Concord vs Oneflow: how they compare in 2026
Concord and Oneflow both serve organizations that want business users to manage agreements with legal controls, electronic signatures and connected CRM data. Concord publishes account packages with five included users and additional seat charges, while Oneflow's Business entry is lower but its AI review beta entitlement is inconsistent across pricing and support pages. Oneflow provides a detailed playbook review surface with highlighted findings and missing clauses. Concord's newer Horizon agents emphasize extraction, with further negotiation functions described as planned. In the difference between shipped review and announced expansion, AI Legal Index identifies a practical rollout question for the legal team. Both contracts address model training expressly, but their AI liability provisions are restrictive. Oneflow also excludes generative AI confidentiality undertakings, making feature selection a contractual issue as well as a product choice.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Concord's AI extracts contract terms, answers questions about agreements and proposes wording changes in its Copilot. Horizon adds custom extraction agents that populate properties across both existing agreements and future uploads within a chosen scope. Those properties can feed reports and workflow conditions, making the models part of ongoing contract operations. The platform also retains drafting, approval routing, electronic signatures, version control and renewal reminders that function independently of AI. Its value therefore extends beyond the models, while the extraction and conversational tools form a central capability rather than an isolated writing feature. Access to Horizon matters when evaluating the agent functionality.
AI supports several substantial contract tasks within Oneflow's wider platform. Write with AI drafts, edits and translates text inside an agreement; AI Extract imports participants, dates and duration into editable metadata. AI Review compares terms with a workspace playbook, and AI Insights aggregates the resulting risks across the portfolio. The premium package adds custom rules, dashboard widgets and a report for negotiation follow up. Electronic signatures, editable HTML agreements, permissions, approvals and renewal reminders continue to work without these models. Customers can disable AI, and several review capabilities remain in beta. AI therefore changes how users analyze contracts without replacing the underlying contract system.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Concord attaches explanatory notes to AI extracted properties so a reviewer can understand how a value was identified. The agent builder also lets users test extraction on sample agreements before activation. These are useful review aids, but the material does not establish linked support for every generated legal assertion or a reproducible accuracy benchmark. The service terms expressly acknowledge hallucinations and require customers to evaluate outputs, including human review. A separate ethics statement recognizes incorrect, biased and misleading responses. Explanations of extracted values consequently support inspection without establishing that suggested clauses or answers have been validated against authoritative legal sources.
Review findings connect to highlighted passages in the agreement, with controls for moving between them. Each finding carries the relevant playbook concept, configured feedback and example clause text. A separate view identifies required clauses that the review did not find, while portfolio charts open the corresponding contract list. This lets the reviewer compare a proposed concern with the actual wording and the organization's rule. Oneflow warns that generated text can misstate facts, numbers and law and recommends human correction. No reproducible accuracy study, error rate or jurisdiction specific evaluation accompanies these features. The contract highlighting supports source verification, not validation of legal authority.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Customers build extraction agents by describing a desired property, reviewing the definition and testing it on up to ten sample agreements. They can limit deployment by folder, dates, creator, amount or other properties. Once activated, an agent processes future agreements in scope, with a separate action for existing agreements, and respects existing access permissions. Results include explanations for review. The terms require human evaluation of output, while later releases allow properties to drive workflow events. The published account does not fully define which consequential downstream actions require approval or how uncertain extraction returns to a person, leaving those controls partly specified.
Administrators enable AI Review for a workspace and configure its playbook, including which clauses matter, which findings count as risks or issues, and what feedback appears. Role permissions separately control access to individual reviews and the Insights dashboard. Sent contracts receive continuing analysis; draft contracts require a manual review action. A person can inspect highlighted text, edit the playbook and use example wording when revising an agreement. The AI appendix advises human review before relying on output. No confidence cutoff, mandatory lawyer approval after an AI finding, or correction route for an already approved mistake is specified. Risk colors classify findings rather than stop execution.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Concord identifies customers and individual users across several industries. PAAY describes importing files through Google Drive and extracting their data; Vecna Robotics describes avoiding missed dates and transposed numbers; and LeoVegas describes reviewing governing law and renewal information across its portfolio. Navarino also describes transferring completed agreements to SharePoint through Zapier. These accounts establish practical use beyond a list of logos. Broad claims about hours saved and reduced contract delays do not include a common baseline, sample definition or independent measurement method. They should not be read as a measured accuracy result for the newer custom extraction agents or every Copilot task.
