data as one class, defined at section 23 as any data, content or materials the customer submits, so prompts and outputs follow that regime. Usage Data sits outside it. Section 5.4 lets the provider collect Usage Data, meaning its technical logs, data and learnings about the customer's use, excluding Customer Data. The provider may use it to run, improve and support the service and for other lawful purposes such as benchmarking.
It may disclose Usage Data externally only if deidentified and aggregated across customers. No deletion duty applies to Usage Data, and section 14.5 makes 5.4 survive termination.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
The Services Agreement sets out separation at the tenant level. It defines single tenant as a dedicated cloud environment for one customer and multitenant as an environment that may be shared, with the choice made in the order. Section 2.2 confines Agiloft's use of customer data to providing the services. The agreement does not describe matter level or department level walls within a customer's instance, or how the AI Applications respect user permissions. Agiloft also publishes a security page.
Leah describes separation at the customer level, through deployment options. The vendor states that single tenant deployment is available for customers with strict data isolation requirements. It says a dedicated zero trust private environment within Azure OpenAI Studio ensures complete isolation from all other customers. Role based access control is stated to be enforced at every layer. That wording makes isolation a deployment option rather than the default, and nothing published describes how customers are separated in the standard shared deployment.
Legal, procurement, finance and shared services teams work in the same system, and nothing published addresses boundaries between them inside a customer.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 7.3 of the Services Agreement permits disclosure of confidential information, which includes customer data, to the extent required by law. Where legally permitted, the receiving party must give the disclosing party prompt notice of the compelled disclosure and reasonable assistance should it wish to contest it. Section 5.1 refers to the same clause for compelled access to customer data. Agiloft publishes no transparency report.
Section 19, headed Required Disclosures, lets the recipient disclose Confidential Information where the law requires. Where the law permits, the recipient must give advance notice and reasonable cooperation, at the discloser's expense, to obtain confidential treatment. The clause expressly covers Confidential Information including Customer Data. Section 23 confirms that the customer's Confidential Information includes Customer Data, so customer material sits inside the notice duty.
The duty is mutual and binds whichever party receives the demand. Section 14.5 makes section 19 survive termination. Leah publishes no transparency report, so there is no public count of demands received or of how they were answered. These terms are version 3.0c. Version 4.0 of January 2026 changes only the trading name, according to the vendor.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
The product is not built on a legal corpus. ConvoAI answers questions about the customer's own contracts with links to the source passage, AI Trainer learns from the customer's own documents, and generative redlining works from the customer's approved clause language. Agiloft's news releases and terms name no primary law source, license or update cadence.
Leah works on the customer's own material. The vendor states that Leah operates against the customer's policies and playbooks and gains intelligence from the customer's unstructured data and business rules. It answers contract questions from the customer's repository with sources attached. The vendor also refers to Leah operating against established legal precedents, but names no source, jurisdiction, database or rights basis for them.
The product manages a customer's contracts rather than retrieving primary law. No provenance statement backs the precedent reference, and no update cadence is published for anything.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
The product does not retrieve or cite primary law. Its output is contract answers, redlines and extracted data, and its published materials do not address checking authority for subsequent history.
Leah describes no citator, treatment signal or currency check, and does not say whether legal authority is reviewed for later history. The platform manages contracts, obligations and procurement workflows rather than retrieving case law, so a citator is not part of what it sells. The vendor does refer to Leah operating against established legal precedents, without identifying any source. That is the one place the product invokes primary authority, and no verification step is described for it.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
ConvoAI Document Q&A links each answer to the supporting passage so the user can verify it in the source, which the vendor markets as white box AI. The product documents how a user checks an answer rather than what the model does when it cannot answer. Neither the February 2025 release nor the terms state an abstention path or confidence signal for questions with no supporting passage. The terms require independent checking of every output.
The home page and the AI governance page describe no explicit path for Leah to decline to answer or abstain, and no confidence or grounding rating. The governance loop does produce rejections. Approvals, escalations and rejections are applied automatically according to the customer's rules. Those are policy outcomes set by configured guardrails, not the model declining because it cannot ground a response. Neither page says what Leah does when the customer's own contract set or playbook does not cover the question in front of it.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin tracks decisions worldwide where a court addressed hallucinated AI content, and records the tool implicated where known. It records no court order, opinion or disciplinary record naming Agiloft, ConvoAI or Astra. Published reports of court findings on AI errors do not name them either. Agiloft is a contract platform that cites no legal authority, so its output does not ordinarily reach a court filing.
