AttiFin AI vs Genie AI: how they compare in 2026

AttiFin is an AI assistant with nothing underneath it. Research, drafting and summarisation are the three capabilities the product sells and each is model-driven; there is no document management system, workflow engine or matter database that would still function if the models were removed. Section 2 of the terms of service defines the Service as an AI-powered legal assistant optimised for UK law that helps you research, draft and summarise, which is the whole of what is offered. Section 15 treats the models as the company's own intellectual property alongside the software. This is an AI-native product rather than a legacy platform carrying an AI layer.

The models are the engine of the core capability, but they sit on a document product that would function without them. Drafting, playbook review, redlining, cross-document comparison and tabular extraction are all generative, and the Eidetic Intelligence architecture is what the vendor sells against general-purpose LLMs. Underneath that sits a conventional platform: a docx editor, PDF import, privacy-aware document sharing, department spaces and a library of more than 500 templates, all of which appear on the Free tier and all of which Genie shipped as an open-source template library in December 2018, before the assistant existed. Remove the models and a template repository with an editor remains, which is what holds this at B.

The AI Policy at Annex B of the privacy policy states that answers are designed to be grounded in verified UK and client sources and to be citable and auditable so a reviewer can trace a statement back to its source, and the home page repeats that every answer is fully cited and instantly verifiable. No accuracy figure is published anywhere, no test set is described, and no retrieval method is set out beyond a claim that the platform indexes UK legal sources. There is no sample output, documentation or reachable product surface on which a reader could confirm that citations resolve. Grounding is asserted as a commitment rather than demonstrated, which is what holds this at C; the AI Policy's own acknowledgement that AI systems can produce inaccurate, incomplete or unrepresentative output keeps it clear of a bare no-hallucination claim. Checked home page, AI Policy, terms of service and privacy policy on 4 September 2026.

Accuracy is measured and published, but not on the dimension this axis asks about. The benchmarking programme carries two dated head-to-head reports: 18 February 2026 against Claude Sonnet on a multi-jurisdiction regulatory scenario, and 22 April 2026 against Claude CoWork on a commercial supply agreement, scoring 15 and 10 dimensions respectively with per-metric rationale the vendor says a reader can reproduce or critique. Those are comparative scores on Genie's own rubric, graded by Genie, rather than a measured citation accuracy figure or a hallucination rate with the test set described. Three headline numbers used in marketing correspond to neither published report and were not located on the benchmarks index on 31 Aug 2026: 92 percent lawyer-rated accuracy, a 140 percent advantage over GPT and Claude, and 90 percent on a 65-document study against 79.3 percent for Claude CoWork and 37.3 percent for ChatGPT. The home page states that the architecture prevents hallucinations before they impact the final result, which is an unmeasured claim of exactly the kind this axis exists to test. One further discrepancy: the benchmarks page carries the meta description 'Independent head-to-head benchmarks' while the page body states that Genie's own engineering team publishes them.

Human review is a contractual requirement here rather than a marketing line. The terms of service open with a statement that AttiFin is a research and productivity tool and not a provider of legal advice, and that a qualified human professional must review and take responsibility for any work product before it is relied upon. The Acceptable Use Policy separately prohibits providing legal advice from output without human review and prohibits automated decisions that materially affect a person's rights without human supervision, and section 11 of the privacy policy states that no solely automated decision-making within the meaning of Article 22 UK GDPR takes place. The Book a Demo page claims a human review checkpoint before any consequential action is taken. What is missing is the control structure: no threshold at which the system stops is published, nothing describes what the product does when it cannot ground an answer, and there is no account of what happens after an output is wrong.

