Brightflag vs BusyLamp: how they compare in 2026

Brightflag was founded in 2014 on machine learning that reads legal invoices, and that model sits at the center of the product. A supervised model, refined on labeled invoice text for more than a decade, reads every line item narrative and classifies it by phase of work and activity on an extended UTBMS framework. A rules engine then checks each line against the customer's billing guidelines and flags violations, rate discrepancies and duplicate entries before a reviewer opens the invoice. Generative features sit on top of that core. AI invoice summaries arrive in approval emails, Ask Brightflag answers questions about spend data, spend forecasts predict budget overruns, AI built vendor profiles support panel management and RFPs, and generative AI produces matter summaries. Workflow, budgets, accruals, matter management and reporting surround the AI, and approved invoices flow to accounts payable. Without the classification model, Brightflag would be a conventional electronic billing system.

AI sits at one step of a billing workflow that runs without it. The Smart Invoice Converter reads an invoice PDF and produces a LEDES file with UTBMS codes and timekeepers, using OpenAI in the United States. Since the August 2026 release, client administrators can require law firms to submit LEDES invoices only through the converter. Onit's product update for that month lists a new AI invoice extraction engine and better validation of converted invoices. The December 2025 release let legal teams run the converter themselves on behalf of law firms. A support chatbot from Maven AGI is the other AI component. Review against billing guidelines, approval workflows, budgets, accruals, work in progress, rate approval, RFPs, reporting and the dashboard all run without AI. Onit's AI Studio products, Spend Agent, ReviewAI and Olava, are separate, and Spend Agent works inside OnitX ELM and Unity ELM rather than BusyLamp.

Brightflag's flags trace to evidence a reviewer can open. Each flag ties an invoice line to the billing guideline rule it breaks, and the reviewer sees both on the invoice review page. Brightflag's internal analysts supervise the classification model, reviewing cases where it is not yet confident in its interpretation and feeding corrections back to it. Ask Brightflag answers only from the organization's own spend data, and a filter explainer shows how it interpreted each question, so a user can check that the results match the query. Users report a wrong answer with a thumbs down for Brightflag's team to investigate. The generative AI terms say outputs are produced probabilistically, may not always be accurate and should not be relied on as a sole source of truth. Brightflag's FAQ says LEDES and PDF invoices are processed with equal accuracy, and the figures it publishes are savings and returns from a Forrester study rather than accuracy rates.

The converter extracts billing data rather than making legal assertions, so there are no citations to ground. No accuracy figure or error rate accompanies it. Onit's product page describes AI driven validation that reduces errors and built in checks that cut review effort. The converter extracts, validates and enriches invoice data before a law firm reviews and corrects the LEDES file. Errors on submitted invoices, such as rate, tax or duration breaches, open on an invoice validation screen for the legal team. Section 12.3 of Onit's Subscription and Services Agreement says Onit cannot guarantee that outputs will be 100 percent accurate. It adds that machine generated output may be incomplete, inaccurate or biased.

In Brightflag the AI reviews and a person, or a rule the customer sets, approves. Invoices route by matter, value or practice area to designated approvers, and approving from an email summary does not bypass workflow rules. Customers can configure automatic approval for invoices that meet set criteria, and the FAQ says most customers auto approve invoices under $5,000 with no guideline violations, which can be about 30 percent of invoices. Invoices that fail set criteria can be rejected automatically. Flagged lines go to the customer's reviewers, and lines the model is not confident about go to Brightflag's own analysts. Approved invoices flow to accounts payable, and approvals sit in an audit trail. The MCP connector is read only, so approvals, edits and rejections happen inside Brightflag. The generative AI terms leave the customer to decide where human review is appropriate and bar using the features to automate decisions with a legal or material impact on an individual.

A person stands between the converter and an approved invoice. Law firm users with the Billing Manager role run the Smart Invoice Converter, which produces LEDES files for review and correction before submission, and client administrators can require that route for every LEDES invoice. Once submitted, invoices pass validation against the customer's rates, taxes and billing guidelines, and errors surface on a validation screen. Approval workflows are scoped by matter criteria with thresholds per currency, and designated releasers handle release, approval and paid status. Section 12.3 of Onit's services agreement makes the customer solely responsible for review of and reliance on AI output, and section 12.7 bars uses that would make the AI high risk under applicable law. Sensitive data needs Onit's prior written approval before it goes into AI features. No confidence signal marks an uncertain line, and what the converter does with a field it cannot read is undescribed.

