Harvey vs Legora vs CoCounsel Legal: the three way comparison in 2026
Three products, and the head to head that keeps getting asked three ways. Harvey is a workspace that reaches into the systems a firm already runs. CoCounsel Legal is an answer engine on a corpus its parent owns, Westlaw and Practical Law. Legora is a shared workspace for the matter team and the AI, with its contract terms published openly. The differences below measure what each vendor is willing to publish rather than what its software can do. Each of the three has something the other two keep behind a sales conversation, so no one of them wins outright. This page sets out where they separate, where they agree, and the questions none of them answers in public.
Which one fits
Three short lists, each resting on a record below. If none of them describes your firm, the grid still does; put the three side by side with a fourth in the builder.
H
Choose Harvey if
- The tool has to live inside iManage, NetDocuments or SharePoint on day one, and your administrators want the documentation before the contract. Harvey documents each integration at the level an administrator needs, applies the walls kept in iManage Security Policy Manager across its workspaces, and lets an administrator choose which connectors are on, who may use them and which tools need a person to confirm.
- Your governance review wants the AI itself certified, with the scope published. ISO 42001 with a Statement of Applicability, AIUC-1 with adversarial testing, and EU AI Act conformity listed, all on a trust portal that answers a request without a sales call.
- You are answering a client's outside counsel guidelines this month. Harvey's trust center inventory, questionnaires, diagrams and statements of applicability, is the most complete pack of the three and can be assembled into a response today.
L
Choose Legora if
- Your security review wants to read the documents rather than request them. Legora publishes its security whitepapers and security measures annex with no gate, customers can bring their own encryption keys and set retention periods, and its general terms come in EU, US and Global versions.
- Your matters run across jurisdictions and the working pattern matters more than the benchmark. Legora is built around a shared surface for the matter team and the AI, with Tabular Review linking every cell back to its source and cross border work stated as a strength.
- You are buying in Europe and want the data protection documentation written for that starting point rather than adapted to it, with an ISO 42001 certified AI management system already in place.
C
Choose CoCounsel Legal if
- Your research answers need to rest on licensed content with validity flags in the output. Answers ground in Westlaw and Practical Law, KeyCite flags appear beside the authority, and the research agent uses them to steer around questioned or overruled cases.
- You need to show a committee that this worked somewhere. Named case studies with figures and a commissioned Forrester study with a published method are more than either of the other two publishes on outcomes.
- Your buying group is not a large firm. CoCounsel Legal separately addresses firms under ten attorneys, corporations, government and academic use, and is the only one of the three whose tier structure is public.
Counted from the live records, not typed. A lead can be an A over two Bs or a C over two Ds; the scoreboard below says which.
AI Liability and Recourse; Practice Systems Integration Depth.
Operational and Outcome Evidence; Firm and Practice Coverage.
No outright lead on the verification date.
Refusal and Uncertainty Behavior.
The scoreboard
All fifteen axes, three columns, graded from public sources on the same grid every vendor in the index gets. Hover a grade for what the letter means on that axis. The notes behind each letter are further down, grouped by where the three separate.
Eight places they separate, with the records beside each one
Each section was written against the records on the verification date and checks that what it describes still holds before it displays. If a record moves, the section is withheld and the notes stand on their own. The writing sits on the left, and the three records it rests on sit beside it.
Measured against asserted
Accuracy is where a vendor can show its work, and two of the three brought the workbook. Harvey and CoCounsel Legal both sat the February 2025 Vals Legal AI Report, an independent benchmark scored against a measured lawyer baseline, and both publish their own evaluation frameworks on top of it, BigLaw Bench and CoCounsel Bench. The figures live on the evaluator's own site, so a buyer can check them without taking anyone's word for anything.
Legora publishes no measurement and no evaluation framework. What it did publish, in September 2026, is how its rebuilt research layer works: an ontology of the law that maps how authorities rank and relate, including amendments, holdings against dissents and temporal validity, and its own AI native citator, with the standard set and audited by a team of former publisher attorney editors.
That layer is in limited beta, with general availability planned for the fourth quarter. It moves Legora from asserted to documented, and still leaves nothing an outsider can test. The remaining gap is a disclosure gap, not a capability finding.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
In the February 2025 Vals Legal AI Report, a third party benchmark set against a lawyer baseline, Harvey Assistant was tested on six tasks. Its results ranged from 65.0 to 94.8 percent, and it beat the lawyer baseline on five. Document question answering reached 94.8 percent, 24.7 points above the baseline, with responses under a minute. Answers on scanned and badly formatted court transcripts reached 77.8 percent, 24.1 points above it.
That study measured task accuracy rather than citation validity, and Harvey did not enter the later Vals study of citation authority.
BigLaw Bench, Harvey's own benchmark, publishes its task categories and judging criteria on a public repository, with hallucination and source results by model. It defines a hallucination as a factual claim that a source of truth can disprove and tracks reasoning errors apart. Harvey reports that its systems hallucinate less often than the foundation models on legal tasks while giving longer answers. Every agent claim links to the source passage behind it, and the full BigLaw Bench dataset is available on request.
Through Ask LexisNexis, cases are validated with Shepard's Citations and the Shepard's Signal is shown beside them. Harvey's own United States case law source, more than 9 million CourtListener opinions, runs on Harvey Graph, which maps who cites whom and how each case was treated, so an agent checks treatment before it answers. Harvey says precedent flags and cite checking for that source will follow.
Each cell in Tabular Review expands to its reasoning and the source documents behind it, and Portal answers carry links back to the exact source. Legal research works several sources in parallel, ranks them by authority and checks each finding against primary law before the answer returns.
The rebuilt research layer runs on an ontology of the law that maps how authorities rank and relate, including amendments and temporal validity, and went live in the United States on 29 October 2026. Legora says three people check every word of that data to reach 99.997 percent accuracy, and that the ontology makes the Agent 40 percent faster. US case law is updated every 24 hours. Its AI native citator, built to a standard set and audited by former publisher attorney editors, is still to come.
Legora publishes its BAR benchmark of 5,161 cases across 28 practice areas, last updated in July 2026, and says it has cataloged more than 50 ways AI fails at legal research without publishing the list. No hallucination rate for the Agent's answers is published.
The research agent identifies key legal concepts, selects Westlaw tools including KeyCite, the Key Number System and annotated statutes, runs multiple search cycles and synthesizes a structured result. Output grounds to primary authority the user can open, with inline citations, a Sources tab with direct links and highlighted excerpts, and KeyCite validity flags shown with the authority. A citation level verification feature, Deep Research Verify, is published, and prompting guardrails restrict output to content validated by people rather than the open internet.
CoCounsel took part in the February 2025 Vals Legal AI Report, a third party benchmark against a measured lawyer baseline, scoring between 73.2 and 89.6 percent across four tasks with a 79.5 percent average, each task more than 10 points above the lawyer baseline. Thomson Reuters also publishes CoCounsel Bench, under which attorneys reviewed 50 complex tasks of about six lawyer hours each and judged the product's response stronger than the expert reference answer on nearly 40 percent.
The 2025 study measured task accuracy rather than citation validity or hallucination rate, and Thomson Reuters did not take part in the later Vals study on citation authoritativeness.