Autonomy is claimed prominently and the oversight mechanism is not described. Marketing sells agents that draft, review and negotiate contracts autonomously, invites the buyer to control when they need to and delegate when they do not, and describes agents handling complex multi-document cross-border deals. What is published about the review point sits in the agreement rather than the product: clause 3.4 disclaims any guarantee that the software comprehends what is put into it, clause 5.9 states that recommendations, suggestions or actions taken by the software are not legally binding, clause 6.10 prohibits use for automated decision-making with legal or similarly significant effects, and clause 21.7 instructs the user to have a human review each output as appropriate. Those are allocations of responsibility, not a described control structure, and no threshold, review surface or escalation path was located on the home page, the use-case pages or the model training page on 31 Aug 2026. The direction of the gap is worth noting: the marketing sells delegation while the agreement prohibits the automated decision-making that delegation implies.

One testimonial is published, attributed to a leading UK family law practice, claiming the team's research and first-draft time was cut significantly. No customer is named anywhere on the site, no figure is attached to the claim, and no date is given. There are no case studies, no customer stories page and no logo strip. The terms of service contemplate live paid subscriptions, free trials and signed Order Forms, so production use is provided for in the agreement, but nothing published evidences it. Checked home page, Book a Demo page, terms of service and privacy policy on 4 September 2026.

Named customers with named individuals and at least one figure, short of dates and method. The customer stories index carries attributed video case studies: Jude Legg, Compliance Lead at Firefish, on cutting contract review time by more than 50 percent; Jafeth Bulsink, Head of Sales at Bright Renewables, on 25 salespeople negotiating contracts with no legal department; Neil Rowe, Head of Commercial at Cambridge United, on player signings; and Nazmus Tareque of AnthroTek on closing a seed round without using a lawyer. A logo strip of 13 named organisations including hyperexponential, Blockworks and the Jamaica Stock Exchange sits alongside them, and the model training page states that Clifford Chance, Pinsent Masons and Withers ran pilots from 2018. No deployment date, scope or measurement method was located on the pages read on 31 Aug 2026, and the individual case study pages were not opened item by item, so the date and method limbs are rebuttable with a single link.

The privilege treatment is unusually direct for a vendor of this size. Section 8 of the terms recognises that customer content may attract both legal advice privilege and litigation privilege and the solicitor's duty of confidentiality under paragraph 6.3 of the SRA Code of Conduct, states that nothing in the terms is intended to waive privilege and that no use in accordance with them should be treated as waiving it, and commits to notifying the customer before any compelled disclosure of material identified as privileged so privilege can be asserted. Training is prohibited in the agreement itself rather than on a policy page, and sub-processors are contractually barred from it; retention is set by the customer and deletion runs within 30 days of termination across primary storage and derived search and caching copies. The position on model providers is stated: other than cloud storage providers, sub-processors will not retain or log customer content for human review. What is absent is segregation between matters. Separation is documented at the customer level through logical separation and role-based access control with content processed in the customer's own tenant, and no matter-level wall is described for a firm buyer. That single gap holds this at B.

The published commitment and the published agreement point in opposite directions on the question that decides this axis, and the agreement is what a customer is held to. The security centre states that customer documents, prompts and confidential data are never used to train shared or internal AI models, and the model training page is headlined on never training on your contracts. Clause 7.3 of the product terms grants Genie a non-exclusive, irrevocable, worldwide, perpetual licence to use, copy, display, distribute and reproduce a customer's Documents in order to improve the software and, in terms, its algorithms and models. Clause 6.8 adds that Genie may use Your Data and Documents to make Improvements and clause 7.5 vests ownership of those Improvements in Genie. The model training page narrows its own promise in its FAQ to contracts never being used to train models that other customers see, and states that the 200,000 businesses using Genie contribute new legal context to the corpus through normal use. Substance on the other side is why this is not lower: OpenAI and Anthropic are named and operate under zero data retention agreements, Genie is stated to be processor and the customer controller, a DPA and a subprocessor list are published, and clause 20.7 says directly that communications are not covered by legal professional privilege, which is more candid than most of this market. No tenant or matter-level segregation model is documented and no retention period is published.