Puzzel's Sales Operations Manager, Anette Johnsen, describes generating offers and contracts from Salesforce opportunities with items from related CPQ quotes. She identifies a concrete benefit of the HTML format: participants revise one agreement instead of uploading successive files before signature. Other named users include Systembolaget's Head of Indirect Sourcing, Tor Myhrman, and Hedin Bil's HR Business Partner, Elin Skoglund, who describe handling agreements and maintaining oversight. These accounts establish operational use across sales, procurement and HR. They do not isolate AI review performance or supply a measured error reduction, evaluation period and sample for Oneflow's current AI packages.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Customer data is confidential information under Concord's commercial agreement, with access restricted to personnel who need it and obligations before compelled disclosure. The agreement gives Concord broad rights to maintain and improve the service, but expressly prohibits using customer data or the customer's specific output to train its AI models. Administrators control roles, contract access and sharing permissions. The extraction agent explanation also states that inaccessible agreements are not processed or revealed to the user. These controls address access and model use directly, although no distinct attorney client privilege undertaking or professional work product framework is provided for law firm matters.
The AI appendix expressly prohibits Oneflow from training any AI model on customer data and takes precedence over conflicting general terms for AI features. Ordinary service confidentiality continues while information remains confidential, with restrictions on compelled disclosure. There is a consequential exception: the generative AI section excludes Oneflow's contractual confidentiality obligations along with liability, indemnities and service levels. Review, Insights and Extract have a separate processing section tied to the DPA. Workspace permissions and optional provider controls support access management, but attorney client privilege and work product receive no specific undertaking. The contract therefore requires attention to the exact AI functionality being enabled.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Concord requires customers to evaluate the accuracy of AI output with human review and acknowledges that it may contain hallucinations. Its ethics principles treat AI as assistance to people and warn against entering sensitive information unrelated to the contract being handled. The product is nevertheless promoted to business teams that manage agreements without routinely involving legal counsel, and Copilot can explain risks and suggest changes. The commercial agreement does not expressly disclaim the provision of legal advice or map those tasks to a lawyer's professional duties. Approval workflows provide organizational controls without a published jurisdiction specific framework for legal supervision.
Oneflow's AI appendix says output is not legal advice, legal conclusions, recommendations about legal rights or an application of law to a customer's circumstances. It advises human review because generated content can misstate law as well as facts. A separate UK article maps solicitor responsibilities to SRA standards, confidentiality, client communication and supervision, and describes practical review and pilot controls. North American terms also prohibit treating the platform as a substitute for an attorney. The product nevertheless serves sales, HR and other users without legal qualifications. No comprehensive jurisdiction by jurisdiction set of product restrictions or lawyer competence program is supplied.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Concord publishes AI principles addressing privacy, human accountability, bias mitigation and transparency. Product and engineering teams are to receive education on fairness, with training scenarios intended to represent different industries and legal frameworks. The company also promises indications when an automated system is being used and acknowledges potentially biased responses. These commitments identify concerns and broad practices, but not a named accountable risk owner, release criteria, published bias test or results across contract types and languages. Customer feedback is part of the stated improvement process. The available account remains a principles statement rather than a verifiable program of model evaluation and oversight.
