BlackBoiler vs LexCheck: how they compare in 2026

The product is an automated contract editing engine. It converts an organization's prior redlines, approved language and written guidance into executable playbook rules, applies them to a new agreement, and returns tracked changes and comments in Microsoft Word. There is no repository, workflow or signature product underneath that would work without the models. The June 2026 Veris release adds a generative, conversational layer for building playbooks and questioning clauses on top of the patented rules based editing engine, and both parts make up the product. The company says eleven United States patents cover document revision, playbook driven markup and clause handling.

Remove the models and nothing remains to sell. The vendor states the systems are built on large language models, and the two capabilities that constitute the product both depend on them: automatic capture of a customer's preferred positions from an uploaded template into a working playbook, and evaluation of an incoming contract against those positions to surface deviations and propose redlines. There is no repository, workflow, approval or signature product underneath that would still function if the models were removed; the self-serve platform exists to review and edit the playbook the models generated. Two named products ship: LexCheck Insights, described as AI-powered contract review software that evaluates every contract and catches deviations in seconds, and LexCheck Copilot. The vendor describes its playbooks as LLM-powered and trained on the most common provisions and ready to use across virtually every contract type.

The vendor describes a four stage chain: evidence (the customer's prior redlines, approved language and guidance), logic (how those become executable rules), checking (a judge validator that assesses whether a proposed change fits the intended outcome, plus statistical similarity checks), and output (tracked edits and comments for lawyer review). The earlier ContextAI feature shows, for each redline, the playbook rule that prompted it and earlier examples of the same edit in the organization, a trail a reviewer can open for every proposed change. The vendor names failure modes: playbook coverage may be incomplete, contract language may depart from earlier examples, and unusual provisions may need a lawyer's fresh decision. The product cites no legal authority and has no citator; its output rests on the customer's own approved language, which is shown to the reviewer. No measured accuracy figure or test set is published.

Accuracy is asserted repeatedly and measured nowhere. The claims are comparative and unquantified: the vendor says its AI is highly accurate and lowers risk more than human review, and its blog says accuracy exceeds that of attorneys while cutting review time by more than ninety percent. No tested accuracy figure, test set, method or outside validation is published. No failure modes are named: nothing says what happens with language outside the playbook, unusual provisions or ambiguous positions. What does exist is an explanation for each flag. The vendor says insights explain why particular contract language may be a problem, so a reviewer sees a reason attached to each flagged passage. No retrieval or matching method is published, so a buyer cannot tell what those explanations are based on. The product cites no legal authority and has no citator, so checks on authority do not apply; grounding here means the customer's own playbook positions.

The system runs the first pass markup alone, producing tracked changes and comments. It is constrained by the customer's approved playbook positions, which the customer reviews and approves before use. The review surface is Microsoft Word track changes in the document the reviewer already has open. The reviewer decides what to accept, change, reject, escalate or negotiate, and the vendor says new risks, exceptions and negotiation decisions are left to the right reviewer. Nothing is applied to the agreement unless the reviewer accepts it, because the output is a proposal in tracked changes. Clause 3(b) of the Access Services Agreement says the same in contract terms: use of the Services is not a substitute for, and shall not replace, review and analysis by a lawyer. No marketing claims the system handles review on its own.

Oversight is asserted and one real control is described, but nothing covers oversight of the output. The customer reviews and finalizes the drafted playbook in a self serve platform before use, can add fallback positions and adjust language, and the vendor says this keeps the customer in control. That control governs the standard, not the result. Nothing published says whether a lawyer must review the proposed redlines, when the system acts alone, what happens when it is wrong, or how a flagged contract returns to human judgment. No human in the loop commitment appears anywhere, including the Terms of Service, which were read in full. Two of the vendor's statements pull against each other. The platform is said to keep the customer in control, while the technology page says the AI is highly accurate and lowers risk more than human review. The marketing also says the tools are easy enough for anyone to use without external support. The point at which output is relied on without legal review is not stated, and no written commitment that the models work alongside a supervising lawyer is published.

Four testimonials are published, each attributed only to a first name and surname initial or to a verified user, in the style of review site content, and none gives an organization or a figure. The customer base is described in categories (AmLaw 25 law firms, Fortune 1000 organizations and several construction customers), but no customer is named anywhere and no case study, deployment figure or before and after measure is published. A 2021 AI Breakthrough award, a National Science Foundation SBIR award and Virginia Innovation Partnership Corporation portfolio status are recognition and funding rather than production use. Clause 12(c) of the Access Services Agreement bars either party from any public statement mentioning the other without written approval, so naming customers would need a waiver from each.