The AI Hallucination Cases database maintained by Damien Charlotin tracks decisions worldwide where a court addressed hallucinated AI content, and records the tool implicated where known. It records no court order, opinion or disciplinary record naming Leah or the former company name ContractPodAi. Published 2026 sanctions trackers and trade press summaries name neither. The platform runs commercial contracting and procurement work rather than producing court filings, so its output does not ordinarily reach a brief.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Section 9.3(b) of the Services Agreement addresses the line between tooling and legal advice, and the Supplemental Terms incorporate the AI providers' acceptable use policies. Neither the terms nor Agiloft's news releases name an ethics opinion, bar rule or professional responsibility framework, or any bar or regulator guidance on lawyers' use of AI.
Leah publishes nothing that engages with bar or ethics guidance. That includes ABA Formal Opinion 512, state bar guidance in the United States, and Solicitors Regulation Authority or Law Society material. The company is headquartered in London and sells into legal departments across North America, Europe, Asia and Australia. Its published compliance material covers regulation and security frameworks, namely GDPR, CCPA, HIPAA, SOC and ISO. None of it addresses the professional conduct obligations that bind the lawyers using the product.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product is sold to legal and procurement teams inside companies, which bill no client, so it sits outside a lawyer to client fee relationship. Agiloft frames its savings in cycle time and negotiation loops rather than fees. Its materials do not address how AI assisted work is recorded or disclosed on a bill, and no law firm is a named buyer segment.
Leah frames its public materials around cost and time removed, quantified at portfolio level. It cites a 91 percent cut in contract review time, more than $18 million of revenue protected and more than $2 million of tracked savings. Its headline figures are more than $125 billion of commercial value managed and more than $10 billion of ROI impact delivered. No per matter record of AI assisted work for fee purposes is described, and no guidance on billing, fee or client disclosure treatment is published.
The vendor describes an immutable audit log of every action, which could in principle support such a record, but does not present it for that purpose. Leah sells to in house functions rather than firms billing clients, so the costs in play are internal cost and outside counsel spend. Its materials address neither.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Agiloft publishes a current subprocessor list, and the Services Agreement defines AI service providers as the third party AI providers listed on it at a stated URL. The agreement commits to emailed notice of updates. The Supplemental Terms name Microsoft Azure OpenAI Service, disclose its content handling, and incorporate the Microsoft, OpenAI and AWS policies. The DPA is published. Together the terms give a firm material it could show a client.
The data processing agreement is Annex B of the Master Terms and Annexes v3.0c. The DPA Setup Page lists every subprocessor with its purpose, location and the product it serves. The list names ABBYY OCR SDK, Anthropic PBC, Cohere Inc., DocuSign or Adobe, Google AI/ML and Google Cloud, Jitterbit, Microsoft Azure Services, OpenAI LLC, QlikTech, Sendgrid, ZOHO, Zuva and four ContractPod group entities. Anthropic, OpenAI, Cohere and Google AI/ML are each listed against Leah Functionality as model providers, noted as storing or retaining no Customer Data, with named jurisdictions.
The DPA itself is the Bonterms DPA, published openly in the same PDF and ready to forward. It incorporates EU Standard Contractual Clauses Modules 2 and 3 and the UK International Data Transfer Addendum. It sets out processing details in Schedule 1 and fixes a 48 hour notice period for security incidents. Clause 4.3 commits to listing any new subprocessor and giving at least 30 days' notice before it processes anything.
Clause 4.4 gives an objection right, with termination and a refund if the objection is not resolved. Version 4.0 of January 2026 changes only the trading name, according to the vendor.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
ConvoAI's source linked answers let a user verify each answer inside the product. Agiloft's news releases and terms do not describe exporting a record of the model used, sources and human verification for a court, or certifying AI assisted work. The product produces no work product meant for court.
The audit stage of Leah's published governance loop logs every decision. Each entry records what the agent did, why, under which policy, with what data and with what outcome. The records are described as tamper resistant, immutable and ready for any audit. That gives the action, the rule, the inputs and the result for each action. The published description of the log does not include the model. The platform chooses among several language models for each task and identifies no model or version, so the log does not show which system produced a given passage.
