Clio vs CosmoLex: how they compare in 2026

Clio is an eighteen year old practice platform with an AI workspace built on top, and Clio frames it that way: its marketing says the 18 year foundation now powers its legal AI. Clio Manage, Grow, Draft and Accounting are conventional software, and the entry tier is sold on practice management, not models. Clio Work is built around AI and sold as a separate product with its own trial, and Grow AI and Manage AI sit inside the older modules. Remove the models and the system 400,000 professionals use to run their firms still works.

A mature conventional platform carries a recent, narrow AI layer. The base is a complete product on its own: matter management, calendaring and tasks, document storage, time capture, billing, a client portal, and the built in trust and general accounting that most customers give as their reason for choosing it. None of that needs a model, and all of it predates the AI by years. The AI arrived in August 2026 as four named features, all shipped: AI Intake with a form builder, document summarization that pulls out key terms, obligations, deadlines and action items, and natural language filtering across the customer's own records. CosmoLex describes them as extending its existing approach to intake and everyday administrative work, not as a reinvention. Without the models, a working practice management and accounting system remains.

Two sources ground the AI, and no accuracy figure is published. Clio's pricing page says the AI is grounded in the firm's matters and cites its sources. Its home page says the AI works from matters, clients, filings, messages and financial data, combined with over a billion legal documents across 100+ countries, the vLex library Clio bought in June 2025. That is a described retrieval method over identifiable sources, and the subprocessor list backs it up by naming a vector database provider. No accuracy measure is published, and the Terms cut against any implied one. Clause 14.2 says Themis does not review Output for accuracy or completeness and that Output may be incomplete or inaccurate. Clause 17.2 says the same of the legal Materials, disclaiming accuracy, completeness and currency. Clio publishes an accuracy resource at /resources/ai-for-lawyers/ai-accuracy-legal/.

Nothing addresses accuracy, and the feature where it matters most extracts deadlines. No accuracy figure, benchmark or evaluation is published for any AI feature, nothing describes how a summary is grounded in the underlying document or how a user traces an extracted item back to its page, and hallucination is not mentioned. The AI material is entirely about data handling, not output quality: the published questions and answers cover encryption, training, processing location and matter isolation, and none asks whether the output is right. That matters here because the summarization feature is marketed as extracting deadlines and action items from pleadings, correspondence and discovery, and a missed or misread deadline is the classic malpractice event. The 2019 subscription agreement disclaims warranties of data accuracy.

Human review is a marketing commitment that Clio's contract makes binding, but there is no finer structure. Clio's pricing page says the firm reviews and approves everything before it reaches a client or court. Terms clause 14.2 turns that into a duty on the subscriber. It must use AI Services and Output only with human oversight, and review Output for accuracy, completeness, fitness and compliance with legal, regulatory and professional requirements before using it. Clause 14.4 leaves the subscriber in full control of how AI Services are set up and presented. Missing: no modes or thresholds are described, and nothing says what the product does on its own versus what it waits to be asked.

No oversight model is published for any AI feature. Nothing says what a lawyer must review before relying on a document summary, whether extracted deadlines go to the calendar automatically or are proposed for confirmation, what happens to an item the system is unsure about, or where a person sits in the intake flow. CosmoLex's launch language leans toward autonomy, describing AI Intake as capturing client data and moving every intake forward without anyone touching it, presented as the benefit. The subscription agreement predates the AI features by seven years and has no review obligation, no acceptable use provision covering generated output and no allocation of responsibility for acting on it. The one related statement is a caution, not a control: it advises firms to review their own professional responsibility obligations in their jurisdiction.

One named firm comes with a figure and period, alongside platform numbers with no method. King Law is named on the home page with a 275% increase in revenue over four years, credited to visibility and tools across the firm. Named people appear with their firms: Angela Lennon at Koenig | Dunne and Danielle Harvey-Jacob at Harvey-Jacob Law. Platform figures are 400,000+ legal professionals, 130+ countries and 300+ integrations. Nothing is dated, and no method is given for the King Law figure. A rating of 4.7 from 12,000+ reviews comes from directories, and Clio's own comparison page is marketing.

