AttiFin AI vs Genie AI: how they compare in 2026
AttiFin AI and Genie AI are both UK legal AI assistants for different users. AttiFin serves law firms and in house lawyers working in UK law, while Genie serves business teams negotiating contracts under playbooks set by in house legal. Genie's lead is what a buyer can check. It publishes prices from free to $600 a month, an ISO 27001 certificate with its number and certifier, named customers, and OpenAI and Anthropic as its model providers. AttiFin's lead is its terms on client material. They prohibit training on customer content, address legal professional privilege and the SRA confidentiality duty by name, and commit to notice before any compelled disclosure of privileged material. Genie's terms run the other way, granting it a perpetual license to use customer documents to improve its models, although its security pages say documents never train them.
Which one fits
Choose AttiFin AI if
- You need privilege and confidentiality addressed in the contract. AttiFin's terms recognize legal advice privilege and litigation privilege and the solicitor's duty under paragraph 6.3 of the SRA Code of Conduct, and commit to notify the customer before disclosing material identified as privileged.
- You want training barred in writing. AttiFin's terms prohibit training AI models on customer content and bind its sub processors to the same restriction, and documents, conversations and drafts are kept under the customer's own retention policy and deleted within 30 days of termination.
- Your client data must stay in the UK. AttiFin hosts and stores customer data in the United Kingdom, lists each optional feature that sends limited data abroad with what goes where, and confirms a UK only configuration in writing on request.
Choose Genie AI if
- Your sales, procurement and commercial teams handle contracts themselves. Genie lets in house legal set playbooks and guardrails that business colleagues then work within, drafting from templates, reviewing third party paper against the playbook and redlining in tracked changes that export to Word.
- You want to see the price before a demo. Genie publishes a free plan, Pro from $75 a month for one user and Enterprise from $600 a month for unlimited users, with self serve signup and no card required.
- Your security review asks for a verifiable certificate. Genie publishes ISO/IEC 27001:2022 certificate number 310012019 from Citation ISO Certification with its audit and expiry dates, and states plainly that it holds no SOC 2 report.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Research, drafting and summarization are the three capabilities AttiFin sells, and each is model driven; there is no document management system, workflow engine or matter database that would still function without the models. Section 2 of the terms of service defines the Service as an AI powered legal assistant optimized for UK law that helps you research, draft and summarize, which is the whole of what is offered. Section 15 treats the models as the company's own intellectual property alongside the software.
The models drive the core capability, but they sit on a document product that would function without them. Drafting, playbook review, redlining, comparison across documents and tabular extraction are all generative, and the Eidetic Intelligence architecture is what the vendor sells against general purpose LLMs. Underneath sits a conventional platform: a docx editor, PDF import, document sharing with privacy controls, department spaces and a library of more than 500 templates. All of these appear on the Free plan, and Genie shipped the templates as an open source library in December 2018, before the assistant existed. Remove the models and a template repository with an editor remains.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
The AI Policy at Annex B of the privacy policy states that answers are designed to be grounded in verified UK and client sources, and to be citable and auditable so a reviewer can trace a statement back to its source. The home page repeats that every answer is fully cited and instantly verifiable. No accuracy figure is published, no test set is described, and no retrieval method is set out beyond a claim that the platform indexes UK legal sources. There is no sample output, documentation or product page showing citations. The AI Policy acknowledges that AI systems can produce inaccurate, incomplete or unrepresentative output, so AttiFin does not claim freedom from hallucination.
Accuracy is measured and published, but as comparative scores rather than citation accuracy. The benchmarking program carries two dated head to head reports: 18 February 2026 against Claude Sonnet on a regulatory scenario across several jurisdictions, and 22 April 2026 against Claude CoWork on a commercial supply agreement. They score 15 and 10 dimensions respectively, with rationale per metric that the vendor says a reader can reproduce or critique. Those are comparative scores on Genie's own rubric, scored by Genie, rather than a measured citation accuracy figure or a hallucination rate with the test set described. Three headline marketing numbers match neither report and are not published on the benchmarks index. They are 92 percent accuracy rated by lawyers, a 140 percent advantage over GPT and Claude, and 90 percent on a 65 document study against 79.3 percent for Claude CoWork and 37.3 percent for ChatGPT. Genie's home page states that the architecture prevents hallucinations before they affect the final result, an unmeasured claim. The benchmarks page also carries the meta description 'Independent head-to-head benchmarks' while its body says Genie's own engineering team publishes them.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The terms of service open by stating that AttiFin is a research and productivity tool and not a provider of legal advice, and that a qualified human professional must review and take responsibility for any work product before it is relied upon. The Acceptable Use Policy separately prohibits giving legal advice from output without human review and prohibits automated decisions that materially affect a person's rights without human supervision. Section 11 of the privacy policy states that no solely automated decision making within the meaning of Article 22 UK GDPR takes place. The Book a Demo page claims a human review checkpoint before any consequential action is taken. No threshold at which the system stops is published, nothing describes what the product does when it cannot ground an answer, and nothing says what happens after an output is wrong.