Brightflag's success stories name the customer and give figures. In the nine months after switching, SMBC's Americas division saved $2.7 million by applying its discount agreements and outside counsel guidelines consistently. It also saved more than 300 labor hours by replacing a Word and email matter opening process with a request form. Lufthansa raised outside counsel guideline compliance by 5 percent in a single quarter and now assigns budgets to more than 80 percent of its matters, up from 20 percent. Syngenta recouped the equivalent of 10 percent of its gross legal spend in the first half of 2021, and Dropbox spends two days less on accruals each month. Each figure is the customer's own account, without a stated method. A Forrester Total Economic Impact study commissioned by Brightflag found a 387 percent return over three years for a composite organization and a 4 percent average saving from billing compliance.

Named customer material for BusyLamp dates from 2021. An Onit blog post of April 2021 quotes Daniel Wate, legal technology analyst at Associated British Foods, on using eBilling.Space to secure volume discounts and consolidate firms. The same post quotes Lynne Kellett, managing legal counsel at EDF UK NNB, whose team implemented it. Neither quote carries a figure. Onit's September 2021 acquisition release said BusyLamp had grown annual recurring revenue by more than 60 percent in twelve months, with customers in automotive, telecommunications and banking. It cited Hyperion Research calling BusyLamp highly innovative and a market leader, and Hyperion's June 2021 report listed it among ten advanced solutions. Today's product page carries an unattributed testimonial from legal counsel at a global financial institution and claims measurable savings without a number. No customer count is given for BusyLamp.

Brightflag's generative AI terms address training for its generative features. Customer data is not transferred to the third party model developers, who cannot and do not use inputs or outputs to train their models, and Brightflag will not fine tune the model instances it operates. Brightflag's own classification model, refined since 2014 on labeled text from actual legal invoices, sits outside those terms, and Brightflag does not name the source of that text. Vendor benchmarking uses data aggregated across Brightflag customers. Data is encrypted at rest with AES 256 under AWS Key Management Service and in transit with TLS 1.2 or higher. Access runs through SAML single sign on, SCIM provisioning and four client roles, from ordinary users who see only their own matters and invoices to administrators, and access can be limited to set IP ranges. Brightflag staff reach customer data only as needed under a role based access policy. Ask Brightflag answers only from the organization's own legal spend data, which its help article presents as keeping that data confidential. The security page and the generative AI terms treat customer data as confidential without separate treatment of privilege or work product.

Onit's Subscription and Services Agreement, last revised 19 August 2026, governs BusyLamp and leaves the customer owning its data as confidential information. Section 12.1 bars third party model providers from using customer input to train their models for the benefit of others, except in deidentified or aggregated form needed to run the service. The same section lets Onit use deidentified, aggregated usage data to improve its AI services, and section 5.2 lets it use customer data, once aggregated and anonymized, for product improvement, analysis and benchmarking. Inside eBilling.Space, administrators, matter scoped project managers and observers hold different rights, and matter fields can be withheld from assigned law firms. Since August 2026 a law firm or lawyer can be blocked globally, and multifactor authentication has been required for all licensed users since February 2026. Privilege, work product and what OpenAI keeps from a conversion go unmentioned, and the tenancy model is unstated.

Brightflag's generative AI terms state that outputs are not legal, tax or other professional advice or a substitute for it, and may not always be accurate. The customer decides whether outputs suit its use case and where human review is appropriate. The terms bar using the features as a general purpose chatbot, to automate decisions with a legal or material impact on an individual, or for anything that does not directly support the platform's primary functions. Brightflag sells to corporate legal departments, and Ask Brightflag is open only to administrator and overview roles. The billing rules it applies come from the customer's own outside counsel guidelines rather than from Brightflag. The terms set no jurisdiction limits for a product that reviews invoices from firms in many countries.