Many customers are quoted, with almost no attributable outcomes. About seventeen people are quoted across CosmoLex's pages, most with a full name and a state or province, spanning Virginia, Louisiana, Pennsylvania, Utah, Ontario, Alberta, British Columbia and Quebec. One gives an employer, a paralegal at Ramos Law. The quotes describe experience rather than measure it, and only one gives a number: a user who spends about a third of the time they did before. Scale is asserted without attribution as thousands of small to midsize firms across North America. One outside endorsement is substantive: CosmoLex says the Canadian Bar Association selected it as its exclusive preferred practice management software. The headline efficiency claim is labeled candidly: 18 or more hours returned each week and a 15.3 times return are footnoted as modeled from third party research for a firm of five to ten attorneys, with results varying. A model is not a deployment result.

Confidentiality commitments are real at Clio, but privilege is never addressed. Terms clause 4.2 binds Themis and its vendors and hosting partners to keep Content strictly confidential and not use or disclose it outside the agreement. Clause 21.3 says only Themis, for strict business reasons, may access and transfer Content, only to provide the Service, with reasonable efforts to notify the subscriber first. Clause 14.6 says using AI Services grants no right to use confidential information to train general large language models. The security page says AI data is encrypted and processed in the customer's region, AI tools process in real time without storing or reusing data, and outputs are generated only for the user who asks. Missing: any express treatment of privilege or work product, on a platform holding the whole matter file, and any documented separation between matters within a firm.

Four elements are addressed, and separation is answered directly. CosmoLex says AI summaries and outputs are limited to individual matters, so the system working on one matter cannot surface or reference information from another, and it says the isolation is designed to preserve attorney client privilege. Under that sit the platform's own controls: permissions and privilege settings for each matter, predefined roles including Administrator, Billing Only and Matter Owner, and matter owner limits on who can see documents. On training, the AI material says documents are never used to train external AI models. Section 9 of the subscription agreement sets a mutual confidentiality regime in which the subscriber's Confidential Information expressly includes its client information, and section 9.5 takes breaches by personnel and subcontractors outside the liability limit. Two gaps remain: no model provider is named, and no retention period is stated for anything during the term.

Clio covers every part of the advice question, all in its contract. The top of the Terms says in bold that Themis is not a law firm and gives no legal advice, through the Service or otherwise. Clause 12.1 adds that the Services, Output or Materials create no attorney client relationship. The Service is only for legal professionals and those they supervise, with a named exception for academic access. Clause 14.2 addresses competence and supervision, requiring human oversight and making the subscriber review Output against professional body requirements and fiduciary rules. Jurisdiction limits are stated three ways. The Service is for North America with separate EMEA terms, Materials are limited to the account's country, and clause 2.16 warns that one code base serves all jurisdictions, so subscribers must set and check their own. Clause 14.4 covers clients: firms must tell their own users about the use of AI, the nature and limits of AI responses, and any human oversight.

One general pointer exists and nothing else. The home page, the practice management, document management, security and pricing pages, and the subscription agreement and its exhibits carry no statement that output is not legal advice, no account of what a user must verify, and no jurisdictional statement. The unauthorized practice question largely does not apply, since practice management and accounting software gives no legal advice. Professional responsibility does apply, in two ways CosmoLex writes about at length on its own blog: trust accounting is governed by detailed rules whose breach draws bar discipline, and the AI now extracts deadlines from litigation documents. Neither is tied to any published guidance. The only statement is in the AI questions and answers, advising that, as with any technology, firms should review their own professional responsibility obligations in their jurisdiction. It names no rule, authority or jurisdiction.