Oneflow promotes human accountability and warns against automation bias in its guidance for UK legal teams. It recommends evaluating missed issues, overrides and review quality rather than relying only on speed, and says its AI performs best in English and Swedish. These are useful limits and principles for customers designing a pilot. The public material does not identify an accountable AI governance owner, publish a model release evaluation, or report bias and performance differences across languages, contract types or populations. General ISO security controls and a list of security policies concern operational protection; they do not describe a separate AI testing and governance program.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Concord specifies encryption in storage and transit, restricted employee access, customer roles, multifactor authentication, daily encrypted backups and external penetration testing twice a year. Its model provider is described as bound to zero data retention, and named subprocessors have listed processing locations. The privacy policy caps debug data at six months, allows indefinite anonymized analytics and offers a data copy on request within thirty days of termination. Commercial terms require return or destruction of confidential information when the subscription ends. Precise backup removal and prompt schedules remain incomplete, and the incident policy does not state a customer notification deadline.
Contract data is encrypted with AES 256 at rest and TLS 1.2 in transit. Customers configure permissions and retention policies; administrators can disable optional providers or AI features. Global DPA terms require breach notification without undue delay, while the North American DPA specifies 48 hours. Daily database snapshots last seven days, and system and authentication logs last 90 days. The DPA permits limited residual backups after deletion without fixing that period. Generative AI history can follow provider terms, while the product page promises removal of temporary review and import data. That leaves no single, specific retention schedule for every prompt and output.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The commercial agreement provides an ordinary intellectual property indemnity for the system and caps aggregate liability at fees paid in the preceding twelve months. It also warrants material conformity with service documentation. However, the AI disclaimer expressly excludes liability for damages resulting from or relating to output and warns that output may be inaccurate or hallucinated. The customer indemnity separately includes claims arising from use of generated content. Those provisions leave no affirmative protection for the legal correctness of an AI clause or contract analysis. The general service indemnity should therefore not be treated as a specific remedy for an AI error.
Ordinary global service terms include an intellectual property defense obligation, a material performance warranty and a general cap based on 12 months of fees. Those protections do not carry through unchanged to AI. The appendix supplies AI output as is, disclaims warranties and excludes all liability and indemnification undertakings for generative AI functionality, together with confidentiality obligations and agreed service levels. It also permits specified AI suspensions or termination without reimbursing fees. North American terms contain the same generative AI exclusion. A wrong clause, inaccurate summary or reliance on generated advice has no specific affirmative AI remedy in these published terms.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Concord's Salesforce guide explains installation, account connection, Opportunity layout changes, template selection and fields sent from account, opportunity, contact and product objects. Agreements can be generated from Salesforce and populated with its data, with synchronization in both directions. Administrators also set the maximum sharing rights available for templates and uploaded files. This is a concrete implementation path rather than a connector logo. Other integrations include storage services, calendars, a Word plugin, Zapier, APIs and MCP access through Claude or ChatGPT. Those connections have different plan requirements, with the Salesforce workflow available on Business and Enterprise and the open API listed on Enterprise.
The Salesforce integration creates interactive contracts from opportunities and transfers contact, company and opportunity data into them. Its configurable sync sends data from Salesforce objects into Oneflow and returns contract values to Salesforce. Product tables can reflect price books or CPQ quotes, while workflows map contract stages back to pipeline stages. Engagement events and status changes appear in the Salesforce timeline, and returned contract data supports dashboards. Oneflow identifies separate setup guidance for older and newer integration versions and compatibility with Professional edition upward. HubSpot, Dynamics 365 and other CRM connections complement this workflow; Salesforce and Dynamics can require premium integration charges.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Concord is a hosted service with customer storage choices in the United States and Europe. Its subprocessor list places AWS hosting in the EU for European customers and North America for North American customers. The same list places OpenAI extraction in North America and Google model tooling and OCR in North America and the EU. Storage selection consequently does not establish that every AI processing step remains in the selected storage region. No private deployment or complete tenancy description is provided. The privacy policy also permits international transfers under stated safeguards, so regional processing requirements need to be matched to the selected features.
