Canopy vs Phaselaw: how they compare in 2026
Canopy and Phaselaw both use their own models to find personal data in piles of documents, but they are rarely weighed against each other because they answer different events. Canopy works after a breach, listing the people a company must notify, while Phaselaw answers a subject access or records request by redacting what must be withheld. Phaselaw sits in the top two bands on eight of fifteen axes and Canopy on five of fifteen, identical on eight. Phaselaw publishes more about the product around its models. It prices by annual document volume with unlimited seats, names customers including the NHS and HMV, says customer data never goes to third party AI, and logs every redaction decision with its reason. Canopy's lead is depth of automation: hundreds of models find personal and health information in any file type, deduplicate the affected people and run first level review with confidence scores. It hosts in five regions, from the United States to Australia. Neither says whether customer documents train its models.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models are the product. Canopy says hundreds of machine learning models detect personal and health information in any file type, deduplicate records into unique affected people and build the notification list, and Auto Review carries out first-level review itself. Without the models there is little left to sell. Verified 22 September 2026.
The models drive the core task inside a platform that would still work without them. Phaselaw's own models flag more than 50 categories of personal data as suggested redactions, and an AI-assisted search added in August 2026 turns a plain-language request into a structured search the reviewer can see and edit. Ingestion, deduplication, email threading, format conversion, case-wide redaction, exemption tracking and export are document processing and workflow that a team could run by hand. Verified 22 September 2026.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Accuracy is asserted, not measured. The site says Canopy's detection is more precise than ediscovery keyword and regex searching and that Auto Review avoids the hallucinations of generic language models, and gated case studies report hours saved and records consolidated. No detection rate, error rate or test set is published. The product does not cite legal authority. Verified 22 September 2026.
Accuracy is asserted, not measured. The customer pages say Phaselaw surfaces personal data automatically so nothing gets missed, and the changelog reports that name detection became significantly more accurate with fewer false positives; no detection rate, error rate, test set or comparison is published. What the models produce can be checked at the source: suggested redactions appear in place on the document for a reviewer to keep or redact, and the AI-assisted search shows the exact query it built. The product does not cite legal authority. Verified 22 September 2026.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Automated first-level review with a confidence-guided human check. Auto Review is described as replacing the first-level review team, and its confidence-level reporting tells review managers which documents need a second look in quality control; in Data Breach Response, people review the documents the models flag. Nothing states a limit on sending a notification list without human review. Verified 22 September 2026.
The models suggest and a reviewer decides, with real review surfaces. A Suggested Redactions page lets a team keep or redact each item, or a whole category, across a case before opening documents; cases carry assigned reviewers and approvers, document statuses and resolvable comments; undoing a redaction across a case shows how many will change and asks for confirmation; and a Case Activity page logs who did what and when. The vendor states that its AI features are clearly labelled and that their suggestions are displayed and editable by all users. Nothing states a limit on exporting before suggestions are reviewed, or what the product does when it misses personal data. Verified 22 September 2026.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Unattributed results. Case studies, gated behind download forms, report one review team saving 2,000 hours, one partner finishing review in about a third of the time and saving its client over $300,000, and 4.28 billion entities consolidated to 3 million unique people. No customer is named on the pages read. Verified 22 September 2026.
Named customers, one with a figure, none measured. The home page shows logos including the NHS, Labour, Museum Wales, YMCA, HMV, the Raspberry Pi Foundation, the Guinness Partnership and Depaul, and quotes Tash Whitaker, DPO of Whitaker Solutions Ltd., on subject access work falling from 10 days to 3, and Paul Byrne, CEO of Propelfwd, a data protection consultancy in the Channel Islands, on subject access and freedom of information work. The site's headline figures, 92% less time per request, over 95% of requests delivered on time and more than 10 million documents redacted, give no basis or date. Verified 22 September 2026.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Confidentiality is asserted in general terms, with no agreement published. The Privacy Notice says Canopy processes client data only as a litigation-support service provider on its clients' instructions and that employees sign confidentiality agreements, and the security pages describe encryption and a virtual private cloud in the customer's jurisdiction. No customer agreement is published, and nothing says whether customer data trains Canopy's models, which the product pages describe as continuously trained. Privilege is not addressed. Verified 22 September 2026.