AI principles are public, but not the process behind them. An AI Principles page, attributed to Chief Technology Officer Jonathan Watson, sets out five commitments: AI as collaborator, transparency of AI actions, high quality data, relentless refinement and uncompromising security. Bias appears once, as a claim that diverse, top quality data minimizes it, not as anything measured. Nothing names a person or committee accountable for the AI, describes testing before a feature ships, or discloses any evaluation result. The one trace of testing is indirect: the subprocessor list names Braintrust Data as an AI analytics, evaluation and testing provider across five products. That shows a testing pipeline exists, not a published regime a buyer could examine.

No governance material is published: no responsible AI page, framework or principles, no person or function accountable for model behavior, no account of what is tested before an AI feature or model change ships, and no certification such as ISO 42001. The published AI material covers only data handling (encryption, training, processing location and matter isolation) and says nothing about how the models behave or how that is checked. Nothing addresses uneven output across document types, practice areas or drafting styles, which matters for a summarizer that will meet everything from a two page retainer to a discovery production. A dedicated AI practice management page is linked in the site footer.

Every element but one is covered in clear terms. Incident practice is contractual: clause 5.5 requires Themis to report any event it reasonably believes is unauthorized access to, disclosure of, use of or damage to Content within 72 hours, and clause 5.6 sets cooperation, investigation and mitigation duties. Deletion has a period: 90 days to retrieve Content after termination, after which all Content is permanently deleted. Escrowed data is held six months under a separate escrow agreement the customer controls. Subprocessors are published in full and dated. Clause 21.3 limits Themis access to strict business reasons, with advance notice. Encryption, geographic redundancy and at least annual third party penetration testing are stated. The gap is retention during the term. No period is published for AI inputs and outputs, and clause 14.6 lets deidentified, aggregated Content and Output be kept for quality improvement without limit.

The security page carries real specifics, and the agreement backs several of them. Encryption is stated in transit, with 256 bit SSL, and at rest, and backups run automatically every few hours, stored encrypted in several locations. Access control is described at two levels: infrastructure controls, and security levels, roles and access privileges assigned to users, with two factor authentication by SMS. Incident practice is contractual: section 8 of the subscription agreement commits CosmoLex to report any unauthorized access promptly on discovery and to use diligent efforts to remedy the breach, while the cost of notifying affected individuals falls on the firm. Section 13.3 gives thirty days after termination to retrieve everything before CosmoLex may irrevocably delete it. Data centers are stated to be in North America, in the United States or Canada depending on the firm's location, and core support staff are in the United States. Two things are missing: no subprocessor or vendor is named, and no retention period is stated for anything during the term.

Liability terms run both ways at Clio, but stop short of AI output. Clause 11.1 excludes liability generally but carves out breaches of confidentiality, security and managed backup, so those duties stay live. Clause 11.2 caps liability at the total paid in the six months before the claim, and does not apply that cap to the indemnity. Clause 13.2 gives the subscriber a real indemnity on two grounds: third party intellectual property claims against the Service, and claims arising from Themis breaching its own confidentiality or security duties. Exceptions are listed in 13.3. None of it reaches AI output. Clause 13.2(a) excludes Output from the intellectual property indemnity, clause 14.2 provides Output as is, and clause 12.2 disclaims any warranty on results. No insurance position is published.

A complete and fairly balanced allocation is published, in an agreement that predates every AI feature by seven years. Section 20 caps total liability at twelve months of fees but carves out CosmoLex's indemnity and its confidentiality obligations entirely. Section 19 excludes consequential damages with the same two carve outs, so confidentiality exposure is uncapped. Section 17 gives the customer an intellectual property indemnity with a defined series of remedies ending in termination, a refund of prepaid fees and return of data in a database format. Section 15 is a real warranty rather than a bare disclaimer, covering reasonable efforts on uptime, freedom from material defects and conformity to the descriptions on the site, with prompt correction as the remedy. Section 9.5 takes breaches caused by CosmoLex's own personnel or subcontractors outside the security liability limit. The weakness is age, not content: the agreement is dated 19 June 2019, names CosmoLex Cloud, LLC as the contracting party under a ProfitSolv Purchaser, Inc. copyright line, and says nothing about artificial intelligence, generated output or model providers.