Section 4.14 of Onit's services agreement states that Onit is not a law firm and does not offer legal advice. Section 12.3 makes the customer solely responsible for review of and reliance on AI output, including obtaining legal or other professional advice as appropriate. BusyLamp's AI converts invoices into billing data and produces no legal analysis. Its buyers are in house legal and legal operations teams, and law firms take part to submit invoices, answer RFPs and correct converted LEDES files. The product carries Germany's statutory RVG fee table, and since May 2026 invoices show which RVG version applies. Jurisdiction limits are unstated, and how the product supports a lawyer's competence and supervision duties is unaddressed.

Brightflag states on its FAQ that it is certified to ISO/IEC 42001, the standard for AI management systems. An article on its site by Michael Dineen, its director of data science, updated in April 2026, says it is among the first legal technology providers to meet the standard. The article says Brightflag has built the standard's principles into its AI product development and internal governance. The FAQ says each AI feature is designed with a confidentiality, privacy and security focused approach. Its security page, which lists ISO 27001, SOC 1 and SOC 2, does not include ISO 42001, and no certifying body, certificate date or scope appears on the open pages. The article lists bias detection and mitigation among the standard's requirements, and Brightflag reports no testing or bias results of its own. The article commits Brightflag to protecting customer data, deploying AI that is transparent, auditable and trustworthy, and improving its AI systems in line with legal and ethical standards. Governance is presented through the certification, without a named owner inside Brightflag.

No AI governance policy covers BusyLamp or Onit's wider product line. There is no responsible AI page, no named owner for model behavior, no description of testing before release and no AI management certification such as ISO/IEC 42001. Section 12 of Onit's services agreement allocates AI risk instead. Output may be incomplete, inaccurate or biased, and uses that would be high risk under applicable law are barred. AI features carry no service levels unless an order says otherwise, and fair use limits let Onit throttle or suspend them. Whether conversion accuracy differs by invoice layout, language or country is unaddressed, although BusyLamp serves law firms across Europe and imports German electronic invoice formats.

Brightflag publishes its security controls and leaves several data handling terms to agreements it signs with each customer. Data retention and deletion are configurable to each customer's requirements, and the privacy notice keeps basic customer account data for six years after a relationship ends. Data is encrypted at rest and in transit, staff access follows a role based access control policy, and the platform is penetration tested by CREST certified testers and scanned for vulnerabilities continuously. Customer data is backed up to AWS data centers as part of business continuity. The privacy notice says all subprocessors, including AI subprocessors, are listed in Brightflag's data processing agreement and in its trust center, which Brightflag opens on request. Brightflag commits to notify customers and regulators of a suspected breach where the law requires it. Customers can track application actions in the product and request fine grained audit logs. Brightflag's 2021 announcement scoped its SOC 1 report to invoice approval and accruals management.

Customers choose hosting in the United Kingdom or Germany, data is encrypted at rest with AES 256, and multifactor authentication has been mandatory for licensed users since February 2026, with authenticator apps added in August. Onit's subprocessor list, updated 17 August 2026, gives BusyLamp its own table of nine processors with purposes and countries. AWS, PlusServer and Hetzner host and back up data, Imperva and Cloudflare protect it, Mailgun and Google Analytics handle email and analytics, Maven AGI runs the support chatbot and OpenAI converts invoices. The data processing addendum, revised 20 April 2026, keeps data for the term of the agreement and defines access rights by duty. It separates test and production systems and keeps an audit trail of data entered, changed or removed. It commits to notify the customer promptly of a security breach, with no number of hours. After termination the customer has 30 days to export, then data is deleted under Onit's retention policy, which is not public, and backup copies may persist.

Brightflag's generative AI terms carry an intellectual property indemnity. If a third party claims an output or a generative feature infringes its rights, Brightflag indemnifies the customer against damages finally awarded by a court, provided Brightflag can defend the claim. The indemnity excludes customer modifications, combination with other technology, customer inputs, known infringement, patented inventions in outputs and trademark use of outputs, and the terms state no cap. Otherwise the features and outputs are provided as is, with accuracy not warranted. Liability caps and exclusions for the platform sit in Brightflag's subscription agreement, which is signed with each customer and not published. The generative AI terms, last updated 6 March 2025, are incorporated into that agreement and take precedence over it for generative features.