Strong commitments in marketing, none in the published terms. The product and customer pages say each client gets isolated processing and data never crosses between cases, that data stays in the region the customer chooses and is never shared with third-party AI, and that access to cases is granted on a need-to-have basis. The Terms of Use, which govern the product, contain no confidentiality clause, and no page says whether customer documents are used to train or improve Phaselaw's own models. Privilege and work product are not addressed. Verified 22 September 2026.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Checked the home, law firm, review and LSP, product and About pages and the Privacy Notice on 22 September 2026. The software produces the lists breach counsel rely on to advise clients on notification duties, but nothing states that it gives no legal advice or addresses counsel's review of its output. Verified 22 September 2026.
For a disclosure tool the professional question is review: whoever signs a disclosure answers for what it leaves in and what it takes out. The law firm page puts that question itself, asking what happens if something is missed when your name is on the disclosure, and answers that personal data is surfaced automatically so nothing gets missed. The Terms of Use provide the service as is and disclaim responsibility for the accuracy of results. Nothing states that exemption and redaction decisions remain the reviewer's judgment, or that the product gives no legal advice. Verified 22 September 2026.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Checked the home, product, About and security pages and the Privacy Notice on 22 September 2026. No AI governance position, accountable owner, testing before release, or finding on how detection performs across document types, languages or regions was located. Verified 22 September 2026.
Principles, not a governance framework. The August 2026 release of AI-assisted search says governance, security and privacy come first for all AI features, and commits to labelling AI features and showing their suggestions for users to edit. Administrators can switch individual detectors on and off. No accountable owner, testing before release, or finding on whether detection performs evenly across the kinds of personal data and documents it handles is published. Verified 22 September 2026.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Security controls are published; retention, subprocessors and incidents are not. The site describes encryption at rest and in transit, a virtual private cloud within the customer's jurisdiction, tenant administrator permissions, penetration testing and staff security training. The Privacy Notice, last updated in November 2023, does not say how long case data is kept or how it is deleted. No subprocessor list or incident notification commitment was located; the trust centre requires a login. Verified 22 September 2026.
Security controls are published; what happens to case documents is not. The product pages describe access to cases granted on a need-to-have basis, single sign-on over OAuth2, OIDC and SAML 2.0, SOC 2 Type II and annual third-party penetration testing, and the changelog adds a case activity log and optional protections against attempts to infer the text under a redaction. The Privacy Policy says personal data is kept as long as necessary to provide the service; nothing states how long uploaded case documents are kept or how they are deleted. No named subprocessor list and no incident notification commitment were located; a trust centre is linked from the site footer and its contents could not be viewed on the date shown. Verified 22 September 2026.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Checked the home, product and About pages, the site map and the Privacy Notice, and tried the /terms and /terms-of-service addresses, on 22 September 2026. No customer agreement is published, so nothing states Canopy's liability, warranties or indemnities. Verified 22 September 2026.
Addressed only through a standard limitation clause. The Terms of Use provide the service as is, exclude indirect damages including those for accuracy of results, cap Phaselab's liability at the greater of $100 or the fees paid in the twelve months before a claim, and require the customer to indemnify Phaselab against claims arising from its use of the service. Nothing stands behind a missed redaction or an over-redaction. Verified 22 September 2026.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Checked the home, product and review and LSP pages on 22 September 2026. Canopy exports entity and notification lists in formats suited to different jurisdictions, but no connection to a review platform, case management or other practice system was located. Verified 22 September 2026.
Checked the home, product, customer and solution pages and the changelog on 22 September 2026. Documents arrive by upload, including ZIP archives, PST and MBOX mailboxes and Slack exports, and the enterprise page says no integrations are required. No connection to a document management, case management, email or records system was located. Single sign-on is supported for login, which is identity rather than a practice system. Verified 22 September 2026.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Regions and isolation are stated for a single hosted service. The software runs on AWS with separate instances and logins for the United States, Canada, the European Union, the United Kingdom and Australia, more regions on request, and data resides in a virtual private cloud within the customer's jurisdiction. Where model processing runs is not stated separately, and no other deployment option is offered. Verified 22 September 2026.