Marketing sells agents that draft, review and negotiate contracts autonomously, invites the buyer to control when they need to and delegate when they do not, and describes agents handling complex deals across several documents and borders. What is published about the review point sits in the agreement rather than the product: clause 3.4 disclaims any guarantee that the software comprehends what is put into it, clause 5.9 states that recommendations, suggestions or actions taken by the software are not legally binding, clause 6.10 prohibits use for automated decision making with legal or similarly significant effects, and clause 21.7 instructs the user to have a human review each output as appropriate. No threshold, review surface or escalation path is published on the home page, the use case pages or the model training page. The marketing sells delegation while the agreement prohibits the automated decision making that delegation implies.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
AttiFin publishes one testimonial, attributed to a leading UK family law practice, claiming the team's research and first draft time was cut significantly. No customer is named on the site, no figure is attached to the claim, and no date is given. There are no case studies, no customer stories page and no logo strip. The terms of service provide for live paid subscriptions, free trials and signed Order Forms, but nothing published shows production use.
Named customers with named individuals and at least one figure are published, without dates or method. The customer stories index carries attributed video case studies. Jude Legg, Compliance Lead at Firefish, speaks to cutting contract review time by more than 50 percent; Jafeth Bulsink, Head of Sales at Bright Renewables, to 25 salespeople negotiating contracts with no legal department; Neil Rowe, Head of Commercial at Cambridge United, to player signings; and Nazmus Tareque of AnthroTek to closing a seed round without a lawyer. A logo strip of 13 named organizations, including hyperexponential, Blockworks and the Jamaica Stock Exchange, sits alongside them, and the model training page states that Clifford Chance, Pinsent Masons and Withers ran pilots from 2018. No deployment date, scope or measurement method is published.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Section 8 of the terms recognizes that customer content may attract legal advice privilege, litigation privilege and the solicitor's duty of confidentiality under paragraph 6.3 of the SRA Code of Conduct. It states that nothing in the terms is intended to waive privilege and that no use in accordance with them should be treated as waiving it. It commits to notifying the customer before any compelled disclosure of material identified as privileged, so privilege can be asserted. Training is prohibited in the agreement itself, and subprocessors are contractually barred from it. Retention is set by the customer, and deletion runs within 30 days of termination across primary storage and derived search and caching copies. Other than cloud storage providers, subprocessors will not retain or log customer content for human review. Separation is documented at the customer level through logical separation and role based access control, with content processed in the customer's own tenant, and no wall between matters is described for a firm buyer.
The published commitment and the published agreement point in opposite directions on training, and the agreement is what a customer is held to. The security center states that customer documents, prompts and confidential data are never used to train shared or internal AI models, and the model training page is headlined on never training on your contracts. Clause 7.3 of the product terms grants Genie a nonexclusive, irrevocable, worldwide, perpetual license to use, copy, display, distribute and reproduce a customer's Documents to improve the software and, in terms, its algorithms and models. Clause 6.8 lets Genie use Your Data and Documents to make Improvements, and clause 7.5 vests ownership of those Improvements in Genie. The model training page's FAQ narrows its promise to contracts never training models that other customers see. On the other side, OpenAI and Anthropic are named and operate under zero data retention agreements, a DPA and a subprocessor list are published, and clause 20.7 says communications are not covered by legal professional privilege. No tenant or matter level segregation model and no retention period is published.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
The first paragraph of AttiFin's terms says it is a research and productivity tool and not a provider of legal advice, and that output may be inaccurate, incomplete or out of date. Nothing in the Service relieves a regulated professional of duties of competence, supervision and confidentiality. The product is positioned for UK law only: optimized for UK law and trained on UK legislation and case law. The terms are governed by the laws of England and Wales, and the SRA Code of Conduct is named to the paragraph. The Acceptable Use Policy adds an EU provision prohibiting a judicial authority from using the Service to research and interpret facts and apply the law to a concrete set of facts. There is no surface for consumers, and the product is sold only to regulated professionals and their organizations.