The advice line is stated in the first paragraph a reader meets rather than buried in a footer: AttiFin is a research and productivity tool and not a provider of legal advice, output may be inaccurate, incomplete or out of date, and nothing in the Service relieves a regulated professional of their duties of competence, supervision and confidentiality. The jurisdiction limit is the product's entire positioning rather than a caveat, stated as optimised for UK law and trained on UK legislation and case law, with the terms governed by the laws of England and Wales, and the SRA Code of Conduct named to the paragraph. The Acceptable Use Policy adds a specific EU limb prohibiting a judicial authority from using the Service to research and interpret facts and apply the law to a concrete set of facts. There is no consumer-facing surface and the product is sold only to regulated professionals and their organisations, so the band's limb on disclosure to non-lawyer audiences does not bite; every limb that does apply is met in the agreement.

A published position on the advice line that is more specific than most of this market, held off an A by two limbs it does not reach. Clause 20 of the product terms states that Genie AI Limited is not a law firm, is not authorised or regulated by any body regulating legal services, and cannot provide reserved legal services including litigation, probate, notarisation and administering oaths, operating only in general commercial matters. It then works through the consequences for the buyer rather than leaving them implied: no requirement to hold professional indemnity insurance, no right to complain to a legal ombudsman, no access to a compensation fund such as the SRA's, and no legal professional privilege over what the user receives. Clause 6.7 excludes domestic, personal and non-commercial use, so there is no consumer-facing surface requiring disclosure. What is missing: nothing published addresses a lawyer's own competence and supervision duties, and the whole treatment is drawn from the England and Wales regulatory perimeter on a product sold across more than 150 jurisdictions including the United States, with no equivalent statement for any of them located on 31 Aug 2026.

An AI Policy is published as Annex B to the privacy policy and incorporated into the terms by reference, which is more than most vendors of this size publish. It commits to compliance with UK requirements and the EU Artificial Intelligence Act, cited by regulation number 2024/1689, to AI literacy among staff who develop and operate the models, to procedures for obtaining rights and licences in data sets, and to testing that monitors the accuracy, reliability and suitability of output alongside change-management processes. Each of those is a single sentence with nothing behind it: no owner inside the company is named for AI governance, no testing regime is described, and no results are published. The section headed Accuracy, bias and technical measures says nothing about bias — no testing, no findings, no populations or matter types considered — which is the clearest gap in an otherwise carefully drafted document.

A described quality mechanism exists where a governance position should be. The model training page sets out a five-layer account in which qualified lawyers contribute training data, set prompt engineering standards, supervise retrieval logic and rate every release against a panel benchmark before it ships, and the security centre publishes a specific EU AI Act position: that Genie is not a high-risk system under the Annex III categories, that the obligations applying to it came into force on 2 August 2026, and that it maintains AI literacy measures for staff operating the system. The substance of this axis is absent. No individual or role inside the vendor is named as accountable for model behaviour, no pre-release testing regime is published beyond accuracy benchmarking, and nothing at all was located on uneven or disparate output across matter types, counterparties or populations. Searched the home page, the model training page, the benchmarks index, the security centre and the product terms on 31 Aug 2026. The ISO 27001 certification covers information security, which is a different subject and does not carry weight here.

Retention is published as a table with distinct periods in section 10 of the privacy policy: uploaded documents, conversations and AI-generated drafts are set by the customer's own retention policy and deleted within 30 days of termination; demo and enquiry records at 24 months; billing records generally six years. Deletion is specific about scope, naming primary storage and derived copies held in search and caching layers, and stating that backup copies are overwritten on the standard backup cycle rather than deleted individually. Encryption in transit and at rest, logical separation between customers, role-based access control, centrally managed keys rotated on a regular cycle and security monitoring are all described, and breach practice is stated on both sides of the controller and processor line including notification to the Information Commissioner's Office within 72 hours where AttiFin is controller. The one element of the set that is missing is the subprocessor list, which section 6 expressly declines to publish and offers only by email request.