Who plugs into what, and who wrote it down
Integration is the part of a legal AI purchase where announcements are most often mistaken for documentation. All three name iManage. Only Harvey documents each connection at the level an administrator needs, what it moves, in which direction, what has to be configured and what it does not support, and its iManage connection is a direct OAuth integration rather than middleware.
CoCounsel Legal has a wide surface, including its parent's HighQ and Legal Tracker, Icertis for contracts and an MCP connection that lets a lawyer reach it from a separate AI client, which is a forward looking piece of plumbing. Legora reads from and saves back to iManage, NetDocuments, Box and SharePoint, names a long list of connected systems from Datasite to Ironclad, and brings its Agent into Word and Outlook. Neither documents what each connector moves, field by field.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
HarveyWord, Outlook, Teams and SharePoint all run Harvey inside them, and Vault syncs documents from iManage, SharePoint and Google Drive. The iManage connection is a direct OAuth integration with an embedded web extension, and NetDocuments access follows the firm's existing permissions. Since October 2026, Harvey also applies the ethical wall policies kept in iManage Security Policy Manager to Threads, Vaults, Review Tables and Spaces, with Security Policy Manager remaining the system of record.
Intake takes requests from email, Jira, Slack, ServiceNow, iManage, Google Drive and SharePoint and sends updates back to the source channel. Command Center syncs employee profiles through SCIM. The Connector Library, generally available since October 2026, connects Harvey through MCP to tools such as Ironclad, Docusign, Intapp, Aderant, Everlaw, LawVu, Box, Gmail, Slack and Jira, and customers can add their own MCP connectors.
Admins choose which connectors are enabled, who may use them and which tools need human confirmation, and each connector passes Harvey's security review before launch. LexisNexis content reaches research through Ask LexisNexis.
LegoraDocument management systems are integrated rather than replaced. Legora reads access rights from the source system each time a user queries rather than caching them at setup, and Intapp Walls for AI and iManage Security Policy Manager enforce matter restrictions. The October 2026 ecosystem release covers reading from and saving back to iManage, NetDocuments, Box and SharePoint, and names Datasite, Intralinks, DiliTrust, Everlaw, Docusign, Ironclad, Agiloft, Slack, Salesforce and LawVu among connected systems.
Laurel, Intapp Time and PointOne turn work done in Legora into time entries by client and matter. Add ins bring the Agent and playbooks into Word and Outlook, EDGAR sits among the research sources, and MCP connectors link Gemini Enterprise, Blue J and ChatGPT Enterprise. Partnerships with Sirion, Conga, Avvoka and Ansarada were announced in the second half of 2026, several rolling out in phases or in beta, and an iManage MCP server was announced as planned. Field level mappings for each connector are not documented.
CoCounsel LegalNamed connections span document management with iManage, NetDocuments and SharePoint, Microsoft 365, the parent's own HighQ collaboration platform and Legal Tracker, contract lifecycle through Icertis, plus DeepJudge, Supio and Smokeball, and a Word add in carrying a personal clause library. An MCP integration lets a lawyer reach the product from a separate AI client without switching platforms. No documentation describes what each integration moves, in which direction, or what an administrator must configure.
What it costs, and who pays when it is wrong
None of the three publishes a rate card, so what separates them on price is how close each lets you get to a number. CoCounsel Legal publishes its tier structure from the main navigation and an online configurator that returns a monthly price for firms of up to ten attorneys, then routes larger firms and existing customers to sales. Harvey licenses per seat, and its help center puts the average at several hundred dollars per user per month. Legora publishes no figure, but its terms set the shape of the bill: a platform fee plus credits that the AI features consume.
On loss, all three publish the contract, and the contracts are closer than the marketing. Each caps liability at twelve months of fees, raises the cap for confidentiality and data breaches, and indemnifies the customer against intellectual property claims. Harvey and Legora put a floor under the cap, $250,000 in Harvey's agreement and €250,000 in Legora's EU terms. Harvey and Thomson Reuters both warrant that the service matches its documentation.
Harvey goes furthest. Its agreement commits it to carry industry standard insurance and to pay for an independent forensic investigation after a security incident, and it is the only one of the three to state an insurance position at all. None of the three warrants what the AI writes. Each says output can be wrong and leaves checking it to the lawyer, which is the industry norm and also exactly the job the lawyer hoped to hand off.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
HarveyLicensing is per seat. The help center FAQ, updated November 6, 2026, puts the average cost at several hundred dollars per user per month, and the price depends on the number of seats, the products deployed and the contract terms. No rate card, plan or tier is published, and buying starts with a demo and a quote from sales. Ask LexisNexis, the research add on, is licensed separately from the base service. Fees are set in each customer's order form and invoiced under the Platform Agreement.
If an order form is terminated early under the agreement, Harvey refunds a pro rata share of prepaid unused fees. Undisputed late amounts carry a finance charge at the Federal Funds Rate plus 1.5% a year.
LegoraNo pricing page or rate is published, and the commercial route is a demo request. The Global terms, dated September 2026, set the charging structure: a Platform Fee plus Credits, with AI features consuming Credits (clauses 1.3 and 2.1.2), and 45 days' notice of a Platform Fee change at renewal (clause 3.1.3). The Credit terms they refer to are not linked from the site. The general terms are published openly, so the structure can be read before a sales conversation even though the figures cannot.
CoCounsel LegalTier names and feature splits are published and reachable from the main navigation: CoCounsel Essentials, Westlaw Advantage with CoCounsel Essentials, Practical Law Dynamic Tool Set with CoCounsel Essentials, and CoCounsel Legal. Each has its own plans and pricing page, with variants for law firms, corporations and government. An online configurator on the Thomson Reuters sales site prices new customers at law firms of up to ten attorneys by number of attorneys, jurisdiction and plan length.
For one attorney it shows CoCounsel Essentials at $360.00 a month on a one year plan and $292.50 a month on a three year plan, with 12% off for two years and 18% off for three. Firms with more than ten attorneys and existing customers are routed to a sales quote, so no figure is published for the larger part of the range.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
HarveyThe Platform Agreement, last updated 9 January 2026, sets out what Harvey stands behind. Section 8 indemnifies the customer against third party claims that the service infringes intellectual property. If a claim arises, Harvey may substitute the service, secure a license to continue, or terminate and refund prepaid fees. The indemnity excludes materials Harvey did not provide and output from input the customer knew was likely to infringe.
Harvey warrants that the service conforms to its documentation, is delivered in a professional manner and complies with applicable law. It also commits to carry industry standard insurance with insurers rated A- or better by A.M. Best. Total liability is capped at the greater of 12 months of fees or $250,000. Payment, indemnity and claims the law will not let a contract limit, such as gross negligence, sit outside that cap.
Data breach and confidentiality claims carry a separate cap of twice 12 months of fees or $500,000. After a security incident, the Security Addendum commits Harvey to an independent forensic investigation at its own cost. The agreement states that output is AI generated and may contain errors.
LegoraGeneral terms and conditions are published openly in an EU version, last updated May 2026, a version for the United States and Global terms dated September 2026. Clause 6.3.2 of the EU terms caps liability at the greater of twelve months of fees or €250,000, and clause 6.3.3 raises it for Enhanced Claims, breaches of confidentiality or the data processing agreement, to the greater of twice the fees or €500,000. The US version has the same structure in dollars, and the Global terms cap at twelve months of fees and twice the fees with no floor.