A specific published position on the advice line exists, without supervision duties or other jurisdictions. Clause 20 of the product terms states that Genie AI Limited is not a law firm and is not authorized or regulated by any body regulating legal services. It cannot provide reserved legal services, including litigation, probate, notarization and administering oaths, and operates only in general commercial matters. It then sets out the consequences for the buyer: no requirement to hold professional indemnity insurance, no right to complain to a legal ombudsman, no access to a compensation fund such as the SRA's, and no legal professional privilege over what the user receives. Clause 6.7 excludes domestic, personal and noncommercial use, so there is no consumer product requiring disclosure. Nothing published addresses a lawyer's own competence and supervision duties. The whole treatment is drawn from the England and Wales regulatory perimeter, on a product sold across more than 150 jurisdictions including the United States. No equivalent statement for any of them is published.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
An AI Policy is published as Annex B to the privacy policy and incorporated into the terms by reference. It commits to compliance with UK requirements and the EU Artificial Intelligence Act, cited by regulation number 2024/1689, to AI literacy among staff who develop and operate the models, and to procedures for obtaining rights and licenses in data sets. It also commits to testing that monitors the accuracy, reliability and suitability of output alongside change management processes. No owner inside the company is named for AI governance, no testing regime is described, and no results are published. The section headed Accuracy, bias and technical measures says nothing about bias, with no testing, findings, populations or matter types considered.
A described quality mechanism exists where a governance position should be. The model training page sets out a five layer account in which qualified lawyers contribute training data, set prompt engineering standards, supervise retrieval logic and rate every release against a panel benchmark before it ships. The security center publishes a specific EU AI Act position: Genie is not a high risk system under the Annex III categories, the obligations applying to it came into force on 2 August 2026, and it maintains AI literacy measures for staff operating the system. No individual or role inside the vendor is named as accountable for model behavior, no prerelease testing regime is published beyond accuracy benchmarking, and nothing is published on uneven output across matter types, counterparties or populations. The ISO 27001 certification covers information security, a different subject.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Retention is published as a table with distinct periods in section 10 of the privacy policy. Uploaded documents, conversations and AI generated drafts follow the customer's own retention policy and are deleted within 30 days of termination; demo and inquiry records are kept 24 months and billing records generally six years. Deletion is specific about scope, naming primary storage and derived copies held in search and caching layers, and stating that backup copies are overwritten on the standard backup cycle rather than deleted individually. Encryption in transit and at rest, logical separation between customers, role based access control, centrally managed keys rotated on a regular cycle and security monitoring are all described. Breach practice is stated on both sides of the controller and processor line, including notification to the Information Commissioner's Office within 72 hours where AttiFin is controller. Section 6 declines to publish the subprocessor list and offers it only by email request.
Substantive published policy covers almost all of this ground, missing a retention period. The security center publishes a register of 35 controls grouped as an auditor would walk them. They include AES-256 at rest and TLS 1.2 or higher in transit, quarterly access reviews recorded in an Access Rights Review Log, a joiner, mover and leaver process, environment segregation, peer reviewed code with deployment separated from development, and tested encrypted backups. A business continuity plan carries a recovery time objective of one hour for critical services, and incident response is documented, with incidents tracked through an Incident and Corrective Action Log. Breach practice is stated: notification to affected customers without undue delay and, where Genie is controller, a report to the UK Information Commissioner's Office within 72 hours. A current subprocessor list names 15 third parties with the purpose, processing location and security measures for each. The register states only that formal procedures govern the retention and secure disposal of customer data, and no retention period for documents or prompts is published.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Section 13 of AttiFin's terms gives a vendor indemnity against third party intellectual property infringement claims, with named exclusions for customer content, customer breach and unapproved combinations. Section 14 sets a general cap at the total fees paid or payable in the 12 months before the event. A separate Data Breach Cap at twice that figure applies to claims from breach of the data protection or confidentiality obligations that causes a personal data breach of customer data. Section 12 warrants for paid use that the Service will perform materially in accordance with the documentation and be provided with reasonable skill and care, and places free trials on an as is basis. No insurance position is published on the home page, terms of service, privacy policy or Book a Demo page. The indemnity covers intellectual property only, and section 12 expressly declines to warrant that output will be accurate or complete.