Production infrastructure uses AWS availability zones in Ireland, with document replication and backups in Sweden. Oneflow's AI FAQ broadly describes data as remaining in the EU, and Insights Premium is described as running within Oneflow's own EU infrastructure. The published subprocessor table gives a more varied picture: optional Legly review operates in Germany, optional OpenAI extraction in the United States, and Postmark email processing also in the United States. Administrators can disable optional services. The public descriptions do not fully reconcile these routes or map every AI function to a processing region. No on premises deployment is offered in the published package descriptions.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Concord offers a SOC 2 Type II report through its Conveyor portal and states participation in the Cloud Security Alliance STAR Level One program. The latter is a self assessment rather than an independent audit. It also states certification under the Data Privacy Framework and its British and Swiss extensions. Separate references to AWS certifications describe infrastructure assurance and should not all be attributed to Concord itself. The public security explanation does not identify the SOC auditor, examination period or full service scope. Encryption, penetration testing and incident procedures provide additional operational detail without establishing the quality of AI contract interpretation.
A public certificate issued by Qvalify covers Oneflow AB's digital solution for contract automation under ISO 9001:2015, ISO 14001:2015 and ISO 27001:2022. It was issued on June 28, 2024 and remains valid through June 30, 2027, identifying the Stockholm organization and its registration number. A June 2026 statement of applicability lists the security controls and their implementation status. The security center separately identifies SOC 1 Type 1 and SOC 2 Type 1 reports issued by Grant Thornton, available under NDA. Those reports concern control design; neither is identified as a Type II examination of operating effectiveness over a stated period.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
OpenAI is named as a provider for AI based extraction, Google for model tooling and OCR, and LangSmith for model tooling. The subprocessor list supplies processing locations and transfer mechanisms for those services, alongside AWS hosting and other operational suppliers. Concord also says its AI provider has agreed to zero data retention. The disclosure does not identify every model version or explain which provider handles each Copilot and agent operation. There is no public commitment to advance notice before a model version or supplier changes. Buyers can therefore identify important suppliers while still lacking the complete model configuration for a particular workflow.
The subprocessor list identifies Legly AB for contract review in Germany and OpenAI for extraction in the United States, alongside AWS infrastructure in Ireland and Sweden. Both AI suppliers are optional and controlled through account settings. The AI appendix directs customers to their Data Management page for the current generative model suppliers and their terms. It does not publish model versions or a complete function to model map. DPA provisions require reasonable advance notice of subprocessor changes to the customer's designated email address and allow a 14 day objection. That process concerns suppliers, without promising notice of every underlying model change.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Essentials costs $499 a month with annual billing and includes five users, AI Copilot, extraction and unlimited agreements, signatures, viewers and guests. Business costs $899 and Enterprise $1,299 on the same billing basis, each also including five users. Extra users cost $49, $69 or $89 monthly respectively. The plan comparison identifies workflow, integration and administration differences, with volume discounts offered on Enterprise. Commercial terms cap renewal price increases at five percent and require sixty days of notice for cancellation or downgrade. A separate implementation fee is not clearly stated, so the published subscription amounts do not establish every possible deployment charge.
Business starts at $292 a month, billed annually, including five users; Enterprise has ten users and a custom quote. Business includes writing, extraction and summary features. Standard AI Review and Insights have conflicting public treatment: the pricing page marks paid beta additions, while September help guidance says they are included in Enterprise during beta. Insights Premium is explicitly a paid addition for Business and Enterprise. SMS, identity verification, premium integrations and enhanced support can cost more. A 14 day trial needs no card. Implementation has no published amount, and global annual renewals can increase by the greater of 5 percent or Swedish CPI.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Concord addresses legal, procurement, finance, sales, HR, operations and IT teams handling their organization's agreements. Essentials targets a small business or one department; Business supports multiple teams; Enterprise adds subsidiary management and other controls for larger organizations. Named customers span robotics, gaming, construction, payments and education. Templates, approvals and guest collaboration let legal teams set boundaries while colleagues conduct routine contract work. The claim to support any contract is not accompanied by a tested matrix of languages, jurisdictions or specialist legal issues. Its main audience is corporate contracting, without a detailed published workflow for law firms delivering advice across separate client matters.