Onit's Subscription and Services Agreement, last revised 19 August 2026 and governed by Delaware law, caps liability at the fees paid or payable under the order in the 12 months before the event. Indemnification, payment obligations and liability that law does not allow to be limited sit outside the cap, and consequential, indirect and punitive damages are excluded. Onit defends the customer against intellectual property infringement claims, except where they arise from combinations, customer data, customer designs or use after Onit asks it to stop. It warrants that the services operate substantially as documented. For AI, section 12 provides features and output as is, says Onit cannot guarantee 100 percent accurate output and gives AI features no service level unless an order states one. Liability under the data processing addendum is limited to one times the prior year's fees, and no insurance is described.

Brightflag's integrations page names each connection and what it does. Approved invoices go to Coupa, Workday, NetSuite, Dynamics 365 and other accounts payable systems, with payment statuses returned to Brightflag, and the page also lists SAP Ariba, SAP S/4HANA and Oracle Fusion. The FAQ describes three finance routes, which are email with a cover page, CSV batch files over SFTP on an hourly, daily or weekly schedule, and the API. Integrations with iManage and NetDocuments link matters to document workspaces, and Jira tickets and Xakia intake submissions create matters. Okta and Microsoft Entra handle sign in and user provisioning. Law firms submit LEDES 1998B or LEDES 98BI version 2 files, PDF invoices or global e invoicing XML. An API and an MCP server connect AI tools such as Claude, Microsoft Copilot, ChatGPT and Gemini, and every role and access restriction set in Brightflag applies in the connected tool. The connector is read only, so approvals, edits and rejections stay in Brightflag.

Invoices move as LEDES files with UTBMS codes, and the converter builds them from PDFs for firms that cannot produce LEDES. A December 2024 enhancement called InvoiceConnect added import of XRechnung and ZUGFeRD electronic invoices, and since September 2026 a government invoice number for tax authority cleared invoices appears in exports. Invoices save as PDF or cXML, and reports download to Excel. The product page says BusyLamp connects with accounts payable and ERP systems and on premises single sign on, with OpenAPI integrations for IP, content management, claims and legal hold systems. It names no system and does not describe what moves. Onit's matter management pushes matters into BusyLamp at the click of a button, a feature described in 2023. The services agreement provides APIs as set out in each order, and no public API documentation is available.

Brightflag is cloud software hosted in a multi tenant AWS environment, with data centers in Ireland, the United States and Australia. The data center follows the customer's location and where its data originates, and the privacy notice says a customer can choose to host platform data in the European Economic Area. Websites are hosted in the European Economic Area. Generative features run from Brightflag's own AWS environment, and the terms say data does not leave that environment. The region where generative processing runs for each customer is not stated. Customer data is backed up to AWS data centers for business continuity, a security operations center monitors the infrastructure, and Brightflag publishes a system status page.

Customers choose hosting in the United Kingdom or Germany, with backups in Ireland, under the AWS entry in Onit's subprocessor table. The same table names PlusServer for the German production environment and Hetzner for German backup servers, without explaining how the German setup divides between them and AWS. Invoice conversion runs through OpenAI in the United States, and the support chatbot through Maven AGI in the United States, with no European processing option for either. Transfers out of the EU rely on standard contractual clauses under Belgian law, with a UK addendum, and the data processing addendum names the Belgian Data Protection Authority as supervisor. The tenancy model is unstated, and there is no single tenant or private deployment.

Brightflag's security page lists ISO/IEC 27001:2013 certification and annual SOC 1 Type 2 and SOC 2 Type 2 reports, with SOC 2 covering security, availability, processing integrity, confidentiality and privacy. Its FAQ adds ISO/IEC 42001, which the security page does not list. Encryption keys are managed in AWS Key Management Service. The certificates, independent test reports and security and privacy policies sit in a trust center that Brightflag opens to prospects and customers on request. The open pages give no auditor, report period or certificate date. The security page still cites the 2013 edition of ISO 27001, whose transition period to the 2022 edition ended in October 2025. Penetration tests come from CREST certified testers. Employees take mandatory security and privacy training when they join and during employment, and Brightflag runs regular phishing simulations. It states compliance with GDPR, CCPA and CPRA. Brightflag acts as a data processor for personal data in the platform, and Ireland's Data Protection Commission is its supervisory authority.