A full allocation of loss is published, with nothing covering the output itself. Clause 18.2 caps aggregate liability at the fees paid or payable in the 12 months before the first event giving rise to the claim, and clause 2.4 sets a separate cap of one thousand pounds for the Free Package. Clause 9 gives the customer a defense and indemnity against third party claims that use of the software infringes intellectual property rights. Conditions sit in 9.2, a remedy sequence in 9.3 of procuring a license, modifying the software or terminating, and six named exceptions in 9.4, including Your Data and any use under a Free Package. There is no recourse when the output is wrong. Clause 5.8 excludes liability for reliance on the software's outputs, recommendations or actions, clause 21.3 disclaims any warranty that content is accurate or complete, and clause 21.4 excludes all liability for reliance. Clause 20.4 states that Genie is not required to hold professional indemnity insurance, and it makes no claim to hold any.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
No practice system integration is named on AttiFin's site. AttiFin's home page states that it works alongside existing systems and invites users to connect their documents and existing tools. No document management system, word processor, email client, matter management platform, CLM or ebilling product is identified. The privacy policy names identity, single sign on and file import providers as categories of recipient and describes importing selected files from a connected account. There is no integrations page, no developer documentation and no help center; the site consists of the home page, a Book a Demo page, the terms of service, the privacy policy with its two annexes, and a cookie policy.
Integration categories are named, and no documentation an implementer could use is published. Genie's home page lists MCP connectors, an API, and native integrations with email, CRM, cloud storage and electronic signature, and the Enterprise plan adds SSO alongside API and MCP integration. A Word add in has its own page. Every 'Learn more' link on the home page integration card resolves to an anchor rather than a destination, and no developer index, integration directory or help center documentation is published from the site navigation or the footer. No document management integration such as iManage or NetDocuments, matter management, electronic billing or court filing connection is named. That fits a product sold to commercial teams rather than firms, but leaves the depth unverifiable.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The platform is hosted in the United Kingdom, and all customer data, including uploaded documents, queries and generated content, is stored there. Section 7 of the privacy policy publishes a table of every optional feature that moves anything abroad, naming what is processed and where. Live web search sends only the search query to the United States, with personal data minimized and redacted where possible and uploaded documents never transferred. Single sign on, document import, transactional email and AI inference hosted in the EEA are each listed with their own scope. Named safeguards are UK adequacy regulations including the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, after a transfer risk assessment. A customer requiring processing in the UK only can disable the optional features and have that confirmed in writing. Content is processed within the customer's own tenant, with logical separation between customers. Section 7 still carries an instruction to the site owner to delete the box before publishing, with wording intended for when the optional features move to UK hosted providers.
Residency is published in detail, and the tenancy model is not stated. The security center states that the platform runs on Amazon Web Services with customer documents stored in UK and EU data centers. The subprocessor table gives a processing location for each of the 15 third parties, which separates where data sits from where it is processed: AWS and MongoDB in the UK and EU, CloudAMQP in the EU, and OpenAI and Anthropic in US and EU data centers. Nothing published states whether the platform is multi tenant or single tenant, and no private or on premises option and no region choice for the customer is published. The same subprocessor table lists Google Cloud and Stripe at global data centers, which is broader than the UK and EU statement on the security page.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
No independent security attestation is published. There is no trust center or trust portal, no SOC 2 or ISO certification is claimed, no auditor is named and no report is offered under any access tier, and the site carries no security badges. Both section 10 of the terms and section 8 of the privacy policy state that further detail on security measures is available under a confidentiality agreement, so the underlying material sits behind an executed agreement rather than a self service request. The measures themselves, encryption, logical separation, role based access, key rotation and monitoring, are AttiFin's own description rather than a third party's attestation.