No export built for court disclosure or AI use certification is described. The audit framing is regulatory and internal rather than judicial.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
- Bar Guidance Alignment
Which one fits
Choose Agiloft if
- You want the no training promise in the contract. Agiloft's Services Agreement bars training on customer data without explicit prior written consent. It also bars using that data to improve the service without the same consent.
- You want to check every AI answer against the contract. ConvoAI Document Q&A links each answer to the supporting passage and opens the highlighted text. Generative redlining works from your approved clause language.
- You want to train review models yourself. AI Trainer lets a team teach the review model what to look for using its own documents, without writing code. An integration hub built on Workato connects contract data to other systems.
Choose Leah if
- You want agents with configured limits and a full log. Leah's customer sets which agents may act, on which data and where they escalate. Every decision is logged with what was done, why and under which policy.
- You want the model providers named. Leah's subprocessor list names Anthropic, OpenAI, Cohere and Google for its AI functions. Each comes with its jurisdictions and a note that it keeps no customer data.
- Your contracting runs through ERP and identity systems. Leah names SAP, NetSuite, Coupa and Okta, and builds in DocuSign and Adobe Sign. Its legal, procurement and finance agents share one platform.
In summary
Agiloft
Agiloft is an enterprise contract lifecycle platform for legal and procurement teams, covering creation, negotiation, approval, signature and obligation tracking across industries from financial services to energy. Its AI tools include AI Trainer, which trains review models on a customer's own documents without code, and ConvoAI Document Q&A, which answers questions with links to the source text. According to the AI Legal Index, Agiloft's commitments sit in its published Services Agreement. Customer data trains no model without explicit written consent. Liability caps are stated, Microsoft Azure OpenAI is named as an AI subprocessor, and the agreement says Agiloft gives no legal advice. Agiloft links a pricing page from its site navigation.
Leah
Leah, formerly ContractPodAi, sells large enterprises an agentic platform for contracting, legal, procurement and finance. Its contract lifecycle product covers intake, playbook review in Microsoft Word, approvals, signing and an obligation repository. Its Agentic OS hands work to agents under the Leah Maestro orchestrator. The AI Legal Index records Leah's agent governance as published in full, with permissions, thresholds and escalation set by the customer and each action logged against its policy. Its master terms and subprocessor list are public, naming Anthropic, OpenAI, Cohere and Google. It publishes no price, accuracy measure or position on legal advice.
Questions buyers ask
Agiloft vs Leah: which CLM is better for legal and procurement teams?
With similar contract terms on both sides, the choice is about the AI. Agiloft writes its AI limits into its contract, links answers to source passages and lets teams train their own review models. Leah runs agents across legal, procurement and finance under a logged governance loop, with four model providers named. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
Do Agiloft and Leah train AI on customer contracts?
Agiloft does not without the customer's explicit prior written consent, a commitment in its Services Agreement that also covers improving the service. Leah says customer contract data is never used to train models, and holds OpenAI and Anthropic to zero retention. Leah's promise sits on its policy pages. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
Do Agiloft and Leah say their AI is not legal advice?
Agiloft does. Section 9.3(b) of its Services Agreement states that it is not an attorney or law firm and gives no advice on legal rights or strategies. Its terms also require independent checking of AI output. Leah publishes no such statement, though it is sold to run legal work end to end. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
What are Agiloft's and Leah's liability caps?
Both cap liability at a year of fees and raise the cap to three times that for breaches of their security terms, with indemnities outside the cap. Agiloft adds an indemnity for misuse of customer data after a breach. Agiloft disclaims liability for AI output, which it supplies as is, and Leah gives no indemnity for it. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
What do Agiloft and Leah both leave unpublished?
Neither publishes an accuracy or error rate for AI review, or a model version. Neither addresses attorney client privilege or names a hosting region in its published terms. Neither engages with bar guidance such as ABA Formal Opinion 512, though procurement teams use both alongside lawyers. From the AI Legal Index, based on each vendor's own published materials as of October 8, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
These two publish similar contract terms, so small wording differences matter. Agiloft's no training promise is contractual and needs written consent. Leah's is a published policy, and its terms do not mention training. Agiloft's Supplemental Terms supply AI output as is, with no liability for its use, and Leah gives no indemnity for AI output either. Agiloft also links a pricing page, customer stories and a trust portal from its site. Neither vendor reviewed this page.