Two case studies name the customer and quote someone: NetApp, on contract review, and RSM, whose quoted reviewer calls it the best technology implementation they have witnessed for value and ease of use. A customer strip names Autodesk, Bio-Rad, DigiCert and NetApp. The headline claims are aggregate: more than a seventy five percent increase in speed to close, contracts signed in as little as one day rather than weeks, and more than a fifty percent cut in legal costs per contract review. None is tied to a named customer, dated or supported by a stated method.

Under clause 7(b) the customer owns all contract data, training of third party foundation models is barred without customer authorization, and use of customer data is limited to configuring, improving, supporting and operating that customer's own use of the service. The vendor also says customer data is not used to train models shared with other customers. Data is isolated per customer, with dedicated instances available for enterprise deployments, access is limited to authorized staff with controls and logging, and data is encrypted in transit and at rest. Mutual confidentiality runs five years, with trade secret protection lasting indefinitely. Privilege and work product are not addressed anywhere. No model provider is named, which leaves open whose model touches contract text and what that provider keeps.

There are substantial commitments a buyer can read before signing, with real gaps. The customer exclusively owns all Client Data, wherever it is stored or processed, and any interest the vendor might hold is assigned to it. Client Data is expressly part of the customer's Confidential Information, and confidentiality lasts through the term and after with no end date. Disclosure is limited to staff who need to know. Data is stored and processed in the United States, with ninety days' notice of any change in processing location. The security page says customer data is used only to provide the service and that the vendor does not look into an account without permission. Encryption is AES-256 at rest and TLS 1.2 or higher in transit. The gaps: privilege and work product are not addressed anywhere. Training is not mentioned in any of the three published documents, so a buyer cannot tell whether contract text reaches a model, and with no model provider named, what a provider may keep is also unknown. Separation between users or matters is not addressed either, which matters because law firms are a named buyer segment.

Clause 3(b) of the Access Services Agreement, headed Review of Outputs and No Legal Advice, says use of the Services is not a substitute for, and shall not replace, review and analysis by a lawyer. Supervision and competence are addressed. The vendor sells to contract managers and procurement staff who are not lawyers, and says directly that a lawyer reviews the redline before anything moves forward and handles exceptions, new risks and negotiation decisions. The marketing never describes the product as giving advice; it consistently describes a first pass returned to a lawyer. BlackBoiler sets no jurisdiction limits for the service. The only geographic limit is a website terms clause limiting site use to United States residents, which covers the website, not the service.

Nothing published addresses the advice line, for a product that proposes contract language and is sold to people who are not lawyers. The Terms of Service were read in full and contain no statement that the service is not legal advice, no expectation of lawyer review, and nothing on competence or supervision. The privacy policy and the security and technology pages say nothing on the point either. The audience is clear: the vendor names legal, sales and procurement departments among its buyers and says its tools are easy for anyone to use, so a team can finish reviews without external support. That is marketing to nonlawyers describing the product as a substitute for outside legal help, with no statement of what the product is and is not. Clause 11.3 disclaims warranties, including accuracy of results, but that allocates risk for defective performance and says nothing about whether output is legal advice or who should review it.

No AI governance position is published. Nobody is named as accountable for AI governance, no testing before release is described, no evaluation results are disclosed, and nothing addresses uneven output across contract types, counterparties or drafting styles. There is no responsible AI page, principles statement, model card, AI policy, ISO 42001 certification or outside governance assessment. The vendor does describe validation tools: a judge validator that checks alignment with the intended outcome, and statistical similarity checks. Those check individual outputs; nothing describes how the vendor builds, tests and answers for its models.

No governance position is published for a system whose output is proposed contract language. Nobody inside the vendor is named as accountable for AI, no testing or evaluation before release is described, no results are disclosed, and nothing addresses uneven output across contract types, counterparties, drafting styles or jurisdictions. There is no responsible AI page, principles statement, model card, AI policy, ISO 42001 certification or outside assessment. The security policies on the security page govern IT assets, disaster recovery and access control under SOC 2; that is security governance, not AI governance. The accuracy statements on the technology page are marketing claims, not a testing regime. The gap stands out because the vendor claims its AI is more accurate than human review while publishing nothing that would let anyone test or govern that claim.

Customer data is kept for the length of the customer relationship unless agreed otherwise, and can be deleted at contract end or earlier on request. Access control is described in two documents. Access is limited to authorized staff who need it, with access controls and logging, and infrastructure access is secured by VPN, secure tokens and IP allowlists issued only to approved employees. Encryption is AES256 at rest and TLS in transit, backups are encrypted, and clause 7(b) confirms the customer owns its data and the vendor will not sell it. No subprocessor list is published, with only Amazon Web Services for hosting and Stripe for payments named, and no incident or breach notification practice appears anywhere. The vendor also discloses that individual client files may sometimes be downloaded temporarily onto an employee's encrypted hard drive for testing. No retention period is stated.