Certification is real, current and documented in detail, with the report itself held back. The security center names the standard as ISO/IEC 27001:2022, gives certificate number 310012019 and names the issuing body as Citation ISO Certification. It publishes the original approval date of 7 February 2019, a current certificate dated 7 February 2026, expiry on 6 February 2029, a last external audit on 29 April 2026 and a last management review in June 2026, with the page marked last reviewed 30 July 2026. The vendor states plainly that it does not hold a SOC 2 report. The certificate, the ISMS scope and the Statement of Applicability are available on request under NDA through a named security mailbox with a stated response within two working days. They are not offered as a download, so the ISMS scope is withheld. The control register refers to independent penetration testing after significant changes but names no testing partner and publishes no summary.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Section 6 of the privacy policy names AI model providers as a category of recipient that processes document extracts and queries to generate answers, summaries and drafts. Section 7 states that inference happens in the UK except where a customer configures a model hosted in the EEA, with live web search sending queries to the United States. Change notification is committed in both documents: the terms and the privacy policy each promise advance notice of any intended addition or replacement of a subprocessor, with an opportunity to object. No model is named and no provider is identified. Section 15 of the terms classes the identity of AttiFin's suppliers as its own confidential information, provided for the customer's evaluation and oversight only, while the home page describes the product as sovereign by design.
The providers are named, and the change commitment runs the wrong way. OpenAI and Anthropic are both listed on the published subprocessor table with their purpose, processing locations in US and EU data centers and stated security measures. The security center adds that both operate under Zero Data Retention agreements, so inputs and outputs are not retained by the provider after processing. The model training page states that Genie passes legal context at inference time instead of fine tuning, specifically so newer foundation models can be swapped in as they land. No specific model or version is identified for either provider. On notification, the subprocessor page says changes will be posted there and asks readers to check back regularly, which leaves noticing a supply chain change to the customer.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
No pricing information is published at any level. There is no pricing page, no tier names, no feature split and no unit of charge; the only route to a number is the Book a Demo form. Section 7 of the terms says fees are set in an Order Form, payable in pounds sterling and exclusive of VAT. Section 6 says free trials may be offered with limited features, capacity or duration.
Real pricing is published across the whole range, including a starting price for the enterprise plan. The pricing block on the home page carries a figure, a unit and a term for all three plans. Free is $0 for one user with limited tokens and no document exports, Pro is from $75 per month for one user with enough usage for roughly five documents, and Enterprise is from $600 per month for unlimited users and unlimited tokens. Each plan's contents are itemized, and signup needs no sales call and no credit card. Every figure carries a 'From', so each is a starting price rather than a rate. Nothing published states what onboarding, the dedicated customer success manager or the bespoke AI training program bundled into Enterprise add. Prices display in US dollars while clause 13.3 of the product terms states that payment will be made in pounds sterling unless stated otherwise.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
AttiFin's home page addresses UK lawyers and UK legal teams, promises everything your firm needs in one specialist platform, and says drafting is trained for your practice area without naming a single practice area. The only practice area on the site is in the unattributed testimonial, which cites a family law practice. There are no segment pages distinguishing firm size, in house teams, government or legal aid work, and no statement of where the product stops. The one boundary stated is jurisdictional: the product is built for UK law only.
Coverage is documented precisely on the dimensions the vendor sells, and the limits are stated in the agreement. Dedicated pages exist for six user groups including in house lawyers, procurement, sales, finance and founders, for startup, mid market and enterprise companies, and for six industries: energy, construction, technology, real estate, mining and sport. The Enterprise plan states coverage of more than 150 jurisdictions and ten languages. Clause 20.2 of the product terms names what Genie cannot do, reserved legal services including litigation, probate, notarization and administering oaths, and confines the product to general commercial matters. Clause 6.7 excludes domestic, personal and noncommercial use. No law firm segmentation is published, nothing addresses government or court use, and the practice dimension is expressed as industry verticals rather than areas of law, so the sectors served are known but not which law is covered.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Section 4 of the terms of service prohibits training on customer content and states that subprocessors are contractually prohibited from doing so. It adds that, other than cloud storage providers, subprocessors will not retain or log customer content for human review. Section 3 of the AI Policy repeats the commitment. The privacy policy separately permits aggregation or anonymization of personal data to study and improve the Service.