Clause 5.1.1 gives an intellectual property indemnity only, clause 6.2.6 gives no warranty on output, and the Global terms exclude liability for beta features. No indemnity for third party claims arising from output or insurance position is stated.
CoCounsel LegalCoCounsel Legal is sold under Thomson Reuters' General Terms for the United States (version 6.0, 1 September 2026), which cap each party's liability in a calendar year at the fees payable for the affected service in the twelve months before the claim. The cap doubles for breaches of confidentiality, data protection or security, and indirect and consequential loss is excluded. Thomson Reuters defends and indemnifies the customer against third party claims that use of the service infringes intellectual property, and that indemnity sits outside the cap, except for claims arising from third party services Thomson Reuters licenses, which are capped at twice the prior twelve months' fees.
The service warranty promises conformity with the documentation, with repair, modification or replacement as the remedy and termination if that fails. For AI output, the terms disclaim liability for its accuracy, legality or reliability and for decisions based on it, and the customer must have a licensed professional or similar expert review it before relying on it. The Legal AI Terms of 23 January 2026, which govern the AI features, add no liability term of their own, and neither document states an insurance position.
Proof it worked somewhere
Every vendor in this market has customer logos. The question is whether anyone could check the claim behind them. CoCounsel Legal is the only one of the three that publishes named customers with figures and an assessable method: Justly Prudent reporting five times return on investment and a doubling of litigation capacity, Brinks on outside counsel spend, and a commissioned Forrester Total Economic Impact study dated 2026 whose commissioned status is disclosed on the page. Aggregate figures arrive with the population stated.
Harvey states 700 plus customers across 58 plus countries and publishes attributed quotes, including Blank Rome on the iManage integration and a Burges Salmon selection story. Legora states more than 1,000 customers across 50 plus markets and a Grant Thornton UK forensic investigations story. Both are real evidence and both stop short of a dated outcome figure with a method a reader could assess, and that is the whole difference between them here. Every customer count on this page is vendor stated, and these three compete for the same accounts.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
HarveyCustomer stories name the firm and give figures. Reed Smith, with about 1,800 lawyers in 34 offices, reports 700 Harvey users a day, 1,400 a month and AI certification for every associate. Repsol's legal division started a pilot in January 2024 with 50 lawyers in 12 jurisdictions and reports cutting the time on one process by more than 90%. CMS reports 95% adoption, and The Adecco Group's general counsel says more than 80% of its legal professionals report real gains in quality and speed.
In October 2026 CVS Health expanded Harvey across its corporate affairs functions after a pilot, with the in house legal team using it for document review, research, drafting and knowledge retrieval. Cozen O'Connor and Spencer West chose Harvey in November 2026. Other named customers include A&O Shearman, Gleiss Lutz, Cuatrecasas, Macfarlanes, KKR, PwC, Deutsche Telekom, HubSpot, Bridgewater and Carvana. The figures are usage counts and time savings as each customer reports them, with no stated method for how they were measured.
LegoraLegora's October 2026 Series E release puts use at more than 140,000 legal professionals at more than 2,400 firms and teams in over 80 markets, with more than half of the AmLaw 50 as customers and in house teams above 40 percent of new customers in the third quarter. Named rollouts carry dates. Jones Day took Legora firm wide across more than 2,500 lawyers in 40 offices (October 2026), Hogan Lovells Cadwalader began a pilot with more than 1,300 lawyers in 18 practice teams (October 2026), and Stoel Rives adopted it for about 350 attorneys (October 2026).
Linklaters reports that 97 percent of its weekly active users worked in the Agent within a month, and that monthly active use among partners rose from 65 percent to almost 80 percent. Other named customers include White & Case, Crowell, Accor, Dentons Europe, BMW Group, Salesforce and Veolia. The customers page reports that 25 percent of users see better quality work, that experienced users save 80 percent of non billable hours weekly, and that firms bill $6.4 million more per 100 lawyers a year, without a date, sample or method for those figures.
CoCounsel LegalThomson Reuters publishes case studies naming Justly Prudent, reporting five times return on investment and a doubling of litigation capacity, and Brinks, on reducing outside counsel spend. It also publishes a commissioned Forrester Total Economic Impact study dated 2026, with its method set out and its commissioned status disclosed on the page. Aggregate figures are published with the population stated, including 2,700 corporate customers using the CoCounsel family and a 61 percent reduction in time to draft correspondence.
The paperwork, and whether you can download it
The grid has moved on at least one of these axes since this reading was written. The grades and notes on the right are current; the reading is withheld rather than left on the page to mislead, and will be rewritten against the new records.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
HarveyISO/IEC 42001:2023 certification covers Harvey's AI management system, and the Statement of Applicability published with it sets out the controls in scope. Its AIUC-1 certification, an AI security and safety standard, was conducted by Schellman and, in Harvey's account, validates its adversarial testing and AI security program. The trust center adds IRAP attestation, an EU AI Act item and AI Governance, AI Monitoring and AI Overview documents, with an AI Acceptable Use Policy among its policies.
An AI Policy dated 26 December 2025 commits to testing the accuracy, reliability and suitability of the AI in the service and to change management for continuing legal compliance. No accountable owner is named, and nothing is published about uneven output across matter types or populations.
LegoraLegora holds ISO 42001 for its AI management system, independently audited with ongoing surveillance, and publishes what the certification covers: how AI is designed, deployed, supervised and monitored, with human oversight and structured governance as the operating principles.
No internal owner of AI governance is named, no results of testing on model behavior before release are published, and nothing covers uneven output across matter types, parties or populations.
CoCounsel LegalThomson Reuters publishes a named standard it calls Fiduciary-Grade AI with a buying framework attached, describes a dedicated research organization of more than 1,000 specialists, states a figure for annual responsible AI investment, and answers a direct published question on bias: prompting guardrails restrict output to a clearly defined and limited set of human validated content rather than the open internet. No named internal owner of model governance, pre release testing results, or disclosure of uneven output across matter types, parties or populations is published. The bias answer describes a content restriction rather than testing for disparate output.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
HarveySchellman audits Harvey for SOC 2 Type II and ISO 27001 every year, and the 2026 audit and certification renewal are complete. The trust center also lists ISO 27701, ISO/IEC 42001, AIUC-1, IRAP, TX-RAMP Level 2, GDPR, CCPA and an EU AI Act item. It publishes Statements of Applicability for ISO 27001, 27701 and 42001.
In October 2026 Harvey announced FedRAMP Class D certification, operating within Knox Systems' FedRAMP Class D certified cloud environment for federal agencies and contractors. Schellman, NCC Group and Bishop Fox perform external audits, and third party penetration tests run every year. Reports, the CAIQ v4.0.3, SIG Core and SIG Lite questionnaires and the data flow and network diagrams are released through a self serve access request, with bulk download.
LegoraISO 27001:2022 with a yearly audit, SOC 2 Type II covering the security criteria and ISO 42001 for the AI management system are all current. The trust center at security.legora.com carries a resources section and a data flow diagram, and the security whitepapers and security measures annex are published without a gate. The security page says penetration tests run twice a year under an assume breach method, while the security measures annex of January 2025 describes them as annual.