Legal, procurement, sales, finance and HR teams can create and manage agreements in Oneflow. Legal users configure review rules and approve terms; business teams use reusable templates and CRM data for offers, sales agreements and employment documents. Named customers span telecoms, retail, recruitment and public sector purchasing. UK guidance also addresses solicitors using AI for commercial contract review, bringing professional duties into the intended audience. AI is optimized for English and Swedish, with variable results in other languages. The product does not supply a jurisdiction specific research corpus, and its coverage statements do not define supported litigation work or every category of legal agreement.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The commercial agreement grants broad rights to maintain and improve the service but expressly excludes using customer data or the customer's specific output to train Concord's AI models. Its security commitment also prohibits customer data being used for model training and describes zero retention obligations for the AI provider. Aggregate analytics remain permitted. Those improvement rights should be read with the explicit training exclusion, rather than treated as an unrestricted permission to train on client contracts.
The AI appendix forbids Oneflow from using customer data to train any AI models and overrides conflicting general terms for AI issues. Inputs and attributable outputs fall within the customer data definition. The general service license permits improvement and anonymized analysis, and AI feedback may improve accuracy, but those clauses do not remove the express training ban. The product FAQ also says underlying models do not train on customer data.
Separate provider processing, retained history and the generative AI confidentiality exclusion remain relevant to handling client material.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Users can edit or delete their content through Concord. The privacy policy limits debug data to six months, retains anonymized analytics indefinitely and offers a data copy on request within thirty days of termination. The commercial agreement separately calls for return or destruction of confidential information when the subscription ends. Model provider zero retention is an additional protection, not a promise that the entire account retains nothing. A complete schedule for backups and every AI interaction is not published.
Oneflow permits customers to set retention policies for stored contracts, and its AI page says temporary import, review and Insights data is removed after use. Generative AI has a different contractual provision: input questions and output responses may remain as history under the model supplier's current terms. No uniform period covers that history or every provider copy. Daily database snapshots last seven days, system logs last 90 days, and residual backups after termination have no precise DPA deadline. Contract deletion therefore cannot be treated as an immediate purge of all AI processing records.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Administrators define roles and categories, assign feature rights and control which agreements each user can access. Custom roles also govern folders and properties. Concord's extraction agent explanation makes the AI behavior explicit: contracts outside the user's permissions are not extracted, and the user does not see which inaccessible contract is involved. This is an internal permissions model rather than inherited rights from a legal document management system. A separate account of professional ethical walls across law firm clients is absent.
Workspace roles control access to contracts, and Oneflow provides distinct permissions for AI Review and the Insights dashboard. Administrators enable review for selected workspaces and can disable AI features or optional suppliers. These controls can support departmental separation and limit who sees review results. The descriptions do not specify how retrieval enforces every contract permission within a workspace, how restrictions propagate to generated summaries, or how a law firm's matter wall follows an AI request. Permission controls alone do not establish a complete ethical wall mechanism for confidential client matters.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 4.2 of the commercial terms commits to prompt written notice before compelled disclosure of confidential information and a reasonable effort to obtain a protective order. Customer data falls within that confidentiality definition. The privacy policy separately allows law enforcement disclosure with or without notice at Concord's discretion, so the public language is not uniform. The contractual commitment supports notice for covered customer information; the broader privacy statement should not be presented as the same protection for every category of data.
Global confidentiality terms require reasonable prior notice when disclosure is legally compelled, unless notice is prohibited, and reasonable assistance at the customer's expense in seeking protection. That gives the customer an opportunity to contest or narrow a request involving ordinary confidential service data. The AI appendix expressly removes contractual confidentiality obligations for generative AI functionality, so the same protection should not be assumed across every AI route.
No transparency report accompanies the commitment. North American and global agreements need to be matched to the contracting entity and enabled services.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Concord's AI works with agreements, templates and properties supplied through the customer's workspace. The company names model service providers, but does not identify a licensed external legal research collection supporting contract explanations or proposed wording. Explanatory notes on extracted values describe how a contract field was derived, not the provenance of underlying legal knowledge. No inventory of authorities, commentary licenses or update schedule establishes the external legal corpus behind the models.