The Data Processing Addendum commits to written notice without undue delay and never later than twenty four hours after the vendor learns of a Security Incident, with the details the customer needs for its own notifications. The Terms add a broadly defined Security Event, a duty to notify and cooperate, and a right for the customer or a regulator to audit books, systems and logs after an incident. Deletion is specific: all copies of Customer Personal Data, including archives, are destroyed within ninety days of termination, returned within thirty days on request, with secure destruction of media and a Certificate of Deletion within thirty days on request. Access control, encryption at rest and in transit, regular penetration and vulnerability testing, backups with a stated twenty four hour recovery time and recovery point, and an annual audit right are all published. No subprocessor list is published; the DPA makes one available on reasonable request, with thirty days' notice and an objection right before any new third party is used. Retention of contract content is described only as prescribed intervals, with no interval named.

Clause 9(a) of the Access Services Agreement covers third party claims that the Services infringe or misappropriate United States intellectual property, with the vendor controlling the defense and able to modify, replace or terminate. Clause 9(a)(iii) carves out unauthorized combinations, customer changes, Customer Data and Third Party Products. Clause 10 caps total liability at amounts paid or payable in the twelve months before the claim, with exceptions for breach of confidentiality, IP infringement, customer payment obligations and breach of the use restrictions. The agreement is explicit that output errors are the customer's risk. The IP indemnity does not reach output quality, clause 8 disclaims all warranties, and clause 3(b) defines the risk of relying on any edit, redline, comment, summary, suggestion or analysis as Customer's Assumed Risks. Clause 9(b)(ii) requires the customer to indemnify the vendor against third party claims arising from those risks. No insurance is mentioned.

Indemnity, caps, carve outs and insurance are all published in specific terms. Clause 9.1 goes beyond an intellectual property indemnity: the vendor covers losses from any Security Event, from any breach of the confidentiality and data security article, and from third party claims that the platform infringes intellectual property. It controls the defense at its own cost, with a license, replacement or refund path at 9.4. Clause 10.1 caps liability at charges paid in the prior twelve months. Clause 9.3 excludes unauthorized combinations and designs the customer supplies, and clause 10.3 leaves liability uncapped for Security Events, confidentiality and data security failures, indemnities, fraud, willful misconduct, gross negligence and service level credits. Insurance has its own article: at least one million dollars of primary cover with A rated carriers, the customer named as an additional insured, and waiver of subrogation. Clause 11.1 warrants that the platform performs as the Documentation describes, with a duty to repair or replace. Availability of 99.9 percent carries a defined credit and a termination right after three consecutive failures. One limit matters. Clause 11.3 disclaims accuracy of results, so the warranty covers conformity with the Documentation, not whether any individual redline is correct, and nothing can be invoked for a wrong output as such.

The Microsoft Word add-in is the delivery surface. Review runs inside Word without moving to a separate tool, the playbook is chosen in the document, and output comes back as native tracked changes and comments for the reviewer to accept, change or reject. Single sign on and API access are listed as enterprise features, with nothing on what the API exposes or what a firm must configure. No document management, contract lifecycle or electronic signature platform is named as an integration partner. The vendor positions itself as sitting alongside a CLM where the CLM leaves a gap, and as handing back to the customer's existing process, but names no connection.

Integration with the contract stack is claimed, but no system is named. The vendor says the platform integrates with the customer's contract lifecycle management system and optimizes the negotiation phase, but names no CLM product anywhere. It publishes no integration page, partner list, connector documentation or API reference, and nothing describes what syncs, in which direction, or what an implementer would configure. Microsoft Word is the one named system, and the product does deliver into it, keeping work in the customer's usual word processor; the privacy policy also mentions plugins exchanging information with LexCheck. That names a surface without saying what moves between it and the platform, and the main workflow described elsewhere is web based: the user signs in and uploads a contract.

The vendor says it uses isolation measures specific to each customer to keep customer data separate, that enterprise deployments may include dedicated customer instances and data separation controls, and that data is held in a silo open only to the client and necessary vendor staff. The service runs on Amazon Web Services, with production, staging and development all in AWS. No region is named, no choice of region is offered, no European or other non United States option is described, and processing location is not distinguished from storage. The vendor says expressly that it does not publish detailed architecture or infrastructure information.

Residency is published in detail, and processing is addressed separately from storage. Clause 1.6 names the primary data centers in Northern Virginia and the secondary in Oregon, and says the platform and Client Data may only be hosted there or at other sites the customer approves. Clause 8.6 says the services are provided from the United States and Client Data is stored and processed there. Any change in processing location needs at least ninety days' notice, and the customer may terminate without penalty, with a pro rata refund, if data is stored in a foreign jurisdiction it has not approved in writing. The Data Processing Addendum commits the vendor to tell the customer in writing of every country where data is processed or stored and to obtain consent, and lists the United States as the only one. Hosting is on Amazon Web Services. Only one cloud deployment is offered, with no on premises, private cloud or region choice. One gap remains: the tenancy model is not stated, so a buyer cannot tell whether the deployment is shared or single tenant, or how customers are separated.