Onit's security page says it audits to SSAE 18 SOC 2 Type 2, SOC 1 Type 2 and HIPAA standards, with no auditor, dates or statement that BusyLamp is in scope. BusyLamp's product page cites ISO 27001 and ISO 9001 certified data centers, which describes the hosting providers rather than BusyLamp GmbH. Onit's trust center, built on Vanta, takes requests for its audit reports. The data processing addendum accepts an SSAE 18 report covering the prior twelve months in place of a customer audit. BusyLamp's German data protection officer is K11 Consulting GmbH of Ludwigsburg, named on the product page.

Brightflag's generative AI terms name AI21 Labs' summarization model for invoice summaries and Anthropic's Claude for Ask Brightflag. Both run from Brightflag's AWS environment, data does not leave that environment, and the model developers receive no customer data. The terms say the models may change from time to time and ask customers to check the terms periodically, while Brightflag's promise of notice covers material changes to the terms themselves. The terms, last updated 6 March 2025, list two features, and Brightflag now also markets generative matter summaries, AI built vendor profiles and Ask Brightflag on the invoice review page. Users agree to AI21's Responsible Use Policy and EULA, Anthropic's Usage Policy and Commercial Terms, and AWS's Responsible AI Policy and service terms. Invoice classification runs on Brightflag's own supervised model. No model versions are given.

Onit's subprocessor list names OpenAI, in the United States, as the service that converts BusyLamp invoices into LEDES files, and Maven AGI as the support chatbot. No model name or version is given. Section 12.4 of the services agreement lets Onit improve, replace or deprecate models or prompts without materially reducing core functionality, and no notice attaches to that. Subprocessor changes go out through an email subscription. The services agreement gives customers 15 days to object, while the data processing addendum sets a 10 day notice period for new subprocessors and 30 days' notice to terminate over one.

Brightflag's FAQ sets out how it charges without publishing figures. Customers pay a fixed one time implementation fee and an annual subscription based on their annual outside counsel spend, and quotes are sized to that spend. Upgrades, maintenance, support, ongoing training, additional users or vendors, storage, bandwidth and custom reports carry no extra charge. Average implementation takes six weeks for first time buyers and ten weeks for replacement buyers, according to a Forrester Total Economic Impact study. The same study is the source of the savings figures on Brightflag's pages, including roughly $160,000 a year from billing compliance. Brightflag has no pricing page.

BusyLamp has no public price. Onit has no pricing page, and the product page offers a datasheet and two demo requests, so every route ends in a sales conversation. The services agreement describes how orders work in general terms. Fees are in United States dollars payable within 30 days, usage beyond the order moves the customer to a higher tier, and AI features can carry overage fees at current rates. No BusyLamp rate, unit, tier or implementation cost is stated.

Brightflag sells to corporate legal departments, from high growth companies to global enterprises with complex, multi jurisdictional operations. Its FAQ names technology, financial services, healthcare, manufacturing, energy, consumer goods and education among the industries it serves. Its stories cover SMBC, Lufthansa, Syngenta, Dropbox, Docker, AIB, Ocado and Ironclad. The buyers are in house legal and legal operations teams and their finance counterparts. Brightflag has offices in Dublin, New York and Sydney, hosts data in Ireland, the United States and Australia, and runs tax workflows for North America, Europe and Asia Pacific. The product covers outside counsel spend, matters, vendors, budgets, accruals and reporting. Contract drafting and legal advice sit outside it, and law firms take part only as vendors submitting invoices.

BusyLamp serves European corporate legal departments that manage outside counsel across borders, with VAT, multiple currencies, matter budgets in any currency and an interface in English and German. Law firms use it to submit invoices, answer RFPs and manage their timekeepers' rates, rather than as buyers. German features include the statutory RVG fee table and a government invoice number for tax authority cleared invoices. Onit's 2021 release named automotive, telecommunications and banking customers. Its March 2026 blog groups BusyLamp with Unity ELM, OnitX ELM, SimpleLegal and Legal Files, each still available and supported. Team size and excluded uses are unstated, apart from the services agreement's bar on ITAR controlled data. Support is provided in English under Onit's maintenance terms.