That policy governs data for which AttiFin is controller, such as account, website and communications data, and its section 3 states expressly that customer data and content are not used to train AI models. The aggregation provision therefore does not reach uploaded documents or prompts.
The published agreement permits what the marketing says never happens, with no requirement to deidentify. Clause 7.3.2 of the product terms grants Genie an irrevocable perpetual license to use a customer's Documents to develop and improve its algorithms and models, and clause 6.8 adds that Genie may use Your Data and Documents to make Improvements. The security center and a dedicated model training policy both state that customer documents, prompts and confidential data are never used to train shared or internal AI models.
Where the marketing and the agreement disagree, the agreement governs. The model training page narrows the promise the same way, limiting it to contracts never training models that other customers see, and says the 200,000 businesses using Genie contribute new legal context through normal use. No opt out from the clause 7.3.2 license is offered.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
The retention table at section 10 of the privacy policy records that uploaded documents, conversations and AI generated drafts are retained as set by the customer under its own retention policy, and are deleted within 30 days of termination unless the customer asks otherwise or law requires retention. No zero retention setting is stated as available. Section 11 of the terms adds that deletion covers primary storage and derived copies held in search and caching layers, with backup copies overwritten on the standard backup cycle rather than deleted individually.
Retention is acknowledged in the security center control register without a stated period, and the same register states that on contract termination customer data can be returned or securely deleted in line with the customer agreement. Neither the security center nor the product terms publishes a retention window for documents, prompts or outputs, no customer configuration of a window is described, and no zero retention option is offered at the Genie layer. Zero data retention is stated for the third party model providers rather than for Genie's own storage.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Section 8 of the privacy policy describes logical separation between customers with role based access control so that one customer cannot access another's data, and section 8 of the terms states that content is processed within the customer's own tenant. The permission model is AttiFin's own rather than one inherited from a document management system at query time. Nothing published addresses walls or segregation between matters or between users inside a single customer organization.
Separation is asserted at the organization level in the home page security section. It is supported by features described as document sharing with privacy controls, business department spaces on the Pro plan, and a role model of Workspace Owner, Administrator and Authorized User in which the Workspace Owner sets access rights. How that separation is enforced is not published. The home page, the security center, the subprocessor page and the product terms show no description of tenancy separation, no access control model for retrieval, and no statement of whether one department space can be reached from another.
The buyer here is an in house or commercial team rather than a firm, so the question is separation between customers rather than walls between matters.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 8 of the terms commits that where a party is required by law or court order to disclose confidential information it will, where legally permitted, give advance notice and reasonable cooperation. The same section adds a further commitment, specific to privilege, to notify the customer before disclosing material the customer has identified as privileged, so that privilege can be asserted. No transparency report is published.
Clause 22.6 of the product terms permits disclosure of Confidential Information where required by law, a governmental or regulatory authority or a court, on condition that the disclosing party, to the extent legally permitted, gives the other party as much notice as possible and takes account of its reasonable requests about the content. The commitment sits in the mutual confidentiality clause rather than in a dedicated government or law enforcement request clause, so it reaches customer material through the definition of Confidential Information rather than by naming customer data directly. No transparency report is published.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
The home page describes searching UK legal sources across case law, statutes and precedents and states the product is trained in UK law, and section 3 of the AI Policy states that AttiFin takes steps to obtain the rights and licenses needed for the data sets used in the Service and has procedures to monitor and verify compliance with third party rights when sourcing data. No database, publisher or primary law source is identified, no license is named, and no update cadence is stated.
The privacy policy notes the use of publicly available information such as published judgments, legislation and public filings to develop and improve the platform.
The model training page identifies the source material by composition and origin: more than 300,000 contracts and 10 million clause revisions built since 2017, plus open source templates, legislation and case law spanning the US and UK legal systems and described elsewhere as 150 jurisdictions. It names pilots with Clifford Chance, Pinsent Masons and Withers from 2018 and continuing contributions from the 200,000 businesses now using the product.
No individual database or source is named for the legislation and case law, no license or public domain basis is stated for any component, and no update cadence or lag is published.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
The terms open by requiring that a qualified human professional review and take responsibility for any work product before it is relied upon. Section 4 of the AI Policy states that answers are designed to be citable and auditable so that a reviewer can trace a statement back to its source. Nothing describes a check for subsequent history or for whether an authority remains good law. The product retrieves UK primary law, so the question applies, and the published answer is an instruction to the user to verify rather than any treatment signal computed or licensed by the vendor.