Region and processing are stated for a single hosted service. The pricing page includes US or UK data hosting in every plan; customer pages say data is isolated in the region the customer chooses and never leaves that country; and the August 2026 release says AI-assisted queries are processed only in the country of deployment, inside Phaselab's own AWS environment. Each client's processing is described as isolated, without saying whether infrastructure is dedicated or shared, and no on-premises or private cloud option is published. Verified 22 September 2026.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
A named certification without a reachable report. The site says Canopy maintains ISO 27001 certification and regularly runs third-party penetration tests. The trust centre linked from the footer requires a member login, and no certificate, scope or date is published on the pages read. Verified 22 September 2026.
A named attestation without a report route that could be seen. The product and customer pages state SOC 2 Type II certification, annual third-party penetration testing and GDPR compliance. No auditor, scope or date is given on those pages. A trust centre is linked from the site footer; its contents, including any way to request the report, could not be viewed on the date shown. Verified 22 September 2026.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Canopy's own models are claimed without detail. The site describes hundreds of patented machine learning models, continuously trained, and says Auto Review's agentic approach outperforms generic language models, without naming any model, provider or architecture or committing to notice of changes. Verified 22 September 2026.
The architecture is described without the models. The pages refer to Phaselaw's own models detecting more than 50 categories of personal data and say customer data is never shared with third-party AI; the August 2026 release adds that AI-assisted queries are processed only by Phaselab in its AWS environment, with no subprocessor added. No model, base model or architecture detail is named, and no commitment to tell customers when the models change is published. Verified 22 September 2026.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Checked the home, product, solutions and partners pages on 22 September 2026. No price, unit or tier is published; every route to a price is a demo request. Verified 22 September 2026.
The unit and structure are published; the figure is not. The pricing page says price is based on the annual volume of documents processed, with no per-user charge, unlimited seats, and full platform access, onboarding, training and support included with no add-ons. The calculator on that page estimates savings rather than price, and every route to a figure is a quote or a demo. A pilot on the customer's own data is offered in place of a free trial. Verified 22 September 2026.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Buyers and incident types are named, short of limits. The site addresses digital forensics and incident response firms, review and legal service providers, law firms and cyber insurers, covers ransomware and business email compromise, and names GDPR, HIPAA and FERPA notification duties across five hosting regions. What data types, languages or jurisdictions it does not handle is not stated. Verified 22 September 2026.
Buyers and request types are set out, short of the limits. The site addresses enterprise privacy, legal, HR and compliance teams, privacy consultants and law firms handling disclosures for clients, and public sector bodies, and covers subject access requests, freedom of information and public records requests, and personnel records, with US or UK hosting. It describes itself as built for subject access work rather than for litigation evidence review. Supported file types are listed; volume limits, the languages and jurisdictions its detectors cover, and the requests it does not handle are not stated. Verified 22 September 2026.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Checked the home, product, About and security pages, the site map and the Privacy Notice on 22 September 2026, and tried the /terms and /terms-of-service addresses. No customer agreement is published, and the Privacy Notice takes no position on training; the product pages say Canopy's models are continuously trained without saying on what data.
The Terms of Use and Privacy Policy are published and neither says whether customer documents are used to train or improve Phaselaw's models. The Privacy Policy reserves a right to use aggregated, de-identified or anonymized data to analyze, build and improve the service, which never names training and is framed around the personal data Phaselab collects as controller rather than the documents customers upload. The product pages say data is never shared with third-party AI, which answers a different question.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Checked the Privacy Notice and the product and security pages on 22 September 2026. The Privacy Notice says client data is processed on clients' instructions but states no retention period for breach data, review decisions or generated lists.
For the AI-assisted search released in August 2026, the vendor states that searches, results and intermediate processing steps are not logged or retained. That is the product's only free-text AI input. No retention period is published for uploaded case documents, redactions or review decisions, which are part of the case record.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Access is set in Canopy's own permission model, maintained by the customer's tenant administrators, covering who can see data and who can export entity lists; each customer's data sits in a virtual private cloud in its jurisdiction. Nothing describes separating individual matters within a tenant or inheriting permissions from another system.
Access is set per case in Phaselaw's own permission model, which the customer maintains; cases carry assigned reviewers and approvers. The law firm page says each case is separate, each client gets isolated processing, and data never crosses between cases, so a firm can work for several clients at once. No inheritance of permissions from a document management system is described.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
The Privacy Notice says Canopy does not disclose personal information to third parties except as required by law in response to lawful requests by public authorities, including for national security or law enforcement. Nothing addresses notifying the customer, and no customer agreement is published.