Customers can bring their own encryption keys, set retention periods and have data deleted when the contract ends. The certifying auditor is not named.
CoCounsel LegalSOC 2 Type II and ISO 27001 are stated as maintained, and ISO 42001 is referenced for the AI management system. FedRAMP In Process status is published for Westlaw and Practical Law, with authorization stated as an investment goal for this product, and a corporate trust center publishes the information security management framework. No attestation report, coverage period, audit scope or named auditor is published, and no route to request the reports without a sales conversation is published either. Certifications are stated at the parent company level rather than scoped to this product.
Where the AI stops, or does not
The grid has moved on at least one of these axes since this reading was written. The grades and notes on the right are current; the reading is withheld rather than left on the page to mislead, and will be rewritten against the new records.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
HarveyAgents show their plan before they run, so a lawyer can adjust the scope and approve the work before Harvey begins. While an agent works, Harvey brings the lawyer back in when a judgment call is needed, logs every step and cites a source for every claim.
Legal Work Orchestration, launched in October 2026, sets defined review gates inside a matter. Each task carries its scope, inputs and reviewer, and when an agent finishes a review Harvey notifies the designated partner. The task completes only once that partner approves it, and the next step then begins.
Intake applies routing rules the legal team defines to send each request to an approved agent, to Contract Intelligence or to a lawyer. In the Connector Library, admins choose which tools are enabled, who may use them and which require human confirmation before they run. Reports and reviews can run on a schedule, and admins govern access through roles and workspace permissions. What happens to an agent's work when a reviewer rejects it, and what Harvey commits to when that work is wrong, are not stated.
LegoraThe Agent proposes a plan before it acts, carries out the work across documents, data sources and tools, checks whether it met the goal, and delivers work product into the project workspace for the lawyer's review and approval. It can also act without being asked, watching email, documents and projects and starting work when something needs attention. Tabular Review adds Mark as Reviewed, Lock Cells and Review Mode for team review, and full audit trails record every tool call, file access and agent action.
ISO 42001 covers the AI management system, with human oversight named as a principle. No threshold at which the Agent stops for a person, and no route after a wrong output, is described.
CoCounsel LegalThomson Reuters states that its AI is built with human oversight at its core and publishes a Fiduciary-Grade AI framework built around transparency and accountability. The product is described as showing its plan before executing: it interprets a request, builds a plan specific to the matter, and returns work product with traceable citations the user can open and check. No threshold is published at which an agent stops and returns to a lawyer.
The General Terms require a licensed professional or similar expert to review AI output before anyone relies on it, and nothing says what Thomson Reuters does once a wrong answer is reported. The August 2026 release moved the product from structured skills to a fully agentic experience.
Who it is for, where it runs, and what sits underneath
The grid has moved on at least one of these axes since this reading was written. The grades and notes on the right are current; the reading is withheld rather than left on the page to mislead, and will be rewritten against the new records.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
HarveyLarge law firms, mid sized firms, in house legal departments and professional services firms are the stated buyers. Since October 2026, federal agencies and contractors can also use Harvey within a FedRAMP Class D environment. Industry pages cover healthcare and life sciences, technology, energy and utilities, media, entertainment and telecom, and the public sector. More than 200,000 lawyers at over 3,500 organizations in more than 85 countries use Harvey, including 80% of Am Law 100 firms and five of the Fortune 10, and its in house page counts more than 1,000 enterprises.
Solutions pages address litigation, transactional work and innovation teams, and research spans legal, regulatory and tax questions across jurisdictions. Firm sizes or practice areas the product is not built for are not stated.
LegoraLarge law firms, small and mid sized firms, in house legal departments, the public sector and professional services are all served, with solution pages for M&A, litigation, banking, insurance, private equity and tax. Multi jurisdiction and cross border work are stated strengths, with research sources across Europe and federal and state law in the United States. No firm size or practice area is named as outside its scope.
CoCounsel LegalPublished navigation separates law firms under ten attorneys from firms over ten, and separately addresses corporations, government (including courts, prosecutors, public defenders, city attorneys and law enforcement), and academic use across more than 200 law schools. Practice areas are listed with their own pages, spanning business and commercial, civil litigation, criminal defense, family, labor and employment, mergers and acquisitions and personal injury. The published table of plans shows which content each plan reaches.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
HarveyMicrosoft Azure hosts Harvey's cloud environment, with each customer's data logically separated and access set by role. Customers can keep data in region in the EU or Switzerland, the United States or Australia, and sign in through a separate US, EU or AU login. Customers with localization needs can also have processing in the EU and Switzerland or in Australia, and that commitment extends to Harvey's subprocessors. The Subprocessor List gives each model provider's processing locations.
Where Anthropic or Mistral models are not offered in a chosen region, Harvey reaches them through hosting platforms such as AWS Bedrock and Google Vertex. Federal customers can use Harvey within Knox Systems' FedRAMP Class D certified cloud environment. What changes between plans or tiers is not stated.
LegoraLegora runs separate arrangements for the EU, the United States and Asia Pacific. Its subprocessor list sets out hosting and AI model providers by region, Microsoft, AWS and Google among them, with EU customers' data held in the EU and EEA. For Asia Pacific it separates hosting in Australia from AI model processing in the EU and Asia Pacific, with OpenAI processing in the EU. The security page says enterprise customers control where their data is stored.
Storage is tiered to data sensitivity, technical teams in the EU and the United States support local clients, and subscriber environments are logically separated.
The regions open to each package and the processing location for every feature are not set out in one place.
CoCounsel LegalPublished data residency controls keep information within required geographic boundaries. The rollout is sequenced by country across the United States, Canada, the United Kingdom and Australia, and FedRAMP In Process status is held for the underlying Westlaw and Practical Law products, with stated investment toward authorization for this one. The list of available regions, the tenancy model, what changes between tiers, and where processing happens as distinct from where data is stored are not published.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
HarveyThe Subprocessor List names ten AI providers with their processing locations, among them Microsoft, OpenAI, Google Cloud, Amazon Web Services, Anthropic and Mistral. ElevenLabs supplies voice services, DeepL machine translation, and Baseten and Fireworks.ai further model hosting. Claude and Gemini models run through Amazon Bedrock and Google Vertex AI, as Harvey's subprocessor FAQ explains. Model providers work under zero data retention, with no human review and no training on customer data.
Harvey Tenet, in research preview since August 2026, is Harvey's own open weight model, post trained from Moonshot's Kimi K3 with Fireworks for long legal tasks. Harvey says it was trained on synthetic, public legal and expert data, with no customer data. Where Tenet runs and which customers can use it are not stated.
Under the DPA, customers who subscribe to the list receive notice at least 30 days before a new subprocessor is added and may object. Which model serves which feature is not stated.
LegoraThe subprocessor list, dated 6 July 2026, names Microsoft, AWS and Google for hosting, infrastructure and AI models and OpenAI for AI models, with DeepL for optional translation, Linkup Labs and Exa Labs for web results, turbopuffer for search infrastructure and Intercom for support, each with its residency. New subprocessors are announced by updating the list, with 30 days for the subscriber to object. An orchestration layer handles model selection across tasks.