Two pages claim SOC 2 Type II certification. No auditor, audit period, report date or scope is published, and no other certification is claimed: no ISO 27001, HIPAA attestation or public penetration test summary. The report is available to prospective customers on request through the sales or security review process. Further security materials and completed questionnaires are kept for enterprise evaluations, while team and individual subscribers are pointed to the public page. That public Security and Trust page has a seventeen question FAQ covering hosting, encryption, isolation, access, retention, deletion, backups and authentication, and carries no reports, dates or covered standards.

A named certification is claimed without scope or date, and the report is reachable only through sales. The vendor says it has achieved and maintains SOC 2 Type II and that its security policies are regularly reviewed and validated under SOC 2. No auditor, audit period, report date or scope is published. To get the latest Type II report, readers are told to contact their Account Executive. A GDPR badge sits under the same Certifications heading but is not a certification: it describes best practices for strict compliance, with no attestation, auditor or scope. The security page itself is substantial and published by the vendor, covering hosting, encryption, data use, recovery objectives, ownership, policies, retention and penetration testing. There is no self serve route to evidence.

The vendor refers to generative AI throughout, and no model, provider or architecture is described beyond the four stage evidence, logic, checking and output framing. Clause 7(b) of the agreement allows Customer Data to be processed using third party infrastructure, technology and AI services, and separately bars training third party foundation models without customer authorization. So third party models are in the supply chain under the contract, and nothing identifies them. The Third Party Products definition gives only a generic example. Amazon Web Services is named, but as infrastructure, which says where a model runs, not whose it is. Stripe is a payment processor that never touches contract content and is routed outside the Word add-in and the conversational interface. No commitment to notify customers of a model change is published.

The vendor refers to the models in general terms and identifies nothing beneath them. It says its systems are built on large language models, that these suit large data sets, and that the playbooks are powered by LLMs and trained on the most common provisions. No model or provider is named, no architecture is described, and nothing says whether the models are the vendor's own or a third party's. The Terms of Service and the Data Processing Addendum were both read in full and neither names an AI subprocessor; the DPA's third party list is available only on request. Amazon Web Services is named as the host and as a subcontractor in the support exclusions, but that says where a model runs, not whose model it is. With no model named, there is no change notice to describe.

BlackBoiler charges $125 per user per month for Starter or $1,250 per user per year with annual billing. Starter includes two playbooks and 25 monthly contract uploads. Pro costs $300 per user per month or $3,000 per year and adds five playbooks per user, 100 monthly uploads, analytics, administration and multifactor authentication. Enterprise has custom pricing for unlimited contract volume, single sign on, API access, playbook help, onboarding and negotiated service terms. A seven day trial requires a payment card and converts to the chosen subscription unless canceled. Setup charges for the larger deployment remain part of the enterprise quote.

No pricing is published at any level, not even the unit of charge. There is no pricing page, rate, band, tier, feature split, minimum term, seat minimum or free tier. Every purchase path leads to a demo or contact request. The agreement confirms this: fees are set in an Order Form, and clause 2.3 leaves the unit of measure to each order, whether named users, concurrent users, devices, locations or transactions. That describes what an order may contain, not what this vendor charges for. Two terms govern how prices change rather than what they are. Clause 5.3 caps any renewal increase at the lesser of two percent of the prior year's charges or the rise in the vendor's list prices, which protects the buyer. Clause 5.4 sets payment within thirty days, with a one percent monthly late fee and a process for disputes raised in good faith. Clause 5.6 requires a satisfactory credit check before a subscription starts.

Three buyer segments each have their own stated position: in house legal teams reviewing the same agreement types at volume, law firms applying set positions across client matters, and contract managers applying standards the legal team has already set. One industry has a dedicated page, construction and AEC contracting, supported by a claim of several construction customers. NDAs, service agreements and subcontracts are the recurring types the product is built for, with more complex contracts in scope subject to playbook coverage. The vendor states the product's limit: how useful it is depends on playbook coverage, the language and context of the agreement, and lawyer review. Practice areas are not addressed, since coverage is by agreement type and industry, and government use is not described; a United States Government Rights clause in the agreement concerns license rights, not coverage.

Who the product serves is listed explicitly, and the limits are left open. Seven segments are named: legal departments, sales departments, procurement departments, global enterprises, high growth businesses, private equity firms and law firms. The named customers span technology, professional services and life sciences. The material frames the platform for teams reviewing recurring commercial agreements at volume, and for nonspecialists applying positions the legal team has set. The coverage boundary is open. Contract types are covered only by the claim that playbooks are ready to use on virtually every contract type, with no list of supported agreements and no statement of where the product works less well. Practice areas are not addressed; coverage is organized by buyer function. Government use is not described.