Substantive published policy across almost all of this ground, missing one specific that a buyer would need. The security centre publishes a register of 35 controls grouped as an auditor would walk them, including AES-256 at rest and TLS 1.2 or higher in transit, quarterly access reviews recorded in an Access Rights Review Log, a joiner-mover-leaver process, environment segregation, peer-reviewed code with deployment separated from development, tested encrypted backups, a business continuity plan carrying a one-hour recovery time objective for critical services, and documented security and privacy incident response with incidents tracked through an Incident and Corrective Action Log. Breach practice is stated rather than implied: notification to affected customers without undue delay and, where Genie is controller, a report to the UK Information Commissioner's Office within 72 hours. A current subprocessor list names 15 third parties with the purpose, processing location and security measures for each. The gap is retention: the register states only that formal procedures govern the retention and secure disposal of customer data, and no retention period for documents or prompts was located anywhere on 31 Aug 2026, so there is no window to hold the vendor to.

The allocation of loss is fully readable before signing. Section 13 gives a vendor-side indemnity against third-party intellectual property infringement claims with named carve-outs for customer content, customer breach and unapproved combinations. Section 14 sets a general cap at the total fees paid or payable in the 12 months before the event, and then a separate Data Breach Cap at twice that figure for claims arising from breach of the data protection or confidentiality obligations that causes a personal data breach of customer data. Section 12 warrants for paid use that the Service will perform materially in accordance with the documentation and be provided with reasonable skill and care, and places free trials on an as-is basis. No insurance position was located on the home page, terms of service, privacy policy or Book a Demo page on 4 September 2026. What keeps this off the top band is the subject of the recourse rather than any missing clause: the indemnity runs to intellectual property, and section 12 expressly declines to warrant that output will be accurate or complete, so the published answer to what the vendor stands behind when its output is wrong is a clear one and it is nothing.

An unusually complete published allocation of loss, short of anything covering the output itself. Clause 18.2 caps aggregate liability at the fees paid or payable in the 12 months before the first event giving rise to the claim, and clause 2.4 sets a separate cap of one thousand pounds for the Free Package. Clause 9 gives the customer a defence and indemnity against third-party claims that use of the software infringes intellectual property rights, with conditions in 9.2, a remedy ladder in 9.3 of procuring a licence, modifying the software or terminating, and six named carve-outs in 9.4 including Your Data and any use under a Free Package. What is absent is recourse when the output is wrong: clause 5.8 excludes liability for reliance on the software's outputs, recommendations or actions, clause 21.3 disclaims any warranty that content is accurate or complete, clause 21.4 excludes all liability for reliance, and clause 20.4 states that Genie is not required to hold professional indemnity insurance and makes no claim to hold any. This sits above a standard limitation clause because a buyer can read the whole allocation, including a real indemnity with a stated scope, before signing.

No practice system integration is named anywhere. The home page states that AttiFin works alongside existing systems and invites the reader to connect their documents and existing tools, but no document management system, word processor, email client, matter management platform, CLM or e-billing product is identified. The privacy policy names identity, single sign-on and file-import providers as categories of recipient and describes importing selected files from a connected account, which is generic connectivity rather than integration into the systems legal work already lives in. There is no integrations page, no developer documentation and no help centre. The site's entire published inventory is the home page, a Book a Demo page, the terms of service, the privacy policy with its two annexes, and a cookie policy, so this is a thin site rather than an unreachable one. Checked 4 September 2026.

Integration categories are named and no documentation an implementer could use was located. The home page lists MCP connectors, an API, and native integrations with email, CRM, cloud storage and eSign, and the Enterprise tier adds SSO authentication alongside API and MCP integration. A Word add-in has its own use-case page. Against that, every 'Learn more' link on the home page integration card resolves to an anchor rather than a destination, and no developer index, integration directory or help centre documentation was located from the site navigation or the footer on 31 Aug 2026. Nothing was found on the systems this axis asks about for legal work specifically: no document management integration such as iManage or NetDocuments, no matter management, no e-billing and no court filing. That is consistent with a product sold to commercial teams rather than to firms, but it leaves the depth unverifiable. The Word add-in page was not opened, so the depth limb is rebuttable with one link.