Integrations at Clio are documented in breadth, not depth. It lists 300+ integrations in an app directory, runs a developer hub and partner program, and treats API access as a governed feature in clause 3.9. API use is bound by the agreement, heavy use may lead to suspension after a reasonable attempt to warn, and access may be changed or ended. Clause 18 says third party services are not Services under the agreement, carry no warranties, indemnities or service commitments from Themis, and may be replaced, disabled or limited at any time without notice. That is honest about where the boundary sits. But nothing published says what any integration moves, in which direction, or what a firm must set up.

Many systems are named, including the ones that matter for this kind of product. Document storage integrates with NetDocuments, Box, Dropbox, OneDrive and Google Drive, so a firm with an established legal document management system can keep it. Microsoft 365 and Outlook are named, with LexShare and LexSign working inside Outlook for secure sending and signature collection. QuickBooks Online and Zapier appear on the pricing page as standard. Exhibit B of the subscription agreement names Groupdocs Signature and HelloSign in the signature path, with Appointlet, Adobe and DocuSign licensed separately. Section 7.5 expressly allows API use, with a published quota of 1,000 calls per user license per month. No connector list or developer reference is published, nothing says what data flows in which direction for any named system, and the depth of each integration is not stated.

Residency is set out in detail, with no tenancy model. Hosting options cover the European Union, Australia, the United States and Canada, with five regional site versions, a separate EMEA instance at eu.app.clio.com with its own terms, and separate North American and EMEA agreements. Processing is distinguished from storage. The security page says all data used by the AI is encrypted and processed in the customer's own region, naming US, Canada, EMEA and APAC. The subprocessor list gives a data location for every provider, including each AI processor, and names infrastructure by provider and product. Missing: the tenancy model is not stated anywhere, and nothing says whether residency options vary by plan.

Two pages describe residency differently. The security page says all data is stored in United States data centers and that core support teams are in the United States and subject to its jurisdiction. The trust accounting page says data is stored in North America and, depending on the firm's location, may be held in a data center in the United States or Canada. The second fits the separate Canadian site the company runs, but it is not clear which page governs, and no page sets out the placement rule. No cloud provider is named (Exhibit B refers only to a cloud provider based in the United States), no tenancy or isolation model is described at infrastructure level, and no region choice is offered. One AI statement helps: AI processing happens inside the customer's CosmoLex environment rather than being sent to an outside service.

Clio states the coverage period of its SOC 2 report and gives customers a contract right to it. The trust center at trust.clio.com says the 2025 SOC 2 Type II report was issued for 1 June 2024 to 31 May 2025. The security page says Clio completes annual SOC 2 Type II and SOC 1 Type II examinations, with both reports in the trust center. Clause 5.4(d) obliges Themis to provide a SOC 2 or SOC 3 report, or a comparable description of security measures, within thirty days of a subscriber's request. At least annual third party penetration testing is stated, and Clio's help center names Deloitte as the independent auditor, though for the earlier Type I engagement. Three details are missing: the trust services criteria are not listed, the auditor for the current Type II is not named, and the penetration testing firm is described only as a leading cybersecurity firm. Clause 5.4(d) also requires signing an agreement with the report's third party provider.

A named standard, a stated cadence and a named assessor are claimed, with no document behind any of them. SOC 2 Type 2 certification is claimed on the security page and repeated on the pricing page as standard on all plans, and the infrastructure is said to be examined and pass inspection every twelve months. An independent threat assessment of the code and architecture perimeter is attributed to Phalanx Secure Solutions, Inc. No auditor is named for the SOC 2 work, no report period, issue date or scope is published, there is no trust center or portal, and there is no route to request a report. Section 8 of the subscription agreement commits CosmoLex to publish on its site, for subscribers to review, any third party audit reports on data security, and no such report appears on the site.