The Privacy Policy lists meeting legal obligations, including court orders and other legal process, among the purposes for which Phaselab may share personal data with third parties. Nothing addresses whether the customer is told of such a request, and nothing addresses requests for the case documents a customer uploads, for which Phaselab describes itself as processor.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Checked the product and law firm pages on 22 September 2026. Canopy works on each customer's breached data; notification rules are said to vary by jurisdiction and industry, but no source of those rules is identified.
Checked the product, customer and solution pages and the changelog on 22 September 2026. The product works on the documents each customer uploads. Exemption reasons are chosen by the customer, and no body of law behind them is identified.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Checked the product and law firm pages on 22 September 2026. The product does not cite legal authority, and nothing addresses checking authority for later treatment.
Checked the product, customer and solution pages and the changelog on 22 September 2026. The product does not cite legal authority, and nothing addresses checking authority for subsequent history.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Auto Review reports a confidence level for its first-level review decisions, and the site says this tells review managers which documents need a second look in quality control. No path in which the system declines to classify a document is described.
The August 2026 release of AI-assisted search describes two behaviors: when asked for a search the system does not support, it returns an error explaining the problem instead of a guess, and when it translates an ambiguous request it shows a warning explaining what it did. Both are illustrated with screenshots. No confidence indicator or equivalent behavior is described for the models that suggest redactions.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
Searched the AI Hallucination Cases database maintained by Damien Charlotin on 22 September 2026 for Canopy, and no recorded case was returned. No court order, opinion or disciplinary record naming the product was located. This is a statement about the public record rather than a finding about the product.
Searched the AI Hallucination Cases database maintained by Damien Charlotin on 22 September 2026 for Phaselaw, and no recorded case was returned. No court order, opinion or disciplinary record naming the product was located. This is a statement about the public record rather than a finding about the product.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Checked the home, law firm, review and LSP and About pages and the Privacy Notice on 22 September 2026. No material engages with lawyers' professional or ethical obligations or names any ethics opinion.
Checked the home, product, customer, solution and pricing pages, the changelog, the Terms of Use and the Privacy Policy on 22 September 2026. The site refers to data protection law, the Information Commissioner's Office and public records laws, but no material engages with lawyers' professional or ethical obligations or names any ethics opinion.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Canopy is licensed by incident response and review providers who bill the breached organization for the work; law firms reach it through those partners and advise the client on the results. It does not sit in a lawyer's own time billing, and nothing addresses how its use is reflected in legal fees.
The law firm page claims 92% less time per request and frames the saving as protected margin on fixed-fee work. Nothing addresses work billed by the hour or what a client is told about AI-assisted review. For the enterprise and public sector teams that make up much of the customer base, no client is billed for the work.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Checked the security, product and review and LSP pages and the Privacy Notice on 22 September 2026. No subprocessor or model provider list and no client-facing disclosure material was located; the trust center requires a member login.
Checked the home, product, customer and pricing pages, the changelog, the Terms of Use and the Privacy Policy on 22 September 2026. No subprocessor or model provider list was located: the Privacy Policy names categories of service provider and Stripe, and the changelog names AWS. A trust center is linked from the site footer; its contents could not be viewed on the date shown.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Checked the product and law firm pages on 22 September 2026. The regulator, not a court, usually receives this work; the site describes an impact assessment report and defensible detection, but nothing records which decisions the models made and which a person verified, or addresses disclosing AI use.
No court sits in the path of most of this work; the body that asks is the regulator. The enterprise page says that if the Information Commissioner's Office challenges a response, every decision is logged, showing what was found, who reviewed it and why each redaction was made. Exemption reasons are tracked per redaction, a Case Activity page logs activity from September 2026, and a spreadsheet summary export records exemptions applied, duplicates, redundant emails, out-of-scope decisions and errors.
Out-of-scope files show whether a person or deduplication removed them. Nothing records which redactions began as model suggestions.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Practice Systems Integration Depth
- Primary Law Corpus Provenance
- Good Law Verification
- Bar Guidance Alignment
- Outside Counsel Guideline Readiness
Which one fits
Choose Canopy if
- You have had a breach and must find everyone affected. Canopy's models detect personal and health information in compromised data of any file type without normalization, consolidate records into a deduplicated list of affected people, and produce an impact assessment report.