No model or model version is named, and nothing states which provider serves which feature.
CoCounsel LegalAnthropic's Claude Agent SDK is named as the architecture of the current release, and a published FAQ names OpenAI and Google as third party AI partners and states the contractual position imposed on them. Which model serves which task, where the models run, a maintained subprocessor list for this product, and any commitment to notify customers before the model supply chain changes are not published.
Where the three agree, and why that is not the same as settled
The grid has moved on at least one of these axes since this reading was written. The grades and notes on the right are current; the reading is withheld rather than left on the page to mislead, and will be rewritten against the new records.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
HarveyAgents, Vault review tables, Knowledge research, Contract Intelligence review, Intake triage and Horizon Scanning all produce their output with language models. No document management or workflow system sits underneath that a firm would buy on its own. Vault stores matter documents, and its purpose is extraction, comparison and reporting across them.
LegoraEverything Legora sells is generative. The Agent plans and executes legal work across the platform's tools, Tabular Review extracts answers from each document into a grid, research answers questions across jurisdictions, and drafting runs in Word, Outlook and the built in editor. An orchestration layer handles tool routing, memory, model selection and guardrails beneath them. Without the models there is no product left to sell.
CoCounsel LegalCoCounsel Legal exists only as a generative and agentic layer, rebuilt in 2026 on an agent framework so it plans, reasons and executes multi step legal work. Without the models there is no product, only the underlying Westlaw and Practical Law content, which the parent sells separately as its own products.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
HarveyNeither Harvey nor its subprocessors may train any AI model on customer content or data, and model providers work under zero data retention. A firm can ask for a bespoke model trained on its own data and used only for that firm. Harvey syncs and enforces the firm's existing ethical wall policies and never creates, modifies or deletes walls, so the walls provider stays the system of record. Workspaces are logically separated, access follows roles, and data is deleted within 30 days of termination.
If the law or a court compels disclosure, Harvey gives advance written notice where it is legally permitted. Attorney client privilege and work product are not addressed as such.
LegoraThe general terms bar Legora from using a subscriber's confidential information to train or fine tune AI models and require the same of its subcontractors. The terms, the data processing agreement and the security measures annex are published in versions for the EU and the United States, and the annex covers least privilege access, personnel confidentiality, authorization controls and retention on customer instruction.
Ethical walls and role based access are stated to keep confidential information from crossing matters or projects, on access control built on the Zanzibar authorization model, and engineers reach customer data only with the customer's written approval. Privilege and work product handling are not addressed.
CoCounsel LegalThomson Reuters' Legal AI Terms of 23 January 2026, part of the customer agreement, bar Thomson Reuters and its third party providers from training or fine tuning any generative or foundation model on prompts, user content or outputs unless agreed separately in writing. Prompts and outputs may be used to evaluate safety and effectiveness, with automated safeguards that keep sensitive and identifying information out of those samples.
A published FAQ states plainly that customer content and prompts are not used to train or improve the product or the underlying models. Third party model partners, including OpenAI and Google, are contractually prohibited from training on customer data, and systemic controls turn off those parties' abuse monitoring so there is no human access to customer data. Thomson Reuters also publishes a zero retention API architecture and data residency controls.
The General Terms treat customer data as confidential information and allow its disclosure under law, subpoena or court order only with prior notice where legally permitted. Attorney client privilege and work product handling are not addressed directly. Thomson Reuters does not describe segregation by matter, although the product is built around matters.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
HarveyCustomers choose what to upload, set their own retention policies and can delete data at any time. Within 30 days of termination, Harvey deletes remaining customer data and content unless told otherwise, and the DPA extends return or deletion to every subprocessor. Access runs on role based controls, logical workspace separation, SAML SSO, audit logs and IP allow listing. The Subprocessor List, updated 21 September 2026, names each provider with its purpose and location, and subscribers receive at least 30 days' notice of an addition with a right to object.
Under the Security Addendum, Harvey notifies the customer of a security incident without undue delay and within 48 hours. It then reports the incident's nature, the investigation and the mitigation, and keeps relevant logs for at least a year.
LegoraThe security measures annex sets least privilege and role based access, and centrally stored logs traceable to unique usernames, with security logs kept at least 12 months. It adds data integrity signing, background checks and confidentiality agreements for staff, and retention as the customer instructs. Subscriber environments are logically separated and full production backups run every four hours.
The data processing agreement has Legora report a personal data breach within 36 hours and delete or return personal data at the subscriber's choice when it ends. The subprocessor list, last updated 6 July 2026, names each provider with its purpose, data and residency, and a new subprocessor comes with 30 days to object. Penetration tests cover the full platform twice a year.
CoCounsel LegalSOC 2 Type II and ISO 27001 are maintained and ISO 42001 certification is referenced for the AI management system. Thomson Reuters publishes a zero retention API architecture, data residency controls, 24 hour security monitoring and threat detection, corporate identity management integration, and a corporate trust center carrying the information security framework. The Data Security Addendum that the General Terms apply, last modified 26 October 2026, commits to notice of a security breach within 72 hours, and the General Terms delete production data within 90 days after termination on written request.
No current named subprocessor list is published for this product. The two named model partners are disclosed in the AI FAQ rather than in a maintained subprocessor list.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
HarveyOutput is not legal advice and may contain errors, misstatements or gaps, and the Platform Agreement calls the service a research tool. Harvey sells to lawyers, legal departments and professional services firms, and its agent pages leave the judgment on every task with the lawyer. Access credentials belong to one named user and may not be shared. Nothing addresses competence and supervision duties under professional rules, or the jurisdictions where the product may be used.
LegoraLawyers, firms and in house teams are the buyers, and the product is described as working with lawyers rather than replacing them, with the Agent's output delivered for a lawyer's review and approval. Legora's Acceptable Use Policy, dated 4 May 2026, and clause 6.1.2 of its EU general terms state that Legora is not a law firm and does not practise law, and the Global terms warrant that its agentic tools include human in the loop review checkpoints.
No treatment of competence and supervision duties and no jurisdiction limit appears in the policy, the terms or the product pages, though Legora publishes a list of supported countries.
CoCounsel LegalThe product is sold to licensed professionals and distributed to more than 200 law schools and 120,000 law students. Thomson Reuters frames the system as working at the level of a senior associate under professional supervision, and its General Terms for the United States put that supervision into the contract: a licensed professional or similar expert must review AI output before anyone relies on it, uses it or passes it on, and the customer alone is responsible for verifying it.
The same terms say the service is provided for information and not as legal advice. The product page, the AI hub, the trust center, the legal blog and the terms name no jurisdiction limits and say nothing of a lawyer's competence duties.
The twelve legal signals, three columns
The signals are recorded rather than graded, because "does this vendor train on my client's data" has an answer, not a letter. Read across three columns they sort into three piles: the ones where the three say the same thing, the ones where one of them says something the other two do not, and the ones where all three say nothing.
All three let the customer set the retention window, and none publishes a default period or a zero option for its own storage, so you can set the window without knowing what it is until you do.
The splits this reading was written against have moved; the matrix below carries the current values.