The AI providers behind each product, and where they run, are named, but not the models. The subprocessor list, last modified 20 August 2026, has an AI Service Providers table naming five AI processors, the products each serves and each one's data location: AWS Bedrock, Anthropic, OpenAI, Google Vertex AI and Microsoft Azure Foundry. They span Clio Manage, Grow, Draft, Work, Vincent AI and Clio Operate. The list also names Turbopuffer as the vector database, Braintrust Data for AI analytics, evaluation and testing, and Vapi for the Grow voice agent. So it is clear whose model handles a customer's content, per product, and where. Two gaps. The specific models are never named, only the providers. And the list page carries no commitment to notify customers of changes; the Themis Data Protection Addendum, under which the list is published, may hold one.

Where processing happens is stated clearly; what does the processing is not. CosmoLex says all AI processing occurs within the customer's secure CosmoLex environment, and data does not leave it to be processed by an outside service. Read with the statement that documents are never used to train external AI models, that implies no third party model provider sits in the path for these features. But no model, version or provider is named. Nothing says whether the model is built in house, licensed and self hosted, or reached through a cloud provider's own service, three very different answers to the question a firm's client would ask. No subprocessor list exists in the agreement or elsewhere, and no commitment covers notice of a change in the model set. A dedicated AI practice management page is linked from the site.

The entry tier has a public price and the rest are quoted. Clio's pricing page shows a starting figure of $49 USD per user per month and names four tiers, Starter, Core, Signature and Elite, with features described tier by tier and a bundle saving of over 15%. Above the entry tier, buyers get a custom quote, and large firms a separate process. The Terms show the published figure is not the whole cost. Clause 9.5 lists setup fees, implementation charges and Metered Features fees as separate, nonrefundable items. Clause 9.6 gives buyers of setup or professional services sixty days to start them or lose them. None of those amounts is published. The tier names have changed again, and third party trackers still show the previous set.

Detailed unit pricing is published in the agreement; the subscription price is not stated in the published text. Exhibit B of the subscription agreement is a real rate card for usage charges. Local call tracking costs three cents a minute and toll free five; SMS costs three cents and MMS four; extra local tracking numbers cost three dollars a month and toll free numbers five. Task routing is five cents a route and electronic signature a dollar a request. Each user license includes 2,500 emails a month, with overage at two cents, and 1,000 API calls a month. Voice and messaging need a fifty dollar minimum prepaid balance. The trial terms are specific: ten days, no credit card, full functionality except a single bank feed connection, with the CRM and signature add ons excluded. The pricing page is headed plans and pricing and lists what every plan includes plus four named add ons.

Coverage is wide, with limits drawn by geography rather than function. Sixteen practice areas have their own pages, from bankruptcy and criminal law to intellectual property and real estate. Pages also cover four firm sizes, from solo to enterprise and large firms, and seven roles. In house counsel and government law each have a page. The Terms state real limits, about where rather than what. The Service is scoped to North America, with separate EMEA terms, and Materials are limited to the country tied to the account. Clause 2.16 warns that one code base serves all jurisdictions, so the subscriber must set and check its own settings. Nothing says which practice types the product handles poorly.

The buyer segment is stated consistently, and little else is bounded. Small and midsize law firms are named repeatedly as the intended customer. CosmoLex addresses solo practitioners leaving larger firms, and offers multiuser support, role based access and advanced financial reporting for midsize teams with higher case volumes. Geographic coverage is shown: separate United States and Canadian offerings, data residency in either country depending on firm location, an exclusive preferred software designation from the Canadian Bar Association, and quoted users in four Canadian provinces and four American states. Practice and boundary detail is missing. No practice area is named, no firm size band is given in numbers, and nothing says what the product does not cover, including whether the trust accounting rules it enforces are set per jurisdiction. The site navigation has a practice type section.