Residency is the most detailed disclosure on the site. The platform is hosted in the United Kingdom and all customer data — uploaded documents, queries run and content generated — is stored in the UK. Section 7 of the privacy policy then publishes a table of every optional feature that moves anything abroad, naming what is processed and where: live web search sends the search query only to the United States with personal data minimised and redacted where technically possible and uploaded documents never transferred; single sign-on, document import, transactional email delivery and EEA-hosted AI inference are each listed separately with their own scope. Safeguards are named specifically as UK adequacy regulations including the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment completed beforehand, and a customer requiring strict UK-only processing can disable the optional features and have the configuration confirmed in writing. Tenancy is stated separately: content is processed within the customer's own tenant with logical separation between customers. The band's limb on what changes between tiers has nothing to bite on, because AttiFin publishes a single deployment in a single region rather than a set of options; the limbs that do apply, the regions available and processing location as distinct from storage location, are both answered precisely, and the latter is the limb most records on this axis miss. One thing a reader should know: section 7 still carries an unremoved instruction addressed to the site owner to delete the box before publishing, together with the replacement wording intended for when the optional features move to UK-hosted providers, so the section describes a transitional state the vendor intends to change. Checked 4 September 2026.

Residency is published in more detail than most of this market and the tenancy model is not stated at all. The security centre states that the platform runs on Amazon Web Services with customer documents stored in UK and EU data centres, and the subprocessor table goes further by giving a processing location for each of 15 third parties, which lets a reader separate where data sits from where it is processed: AWS and MongoDB in UK and EU, CloudAMQP in the EU, and OpenAI and Anthropic in US and EU data centres. Two things hold this at B. Nothing published states whether the platform is multi-tenant or single-tenant, and no private, single-tenant or on-premises option and no customer-selectable region was located on 31 Aug 2026. There is also a tension a buyer should read alongside the storage claim: the same subprocessor table lists Google Cloud and Stripe at global data centres, which is broader than the UK and EU statement on the security page.

No independent security attestation was located. There is no trust centre or trust portal, no SOC 2 or ISO certification is claimed, no auditor is named and no report is offered under any access tier. The site carries no security badges at all, so there is nothing unsupported on display either, which is why this sits at the floor rather than in the badges-without-scope band. Both section 10 of the terms and section 8 of the privacy policy state that further detail on security measures is available under a confidentiality agreement, which places the underlying material behind an executed agreement rather than a self-service request. The measures themselves are described in prose — encryption, logical separation, role-based access, key rotation, monitoring — but description by the vendor is not attestation by a third party. Checked home page, terms of service, privacy policy, Book a Demo page and site footer on 4 September 2026.

Certification is real, current and documented to an unusual level of detail, with the report itself the one thing held back. The security centre names the standard as ISO/IEC 27001:2022, gives certificate number 310012019, names the issuing body as Citation ISO Certification, and publishes the original approval date of 7 February 2019, a current certificate dated 7 February 2026, expiry on 6 February 2029, a last external audit on 29 April 2026 and a last management review in June 2026, with the page marked last reviewed 30 July 2026. The vendor also states plainly that it does not hold a SOC 2 report, which is more useful to a buyer than a silent omission. The certificate, the ISMS scope and the Statement of Applicability are available on request under NDA through a named security mailbox with a stated two working day response, which is a promise of follow-up rather than a self-serve download, so the attestation earns no access credit and the ISMS scope, the part a buyer most needs, is what is withheld. The control register refers to independent penetration testing following significant changes but names no testing partner and publishes no summary.