None of the three says what the product does when it cannot ground an answer. None of the three engages a named ethics opinion, not ABA Formal Opinion 512 and not a state bar; two make a general reference to professional standards and one makes none. For products sold only to lawyers, that is a quieter room than you would expect.
What happens to client material once it enters the product, and what the vendor has committed to in writing.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Read the three records
Under the Platform Agreement, Harvey will not train any AI model on customer content or customer data, and its subprocessors will not either. The term covers both uploaded documents, which Harvey calls customer data, and the prompts and answers it calls customer content. A firm that asks for it can have a bespoke model trained on its own data and used only for that firm. Harvey may use usage data, such as feature and session statistics, to develop and improve the service, and usage data excludes customer data and content.
Under the heading Feedback, Usage Data and no training, Legora's general terms bar it from using a subscriber's confidential information to train or fine tune AI models and bar its subcontractors from doing so. Legora may use usage data to develop and improve the services, and shares it outside the company only when aggregated and anonymized. The home page and security page repeat the commitment as zero AI training on customer data.
Thomson Reuters' Legal AI Terms (version 1.0, 23 January 2026) govern the AI functionality in its legal products and form part of the customer agreement. They bar Thomson Reuters and its third party providers from developing, training or fine tuning any generative or foundation model with user prompts, user content or outputs unless agreed separately in writing, and allow prompts and outputs to be used to evaluate safety and effectiveness, with automated safeguards that keep sensitive and identifying information out of those samples.
A product FAQ adds that AI partners including OpenAI and Google are contractually prohibited from training on customer data, and Thomson Reuters states it has turned off those partners' abuse monitoring so there is no human access to customer data.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Read the three records
Customers decide what to upload, how long it is kept and whether it can be shared inside the organization, and they can delete data at any time. No default retention period is published. Model providers work under zero data retention, and subprocessors other than cloud storage providers may not retain or log content for human review. After termination, Harvey deletes remaining customer data and content within 30 days unless the customer instructs otherwise.
Section 17 of the security measures annex, dated 31 January 2025, keeps personal data under whatever retention the subscriber instructs during the data processing agreement, and clause 11 of that agreement governs return or deletion after it ends. No default retention period or zero retention setting is published. Backups of the full production environment run every four hours, and each subscriber's environment stays logically separate.
A product FAQ says retention of user content and prompts is customized to the customer, set at the organization account level with the support of a client manager, and that Thomson Reuters deletes in line with the customer's own retention policy. Users can also delete their content and prompts in the product at any time. No retention period is published for the life of a subscription, so the window is whatever the customer negotiates, and setting it runs through a client manager rather than an administrator control the customer operates alone.
The General Terms add that, on written request at termination, customer data in the production environment is deleted within 90 days, with backups deleted in the normal course of business. The separately published zero retention statement covers the model provider API layer rather than the product's own storage.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Read the three records
NetDocuments permissions carry through, so a user sees only the cabinets, matters, folders and files they can already open, and Harvey does not change those permissions. The iManage connection is a direct OAuth integration that respects iManage permissions and ethical walls.
Since October 2026, Harvey applies the wall policies kept in iManage Security Policy Manager to Threads, Vaults, Review Tables and Spaces. A synced workspace takes its matter's policy, and each recipient of a shared Vault or Thread is checked against the walls on every matter it draws on. Security Policy Manager stays the system of record, and audit logs record wall syncs, access attempts and enforcement changes. Harvey also syncs other ethical walls providers and blocks walled users from reaching or sharing restricted content.
Legora reads access rights from the source document system each time a user works, rather than caching them once at setup, so a lawyer sees in Legora only what iManage, NetDocuments or SharePoint already opens to them. Ethical walls are enforced through Intapp Walls for AI and iManage Security Policy Manager, and Legora's own access control, built on the Zanzibar authorization model, keeps confidential information from crossing matters or projects. Full audit trails record every tool call, file access and agent action.
Integrations with iManage, NetDocuments and SharePoint are named, and corporate identity management integration is stated, but Thomson Reuters does not say whether retrieval enforces source system permissions at query time per user, or how ethical walls and matter level segregation are handled. A third party review refers to granular roles and ethical walls; Thomson Reuters' own material does not.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Read the three records
If law or a court order compels Harvey to disclose a customer's confidential information, the Platform Agreement commits it to advance written notice where legally permitted and to help seek confidential treatment. The DPA makes the same commitment for law enforcement requests for personal data. Where the law forbids notice, Harvey seeks a waiver and tells the customer once the prohibition ends. Its Law Enforcement Requests policy sends agencies to the customer first, challenges requests its lawyers consider unlawful and answers foreign requests only through channels such as a Mutual Legal Assistance Treaty. No transparency report is published.
Either party may disclose confidential information under the general terms when law or an order of an authority, regulator or court compels it. The compelled party gives the other notice of the proceeding where the law allows and cooperates in seeking confidential treatment. The data processing agreement adds notice of any communication with a data protection authority about Legora's processing. No transparency report is published.
Thomson Reuters' General Terms for the United States treat customer data as confidential information. They let a party disclose the other's confidential information when law, regulation, subpoena or court order requires it, and only after prior notice and reasonable help to contest or limit the disclosure, where legally permitted. No transparency report is published.
Where the law comes from, whether it is still good law, and what the product does when it does not know.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Read the three records
Knowledge connects questions to more than 500 legal sources across jurisdictions. It names its publisher partners, among them Ask LexisNexis, Wolters Kluwer, Gyldendal Rettsdata, SCC Online, Otto Schmidt, Lefebvre and Tirant lo Blanch, beside EUR-Lex and SEC filings on EDGAR. United States case law also comes from more than 9 million CourtListener opinions, and in October 2026 Harvey widened its Italian legislation, case law and commentary.
The Subprocessor List names RELX, doing business as LexisNexis, for Ask LexisNexis, and Parallel Web Systems and you.com for web browsing. Harvey's AI Policy commits it to obtaining the rights and licenses its data sets require. No license basis per source or update schedule is published.
Legora's research page describes its corpus as publisher partnerships and official sources. Its newsroom names US federal and state primary law, hosted on Legora and updated every 24 hours, content partnerships with Wolters Kluwer's Legal and Regulatory US business and the American Law Institute, and European official sources, while the Qura acquisition adds a Swedish database of case law, legislation and regulation.
Legora says it brought in outside counsel to confirm that the court opinions it hosts are public. No license basis is stated source by source.
Output is grounded in Westlaw and Practical Law, proprietary databases Thomson Reuters owns and sells separately, maintained by more than 1,200 full time attorney editors. Thomson Reuters material is explicit that the system draws on this content rather than scraping the public internet. The rights basis is ownership rather than a stated license, and no update cadence or lag for the underlying content is published.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Read the three records
Ask LexisNexis brings United States primary law from LexisNexis into Harvey, with Shepard's Citations showing whether each cited authority is still good law. In the Motion to Dismiss workflow, built with LexisNexis in October 2026, cases are validated through Shepard's and the Shepard's Signal is reported beside them. Both depend on the customer's access to Ask LexisNexis.
Harvey's own United States case law source, more than 9 million CourtListener opinions, runs on Harvey Graph, which maps how each case has been treated so an agent checks treatment as it answers. Harvey says precedent flags and cite checking for that source will follow, and outside the United States no treatment signal is described.