- You must notify under several regimes at once. Canopy exports notification lists for GDPR, HIPAA, FERPA and other duties, and its Auto Review runs first level review with confidence levels that tell managers which documents need a second look.
- The breached data must stay in its jurisdiction. Canopy runs separate instances on AWS in the United States, Canada, the European Union, the United Kingdom and Australia, with data held in a virtual private cloud in the customer's jurisdiction.
Choose Phaselaw if
- You must answer a subject access or public records request. Phaselaw ingests documents, emails, chats and images, removes duplicates, threads email and suggests redactions across more than 50 categories of personal data, applying one decision across a whole case.
- The regulator may question your response. Phaselaw logs what was found, who reviewed it and why each redaction was made, and exports a summary of the exemptions and review decisions applied.
- You want pricing that does not grow with your team. Phaselaw charges by annual document volume with unlimited seats, onboarding, training and support included, and US or UK hosting in every plan.
In summary
Canopy
Canopy, from Canopy Software, Inc. of Reston, Virginia, is data breach response software used by review providers, forensics and incident response firms, breach counsel and cyber insurers. Hundreds of its own machine learning models find personal and health information in compromised data of any file type, produce an impact assessment, deduplicate affected people and export notification lists for GDPR, HIPAA and FERPA, with Auto Review handling first level review. The AI Legal Index grades it in the top two bands on five of fifteen capability axes, with an A on AI centrality. It hosts on AWS in five regions and states ISO 27001. As of 22 September 2026 the index located no customer agreement, named customer or price.
Phaselaw
Phaselaw, from Phaselab, Inc. of New York, is a document review and redaction platform for subject access, freedom of information, public records and personnel records requests. It ingests documents, emails, chats and images, removes duplicates, and uses its own models to suggest redactions across more than 50 categories of personal data, with an AI search a reviewer can see and edit. The AI Legal Index grades it in the top two bands on eight of fifteen capability axes. It prices by annual document volume, hosts in the US or UK, states SOC 2 Type II, and shows customers including the NHS, HMV and YMCA. As of 22 September 2026 the index located no published price figure or training position.
Questions buyers ask
Are Canopy and Phaselaw the same kind of product?
Not quite. Both find personal data in documents with their own models, but Canopy is used after a data breach to identify and notify affected people, while Phaselaw answers subject access and public records requests by redacting what must be withheld. On the AI Legal Index Phaselaw sits in the top two bands on eight of fifteen capability axes and Canopy on five of fifteen.
Do Canopy and Phaselaw send data to outside AI providers?
Phaselaw states that customer data is never shared with third party AI and that its AI search queries are processed only in its own AWS environment in the country of deployment. Canopy describes its hundreds of models as its own and patented, without naming any provider. Neither says whether customer documents are used to train its models. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 26, 2026. No vendor pays for placement.
How is Phaselaw priced?
By the annual volume of documents processed, with unlimited seats and full platform access, onboarding, training and support included, and US or UK hosting in every plan. No figure is published; a quote or demo is required, and a pilot on your own documents is offered instead of a free trial. Canopy publishes no pricing information. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 26, 2026. No vendor pays for placement.
Can a law firm use Canopy directly?
Canopy addresses law firms, which typically reach it through the review and legal service providers that license the software, alongside forensics firms and cyber insurers. Phaselaw has a dedicated page for privacy consultants and law firms handling disclosures for clients, with each client case isolated from the others. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 26, 2026. No vendor pays for placement.
What do Canopy and Phaselaw both leave unpublished?
A measured detection rate and a position on training. Neither publishes how often its models miss personal data or flag it wrongly, and neither says whether customer documents train its models. Neither connects to a document management or case management system, and neither names an accountable owner for its AI. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 26, 2026. No vendor pays for placement.
Three readings to weigh. Canopy publishes no customer agreement, and law firms usually reach it through partner review providers. Phaselaw's terms cap its liability at the greater of $100 or a year's fees and require the customer to indemnify it; that is a published term. Both trust centers were closed to this index's check. Canopy and Phaselaw were both verified on 22 September 2026. Neither vendor reviewed this page.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything above comes from public material on the dates shown. How the index grades.