Oneflow's review and portfolio analysis work with the customer's agreements and configured playbook concepts. Example clauses come from the organization's rule setup, and drafting can use selected text as input. No catalog of legislation, reported decisions or licensed legal commentary is supplied for these features. Naming a model provider does not identify the legal sources in its training data or their licensing terms.
The UK educational articles link professional guidance, but those links do not constitute a legal research corpus inside the product.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Concord extracts terms and explains contract risks without identifying a licensed citator or a judicial treatment mechanism. Approval of an agreement and a note explaining a value do not establish that a legal authority remains valid. The system's contract repository is therefore distinct from a service that tracks later treatment of cases or changes to legislation. Legal conclusions drawn from its suggestions still require an appropriate independent method of confirming the applicable law.
Highlighted review passages let a user inspect contract language, not whether a judicial decision remains authoritative. Oneflow has no published citator connection, treatment history service or automated check of legislation's current status. Teams maintain their own playbooks, including preferred and fallback clauses, so changing a rule after a legal development remains an organizational responsibility. The appendix warns that AI can generate incorrect law and recommends human review. A portfolio risk chart or missing clause flag does not establish that the underlying legal proposition remains valid.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Concord warns that AI responses may be incorrect, biased or misleading and requires human evaluation. Extraction notes and sample testing help users inspect results before an agent is activated. The product does not publish a defined refusal response for inadequate legal support, an unsupported jurisdiction or contradictory information. The builder's clarifying questions concern the property being configured, rather than a general abstention policy during execution. A reviewer cannot infer uncertainty handling solely from the availability of a test preview.
The AI Review interface separates findings from a missing clauses view. That view identifies playbook concepts absent from the agreement, giving the reviewer an explicit negative result instead of merely omitting a match. Red and yellow labels distinguish issues from risks; they are not numerical confidence estimates. Oneflow warns that generated facts and law can be wrong, but does not publish a general abstention rule for drafting or summaries. Missing clause handling is described for review, without promising that every unsupported question will be refused.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The October 16, 2026 review of the Charlotin database returned no entry naming Concord's contract platform in the AI tool field. One case includes Concord as a litigant in Concord v. Anthropic, with Claude.ai identified as the tool; that is not a finding about this vendor. A company name match alone would misattribute the incident. No named case does not establish the accuracy of Concord's contract summaries or generated wording.
Damien Charlotin's AI Hallucination Cases database contained no entry naming Oneflow as of October 16, 2026. The result covers the database's reported court incidents, not every private use of the product or every inaccurate contract response. Oneflow itself discusses court examples involving generic AI tools in educational material; those examples do not identify Oneflow as the tool involved. Contract drafting and risk analysis can still produce incorrect law, which the AI appendix expressly warns about. The absence of a named incident provides no accuracy guarantee.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Concord's ethics principles discuss human accountability, privacy and bias, and its terms require customers to evaluate generated output. They do not connect these controls to a named bar opinion, professional conduct rule or jurisdiction specific framework for lawyers. The platform's electronic signature compliance addresses a different legal question. Corporate legal teams receive review and access tools, but no published mapping explains how their use satisfies professional obligations when advising others with AI assistance.
Oneflow's UK contract review guidance maps SRA standards and conduct duties to human supervision, confidentiality, client transparency and practical controls. It also discusses insurance, data protection and the legal team's responsibility for final judgment. This is a jurisdiction specific mapping with suggested review steps, rather than a generic statement that lawyers remain responsible. It is vendor guidance, not regulator approval or an independent finding of compliance. The mapping does not establish equivalent coverage for every jurisdiction in which Oneflow sells its platform.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Concord is sold to organizations managing their own contracting operations, with business colleagues using templates and approvals defined by legal teams. The advertised savings concern administrative work, agreement delays and missed renewals within that organization. Its subscription does not record lawyer time for a client invoice or allocate a model expense to a represented client. No client fee disclosure process accompanies the product, and the corporate contracting relationship remains outside the ordinary lawyer client billing workflow.