Legora is building its own AI native citator on an ontology of the law. The ontology captures the hierarchy of authority, how sources relate and temporal validity, so an amended rule or an overruled case is recognized as such, and former publisher attorney editors set and audit the standard. The ontology went live in the United States on 29 October 2026, while the citator itself is still to come, with more detail promised later in 2026.
The technology comes from the Qura and Wexler acquisitions. No coverage figure or error rate is published for treatment.
Treatment signals come from KeyCite, the vendor's own named commercial citation service, and appear with the authority. Vendor engineering material states that reports carry inline citations, KeyCite flags and excerpts, and that the research agent uses KeyCite warnings to flag questioned or overruled cases and adjusts its strategy accordingly. Separate vendor material describes the system recognizing red and yellow validity flags and factoring them into its analysis rather than only displaying them.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Read the three records
BigLaw Bench publishes hallucination rates and explains how Harvey defines and detects hallucinated claims, and agents cite a source for every claim. No setting or behavior is described for declining to answer when Harvey cannot ground a response.
The Agent checks whether it met the goal and loops back to adjust, and research ranks sources by authority before answering. No explicit no answer path, abstention behavior or confidence value shown to the user is described.
Research logs, step by step reasoning, an audit trail and prompting guardrails that restrict output to a defined set of validated content are all described. No path for declining or abstaining is described for when the product cannot ground an answer, and no confidence or grounding score is shown to the user.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
Read the three records
The AI Hallucination Cases database, maintained by Damien Charlotin, records court decisions worldwide that address hallucinated AI content and names the tool involved where known. It lists one matter naming Harvey, Hill v. Foundation Media LLC (S.D.N.Y., No. 25-cv-5947). On 22 September 2026 the court directed defense counsel to say whether AI was used on a brief with two questioned quotations and a citation, and a week later it took no further action.
Harvey is named only in counsel's own letter to the court, which says the brief was prepared with Harvey. No order makes any finding about Harvey or its output. A Galicia High Court order of 7 July 2026 lists Harvey AI among verified legal AI tools while setting a €1,800 fine, again with no finding about the product. Harvey's agreement states that output is AI generated and may contain errors.
One decision in the AI Hallucination Cases database kept by Damien Charlotin names Legora as the tool behind a lawyer's filing. In Farhat v. Cutera, Inc. (N.D. California, 28 October 2026), the court admonished the lawyer, with no monetary or professional sanction, and no vendor dispute is recorded. Legora's research checks findings against primary law, and its Tabular Review links every answer to the document it came from.
In Fletcher v. Experian Information Solutions, No. 25-20086, the Fifth Circuit sanctioned appellate counsel $2,500 on 18 Feb 2026 after a reply brief was found to contain 16 fabricated quotations and 5 further misrepresentations of law or fact. The court's findings address counsel's conduct: failure to verify, and evasive and misleading responses to the show cause order, which the court treated as conduct unbecoming under FRAP 46(c).
The possible sources counsel identified were named by the court as Casetext and vLex, both described as generative AI products; Casetext is the brand Thomson Reuters acquired in 2023 and replaced with CoCounsel, and the court made no finding about either product's own output. The AI Hallucination Cases database kept by Damien Charlotin also holds six entries naming CoCounsel as the tool, and each outcome falls on the filer.
Four are lawyers' filings in which Thomson Reuters says it investigated and the errors did not originate in Westlaw or CoCounsel: Hill v. Workday (N.D. California, 5 September 2025 and 28 April 2026), United States v. Farris (Sixth Circuit, 3 April 2026), where counsel was disqualified and given a bar referral, and Heimkes v. Fairhope Motorcoach Resort (S.D. Alabama, 31 March 2026). The other two ended in warnings, to counsel in CVTEK, a bid protest decided by the Government Accountability Office on 12 February 2026, and to a self-represented plaintiff in Williams v. Capital One Bank (D.D. C., 18 March 2025).
The obligations that attach to a lawyer rather than to software, and whether the vendor has engaged with them in public.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Read the three records
Harvey's terms call the service a research tool whose output is not legal advice, and the agent pages leave the judgment on each task with the lawyer. No named ethics opinion appears, such as ABA Formal Opinion 512 or a state bar opinion.
Material Legora publishes on its own AI governance and ISO 42001 certification engages none of ABA Formal Opinion 512, a state bar opinion or national bar guidance on lawyers' use of AI.
Thomson Reuters publishes a named framework and a buying guide that address professional standards in general terms, and markets a responsible AI position to courts and government. Neither engages a named ethics opinion, including ABA Formal Opinion 512 and state bar guidance.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Read the three records
ROI calculators for law firms and in house teams sit on Harvey's site, and customer stories report time saved, such as Repsol's. Command Center reports adoption by user, practice group and role. Nothing records AI assisted work per matter for billing, or addresses how a firm bills for that work or discloses it to clients.
Law firms and in house teams buy the product. Integrations announced between August and October 2026 with Intapp Time, Laurel and PointOne turn each task a lawyer completes in Legora into a time entry by client and matter, giving firms a record of AI assisted work for billing. The customers page also reports 80 percent of non billable hours saved weekly by experienced users and $6.4 million in additional billing per 100 lawyers a year. Legora offers no guidance on how firms should bill or disclose AI assisted work to clients.
Thomson Reuters quantifies time savings: a 61 percent reduction in time to draft correspondence, a customer story reporting an hour's task completed in five minutes or less, and a commissioned return on investment study. The product page, the AI hub, the legal blog and the customer stories describe no per matter record of AI assisted work for fee purposes and give no guidance on billing, fee or client disclosure treatment.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Read the three records
The trust center offers a Data Processing Addendum, a Business Associate Addendum and a Data Subject Requests item. It adds the CAIQ v4.0.3, SIG Core and SIG Lite questionnaires, data flow and network diagrams, a HIPAA report and a Security Welcome Packet. Sensitive items are released through a self serve request with bulk download. Statements of Applicability for ISO 27001, 27701 and 42001 show what each certification covers.
The public Subprocessor List names every provider with its purpose and location, and subscribers hear of additions 30 days ahead.
Legora publishes its subprocessor list by region, last updated 6 July 2026, naming Microsoft, AWS, Google and OpenAI as AI model and hosting providers with their purpose, data categories and residency, and offers email updates. Its general terms, data processing agreement, security measures annex and acceptable use policy are published without a gate. No client facing consent or notice pack is offered, and trust center documents come through a request.
A published FAQ names the third party model providers that may process customer content, OpenAI and Google, and states the contractual prohibition imposed on them, with no agreement needed to read it. A corporate trust center publishes the information security framework. No maintained subprocessor list for this product and no consent or notification pack a firm could forward to its own client is published.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Read the three records
Audit logs are a standard enterprise control, agents log every step, and every claim links to the source passage behind it. Command Center reports usage by user and feature. No export brings together the model used, the sources retrieved and the human review for one document.
Full audit trails record every tool call, file access and agent action, Tabular Review cells link to their source documents, and Portal answers cite the exact source. No export for each document records the model used and the human verification, and no court disclosure template is offered.