Nothing on the home page, the use case pages, the model training page, the benchmarks index or in the product terms addresses whether authority is checked for subsequent history, and no citator, treatment signal or good law indicator is described. The product drafts and reviews contracts rather than retrieving primary law for research, so a citator is not part of what it sells, although its corpus is stated to include legislation and case law and one published benchmark scores a legal authority citations dimension.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
No public material describes what the product does when it cannot ground an answer. Section 4 of the AI Policy acknowledges that AI systems can produce inaccurate, incomplete or unrepresentative output and requires human review before reliance, but describes no way to decline, no behavior when there is no answer, and no confidence or grounding score shown to the user.
No explicit path for declining to answer or abstaining is documented, and no confidence or grounding score is described. The nearest published material points elsewhere: the home page describes a system gated on quality that validates outputs at every stage and prevents hallucinations before they impact the final result, which is a claim about prevention rather than abstention, and the model training page says qualified lawyers review where the model should defer, which describes a design review rather than published product behavior. Clause 3.4 of the product terms disclaims any guarantee that the software comprehends what is put into it.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin records no court order, opinion or disciplinary record naming AttiFin or the company AttiFin AI Ltd. This is a statement about the public record rather than a finding about the product.
The AI Hallucination Cases database maintained by Damien Charlotin, which tracks decisions worldwide where a court addressed hallucinated AI content and records the tool implicated where known, records no court order, opinion or disciplinary record naming Genie AI or the company Genie AI Limited, and 2026 sanctions summaries in the trade press name neither. The product drafts and reviews contracts rather than producing court filings, so its output does not commonly take the form of citations in a brief.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Section 8 of the terms names the solicitor's duty of confidentiality under paragraph 6.3 of the SRA Code of Conduct and addresses legal advice privilege and litigation privilege by name, and the Book a Demo page states that all AI outputs are designed to support compliance with the SRA Code of Conduct for Solicitors. The instrument engaged is a regulator's code of conduct rather than a bar ethics opinion, which is the corresponding authority in England and Wales, where this product is sold.
No guidance from any other jurisdiction is addressed and no mapping of product behavior to specific provisions is published beyond the confidentiality paragraph.
Clause 20 of the product terms engages with professional responsibility in specific terms but does not name ethics guidance. It states that Genie is not a law firm and not regulated for legal services, identifies reserved legal activities it cannot perform, and names the consequences for the buyer, including no legal ombudsman route and no access to a compensation fund such as the SRA's. The home page, the model training page, the security center, the benchmarks index and the legal pages show no engagement with any named ethics opinion.
That includes ABA Formal Opinion 512, US state bar guidance, and Law Society or SRA guidance on the use of AI. The material describes Genie's own regulatory status rather than the obligations its buyers are bound by.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
AttiFin's home page states that first drafts take minutes rather than hours and that UK lawyers spend more than half their time on research, drafting and document review, and the single testimonial claims that research and first draft time was cut significantly. Nothing published addresses what happens to a client bill when AI assisted work compresses billable time, and no record of AI assisted work for each matter is described.
Public materials are framed around time and cost saved. They include a customer quote on cutting contract review time by more than 50 percent, another on closing a funding round without a lawyer, and marketing copy on intelligence greater than a law firm at a fraction of the price. The home page, the pricing block, the use case pages and the legal pages show no record of AI assisted work per matter for fee purposes and no guidance on billing, fee or client disclosure treatment.
The product is sold to business teams rather than to firms billing a client, so the fee question arises differently, but nothing addresses it either way.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Section 6 of the privacy policy states that AttiFin does not publish the identity of individual suppliers and that customers and prospective customers can obtain the current subprocessor list, together with the Data Processing Agreement, by contacting legal@attifin.ai. Categories of recipient are published (cloud hosting and storage, AI model providers, search providers, identity and file import providers, communications and business operations providers), but no provider is named.
Section 15 of the terms classes the identity of AttiFin's suppliers as its confidential information, supplied for the customer's evaluation and oversight of the Service only.