The vendor's UK AI review material addresses solicitors as well as internal legal departments and promotes faster review with retained professional judgment. Its product pages also describe reducing routine contract work and administrative effort. No accompanying procedure explains how a firm records AI time, adjusts a client invoice, discloses savings or passes through Oneflow charges. Subscription pricing is the buyer's software cost rather than a client billing policy.
Because the audience includes lawyers serving clients, the time savings claims cannot be treated solely as an organization's internal operating expense.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The subprocessor list identifies OpenAI, Google and LangSmith for AI related work, with processing locations and transfer mechanisms alongside other suppliers. Concord offers its data processing agreement on request and provides access to its SOC report through a portal. These materials can support a client's supplier review, but no dedicated outside counsel AI disclosure pack is published. A legal team still needs the applicable plan, processing configuration and professional engagement requirements to complete a client approval response.
Oneflow supplies a public DPA, global and North American service terms, an AI appendix and a subprocessor table with functions and processing locations. Optional AI suppliers include Legly and OpenAI, and administrators can control optional services. A public ISO certificate and statement of applicability support security diligence; SOC reports require an NDA. These materials help counsel explain data handling to a client.
They do not form a dedicated client AI disclosure package, and the generative AI confidentiality exclusion and conflicting regional descriptions require specific attention in any outside counsel approval process.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Concord's audit trail records activity, users and timestamps, including changes after signing, and signature certificates can be downloaded. AI extraction notes add an explanation of individual values. These records can help reconstruct contract handling, but do not establish a complete export of prompts, model identities and a lawyer's verification. The March 2026 release notes also state that completed workflow job records are removed after ninety days. A contract audit history should therefore not be assumed to preserve every AI execution detail indefinitely.
AI Insights supports an export of portfolio analysis, and reviewers can inspect the contract passages associated with a playbook finding. Insights Premium adds an action report for internal discussion and negotiation. Enterprise also includes an account audit log, while signing workflows maintain transaction records. The published export instructions do not establish a complete record of model identity, prompt, output and human edits for each AI action.
These are useful contract administration records, but no court disclosure template or complete model provenance export is described for a later filing.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Primary Law Corpus Provenance
- Good Law Verification
Which one fits
Choose Concord if
- You want published account tiers and stated additional user charges.
- The initial AI requirement is extraction within a broader contract workflow.
- Concord's CRM and collaboration processes fit the team's current approvals.
Choose Oneflow if
- Missing clause detection and highlighted playbook findings are immediate requirements.
- Salesforce CPQ data needs to remain connected to a negotiated web agreement.
- The five user Business starting amount fits the planned first rollout.
In summary
Concord
Concord combines agreement collaboration, signature, repository management and CRM connections. Its published packages include a defined user allowance, while Horizon adds agent based extraction to the workflow.
Oneflow
Oneflow pairs shared web contracts with configurable review concepts and portfolio dashboards. Reviewers can move from a risk finding to the source passage, while Salesforce data and stages synchronize with agreements.
Questions buyers ask
How do the starting account prices compare?
Concord Essentials starts at $499 a month for five users on annual billing, with added user charges. Oneflow Business starts at $292 for five users on annual billing, but review additions need separate confirmation. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Are Horizon negotiation features already equivalent to Oneflow review?
Concord's published Horizon launch emphasizes extraction and describes redlining as planned. Oneflow's beta review instructions already explain configurable findings, missing clauses and a portfolio view. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Do their agreements prohibit AI training on customer content?
Both publish express restrictions on training, while allowing certain service operations or analytics. The prohibition should be distinguished from retained application data and the separate limitations on AI liability. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
What does the AI contract comparison reveal?
Beyond their shared collaboration and signature functions, AI Legal Index identifies Oneflow's generative AI confidentiality exclusion as an additional procurement issue. Concord also excludes liability for AI output, so neither platform's workflow features establish an affirmative output remedy.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Concord's planned redlining and Oneflow's beta review entitlements are treated according to their published availability.