Where the models run is disclosed and who supplies them is not. Section 6 of the privacy policy names AI model providers as a category of recipient that processes document extracts and queries to generate answers, summaries and drafts, and section 7 states that inference happens in the UK except where a customer configures an EEA-hosted model, with the live web search feature sending queries to the United States. Change notification is committed on both surfaces: the terms and the privacy policy each promise advance notice of any intended addition or replacement of a sub-processor together with an opportunity to object. No model is named and no provider is identified, and section 15 of the terms goes further, classing the identity of AttiFin's suppliers as its own confidential information provided for the customer's evaluation and oversight only, which sits awkwardly against the home page's sovereign-by-design framing. Architecture described without the providers named is the middle band in its own words.

The providers are named and the change commitment runs the wrong way. OpenAI and Anthropic are both listed on the published subprocessor table with their purpose, processing locations in US and EU data centres and stated security measures, and the security centre adds that both operate under Zero Data Retention agreements so that inputs and outputs are not retained by the provider after processing. The architecture is described rather than gestured at: the model training page states that Genie passes legal context at inference time instead of fine-tuning, specifically so newer foundation models can be swapped in as they land. Two gaps, checked 31 Aug 2026. No specific model or version is identified for either provider, so a buyer knows whose models but not which. And on notification the subprocessor page states the opposite of a commitment, saying changes will be posted on the page and asking the reader to check back regularly, which puts the burden of noticing a supply chain change on the customer.

No pricing information is published at any level. There is no pricing page, no tier names, no feature split and no unit of charge; the only route to a number is the Book a Demo form. Section 7 of the terms establishes that fees are set in an Order Form, are payable in pounds sterling and are exclusive of VAT, and section 6 records that free trials may be offered with limited features, capacity or duration, but currency and tax treatment are payment mechanics rather than a published price or a published structure. No VendorPricing row is written, because nothing lifted this axis off the floor. Checked home page, Book a Demo page, terms of service, privacy policy and site footer on 4 September 2026; no pricing surface exists on the site.

Real pricing across the whole range including a floor for the enterprise tier, which is more than most of this index publishes, held off an A by implementation. The pricing block on the home page carries a figure, a unit and a term for all three tiers: Free at $0 for one user with limited tokens and no document exports, Pro from $75 per month for one user with enough usage for roughly five documents, and Enterprise from $600 per month for unlimited users and unlimited tokens. Each tier's contents are itemised rather than summarised, and signup is self-serve with no credit card required. Two things hold it at B. Every figure carries a 'From', so each is a floor rather than a rate. And nothing published states what onboarding, the dedicated customer success manager or the bespoke AI training programme bundled into Enterprise actually add. A buyer should also note a currency mismatch: prices display in US dollars while clause 13.3 of the product terms states that payment will be made in pounds sterling unless stated otherwise.

The buyer is described only in the broadest terms. The home page addresses UK lawyers and UK legal teams, promises everything your firm needs in one specialist platform, and says drafting is trained for your practice area without naming a single practice area the product supports. The only practice area appearing anywhere on the site is in the unattributed testimonial, which cites a family law practice. There are no segment pages distinguishing firm size, in-house teams, government or legal aid work, and no statement of where the product stops. Coverage is claimed broadly with no published evidence that the breadth is real. The jurisdiction boundary the vendor does state clearly, that this is built for UK law only, is credited on the professional responsibility axis and is not counted twice here.

Coverage is documented precisely on the dimensions the vendor sells, and the limits are stated in the agreement rather than left open, which is rare on this axis. Dedicated pages exist for six user groups including in-house lawyers, procurement, sales, finance and founders, for three company types across startup, mid-market and enterprise, and for six industries including energy, construction, technology, real estate, mining and sport. The Enterprise tier states coverage of more than 150 jurisdictions and ten languages. The boundary statement is unusually explicit: clause 20.2 of the product terms names what Genie cannot do, being reserved legal services including litigation, probate, notarisation and administering oaths, and confines the product to general commercial matters, while clause 6.7 excludes domestic, personal and non-commercial use. What is absent is the firm dimension this axis also asks about. No law firm segmentation was located, nothing addresses government or court use, and the practice dimension is expressed as industry verticals rather than areas of law, so a reader learns which sectors are served but not which law is covered.