A current subprocessor list is published without a gate, naming 15 third parties with the purpose of processing, the location and the security measures for each, and identifying OpenAI and Anthropic as the model providers that see content. A standard data processing agreement including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum is published alongside it, as is a model training policy.
What is not published is material for clients that a firm or department could forward to satisfy an AI clause: there is no consent or notification pack, and the ISO 27001 certificate, ISMS scope and Statement of Applicability are available only on request under NDA.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Section 4 of the AI Policy states that answers are designed to be grounded in verified UK and client sources and to be citable and auditable so that a reviewer can trace a statement back to its source, and AttiFin's home page states that every output is cited, auditable and ready for review. Sources retrieved are therefore addressed, but no export is described, the model used is not disclosed to the customer at all, and no record of human verification is mentioned. No disclosure guidance or template for a court is published.
Some elements of a record exist as a byproduct of how the product works. Genie's home page states that it edits, redlines and manages negotiations directly in tracked changes and that the result exports to Word, so what the AI changed in a document is attributable and portable, and a version comparison feature shows what changed between documents. Two elements are missing: the model used is not disclosed anywhere on the property, and no export designed to cover model, sources retrieved and human verification together is described. The product generates contracts rather than court filings, so a judicial standing order is not its usual context.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Refusal and Uncertainty Behavior
In summary
AttiFin AI
AttiFin AI, from AttiFin AI Ltd of Newcastle upon Tyne, is an AI legal assistant built for UK law and sold to law firms and in house legal teams. It handles research, drafting and summarization, answering questions across UK case law, statutes and precedents with citations. According to the AI Legal Index, AttiFin's terms prohibit training on customer content, address privilege and the SRA confidentiality duty directly, and require a qualified professional to review work before reliance. It hosts and stores customer data in the UK.
Genie AI
Genie AI, founded in London in 2017, is a contract drafting, review and negotiation platform for business teams. In house legal sets playbooks that commercial, procurement and sales colleagues work within, and agentic workflows run across multiple documents. According to the AI Legal Index, Genie names OpenAI and Anthropic as its model providers under zero data retention agreements, holds ISO 27001 with a published certificate number, and publishes prices from a free plan to $600 a month. Its terms state that it is not a law firm and that its communications carry no legal professional privilege. Its security pages say customer documents never train its models.
Questions buyers ask
AttiFin AI vs Genie AI: which is better for UK legal work?
They serve different users. AttiFin is built for law firms and in house lawyers working in UK law, while Genie serves business teams negotiating contracts under legal's playbooks. Genie publishes more that a buyer can check, including prices, a certificate and named customers. AttiFin's terms say more about client material. From the AI Legal Index, based on each vendor's own published materials as of September 26, 2026. No vendor pays for placement.
Does Genie AI train on customer documents?
Its terms allow it. Clause 7.3.2 of Genie's product terms grants it an irrevocable, perpetual license to use customer documents to develop and improve its algorithms and models, while its security center and model training page say customer documents are never used to train shared or internal models. Where the two differ, the terms govern. AttiFin's terms prohibit training on customer content. From the AI Legal Index, based on each vendor's own published materials as of September 26, 2026. No vendor pays for placement.
Do AttiFin AI and Genie AI protect legal professional privilege?
AttiFin's terms recognize legal advice and litigation privilege, state that use under the terms is not intended to waive it, and commit to notice before disclosing material identified as privileged. Genie's terms state that communications with Genie are not covered by legal professional privilege, because Genie is not a law firm and is not regulated for legal services. From the AI Legal Index, based on each vendor's own published materials as of September 26, 2026. No vendor pays for placement.
Where do AttiFin AI and Genie AI host data?
AttiFin hosts and stores customer data in the United Kingdom and publishes a table of optional features, such as live web search, that send limited data abroad. Genie stores customer documents on Amazon Web Services in UK and EU data centers, and its subprocessor list places OpenAI and Anthropic processing in US and EU data centers. From the AI Legal Index, based on each vendor's own published materials as of September 26, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Three points to weigh. Genie's terms grant it an irrevocable, perpetual license to use customer documents to develop and improve its algorithms and models. Where they differ from its security pages, the terms govern, and that is a published term. AttiFin's terms treat the identity of its suppliers as confidential, and its sub processor list is available only on request. Genie displays prices in US dollars while its terms state payment in pounds. Neither vendor reviewed this page.