Thomson Reuters states that each research report includes transparent research logs with verifiable citations and step by step reasoning. Sources are hyperlinked with highlighted excerpts in a dedicated tab, and KeyCite validity flags appear with the authority, which together show what was retrieved and its status. The model used is not identified per output, since Thomson Reuters says the system works across multiple providers, and no export per document covering model, sources and human verification together is described.
The questions all three leave open
Derived from the records above rather than written, so it cannot favor any of the three.
None. On every axis at least one of the three publishes something to check. That does not make the record complete, which is what the next list is for.
- Refusal and Uncertainty BehaviorWhat does the product do when the answer is not in the corpus?
- Client Data in Training · Never, in the contract
- Prompt and Output Retention · Customer controlled, no zero option
- Third Party Request and Subpoena Notice · Notice committed
- Primary Law Corpus Provenance · Sources named, basis unstated
- Outside Counsel Guideline Readiness · Subprocessors listed
- Court Disclosure Support · Partial record
The three pairs, one at a time
Each edge of this triangle has its own page with a written verdict and the full records for its two vendors. This page reads the three at once; those read two in depth.
Harvey vs LegoraHarvey and Legora both give a law firm agents that plan multistep work for a lawyer to approve, so the real difference lies in what surrounds the agent. Harvey ties the work to publisher content and to partner review. Harvey's Knowledge draws on more than 500 sources from publishers such as Wolters Kluwer, Otto Schmidt and Lefebvre. Ask LexisNexis checks cases through Shepard's Citations, and under Legal Work Orchestration a task closes only when its designated partner approves it. Legora ties the work to the bill and builds its own research stack. Each completed task can become a time entry by client and matter in Intapp Time, Laurel or PointOne. Its ontology of US law went live in October 2026, and its own citator is still to come. Buying differs too. Harvey starts with a contact sales form and sets fees in each order form. Legora quotes after a demo, and its Global terms charge a platform fee plus credits that the AI features use up. Pick Harvey when research must rest on a licensed citator and partners sign off each step. Pick Legora when AI work should land on the matter's bill.
Harvey vs CoCounsel LegalCoCounsel Legal and Harvey now both sell agentic legal AI, so the real difference is what each one reasons from and where the work happens. CoCounsel Legal plans a matter step by step from Westlaw, Practical Law and the firm's own files, and shows its reasoning as it goes. It adds Westlaw Brief Builder and tabular review of up to 10,000 documents against 100 questions. It suits a buyer whose answers need licensed authority behind every citation, and it is sold in plans bundled with Westlaw and Practical Law. Harvey routes work across its own agents, Vault, Knowledge and Spaces, a shared workspace where a firm, its clients and other counsel on the matter collaborate behind ethical walls. Command Center shows who uses it, on what work, against comparable organizations. The fit is a large firm or legal department that wants one platform across practices and offices, and more than 80 AmLaw 100 firms already use it. Harvey licenses per seat and publishes an average rather than a rate card, while CoCounsel shows its plan structure and prices small firm plans online. Both state SOC 2 Type II and ISO 27001. Harvey publishes the scope behind each certificate and releases the reports on a self serve request, while CoCounsel's certifications are stated at Thomson Reuters level, which is the first thing a security team will ask about.
CoCounsel Legal vs LegoraCoCounsel Legal and Legora both sell an AI workspace to law firms and in house teams. CoCounsel Legal's advantage is measurement and evidence. Its accuracy has been measured by an independent evaluator, scoring between 73.2 and 89.6 percent across four tasks in the February 2025 Vals Legal AI Report. It grounds output in Westlaw and Practical Law, with KeyCite validity flags shown alongside the authority and used by the research agent itself. Legora's advantage is the shared workspace. Lawyers, agents and clients work in one place, Tabular Review puts a source behind every cell of a document grid, and access rights are read from the document system each time a user queries, with ethical walls enforced through Intapp Walls and iManage Security Policy Manager. It holds ISO 42001 for its AI management system alongside ISO 27001 and SOC 2 Type II, and it states retention as instructed by the subscriber.
Questions buyers ask
The questions people type into an assistant about these three, answered from the records. The same answers travel with the page as structured data, so an assistant lifting one gets the source and the date with it.
Harvey vs Legora: which is better for a law firm?
Harvey is the better documented vendor, with independently measured accuracy, integration documentation an implementer can work from, and a contract that adds a conformance warranty and an insurance commitment to its liability cap. Legora's case is the shared workspace, where lawyers, agents and clients work in one place and Tabular Review puts a source behind every cell, and it publishes its security documents with no gate. Both read access rights from the firm's document system rather than replacing them, so the walls a firm already runs carry into either. The gap is a disclosure gap more than a capability finding. From the AI Legal Index, based on each vendor's own published materials as of November 10, 2026. No vendor pays for placement.
Harvey vs CoCounsel: how do they compare?
Both document their products thoroughly, so the choice comes down to what you are buying. CoCounsel Legal is an answer engine on a corpus its parent owns, Westlaw and Practical Law, with KeyCite validity flags in the output, the only public tier structure of the three and the only outcome evidence with a published method. Harvey is a workspace that reaches into the systems a firm already runs, with each integration documented at the level an administrator needs and retrieval that honors the firm's own document permissions and ethical walls. From the AI Legal Index, based on each vendor's own published materials as of November 10, 2026. No vendor pays for placement.
CoCounsel vs Legora: how do they compare?
They are strong in different places. CoCounsel's advantage is measurement and authority: independently benchmarked accuracy, a licensed citator shown with every authority, and named customers with figures. Legora's advantage is the shared workspace: lawyers, agents and clients in one place, Tabular Review with a source behind every cell, and matter walls enforced from the document system at query time, plus an ISO 42001 certified AI management system. Both publish their contract terms, each capping liability at twelve months of fees, and of the two only CoCounsel has had its accuracy measured by an independent evaluator. From the AI Legal Index, based on each vendor's own published materials as of November 10, 2026. No vendor pays for placement.
Which is best, Harvey, Legora or CoCounsel Legal?
None of them is best across the board. Choose on what matters to your matters: integration documentation and contract protection point to Harvey, corpus, citator and auditable evidence to CoCounsel Legal, and the shared workspace, open security documents and a European starting point to Legora. From the AI Legal Index, based on each vendor's own published materials as of November 10, 2026. No vendor pays for placement.
How does the AI Legal Index compare three vendors at once?
From public sources only, with the same fixed criteria applied to every vendor in the index, read across three columns rather than two. The scoreboard is computed from the live records when the page renders, and each written section checks that what it describes still holds before it displays. None of the three vendors pays for inclusion, placement or a grade, and none reviewed this page before it published.
Three cautions specific to this page
CoCounsel Legal is Thomson Reuters, which also owns Westlaw and Practical Law, so the content its answers rest on and the product selling those answers have one owner. That is a strength for grounding and a concentration risk for a firm already buying research from the same publisher, and it is worth pricing as one relationship rather than two.
Legora's gaps on citation accuracy, oversight, deployment and model supply chain describe what it publishes across its site, blog, newsroom, trust center and contract documents. They are disclosure findings, not capability findings, and the record is updated the day the material appears.
All three compete for the same accounts, so every customer count above is vendor stated. None of the three was told in advance and none reviewed this page. Everything above comes from public material on the dates shown. How the index grades.